CVEdetails.com the ultimate security vulnerability data source
(e.g.: CVE-2009-1234 or 2010-1234 or 20101234)
Log In   Register
  Take a third party risk management course for FREE
Vulnerability Feeds & WidgetsNew   www.itsecdb.com  

Security Vulnerabilities Published In May 2018 (CVSS score >= 7)

Press ESC to close
# CVE ID CWE ID # of Exploits Vulnerability Type(s) Publish Date Update Date Score Gained Access Level Access Complexity Authentication Conf. Integ. Avail.
1 CVE-2018-1000300 787 DoS Overflow 2018-05-24 2020-08-24
7.5
None Remote Low Not required Partial Partial Partial
curl version curl 7.54.1 to and including curl 7.59.0 contains a CWE-122: Heap-based Buffer Overflow vulnerability in denial of service and more that can result in curl might overflow a heap based memory buffer when closing down an FTP connection with very long server command replies.. This vulnerability appears to have been fixed in curl < 7.54.1 and curl >= 7.60.0.
2 CVE-2018-1000178 787 Exec Code 2018-05-08 2020-10-26
7.5
None Remote Low Not required Partial Partial Partial
A heap corruption of type CWE-120 exists in quassel version 0.12.4 in quasselcore in void DataStreamPeer::processMessage(const QByteArray &msg) datastreampeer.cpp line 62 that allows an attacker to execute code remotely.
3 CVE-2018-1000155 863 DoS 2018-05-24 2019-10-03
7.5
None Remote Low Not required Partial Partial Partial
OpenFlow version 1.0 onwards contains a Denial of Service and Improper authorization vulnerability in OpenFlow handshake: The DPID (DataPath IDentifier) in the features_reply message are inherently trusted by the controller. that can result in Denial of Service, Unauthorized Access, Network Instability. This attack appear to be exploitable via Network connectivity: the attacker must first establish a transport connection with the OpenFlow controller and then initiate the OpenFlow handshake.
4 CVE-2018-11576 125 2018-05-31 2018-06-28
7.5
None Remote Low Not required Partial Partial Partial
ngiflib.c in MiniUPnP ngiflib 0.4 has a heap-based buffer over-read in GifIndexToTrueColor.
5 CVE-2018-11575 787 Overflow 2018-05-31 2020-08-24
7.5
None Remote Low Not required Partial Partial Partial
ngiflib.c in MiniUPnP ngiflib 0.4 has a stack-based buffer overflow in DecodeGifImg.
6 CVE-2018-11547 125 2018-05-29 2018-06-29
7.5
None Remote Low Not required Partial Partial Partial
md_is_link_reference_definition_helper in md4c 0.2.5 has a heap-based buffer over-read because md_is_link_label mishandles loop termination.
7 CVE-2018-11546 125 2018-05-29 2018-06-29
7.5
None Remote Low Not required Partial Partial Partial
md4c 0.2.5 has a heap-based buffer over-read because md_is_named_entity_contents has an off-by-one error.
8 CVE-2018-11545 787 Overflow 2018-05-29 2020-08-24
7.5
None Remote Low Not required Partial Partial Partial
md4c 0.2.5 has a heap-based buffer overflow in md_merge_lines because md_is_link_label mishandles the case of a link label composed solely of backslash escapes.
9 CVE-2018-11536 787 Overflow 2018-05-29 2020-08-24
7.5
None Remote Low Not required Partial Partial Partial
md4c before 0.2.5 has a heap-based buffer overflow because md_split_simple_pairing_mark mishandles splits.
10 CVE-2018-11535 89 Sql 2018-05-29 2018-06-29
7.5
None Remote Low Not required Partial Partial Partial
An issue was discovered in SITEMAKIN SLAC (Site Login and Access Control) v1.0. The parameter "my_item_search" in users.php is exploitable using SQL injection.
11 CVE-2018-11531 787 Overflow 2018-05-29 2020-08-24
7.5
None Remote Low Not required Partial Partial Partial
Exiv2 0.26 has a heap-based buffer overflow in getData in preview.cpp.
12 CVE-2018-11528 89 Sql 2018-05-29 2018-06-28
7.5
None Remote Low Not required Partial Partial Partial
WUZHI CMS 4.1.0 has SQL Injection via an api/sms_check.php?param= URI.
13 CVE-2018-11523 434 2018-05-29 2018-06-29
7.5
None Remote Low Not required Partial Partial Partial
upload.php on NUUO NVRmini 2 devices allows Arbitrary File Upload, such as upload of .php files.
14 CVE-2018-11506 787 DoS Overflow 2018-05-28 2020-08-24
7.2
None Local Low Not required Complete Complete Complete
The sr_do_ioctl function in drivers/scsi/sr_ioctl.c in the Linux kernel through 4.16.12 allows local users to cause a denial of service (stack-based buffer overflow) or possibly have unspecified other impact because sense buffers have different sizes at the CDROM layer and the SCSI layer, as demonstrated by a CDROMREADMODE2 ioctl call.
