CVEdetails.com the ultimate security vulnerability data source
(e.g.: CVE-2009-1234 or 2010-1234 or 20101234)
Log In   Register
Vulnerability Feeds & WidgetsNew   www.itsecdb.com  

Security Vulnerabilities (CVSS score between 6 and 6.99)

Press ESC to close
# CVE ID CWE ID # of Exploits Vulnerability Type(s) Publish Date Update Date Score Gained Access Level Access Complexity Authentication Conf. Integ. Avail.
1001 CVE-2018-17104 352 CSRF 2018-09-16 2018-11-20
6.8
None Remote Medium Not required Partial Partial Partial
An issue was discovered in Microweber 1.0.7. There is a CSRF attack (against the admin user) that can add an administrative account via api/save_user.
1002 CVE-2018-17103 352 CSRF 2018-09-16 2018-11-28
6.8
None Remote Medium Not required Partial Partial Partial
** DISPUTED ** An issue was discovered in GetSimple CMS v3.3.13. There is a CSRF vulnerability that can change the administrator's password via admin/settings.php. NOTE: The vendor reported that the PoC was sending a value for the nonce parameter.
1003 CVE-2018-17102 352 CSRF 2018-09-16 2018-11-21
6.8
None Remote Medium Not required Partial Partial Partial
An issue was discovered in QuickAppsCMS (aka QACMS) through 2.0.0-beta2. A CSRF vulnerability can change the administrator password via the user/me URI.
1004 CVE-2018-17101 787 DoS 2018-09-16 2019-01-23
6.8
None Remote Medium Not required Partial Partial Partial
An issue was discovered in LibTIFF 4.0.9. There are two out-of-bounds writes in cpTags in tools/tiff2bw.c and tools/pal2rgb.c, which can cause a denial of service (application crash) or possibly have unspecified other impact via a crafted image file.
1005 CVE-2018-17100 190 DoS Overflow 2018-09-16 2019-01-23
6.8
None Remote Medium Not required Partial Partial Partial
An issue was discovered in LibTIFF 4.0.9. There is a int32 overflow in multiply_ms in tools/ppm2tiff.c, which can cause a denial of service (crash) or possibly have unspecified other impact via a crafted image file.
1006 CVE-2018-17098 119 DoS Overflow 2018-09-16 2018-11-08
6.8
None Remote Medium Not required Partial Partial Partial
The WavFileBase class in WavFile.cpp in Olli Parviainen SoundTouch 2.0 allows remote attackers to cause a denial of service (heap corruption from size inconsistency) or possibly have unspecified other impact, as demonstrated by SoundStretch.
1007 CVE-2018-17097 415 DoS 2018-09-16 2018-11-08
6.8
None Remote Medium Not required Partial Partial Partial
The WavFileBase class in WavFile.cpp in Olli Parviainen SoundTouch 2.0 allows remote attackers to cause a denial of service (double free) or possibly have unspecified other impact, as demonstrated by SoundStretch.
1008 CVE-2018-17095 119 Overflow 2018-09-16 2019-01-23
6.8
None Remote Medium Not required Partial Partial Partial
An issue has been discovered in mpruett Audio File Library (aka audiofile) 0.3.6. A heap-based buffer overflow in Expand3To4Module::run has occurred when running sfconvert.
1009 CVE-2018-17094 476 2018-09-16 2018-11-01
6.8
None Remote Medium Not required Partial Partial Partial
An issue has been discovered in mackyle xar 1.6.1. There is a NULL pointer dereference in xar_unserialize in lib/archive.c.
1010 CVE-2018-17093 476 2018-09-16 2018-11-01
6.8
None Remote Medium Not required Partial Partial Partial
An issue has been discovered in mackyle xar 1.6.1. There is a NULL pointer dereference in xar_get_path in lib/util.c.
