2018 CVEs (page 99)
Page 99 of 162 — CVEs published in 2018, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2018-2918 | High | 7.5 | 2018-07-18 | Vulnerability in the Sun ZFS Storage Appliance Kit (AK) component of Oracle Sun Systems Products Suite (subcomponent: API frameworks). The supported version th… |
CVE-2018-2917 | Medium | 5.3 | 2018-07-18 | Vulnerability in the Sun ZFS Storage Appliance Kit (AK) component of Oracle Sun Systems Products Suite (subcomponent: API frameworks). The supported version th… |
CVE-2018-2916 | Low | 2.7 | 2018-07-18 | Vulnerability in the Sun ZFS Storage Appliance Kit (AK) component of Oracle Sun Systems Products Suite (subcomponent: API frameworks). The supported version th… |
CVE-2018-2915 | Medium | 5.8 | 2018-07-18 | Vulnerability in the Hyperion Data Relationship Management component of Oracle Hyperion (subcomponent: Access and security). The supported version that is affe… |
CVE-2018-2908 | High | 7.7 | 2018-07-18 | Vulnerability in the Solaris component of Oracle Sun Systems Products Suite (subcomponent: Kernel). The supported version that is affected is 11.3. Easily expl… |
CVE-2018-2907 | High | 8.6 | 2018-07-18 | Vulnerability in the Hyperion Financial Reporting component of Oracle Hyperion (subcomponent: Security Models). The supported version that is affected is 11.1… |
CVE-2018-2906 | Low | 3.7 | 2018-07-18 | Vulnerability in the Hardware Management Pack component of Oracle Sun Systems Products Suite (subcomponent: Ipmitool). The supported version that is affected i… |
CVE-2018-2905 | Medium | 5.3 | 2018-07-18 | Vulnerability in the Sun ZFS Storage Appliance Kit (AK) component of Oracle Sun Systems Products Suite (subcomponent: Core Services). The supported version tha… |
CVE-2018-2904 | Medium | 6.5 | 2018-07-18 | Vulnerability in the Oracle Communications EAGLE LNP Application Processor component of Oracle Communications Applications (subcomponent: GUI). The supported v… |
CVE-2018-2903 | Medium | 4.4 | 2018-07-18 | Vulnerability in the Solaris component of Oracle Sun Systems Products Suite (subcomponent: Kernel). Supported versions that are affected are 10 and 11.3. Easil… |
CVE-2018-2901 | Low | 3.7 | 2018-07-18 | Vulnerability in the Solaris component of Oracle Sun Systems Products Suite (subcomponent: Kernel). Supported versions that are affected are 10 and 11.2. Diffi… |
CVE-2018-2900 | High | 8.2 | 2018-07-18 | Vulnerability in the BI Publisher component of Oracle Fusion Middleware (subcomponent: Layout Tools). The supported version that is affected is 11.1.1.7.0. Eas… |
CVE-2018-2899 | Medium | 6.1 | 2018-07-18 | Vulnerability in the Oracle FLEXCUBE Universal Banking component of Oracle Financial Services Applications (subcomponent: Infrastructure). Supported versions t… |
CVE-2018-2898 | Medium | 6.1 | 2018-07-18 | Vulnerability in the Oracle FLEXCUBE Investor Servicing component of Oracle Financial Services Applications (subcomponent: Infrastructure). Supported versions… |
CVE-2018-2897 | Medium | 6.1 | 2018-07-18 | Vulnerability in the Oracle FLEXCUBE Enterprise Limits and Collateral Management component of Oracle Financial Services Applications (subcomponent: Infrastruct… |
CVE-2018-2896 | Medium | 6.1 | 2018-07-18 | Vulnerability in the Oracle Banking Payments component of Oracle Financial Services Applications (subcomponent: Payments Core). Supported versions that are aff… |
CVE-2018-2895 | Medium | 6.1 | 2018-07-18 | Vulnerability in the Oracle Banking Corporate Lending component of Oracle Financial Services Applications (subcomponent: Core module). Supported versions that… |
CVE-2018-2894 | Critical | 9.8 | 2018-07-18 | Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: WLS - Web Services). Supported versions that are affected are… |
CVE-2018-2893 | Critical | 9.8 | 2018-07-18 | Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: WLS Core Components). Supported versions that are affected are… |