15 CVE-2018-11499 416 DoS 2018-05-26 2019-07-23
7.5
None Remote Low Not required Partial Partial Partial
A use-after-free vulnerability exists in handle_error() in sass_context.cpp in LibSass 3.4.x and 3.5.x through 3.5.4 that could be leveraged to cause a denial of service (application crash) or possibly unspecified other impact.
16 CVE-2018-11482 798 2018-05-30 2018-07-05
7.5
None Remote Low Not required Partial Partial Partial
/usr/lib/lua/luci/websys.lua on TP-LINK IPC TL-IPC223(P)-6, TL-IPC323K-D, TL-IPC325(KP)-*, and TL-IPC40A-4 devices has a hardcoded zMiVw8Kw0oxKXL0 password.
17 CVE-2018-11479 20 Exec Code 2018-05-25 2020-02-05
7.2
None Local Low Not required Complete Complete Complete
The VPN component in Windscribe 1.81 uses the OpenVPN client for connections. Also, it creates a WindScribeService.exe system process that establishes a \\.\pipe\WindscribeService named pipe endpoint that allows the Windscribe VPN process to connect and execute an OpenVPN process or other processes (like taskkill, etc.). There is no validation of the program name before constructing the lpCommandLine argument for a CreateProcess call. An attacker can run any malicious process with SYSTEM privileges through this named pipe.
18 CVE-2018-11444 89 Sql 2018-05-25 2018-06-27
7.5
None Remote Low Not required Partial Partial Partial
A SQL Injection issue was observed in the parameter "q" in jobcard-ongoing.php in EasyService Billing 1.0.
19 CVE-2018-11419 125 2018-05-24 2019-10-03
7.5
None Remote Low Not required Partial Partial Partial
An issue was discovered in JerryScript 1.0. There is a heap-based buffer over-read in the lit_read_code_unit_from_hex function via a RegExp("[\\u0") payload, related to re_parse_char_class in parser/regexp/re-parser.c.
20 CVE-2018-11418 125 2018-05-24 2019-10-03
7.5
None Remote Low Not required Partial Partial Partial
An issue was discovered in JerryScript 1.0. There is a heap-based buffer over-read in the lit_read_code_unit_from_utf8 function via a RegExp("[\\u0020") payload, related to re_parse_char_class in parser/regexp/re-parser.c.
21 CVE-2018-11410 416 DoS 2018-05-24 2019-04-05
7.5
None Remote Low Not required Partial Partial Partial
An issue was discovered in Liblouis 3.5.0. A invalid free in the compileRule function in compileTranslationTable.c allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact.
22 CVE-2018-11373 89 Sql 2018-05-22 2018-06-25
7.5
None Remote Low Not required Partial Partial Partial
iScripts eSwap v2.4 has SQL injection via the "salelistdetailed.php" User Panel ToId parameter.
23 CVE-2018-11372 89 Sql 2018-05-22 2018-06-25
7.5
None Remote Low Not required Partial Partial Partial
iScripts eSwap v2.4 has SQL injection via the wishlistdetailed.php User Panel ToId parameter.
24 CVE-2018-11369 89 Sql 2018-05-22 2018-06-22
7.5
None Remote Low Not required Partial Partial Partial
An issue was discovered in PbootCMS v1.0.9. There is a SQL Injection that can get important information from the database via the \apps\home\controller\ParserController.php scode parameter.
25 CVE-2018-11340 434 Exec Code 2018-05-22 2019-03-21
9.0
None Remote Low ??? Complete Complete Complete
An unrestricted file upload vulnerability in importuser.cgi in ASUSTOR AS6202T ADM 3.1.0.RFQ3 allows attackers to upload supplied data to a specified filename. This can be used to place attacker controlled code on the file system that is then executed.
26 CVE-2018-11331 434 Exec Code 2018-05-21 2018-06-22
7.5
None Remote Low Not required Partial Partial Partial
An issue was discovered in Pluck before 4.7.6. Remote PHP code execution is possible because the set of disallowed filetypes for uploads in missing some applicable ones such as .phtml and .htaccess.
27 CVE-2018-11319 22 Exec Code Dir. Trav. 2018-05-20 2019-10-03
8.5
None Remote Medium ??? Complete Complete Complete
Syntastic (aka vim-syntastic) through 3.9.0 does not properly handle searches for configuration files (it searches the current directory up to potentially the root). This improper handling might be exploited for arbitrary code execution via a malicious gcc plugin, if an attacker has write access to a directory that is a parent of the base directory of the project being checked. NOTE: exploitation is more difficult after 3.8.0 because filename prediction may be needed.
