Vulnerabilities published in 2018
16,257 vulnerabilities were published in 2018: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 57 of 163.
- CVE-2018-25130 Beward Intercom 2.3.1 Local Credentials Disclosure via Unencrypted Database
- CVE-2018-25129 SOCA Access Control System 180612 Information Disclosure via Multiple Endpoints
- CVE-2018-25128 SOCA Access Control System 180612 SQL Injection and Authentication Bypass
- CVE-2018-25127 SOCA Access Control System 180612 Cross-Site Request Forgery via Admin Interface
- CVE-2018-25126 TVT NVMS-9000 Hard-coded API Credentials & Command Injection
- CVE-2018-25125 Netis DL4322D RTK 2.1.1 FTP Service DoS
- CVE-2018-25124 PacsOne Server 6.6.2 DICOM Web Viewer Directory Traversal LFI
- CVE-2018-25123 Nagios XI < 5.5.7 Privilege Escalation via MRTG Graphing Component
- CVE-2018-25122 Nagios XI < 5.4.13 Component Download Page RCE
- CVE-2018-25121 Nagios XI < 5.4.13 XSS via Views Page
- CVE-2018-25120 D-Link DNS-343 ShareCenter <= 1.05 Command Injection via /goform/Mail_Test
- CVE-2018-25119 Nagios Fusion < 4.1.5 XSS via fusionwindow Parameter
- CVE-2018-25118 GeoVision Command Injection RCE via /PictureCatch.cgi
- CVE-2018-25117 VestaCP Debian Installer Malicious Backdoor Supply Chain Compromise
- CVE-2018-25116 MyBB Thread Redirect Plugin 0.2.1 - Cross-Site Scripting
- CVE-2018-25115 D-Link DIR-110/412/600/615/645/815 RCE via service.cgi
- CVE-2018-25114 osCommerce 2.3.4.1 Installer Unauthenticated Configuration File Injection PHP Code Execution
- CVE-2018-25113 Dicoogle PACS Web Server 2.5.0 Unauthenticated Path Traversal
- CVE-2018-25112 PHOENIX CONTACT: ILC 1x1 ETH Denial of Service
- CVE-2018-25111 django-helpdesk Allows Sensitive Data Exposure
- CVE-2018-25110 Regular Expression Denial of Service (ReDoS) in markedjs/marked
- CVE-2018-25109 Nintendo Animal Crossing Letter Trigram ac-exploit-gc memory corruption
- CVE-2018-25108 WAGO: Denial of service in 750-8xx controller due to uncontrolled resource consumption
- CVE-2018-25107 The Crypt::Random::Source package before 0.13 for Perl has a fallback to the built-in rand() function, which is not a secure source of random bits.
- CVE-2018-25106 webuidesigning NebulaX Theme Legacy.php nebula_send_to_hubspot sql injection
- CVE-2018-25105 File Manager <= 3.0 - Unauthenticated Arbitrary File Upload/Download
- CVE-2018-25104 CoinGate Plugin Payment callback.php postProcess logic error
- CVE-2018-25103 Use-after-free vulnerabilities in lighttpd <= 1.4.50
- CVE-2018-25101 l2c2technologies Koha opac-MARCdetail.pl cross site scripting
- CVE-2018-25100 The Mojolicious module before 7.66 for Perl may leak cookies in certain situations related to multiple similar cookies for the same domain.
- CVE-2018-25099 In the CryptX module before 0.062 for Perl, gcm_decrypt_verify() and chacha20poly1305_decrypt_verify() do not verify the tag.