CVE-2018-2892 | High | 7.8 | 2018-07-18 | Vulnerability in the Solaris component of Oracle Sun Systems Products Suite (subcomponent: Availability Suite Service). Supported versions that are affected ar… |
CVE-2018-2891 | Medium | 6.1 | 2018-07-18 | Vulnerability in the Oracle Retail Bulk Data Integration component of Oracle Retail Applications (subcomponent: BDI Job Scheduler). The supported version that… |
CVE-2018-2888 | Medium | 6.7 | 2018-07-18 | Vulnerability in the MICROS Retail-J component of Oracle Retail Applications (subcomponent: Back Office). Supported versions that are affected are 10.2.x, 11.0… |
CVE-2018-2882 | High | 7.7 | 2018-07-18 | Vulnerability in the MICROS Retail-J component of Oracle Retail Applications (subcomponent: Interfaces). Supported versions that are affected are 10.2.x, 11.0… |
CVE-2018-2881 | Medium | 6.3 | 2018-07-18 | Vulnerability in the MICROS Retail-J component of Oracle Retail Applications (subcomponent: Database). Supported versions that are affected are 11.0.x, 12.0.x… |
CVE-2018-2767 | Low | 3.1 | 2018-07-18 | Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Security: Encryption). Supported versions that are affected are 5.5.60 and p… |
CVE-2018-2598 | Low | 3.7 | 2018-07-18 | Vulnerability in the MySQL Workbench component of Oracle MySQL (subcomponent: Workbench: Security: Encryption). Supported versions that are affected are 6.3.10… |
CVE-2018-10871 | Low | 3.8 | 2018-07-18 | 389-ds-base before versions 1.3.8.5, 1.4.0.12 is vulnerable to a Cleartext Storage of Sensitive Information. By default, when the Replica and/or retroChangeLog… |
CVE-2018-14371 | High | 7.5 | 2018-07-18 | The getLocalePrefix function in ResourceManager.java in Eclipse Mojarra before 2.3.7 is affected by Directory Traversal via the loc parameter. A remote attacke… |
CVE-2018-14379 | High | 8.8 | 2018-07-18 | MP4Atom::factory in mp4atom.cpp in MP4v2 2.0.0 incorrectly uses the MP4ItemAtom data type in a certain case where MP4DataAtom is required, which allows remote… |
CVE-2018-14363 | High | 7.5 | 2018-07-17 | An issue was discovered in NeoMutt before 2018-07-16. newsrc.c does not properly restrict '/' characters that may have unsafe interaction with cache pathnames. |
CVE-2018-14362 | Critical | 9.8 | 2018-07-17 | An issue was discovered in Mutt before 1.10.1 and NeoMutt before 2018-07-16. pop.c does not forbid characters that may have unsafe interaction with message-cac… |
CVE-2018-14361 | Critical | 9.8 | 2018-07-17 | An issue was discovered in NeoMutt before 2018-07-16. nntp.c proceeds even if memory allocation fails for messages data. |
CVE-2018-14360 | Critical | 9.8 | 2018-07-17 | An issue was discovered in NeoMutt before 2018-07-16. nntp_add_group in newsrc.c has a stack-based buffer overflow because of incorrect sscanf usage. |
CVE-2018-14359 | Critical | 9.8 | 2018-07-17 | An issue was discovered in Mutt before 1.10.1 and NeoMutt before 2018-07-16. They have a buffer overflow via base64 data. |
CVE-2018-14358 | Critical | 9.8 | 2018-07-17 | An issue was discovered in Mutt before 1.10.1 and NeoMutt before 2018-07-16. imap/message.c has a stack-based buffer overflow for a FETCH response with a long… |
CVE-2018-14357 | Critical | 9.8 | 2018-07-17 | An issue was discovered in Mutt before 1.10.1 and NeoMutt before 2018-07-16. They allow remote IMAP servers to execute arbitrary commands via backquote charact… |
CVE-2018-14356 | Critical | 9.8 | 2018-07-17 | An issue was discovered in Mutt before 1.10.1 and NeoMutt before 2018-07-16. pop.c mishandles a zero-length UID. |
CVE-2018-14355 | Medium | 5.3 | 2018-07-17 | An issue was discovered in Mutt before 1.10.1 and NeoMutt before 2018-07-16. imap/util.c mishandles ".." directory traversal in a mailbox name. |
CVE-2018-14354 | Critical | 9.8 | 2018-07-17 | An issue was discovered in Mutt before 1.10.1 and NeoMutt before 2018-07-16. They allow remote IMAP servers to execute arbitrary commands via backquote charact… |
CVE-2018-14353 | Critical | 9.8 | 2018-07-17 | An issue was discovered in Mutt before 1.10.1 and NeoMutt before 2018-07-16. imap_quote_string in imap/util.c has an integer underflow. |