28 CVE-2018-11309 89 Sql 2018-05-28 2018-06-28
7.5
None Remote Low Not required Partial Partial Partial
Blind SQL injection in coupon_code in the MemberMouse plugin 2.2.8 and prior for WordPress allows an unauthenticated attacker to dump the WordPress MySQL database via an applyCoupon action in an admin-ajax.php request.
29 CVE-2018-11248 22 Dir. Trav. 2018-05-18 2018-06-20
7.5
None Remote Low Not required Partial Partial Partial
util/FileDownloadUtils.java in FileDownloader 1.7.3 does not check an attachment's name. If an attacker places "../" in the file name, the file can be stored in an unintended directory because of Directory Traversal.
30 CVE-2018-11236 787 Exec Code Overflow 2018-05-18 2020-08-24
7.5
None Remote Low Not required Partial Partial Partial
stdlib/canonicalize.c in the GNU C Library (aka glibc or libc6) 2.27 and earlier, when processing very long pathname arguments to the realpath function, could encounter an integer overflow on 32-bit architectures, leading to a stack-based buffer overflow and, potentially, arbitrary code execution.
31 CVE-2018-11220 Exec Code 2018-05-31 2019-10-03
9.0
None Remote Low ??? Complete Complete Complete
Bitmain Antminer D3, L3+, and S9 devices allow Remote Command Execution via the system restore function.
32 CVE-2018-11210 125 Overflow 2018-05-16 2019-10-03
7.5
None Remote Low Not required Partial Partial Partial
** DISPUTED ** TinyXML2 6.2.0 has a heap-based buffer over-read in the XMLDocument::Parse function in libtinyxml2.so. NOTE: The tinyxml2 developers have determined that the reported overflow is due to improper use of the library and not a vulnerability in tinyxml2.
33 CVE-2018-11141 22 Dir. Trav. 2018-05-31 2018-06-29
7.5
None Remote Low Not required Partial Partial Partial
The 'IMAGES_JSON' and 'attachments_to_remove[]' parameters of the '/adminui/advisory.php' script in the Quest KACE System Management Virtual Appliance 8.0.318 can be abused to write and delete files respectively via Directory Traversal. Files can be at any location where the 'www' user has write permissions.
34 CVE-2018-11140 89 Sql 2018-05-31 2018-07-02
7.5
None Remote Low Not required Partial Partial Partial
The 'reportID' parameter received by the '/common/run_report.php' script in the Quest KACE System Management Appliance 8.0.318 is not sanitized, leading to SQL injection (in particular, an error-based type).
35 CVE-2018-11139 78 Exec Code 2018-05-31 2019-10-03
9.0
None Remote Low ??? Complete Complete Complete
The '/common/ajax_email_connection_test.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by any authenticated user and can be abused to execute arbitrary commands on the system. This script is vulnerable to command injection via the unsanitized user input 'TEST_SERVER' sent to the script via the POST method.
36 CVE-2018-11138 78 Exec Code 2018-05-31 2019-10-03
10.0
None Remote Low Not required Complete Complete Complete
The '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by anonymous users and can be abused to execute arbitrary commands on the system.
37 CVE-2018-11136 89 Sql 2018-05-31 2018-06-29
7.5
None Remote Low Not required Partial Partial Partial
The 'orgID' parameter received by the '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance 8.0.318 is not sanitized, leading to SQL injection (in particular, a blind time-based type).
38 CVE-2018-11134 640 2018-05-31 2018-06-29
9.0
None Remote Low ??? Complete Complete Complete
In order to perform actions that requires higher privileges, the Quest KACE System Management Appliance 8.0.318 relies on a message queue managed that runs with root privileges and only allows a set of commands. One of the available commands allows changing any user's password (including root). A low-privilege user could abuse this feature by changing the password of the 'kace_support' account, which comes disabled by default but has full sudo privileges.
39 CVE-2018-11132 78 Exec Code 2018-05-31 2020-08-24
9.0
None Remote Low ??? Complete Complete Complete
In order to perform actions that require higher privileges, the Quest KACE System Management Appliance 8.0.318 relies on a message queue that runs daemonized with root privileges and only allows a set of commands to be executed. A command injection vulnerability exists within this message queue which allows low-privilege users to append arbitrary commands that will be run as root.
40 CVE-2018-11094 798 2018-05-15 2018-06-22
10.0
None Remote Low Not required Complete Complete Complete
An issue was discovered on Intelbras NCLOUD 300 1.0 devices. /cgi-bin/ExportSettings.sh, /goform/updateWPS, /goform/RebootSystem, and /goform/vpnBasicSettings do not require authentication. For example, when an HTTP POST request is made to /cgi-bin/ExportSettings.sh, the username, password, and other details are retrieved.