- CVE-2018-25098 blockmason credit-protocol UCAC CreditProtocol.sol executeUcacTx denial of service
- CVE-2018-25097 Acumos Design Studio cross site scripting
- CVE-2018-25096 MdAlAmin-aol Own Health Record logout.php cross-site request forgery
- CVE-2018-25095 Duplicator < 1.3.0 - Unauthenticated RCE
- CVE-2018-25094 ระบบบัญชีออนไลน์ Online Accounting System image.php path traversal
- CVE-2018-25093 Vaerys-Dawn DiscordSailv2 Tag access control
- CVE-2018-25092 Vaerys-Dawn DiscordSailv2 Command Mention access control
- CVE-2018-25091 Authorization Header forwarded on redirect
- CVE-2018-25090 Wago: Improper Neutralization of Input During Web Page Generation in multiple devices
- CVE-2018-25089 glb Meetup Tag Extension Link Attribute reverse tabnabbing
- CVE-2018-25088 Blue Yonder postgraas_server PostgreSQL Backend postgres_cluster_driver.py create_postgres_db sql injection
- CVE-2018-25087 Arborator Server project.cgi start denial of service
- CVE-2018-25086 sea75300 FanPress CM Template Preview templatepreview.php getArticlesPreview cross site scripting
- CVE-2018-25085 Responsive Menus Configuration Setting responsive_menus.module responsive_menus_admin_form_submit cross site scripting
- CVE-2018-25084 Ping Identity Self-Service Account Manager SSAMController.java cross site scripting
- CVE-2018-25083 pullit vulnerable to command injection
- CVE-2018-25082 zwczou WeChat SDK Python to_xml xml external entity reference
- CVE-2018-25081 Information disclosure in bitwarden:bitwarden
- CVE-2018-25080 MobileDetect Example session_example.php initLayoutType cross site scripting
- CVE-2018-25079 Segmentio is-url index.js redos
- CVE-2018-25078 Privilege escalation in man-db project:man-db
- CVE-2018-25077 melnaron mel-spintax spintax.js redos
- CVE-2018-25076 Events Extension events.php searchResults sql injection
- CVE-2018-25075 karsany OBridge ProcedureDao.java getAllStandaloneProcedureAndFunction sql injection
- CVE-2018-25074 Prestaul skeemas base.js redos
- CVE-2018-25073 Newcomer1989 TSN-Ranksystem bot.php getlog cross site scripting
- CVE-2018-25072 lojban jbovlaste listing.html sql injection
- CVE-2018-25071 roxlukas LMeve proxy.php insert_log sql injection
- CVE-2018-25070 polterguy Phosphorus Five CSV Import NonQuery.cs csv.Read sql injection
- CVE-2018-25069 Netis Netcore Router hard-coded password
- CVE-2018-25068 devent globalpom-utils FileResourceManagerProvider.java createTmpDir temp file
- CVE-2018-25067 JoomGallery Image Sort default.php sql injection
- CVE-2018-25066 PeterMu nodebatis sql injection
- CVE-2018-25065 Wikimedia mediawiki-extensions-I18nTags Unlike Parser I18nTags_body.php cross site scripting
- CVE-2018-25064 OSM Lab show-me-the-way site.js cross site scripting
- CVE-2018-25063 Zenoss Dashboard defaultportlets.js cross site scripting
- CVE-2018-25062 flar2 ElementalX ipsec xfrm_user.c xfrm_dump_policy_done denial of service
- CVE-2018-25061 rgb2hex redos
- CVE-2018-25060 Macaron csrf csrf.go missing secure attribute
- CVE-2018-25059 pastebinit server.go pasteHandler path traversal
- CVE-2018-25058 Twitter-Post-Fetcher Link Target twitterFetcher.js reverse tabnabbing
- CVE-2018-25057 simple_php_link_shortener index.php sql injection
- CVE-2018-25056 yolapi metadata.py render_description cross site scripting
- CVE-2018-25055 FarCry Solr Pro Plugin Search solrProSearch.cfc cross site scripting
- CVE-2018-25054 shred cilla Search search.jsp cross site scripting
- CVE-2018-25053 moappi Json2html json2html.js cross site scripting
- CVE-2018-25052 Catalyst-Plugin-Session Session ID Session.pm _load_sessionid cross site scripting
- CVE-2018-25051 JmPotato Pomash editor.html cross site scripting
- CVE-2018-25050 Harvest Chosen abstract-chosen.coffee AbstractChosen cross site scripting
- CVE-2018-2505 Cross-site scripting in SAP Commerce (SAP Hybris Commerce)
- CVE-2018-25049 email-existence index.js redos
- CVE-2018-25048 Codesys Runtime Improper Limitation of a Pathname
- CVE-2018-25047 Smarty Cross-site Scripting vulnerability in pages that use smarty_function_mailto
- CVE-2018-25046 Path traversal in code.cloudfoundry.org/archiver
- CVE-2018-25045 Django REST framework XSS Vulnerability
- CVE-2018-25044 uTorrent Guest Account privileges management
- CVE-2018-25043 uTorrent PRNG improper authentication
- CVE-2018-25042 uTorrent memory corruption
- CVE-2018-25041 uTorrent JSON RPC Server privileges management
- CVE-2018-25040 uTorrent Web HTTP RPC Server privileges management
- CVE-2018-2504 Cross-site scripting in SAP NetWeaver AS Java (ServerCore)
- CVE-2018-25039 Thomson TCW710 RgUrlBlock.asp Persistent cross site scriting
- CVE-2018-25038 Thomson TCW710 RgDhcp Persistent cross site scriting
- CVE-2018-25037 Thomson TCW710 RgDdns Persistent cross site scriting
- CVE-2018-25036 Thomson TCW710 RgTime Persistent cross site scriting
- CVE-2018-25035 Thomson TCW710 RGFirewallEL Persistent cross site scriting
- CVE-2018-25034 Thomson TCW710 wlanPrimaryNetwork Persistent cross site scripting
- CVE-2018-25033 Out-of-bounds read in admesh
- CVE-2018-25032 Nokogiri affected by zlib's Out-of-bounds Write vulnerability