CVE-2018-14352 | Critical | 9.8 | 2018-07-17 | An issue was discovered in Mutt before 1.10.1 and NeoMutt before 2018-07-16. imap_quote_string in imap/util.c does not leave room for quote characters, leading… |
CVE-2018-14351 | Critical | 9.8 | 2018-07-17 | An issue was discovered in Mutt before 1.10.1 and NeoMutt before 2018-07-16. imap/command.c mishandles a long IMAP status mailbox literal count size. |
CVE-2018-14350 | Critical | 9.8 | 2018-07-17 | An issue was discovered in Mutt before 1.10.1 and NeoMutt before 2018-07-16. imap/message.c has a stack-based buffer overflow for a FETCH response with a long… |
CVE-2018-14349 | Critical | 9.8 | 2018-07-17 | An issue was discovered in Mutt before 1.10.1 and NeoMutt before 2018-07-16. imap/command.c mishandles a NO response without a message. |
CVE-2018-1612 | Medium | 5.8 | 2018-07-17 | IBM QRadar Incident Forensics (IBM QRadar SIEM 7.2, and 7.3) could allow a remote attacker to bypass authentication and obtain sensitive information. IBM X-For… |
CVE-2018-14347 | Medium | 6.5 | 2018-07-17 | GNU Libextractor before 1.7 contains an infinite loop vulnerability in EXTRACTOR_mpeg_extract_method (mpeg_extractor.c). |
CVE-2018-14346 | High | 8.8 | 2018-07-17 | GNU Libextractor before 1.7 has a stack-based buffer overflow in ec_read_file_func (unzip.c). |
CVE-2018-14345 | High | 7.5 | 2018-07-17 | An issue was discovered in SDDM through 0.17.0. If configured with ReuseSession=true, the password is not checked for users with an already existing session. A… |
CVE-2018-13862 | Critical | 9.8 | 2018-07-17 | Touchpad / Trivum WebTouch Setup V9 V2.53 build 13163 of Apr 6 2018 09:10:14 (FW 303) allow unauthorized remote attackers to reset the authentication via the "… |
CVE-2018-13861 | Critical | 9.8 | 2018-07-17 | Touchpad / Trivum WebTouch Setup V9 V2.53 build 13163 of Apr 6 2018 09:10:14 (FW 303) allows unauthorized remote attackers to reboot or execute other functions… |
CVE-2018-13860 | High | 7.5 | 2018-07-17 | MusicCenter / Trivum Multiroom Setup Tool V8.76 - SNR 8604.26 - C4 Professional before V9.34 build 13381 - 12.07.18 allows unauthorized remote attackers to obt… |
CVE-2018-13859 | Critical | 9.8 | 2018-07-17 | MusicCenter / Trivum Multiroom Setup Tool V8.76 - SNR 8604.26 - C4 Professional before V9.34 build 13381 - 12.07.18, allow unauthorized remote attackers to res… |
CVE-2018-13858 | Critical | 9.8 | 2018-07-17 | MusicCenter / Trivum Multiroom Setup Tool V8.76 - SNR 8604.26 - C4 Professional allows unauthorized remote attackers to reboot or execute other functions via t… |
CVE-2018-6681 | Medium | 5.4 | 2018-07-17 | Abuse of Functionality vulnerability in the web interface in McAfee Network Security Management (NSM) 9.1.7.11 and earlier allows authenticated users to allow… |
CVE-2018-14338 | High | 8.1 | 2018-07-17 | samples/geotag.cpp in the example code of Exiv2 0.26 misuses the realpath function on POSIX platforms (other than Apple platforms) where glibc is not used, pos… |
CVE-2018-13864 | High | 7.5 | 2018-07-17 | A directory traversal vulnerability has been found in the Assets controller in Play Framework 2.6.12 through 2.6.15 (fixed in 2.6.16) when running on Windows… |
CVE-2018-14337 | High | 7.5 | 2018-07-17 | The CHECK macro in mrbgems/mruby-sprintf/src/sprintf.c in mruby 1.4.1 contains a signed integer overflow, possibly leading to out-of-bounds memory access becau… |
CVE-2018-14334 | Critical | 9.8 | 2018-07-17 | manager/editor/upload.php in joyplus-cms 1.6.0 allows arbitrary file upload because detection of a prohibited file extension simply sets the $errm value, and d… |
CVE-2018-14333 | High | 8.1 | 2018-07-17 | TeamViewer through 13.1.1548 stores a password in Unicode format within TeamViewer.exe process memory between "[00 88] and "[00 00 00]" delimiters, which might… |
CVE-2018-14331 | High | 8.8 | 2018-07-17 | An issue was discovered in XiaoCms X1 v20140305. There is a CSRF vulnerability to change the administrator account password via admin/index.php?c=index&a=my. |