1011 CVE-2018-17088 190 Overflow 2018-09-16 2018-11-05
6.8
None Remote Medium Not required Partial Partial Partial
The ProcessGpsInfo function of the gpsinfo.c file of jhead 3.00 may allow a remote attacker to cause a denial-of-service attack or unspecified other impact via a malicious JPEG file, because there is an integer overflow during a check for whether a location exceeds the EXIF data length. This is analogous to the CVE-2016-3822 integer overflow in exif.c. This gpsinfo.c vulnerability is unrelated to the CVE-2018-16554 gpsinfo.c vulnerability.
1012 CVE-2018-17076 119 Overflow 2018-09-15 2018-11-08
6.8
None Remote Medium Not required Partial Partial Partial
GPP through 2.25 will try to use more memory space than is available on the stack, leading to a segmentation fault or possibly unspecified other impact via a crafted file.
1013 CVE-2018-17045 352 CSRF 2018-09-14 2018-11-28
6.8
None Remote Medium Not required Partial Partial Partial
An issue was discovered in CMS MaeloStore V.1.5.0. There is a CSRF vulnerability that can change the administrator password via admin/modul/users/aksi_users.php?act=update.
1014 CVE-2018-17043 119 Overflow 2018-09-14 2018-11-07
6.8
None Remote Medium Not required Partial Partial Partial
An issue has been found in doc2txt through 2014-03-19. It is a heap-based buffer overflow in the function Storage::init in Storage.cpp, called from parse_doc in parse_doc.cpp.
1015 CVE-2018-17037 264 2018-09-14 2018-11-02
6.5
None Remote Low Single system Partial Partial Partial
user/editpost.php in UCMS 1.4.6 mishandles levels, which allows escalation from the normal user level of 1 to the superuser level of 3.
1016 CVE-2018-17030 94 Exec Code 2018-09-13 2018-11-07
6.0
None Remote Medium Single system Partial Partial Partial
BigTree CMS 4.2.23 allows remote authenticated users, if possessing privileges to set hooks, to execute arbitrary code via /core/admin/auto-modules/forms/process.php.
1017 CVE-2018-17023 352 CSRF 2018-09-13 2018-11-07
6.8
None Remote Medium Not required Partial Partial Partial
Cross-site request forgery (CSRF) vulnerability on ASUS GT-AC5300 routers with firmware through 3.0.0.4.384_32738 allows remote attackers to hijack the authentication of administrators for requests that change the administrator password via a request to start_apply.htm.
1018 CVE-2018-16981 119 Overflow 2018-09-12 2018-11-02
6.8
None Remote Medium Not required Partial Partial Partial
stb stb_image.h 2.19, as used in catimg, Emscripten, and other products, has a heap-based buffer overflow in the stbi__out_gif_code function.
1019 CVE-2018-16966 352 CSRF 2019-04-15 2019-04-16
6.8
None Remote Medium Not required Partial Partial Partial
There is a CSRF vulnerability in the mndpsingh287 File Manager plugin 3.0 for WordPress via the page=wp_file_manager_root public_path parameter.
1020 CVE-2018-16952 352 CSRF 2018-09-17 2018-12-07
6.8
None Remote Medium Not required Partial Partial Partial
The Oracle WebCenter Interaction Portal 10.3.3 does not implement protection against Cross-site Request Forgery in its design. The impact is sensitive actions in the portal (such as changing a portal user's password). NOTE: this CVE is assigned by MITRE and isn't validated by Oracle because Oracle WebCenter Interaction Portal is out of support.
1021 CVE-2018-16951 352 Exec Code CSRF 2018-09-11 2018-11-02
6.0
None Remote Medium Single system Partial Partial Partial
xunfeng 0.2.0 allows command execution via CSRF because masscan.py mishandles backquote characters, a related issue to CVE-2018-16832.