41 CVE-2018-11091 434 Exec Code 2018-05-14 2019-11-12
9.0
None Remote Low ??? Complete Complete Complete
An issue was discovered in MyBiz MyProcureNet 5.0.0. A malicious file can be uploaded to the webserver by an attacker. It is possible for an attacker to upload a script to issue operating system commands. This vulnerability occurs because an attacker is able to adjust the "HiddenFieldControlCustomWhiteListedExtensions" parameter and add arbitrary extensions to the whitelist during the upload. For instance, if the extension .asp is added to the "HiddenFieldControlCustomWhiteListedExtensions" parameter, the server accepts "secctest.asp" as a legitimate file. Hence malicious files can be uploaded in order to execute arbitrary commands to take over the server.
42 CVE-2018-11032 89 Sql 2018-05-14 2018-06-19
7.5
None Remote Low Not required Partial Partial Partial
PHPRAP 1.0.4 through 1.0.8 has SQL Injection via the application/home/controller/project.php search() function.
43 CVE-2018-11031 918 2018-05-14 2018-06-19
10.0
None Remote Low Not required Complete Complete Complete
application/home/controller/debug.php in PHPRAP 1.0.4 through 1.0.8 has SSRF via the /debug URI, as demonstrated by an api[url]=file:////etc/passwd&api[method]=get POST request.
44 CVE-2018-11013 787 Exec Code Overflow 2018-05-13 2020-08-24
10.0
None Remote Low Not required Complete Complete Complete
Stack-based buffer overflow in the websRedirect function in GoAhead on D-Link DIR-816 A2 (CN) routers with firmware version 1.10B05 allows unauthenticated remote attackers to execute arbitrary code via a request with a long HTTP Host header.
45 CVE-2018-10996 119 DoS Exec Code Overflow 2018-05-12 2018-06-18
10.0
None Remote Low Not required Complete Complete Complete
The weblogin_log function in /htdocs/cgibin on D-Link DIR-629-B1 devices allows attackers to execute arbitrary code or cause a denial of service (buffer overflow) via a session.cgi?ACTION=logout request involving a long REMOTE_ADDR environment variable.
46 CVE-2018-10992 88 2018-05-11 2020-08-24
7.5
None Remote Low Not required Partial Partial Partial
lilypond-invoke-editor in LilyPond 2.19.80 does not validate strings before launching the program specified by the BROWSER environment variable, which allows remote attackers to conduct argument-injection attacks via a crafted URL, as demonstrated by a --proxy-pac-file argument, because the GNU Guile code uses the system Scheme procedure instead of the system* Scheme procedure. NOTE: this vulnerability exists because of an incomplete fix for CVE-2017-17523.
47 CVE-2018-10990 613 2018-05-14 2021-09-13
7.5
None Remote Medium ??? Partial Partial Complete
On Arris Touchstone Telephony Gateway TG1682G 9.1.103J6 devices, a logout action does not immediately destroy all state on the device related to the validity of the "credential" cookie, which might make it easier for attackers to obtain access at a later time (e.g., "at least for a few minutes"). NOTE: there is no documentation stating that the web UI's logout feature was supposed to do anything beyond removing the cookie from one instance of a web browser; a client-side logout action is often not intended to address cases where a person has made a copy of a cookie outside of a browser.
48 CVE-2018-10982 DoS +Priv 2018-05-10 2019-10-03
7.2
None Local Low Not required Complete Complete Complete
An issue was discovered in Xen through 4.10.x allowing x86 HVM guest OS users to cause a denial of service (unexpectedly high interrupt number, array overrun, and hypervisor crash) or possibly gain hypervisor privileges by setting up an HPET timer to deliver interrupts in IO-APIC mode, aka vHPET interrupt injection.
49 CVE-2018-10968 1188 2018-05-18 2019-10-03
7.5
None Remote Low Not required Partial Partial Partial
On D-Link DIR-550A and DIR-604M devices through v2.10KR, a malicious user can use a default TELNET account to get unauthorized access to vulnerable devices, aka a backdoor access vulnerability.
50 CVE-2018-10967 78 Exec Code 2018-05-18 2019-10-03
9.0
None Remote Low ??? Complete Complete Complete
On D-Link DIR-550A and DIR-604M devices through v2.10KR, a malicious user can forge an HTTP request to inject operating system commands that can be executed on the device with higher privileges, aka remote code execution.
Total number of vulnerabilities : 286   Page : 1 (This Page)2 3 4 5 6
CVE is a registred trademark of the MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. CWE is a registred trademark of the MITRE Corporation and the authoritative source of CWE content is MITRE's CWE web site. OVAL is a registered trademark of The MITRE Corporation and the authoritative source of OVAL content is MITRE's OVAL web site.
Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.