CVE-2018-14329 | Medium | 4.7 | 2018-07-17 | In HTSlib 1.8, a race condition in cram/cram_io.c might allow local users to overwrite arbitrary files via a symlink attack. |
CVE-2018-0710 | High | 8.8 | 2018-07-17 | Command injection vulnerability in SSH of QNAP Q'center Virtual Appliance version 1.7.1063 and earlier could allow authenticated users to run arbitrary command… |
CVE-2018-0709 | High | 8.8 | 2018-07-17 | Command injection vulnerability in date of QNAP Q'center Virtual Appliance version 1.7.1063 and earlier could allow authenticated users to run arbitrary comman… |
CVE-2018-0708 | High | 8.8 | 2018-07-17 | Command injection vulnerability in networking of QNAP Q'center Virtual Appliance version 1.7.1063 and earlier could allow authenticated users to run arbitrary… |
CVE-2018-0707 | High | 7.2 | 2018-07-17 | Command injection vulnerability in change password of QNAP Q'center Virtual Appliance version 1.7.1063 and earlier could allow authenticated users to run arbit… |
CVE-2018-0706 | High | 8.8 | 2018-07-17 | Exposure of Private Information in QNAP Q'center Virtual Appliance version 1.7.1063 and earlier could allow authenticated users to access sensitive information. |
CVE-2018-13832 | Medium | 4.8 | 2018-07-16 | Multiple Persistent cross-site scripting (XSS) issues in the Techotronic all-in-one-favicon (aka All In One Favicon) plugin 4.6 for WordPress allow remote atta… |
CVE-2018-12584 | Critical | 9.8 | 2018-07-16 | The ConnectionBase::preparseNewBytes function in resip/stack/ConnectionBase.cxx in reSIProcate through 1.10.2 allows remote attackers to cause a denial of serv… |
CVE-2018-10857 | Medium | 5.9 | 2018-07-16 | git-annex is vulnerable to a private data exposure and exfiltration attack. It could expose the content of files located outside the git-annex repository, or c… |
CVE-2018-10840 | Medium | 6.6 | 2018-07-16 | Linux kernel is vulnerable to a heap-based buffer overflow in the fs/ext4/xattr.c:ext4_xattr_set_entry() function. An attacker could exploit this by operating… |
CVE-2018-1046 | High | 7.8 | 2018-07-16 | pdns before version 4.1.2 is vulnerable to a buffer overflow in dnsreplay. In the dnsreplay tool provided with PowerDNS Authoritative, replaying a specially cr… |
CVE-2018-14326 | High | 8.8 | 2018-07-16 | In MP4v2 2.0.0, there is an integer overflow (with resultant memory corruption) when resizing MP4Array for the ftyp atom in mp4array.h. |
CVE-2018-14325 | High | 8.8 | 2018-07-16 | In MP4v2 2.0.0, there is an integer underflow (with resultant memory corruption) when parsing MP4Atom in mp4atom.cpp. |
CVE-2018-14324 | Critical | 9.8 | 2018-07-16 | The demo feature in Oracle GlassFish Open Source Edition 5.0 has TCP port 7676 open by default with a password of admin for the admin account. This allows remo… |
CVE-2018-10859 | Medium | 5.9 | 2018-07-16 | git-annex is vulnerable to an Information Exposure when decrypting files. A malicious server for a special remote could trick git-annex into decrypting a file… |
CVE-2018-5239 | Medium | 6.2 | 2018-07-16 | Norton App Lock prior to v1.3.0.332 can be susceptible to a bypass exploit. In this type of circumstance, the exploit can allow the user to circumvent the app… |
CVE-2018-0385 | High | 7.5 | 2018-07-16 | A vulnerability in the detection engine parsing of Security Socket Layer (SSL) protocol packets for Cisco Firepower System Software could allow an unauthentica… |
CVE-2018-0384 | Medium | 5.8 | 2018-07-16 | A vulnerability in the detection engine of Cisco FireSIGHT System Software could allow an unauthenticated, remote attacker to bypass a URL-based access control… |
CVE-2018-0383 | High | 8.6 | 2018-07-16 | A vulnerability in the detection engine of Cisco FireSIGHT System Software could allow an unauthenticated, remote attacker to bypass a file policy that is conf… |
CVE-2018-0370 | High | 7.5 | 2018-07-16 | A vulnerability in the detection engine of Cisco Firepower System Software could allow an unauthenticated, remote attacker to cause one of the detection engine… |