1022 CVE-2018-16886 287 2019-01-14 2019-06-04
6.8
None Remote Medium Not required Partial Partial Partial
etcd versions 3.2.x before 3.2.26 and 3.3.x before 3.3.11 are vulnerable to an improper authentication issue when role-based access control (RBAC) is used and client-cert-auth is enabled. If an etcd client server TLS certificate contains a Common Name (CN) which matches a valid RBAC username, a remote attacker may authenticate as that user with any valid (trusted) client certificate in a REST API request to the gRPC-gateway.
1023 CVE-2018-16884 416 Mem. Corr. 2018-12-18 2019-05-28
6.7
None Local Network Low Single system Partial Partial Complete
A flaw was found in the Linux kernel's NFS41+ subsystem. NFS41+ shares mounted in different network namespaces at the same time can make bc_svc_process() use wrong back-channel IDs and cause a use-after-free vulnerability. Thus a malicious container user can cause a host kernel memory corruption and a system panic. Due to the nature of the flaw, privilege escalation cannot be fully ruled out.
1024 CVE-2018-16880 787 Mem. Corr. 2019-01-29 2019-05-16
6.9
None Local Medium Not required Complete Complete Complete
A flaw was found in the Linux kernel's handle_rx() function in the [vhost_net] driver. A malicious virtual guest, under specific conditions, can trigger an out-of-bounds write in a kmalloc-8 slab on a virtual host which may lead to a kernel memory corruption and a system panic. Due to the nature of the flaw, privilege escalation cannot be fully ruled out. Versions from v4.16 and newer are vulnerable.
1025 CVE-2018-16874 22 Exec Code Dir. Trav. 2018-12-14 2019-06-03
6.8
None Remote Medium Not required Partial Partial Partial
In Go before 1.10.6 and 1.11.x before 1.11.3, the "go get" command is vulnerable to directory traversal when executed with the import path of a malicious Go package which contains curly braces (both '{' and '}' characters). Specifically, it is only vulnerable in GOPATH mode, but not in module mode (the distinction is documented at https://golang.org/cmd/go/#hdr-Module_aware_go_get). The attacker can cause an arbitrary filesystem write, which can lead to code execution.
1026 CVE-2018-16873 20 Exec Code 2018-12-14 2019-06-03
6.8
None Remote Medium Not required Partial Partial Partial
In Go before 1.10.6 and 1.11.x before 1.11.3, the "go get" command is vulnerable to remote code execution when executed with the -u flag and the import path of a malicious Go package, or a package that imports it directly or indirectly. Specifically, it is only vulnerable in GOPATH mode, but not in module mode (the distinction is documented at https://golang.org/cmd/go/#hdr-Module_aware_go_get). Using custom domains, it's possible to arrange things so that a Git repository is cloned to a folder named ".git" by using a vanity import path that ends with "/.git". If the Git repository root contains a "HEAD" file, a "config" file, an "objects" directory, a "refs" directory, with some work to ensure the proper ordering of operations, "go get -u" can be tricked into considering the parent directory as a repository root, and running Git commands on it. That will use the "config" file in the original Git repository root for its configuration, and if that config file contains malicious commands, they will execute on the system running "go get -u".
1027 CVE-2018-16854 352 CSRF 2018-11-26 2018-12-19
6.8
None Remote Medium Not required Partial Partial Partial
A flaw was found in moodle before versions 3.6, 3.5.3, 3.4.6, 3.3.9 and 3.1.15. The login form is not protected by a token to prevent login cross-site request forgery.
1028 CVE-2018-16842 125 DoS 2018-10-31 2018-12-07
6.4
None Remote Low Not required Partial None Partial
Curl versions 7.14.1 through 7.61.1 are vulnerable to a heap-based buffer over-read in the tool_msgs.c:voutf() function that may result in information exposure and denial of service.
1029 CVE-2018-16802 264 Exec Code 2018-09-10 2018-12-18
6.8
None Remote Medium Not required Partial Partial Partial
An issue was discovered in Artifex Ghostscript before 9.25. Incorrect "restoration of privilege" checking when running out of stack during exception handling could be used by attackers able to supply crafted PostScript to execute code using the "pipe" instruction. This is due to an incomplete fix for CVE-2018-16509.
