CVE Vulnerability Database
Search and browse 394,640 CVE records with CVSS scores, EPSS exploit predictions, CISA KEV status and whether the Vulnix engine has a detection for them.
16,510 records from 2018Clear filters
- CVE-2018-15333Medium 5.5Dec 28, 2018On versions 11.2.1. and greater, unrestricted Snapshot File Access allows BIG-IP system's user with any role, including Guest Role, to have access and download previously generated and available snapshot files on the BIG-IP configuration utility such as QKView and TCPDumps.
- CVE-2018-20524Medium 6.1Dec 27, 2018The Chat Anywhere extension 2.4.0 for Chrome allows XSS via crafted use of <<a> in a message, because a danmuWrapper DIV element in chatbox-only\danmu.js is outside the scope of a Content Security Policy (CSP).
- CVE-2018-20520Medium 6.1Dec 27, 2018MiniCMS V1.10 has XSS via the mc-admin/post-edit.php query string, a related issue to CVE-2018-10296 and CVE-2018-16233.
- CVE-2018-20519High 8.1Dec 27, 2018An issue was discovered in 74cms v4.2.111. It allows remote authenticated users to read or modify arbitrary resumes by changing a job-search intention, as demonstrated by the index.php?c=Personal&a=ajax_save_basic pid parameter.
- CVE-2018-20511Medium 5.5Dec 27, 2018An issue was discovered in the Linux kernel before 4.18.11. The ipddp_ioctl function in drivers/net/appletalk/ipddp.c allows local users to obtain sensitive kernel address information by leveraging CAP_NET_ADMIN to read the ipddp_route dev and next fields via an SIOCFINDIPDDPRT ioctl call.
- CVE-2018-20508Critical 9.8Dec 27, 2018CrashFix 1.0.4 has SQL Injection via the User[status] parameter. This is related to actionIndex in UserController.php, and the protected\models\User.php search() function.
- CVE-2018-20502Medium 6.5Dec 26, 2018An issue was discovered in Bento4 1.5.1-627. There is an attempt at excessive memory allocation in the AP4_DataBuffer class when called from AP4_HvccAtom::Create in Core/Ap4HvccAtom.cpp.
- CVE-2018-20404High 7.5Dec 26, 2018ETK_E900.sys, a SmartETK driver for VIA Technologies EPIA-E900 system board, is vulnerable to denial of service attack via IOCTL 0x9C402048, which calls memmove and constantly fails on an arbitrary (uncontrollable) address, resulting in an eternal hang or a BSoD.
- CVE-2018-20217Medium 5.3Dec 26, 2018A Reachable Assertion issue was discovered in the KDC in MIT Kerberos 5 (aka krb5) before 1.17. If an attacker can obtain a krbtgt ticket using an older encryption type (single-DES, triple-DES, or RC4), the attacker can crash the KDC by making an S4U2Self request.
- CVE-2018-19873Critical 9.8Dec 26, 2018An issue was discovered in Qt before 5.11.3. QBmpHandler has a buffer overflow via BMP data.
- CVE-2018-19871Medium 6.5Dec 26, 2018An issue was discovered in Qt before 5.11.3. There is QTgaFile Uncontrolled Resource Consumption.
- CVE-2018-19870High 8.8Dec 26, 2018An issue was discovered in Qt before 5.11.3. A malformed GIF image causes a NULL pointer dereference in QGifHandler resulting in a segmentation fault.
- CVE-2018-19869Medium 6.5Dec 26, 2018An issue was discovered in Qt before 5.11.3. A malformed SVG image causes a segmentation fault in qsvghandler.cpp.
- CVE-2018-19799Medium 6.1Dec 26, 2018Dolibarr ERP/CRM through 8.0.3 has /exports/export.php?datatoexport= XSS.
- CVE-2018-19616High 8.1Dec 26, 2018An issue was discovered in Rockwell Automation Allen-Bradley PowerMonitor 1000. An unauthenticated user can add/edit/remove administrators because access control is implemented on the client side via a disabled attribute for a BUTTON element.
- CVE-2018-19615Medium 6.1Dec 26, 2018Rockwell Automation Allen-Bradley PowerMonitor 1000 all versions. A remote attacker could inject arbitrary code into a targeted userâs web browser to gain access to the affected device.
- CVE-2018-19182High 8.8Dec 26, 2018Engelsystem before commit hash 2e28336 allows CSRF.
- CVE-2018-18537Medium 5.5Dec 26, 2018The GLCKIo low-level driver in ASUS Aura Sync v1.07.22 and earlier exposes a path to write an arbitrary DWORD to an arbitrary address.
- CVE-2018-18536High 7.8Dec 26, 2018The GLCKIo and Asusgio low-level drivers in ASUS Aura Sync v1.07.22 and earlier expose functionality to read/write data from/to IO ports. This could be leveraged in a number of ways to ultimately run code with elevated privileges.
- CVE-2018-18535High 7.8Dec 26, 2018The Asusgio low-level driver in ASUS Aura Sync v1.07.22 and earlier exposes functionality to read and write Machine Specific Registers (MSRs). This could be leveraged to execute arbitrary ring-0 code.
- CVE-2018-17987High 7.5Dec 26, 2018The determineWinner function of a smart contract implementation for HashHeroes Tiles, an Ethereum game, uses a certain blockhash value in an attempt to generate a random number for the case where NUM_TILES equals the number of people who purchased a tile, which allows an attacker to control the awarding of the prize by being the last person to purchase a tile.
- CVE-2018-15518High 8.8Dec 26, 2018QXmlStream in Qt 5.x before 5.11.3 has a double-free or corruption during parsing of a specially crafted illegal XML document.
- CVE-2018-11742Critical 9.8Dec 26, 2018NEC Univerge Sv9100 WebPro 6.00.00 devices have Cleartext Password Storage in the Web UI.
- CVE-2018-11741Critical 9.8Dec 26, 2018NEC Univerge Sv9100 WebPro 6.00.00 devices have Predictable Session IDs that result in Account Information Disclosure via Home.htm?sessionId=#####&GOTO(8) URIs.
- CVE-2018-20486Medium 6.1Dec 26, 2018MetInfo 6.x through 6.1.3 has XSS via the /admin/login/login_check.php url_array[] parameter.