CVE-2018-0369 | High | 8.6 | 2018-07-16 | A vulnerability in the reassembly logic for fragmented IPv4 packets of Cisco StarOS running on virtual platforms could allow an unauthenticated, remote attacke… |
CVE-2018-0368 | High | 7.8 | 2018-07-16 | A vulnerability in Cisco Digital Network Architecture (DNA) Center could allow an authenticated, local attacker to access sensitive information on an affected… |
CVE-2018-0366 | Medium | 6.1 | 2018-07-16 | A vulnerability in the web-based management interface of Cisco Web Security Appliance (WSA) could allow an unauthenticated, remote attacker to conduct a reflec… |
CVE-2018-0361 | Low | 3.3 | 2018-07-16 | ClamAV before 0.100.1 lacks a PDF object length check, resulting in an unreasonably long time to parse a relatively small file. |
CVE-2018-0360 | Medium | 5.5 | 2018-07-16 | ClamAV before 0.100.1 has an HWP integer overflow with a resultant infinite loop via a crafted Hangul Word Processor file. This is in parsehwp3_paragraph() in… |
CVE-2018-0341 | High | 8.8 | 2018-07-16 | A vulnerability in the web-based UI of Cisco IP Phone 6800, 7800, and 8800 Series with Multiplatform Firmware before 11.2(1) could allow an authenticated, remo… |
CVE-2018-13981 | Critical | 9.8 | 2018-07-16 | The websites that were built from Zeta Producer Desktop CMS before 14.2.1 are vulnerable to unauthenticated remote code execution due to a default component th… |
CVE-2018-13980 | Medium | 5.5 | 2018-07-16 | The websites that were built from Zeta Producer Desktop CMS before 14.2.1 are vulnerable to unauthenticated file disclosure if the plugin "filebrowser" is inst… |
CVE-2018-11717 | Critical | 9.8 | 2018-07-16 | An issue was discovered in Zoho ManageEngine Desktop Central before 100251. By leveraging access to a log file, a context-dependent attacker can obtain (depend… |
CVE-2018-11716 | Critical | 9.8 | 2018-07-16 | An issue was discovered in Zoho ManageEngine Desktop Central before 100230. There is unauthenticated remote access to all log files of a Desktop Central instan… |
CVE-2018-5229 | Medium | 5.4 | 2018-07-16 | The NotificationRepresentationFactoryImpl class in Atlassian Universal Plugin Manager before version 2.22.9 allows remote attackers to inject arbitrary HTML or… |
CVE-2018-14071 | Critical | 9.8 | 2018-07-16 | The Geo Mashup plugin before 1.10.4 for WordPress has insufficient sanitization of post editor and other user input. |
CVE-2018-13387 | Medium | 6.1 | 2018-07-16 | The IncomingMailServers resource in Atlassian JIRA Server before version 7.6.7, from version 7.7.0 before version 7.7.5, from version 7.8.0 before version 7.8… |
CVE-2018-14089 | High | 7.5 | 2018-07-16 | An issue was discovered in a smart contract implementation for Virgo_ZodiacToken, an Ethereum token. In this contract, 'bool sufficientAllowance = allowance <=… |
CVE-2018-14088 | Critical | 9.8 | 2018-07-16 | An issue was discovered in a smart contract implementation for STeX White List (STE(WL)), an Ethereum token. The contract has an integer overflow. If the owner… |
CVE-2018-14087 | Critical | 9.8 | 2018-07-16 | An issue was discovered in a smart contract implementation for EUC (EUC), an Ethereum token. The contract has an integer overflow. If the owner sets the value… |
CVE-2018-14086 | Critical | 9.8 | 2018-07-16 | An issue was discovered in a smart contract implementation for SingaporeCoinOrigin (SCO), an Ethereum token. The contract has an integer overflow. If the owner… |
CVE-2018-14085 | High | 7.5 | 2018-07-16 | An issue was discovered in a smart contract implementation for UserWallet 0x0a7bca9FB7AfF26c6ED8029BB6f0F5D291587c42, an Ethereum token. First, suppose that th… |
CVE-2018-14084 | Critical | 9.8 | 2018-07-16 | An issue was discovered in a smart contract implementation for MKCB, an Ethereum token. If the owner sets the value of sellPrice to a large number in setPrices… |
CVE-2018-14073 | High | 7.5 | 2018-07-15 | libsixel 1.8.1 has a memory leak in sixel_allocator_new in allocator.c. |