1030 CVE-2018-16797 119 Exec Code Overflow 2018-09-10 2018-11-28
6.8
None Remote Medium Not required Partial Partial Partial
A heap-based buffer overflow in PotPlayerMini.exe in PotPlayer 1.7.8556 allows remote attackers to execute arbitrary code via a .wav file with large BytesPerSec and SamplesPerSec values, and a small Data_Chunk_Size value.
1031 CVE-2018-16792 611 2018-12-05 2018-12-31
6.4
None Remote Low Not required Partial Partial None
SolarWinds SFTP/SCP server through 2018-09-10 is vulnerable to XXE via a world readable and writable configuration file that allows an attacker to exfiltrate data.
1032 CVE-2018-16784 91 Exec Code 2018-09-21 2018-11-08
6.5
None Remote Low Single system Partial Partial Partial
DedeCMS 5.7 SP2 allows XML injection, and resultant remote code execution, via a "<file type='file' name='../" substring.
1033 CVE-2018-16782 119 Overflow 2018-09-10 2018-11-14
6.8
None Remote Medium Not required Partial Partial Partial
libimageworsener.a in ImageWorsener 1.3.2 has a buffer overflow in the bmpr_read_rle_internal function in imagew-bmp.c.
1034 CVE-2018-16774 22 Dir. Trav. 2018-09-10 2018-09-24
6.4
None Remote Low Not required None Partial Partial
HongCMS 3.0.0 allows arbitrary file deletion via a ../ in the file parameter to admin/index.php/language/ajax?action=delete.
1035 CVE-2018-16770 20 DoS 2018-09-10 2018-11-01
6.8
None Remote Medium Not required Partial Partial Partial
In WAVM through 2018-07-26, a crafted file sent to the WebAssembly Virtual Machine may cause a denial of service (application crash) or possibly have unspecified other impact because a certain new_allocator allocate call fails.
1036 CVE-2018-16769 20 DoS 2018-09-10 2018-11-01
6.8
None Remote Medium Not required Partial Partial Partial
In WAVM through 2018-07-26, a crafted file sent to the WebAssembly Virtual Machine may cause a denial of service (application crash) or possibly have unspecified other impact because libRuntime.so!llvm::InstructionCombiningPass::runOnFunction is mishandled.
1037 CVE-2018-16768 119 DoS Overflow 2018-09-10 2018-11-01
6.8
None Remote Medium Not required Partial Partial Partial
In WAVM through 2018-07-26, a crafted file sent to the WebAssembly Virtual Machine may cause a denial of service (application crash) or possibly have unspecified other impact because of an unspecified "heap-buffer-overflow" condition in IR::FunctionValidationContext::end.
1038 CVE-2018-16767 119 DoS Overflow 2018-09-10 2018-11-01
6.8
None Remote Medium Not required Partial Partial Partial
In WAVM through 2018-07-26, a crafted file sent to the WebAssembly Virtual Machine may cause a denial of service (application crash) or possibly have unspecified other impact because of an unspecified "heap-buffer-overflow" condition in FunctionValidationContext::popAndValidateOperand.
1039 CVE-2018-16766 20 DoS 2018-09-10 2018-11-01
6.8
None Remote Medium Not required Partial Partial Partial
In WAVM through 2018-07-26, a crafted file sent to the WebAssembly Virtual Machine may cause a denial of service (application crash) or possibly have unspecified other impact because Errors::unreachable() is reached.
1040 CVE-2018-16765 119 DoS Overflow 2018-09-10 2018-10-31
6.8
None Remote Medium Not required Partial Partial Partial
In WAVM through 2018-07-26, a crafted file sent to the WebAssembly Virtual Machine may cause a denial of service (application crash) or possibly have unspecified other impact because of an unspecified "heap-buffer-overflow" condition in FunctionValidationContext::else_.
