2018 CVE Vulnerabilities
17,819 CVEs published in 2018.
| CVE ID | Severity | CVSS | EPSS | Published | Description |
|---|---|---|---|---|---|
| CVE-2018-19937 | MEDIUM | 6.6 | 0.3% | Dec 31, 2018 | A local, authenticated attacker can bypass the passcode in the VideoLAN VLC media player app before 3.1.5 for iOS by ope... |
| CVE-2018-19918 | MEDIUM | 5.4 | 0.7% | Dec 31, 2018 | CuppaCMS has XSS via an SVG document uploaded to the administrator/#/component/table_manager/view/cu_views URI. |
| CVE-2018-19906 | MEDIUM | 5.4 | 0.7% | Dec 31, 2018 | Stored XSS exists in razorCMS 3.4.8 via the /#/page description parameter. |
| CVE-2018-19905 | MEDIUM | 5.4 | 0.7% | Dec 31, 2018 | HTML injection exists in razorCMS 3.4.8 via the /#/page keywords parameter. |
| CVE-2018-19904 | MEDIUM | 6.1 | 0.9% | Dec 31, 2018 | Persistent XSS exists in XSLT CMS via the create/?action=items.edit&type=Page "body" field. |
| CVE-2018-18593 | MEDIUM | 6.5 | 6.6% | Dec 31, 2018 | Remote Directory Traversal and Remote Disclosure of Privileged Information in UCMDB Configuration Management Service, ve... |
| CVE-2018-20590 | MEDIUM | 4.8 | 0.6% | Dec 30, 2018 | Ivan Cordoba Generic Content Management System (CMS) through 2018-04-28 has XSS via the Administrator/users.php user ID. |
| CVE-2018-20584 | MEDIUM | 6.5 | 2.9% | Dec 30, 2018 | JasPer 2.0.14 allows remote attackers to cause a denial of service (application hang) via an attempted conversion to the... |
| CVE-2018-7366 | MEDIUM | 4.3 | 0.6% | Dec 28, 2018 | ZTE ZXV10 B860AV2.1 product ChinaMobile branch with the ICNT versions up to V1.3.3, the BESTV versions up to V1.2.2, the... |
| CVE-2018-20217 | MEDIUM | 5.3 | 1.5% | Dec 26, 2018 | A Reachable Assertion issue was discovered in the KDC in MIT Kerberos 5 (aka krb5) before 1.17. If an attacker can obtai... |
| CVE-2018-19615 | MEDIUM | 6.1 | 3.3% | Dec 26, 2018 | Rockwell Automation Allen-Bradley PowerMonitor 1000 all versions. A remote attacker could inject arbitrary code into a t... |
| CVE-2018-20482 | MEDIUM | 4.7 | 0.5% | Dec 26, 2018 | GNU Tar through 1.30, when --sparse is used, mishandles file shrinkage during read access, which allows local users to c... |
| CVE-2018-20467 | MEDIUM | 6.5 | 3.1% | Dec 26, 2018 | In coders/bmp.c in ImageMagick before 7.0.8-16, an input file can result in an infinite loop and hang, with high CPU and... |
| CVE-2018-20459 | MEDIUM | 5.5 | 0.9% | Dec 25, 2018 | In radare2 through 3.1.3, the armass_assemble function in libr/asm/arch/arm/armass.c allows attackers to cause a denial-... |
| CVE-2018-20458 | MEDIUM | 5.5 | 0.9% | Dec 25, 2018 | In radare2 prior to 3.1.1, r_bin_dyldcache_extract in libr/bin/format/mach0/dyldcache.c may allow attackers to cause a d... |
| CVE-2018-20457 | MEDIUM | 5.5 | 0.9% | Dec 25, 2018 | In radare2 through 3.1.3, the assemble function inside libr/asm/p/asm_arm_cs.c allows attackers to cause a denial-of-ser... |
| CVE-2018-20451 | MEDIUM | 6.5 | 0.9% | Dec 25, 2018 | The process_file function in reader.c in libdoc through 2017-10-23 has a heap-based buffer over-read that allows attacke... |
| CVE-2018-8917 | MEDIUM | 6.5 | 0.8% | Dec 24, 2018 | Cross-site scripting (XSS) vulnerability in info.cgi in Synology DiskStation Manager (DSM) before 6.1.6-15266 allows rem... |
| CVE-2018-8918 | MEDIUM | 6.5 | 0.8% | Dec 24, 2018 | Cross-site scripting (XSS) vulnerability in info.cgi in Synology Router Manager (SRM) before 1.1.7-6941 allows remote at... |
| CVE-2018-20360 | MEDIUM | 5.5 | 1.1% | Dec 22, 2018 | An invalid memory address dereference was discovered in the sbr_process_channel function of libfaad/sbr_dec.c in Freewar... |
| CVE-2018-20124 | MEDIUM | 5.5 | 0.5% | Dec 20, 2018 | hw/rdma/rdma_backend.c in QEMU allows guest OS users to trigger out-of-bounds access via a PvrdmaSqWqe ring element with... |
| CVE-2018-20126 | MEDIUM | 5.5 | 0.5% | Dec 20, 2018 | hw/rdma/vmw/pvrdma_cmd.c in QEMU allows create_cq and create_qp memory leaks because errors are mishandled. |
| CVE-2018-1000880 | MEDIUM | 6.5 | 4.1% | Dec 20, 2018 | libarchive version commit 9693801580c0cf7c70e862d305270a16b52826a7 onwards (release v3.2.0 onwards) contains a CWE-20: I... |
| CVE-2018-1000879 | MEDIUM | 6.5 | 3.4% | Dec 20, 2018 | libarchive version commit 379867ecb330b3a952fb7bfa7bffb7bbd5547205 onwards (release v3.3.0 onwards) contains a CWE-476: ... |
| CVE-2018-1000874 | MEDIUM | 6.1 | 0.8% | Dec 20, 2018 | PHP cebe markdown parser version 1.2.0 and earlier contains a Cross Site Scripting (XSS) vulnerability in all distribute... |
Check if your code is affected by 2018 CVEs
Strix scans your code and infrastructure for known vulnerabilities automatically.
Scan your code now