1041 CVE-2018-16764 119 DoS Overflow 2018-09-10 2018-10-31
6.8
None Remote Medium Not required Partial Partial Partial
In WAVM through 2018-07-26, a crafted file sent to the WebAssembly Virtual Machine may cause a denial of service (application crash) or possibly have unspecified other impact because of an IR::FunctionValidationContext::catch_all heap-based buffer over-read.
1042 CVE-2018-16732 352 CSRF 2018-09-08 2018-10-19
6.8
None Remote Medium Not required Partial Partial Partial
\upload\plugins\sys\admin\Setting.php in CScms 4.1 allows CSRF via admin.php/setting/ftp_save.
1043 CVE-2018-16715 275 2018-09-08 2018-11-07
6.5
None Remote Low Single system Partial Partial Partial
An issue was discovered in Absolute Software CTES Windows Agent through 1.0.0.1479. The security permissions on the %ProgramData%\CTES folder and sub-folders may allow write access to low-privileged user accounts. This allows unauthorized replacement of service program executable (EXE) or dynamically loadable library (DLL) files, causing elevated (SYSTEM) user access. Configuration control files or data files under this folder could also be similarly modified to affect service process behavior.
1044 CVE-2018-16713 119 Overflow 2018-09-26 2018-12-27
6.8
None Remote Low Single system Complete None None
IObit Advanced SystemCare, which includes Monitor_win10_x64.sys or Monitor_win7_x64.sys, 1.2.0.5 (and possibly earlier versions) allows a user to send an IOCTL (0x9C402084) with a buffer containing user defined content. The driver's subroutine will execute a rdmsr instruction with the user's buffer for input, and provide output from the instruction.
1045 CVE-2018-16712 200 +Info 2018-09-26 2018-12-27
6.8
None Remote Low Single system Complete None None
IObit Advanced SystemCare, which includes Monitor_win10_x64.sys or Monitor_win7_x64.sys, 1.2.0.5 (and possibly earlier versions) allows a user to send a specially crafted IOCTL 0x9C406104 to read physical memory.
1046 CVE-2018-16711 119 Overflow 2018-09-26 2018-12-11
6.5
None Remote Low Single system Partial Partial Partial
IObit Advanced SystemCare, which includes Monitor_win10_x64.sys or Monitor_win7_x64.sys, 1.2.0.5 (and possibly earlier versions) allows a user to send an IOCTL (0x9C402088) with a buffer containing user defined content. The driver's subroutine will execute a wrmsr instruction with the user's buffer for input.
1047 CVE-2018-16710 200 DoS +Info 2018-09-07 2018-11-14
6.4
None Remote Low Not required Partial None Partial
** DISPUTED ** OctoPrint through 1.3.9 allows remote attackers to obtain sensitive information or cause a denial of service via HTTP requests on port 8081. NOTE: the vendor disputes the significance of this report because their documentation states that with "blind port forwarding ... Putting OctoPrint onto the public internet is a terrible idea, and I really can't emphasize that enough."
1048 CVE-2018-16650 352 CSRF 2018-09-07 2018-11-02
6.8
None Remote Medium Not required Partial Partial Partial
phpMyFAQ before 2.9.11 allows CSRF.
1049 CVE-2018-16634 352 CSRF 2018-12-04 2018-12-27
6.8
None Remote Medium Not required Partial Partial Partial
Pluck v4.7.7 allows CSRF via admin.php?action=settings.
1050 CVE-2018-16621 94 2018-11-15 2019-01-24
6.5
None Remote Low Single system Partial Partial Partial
Sonatype Nexus Repository Manager before 3.14 allows Java Expression Language Injection.
CVE is a registred trademark of the MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. CWE is a registred trademark of the MITRE Corporation and the authoritative source of CWE content is MITRE's CWE web site. OVAL is a registered trademark of The MITRE Corporation and the authoritative source of OVAL content is MITRE's OVAL web site.
Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.