CVEdetails.com the ultimate security vulnerability data source
(e.g.: CVE-2009-1234 or 2010-1234 or 20101234)
Log In   Register
Vulnerability Feeds & WidgetsNew   www.itsecdb.com  

Security Vulnerabilities (CVSS score between 6 and 6.99)

Press ESC to close
# CVE ID CWE ID # of Exploits Vulnerability Type(s) Publish Date Update Date Score Gained Access Level Access Complexity Authentication Conf. Integ. Avail.
3651 CVE-2018-0809 264 2018-02-14 2018-10-30
6.9
None Local Medium Not required Complete Complete Complete
The Windows kernel in Windows 10, versions 1703 and 1709, and Windows Server, version 1709 allows an elevation of privilege vulnerability due to the way objects are handled in memory, aka "Windows Elevation of Privilege Vulnerability". This CVE is unique from CVE-2018-0742, CVE-2018-0756, CVE-2018-0820 and CVE-2018-0843.
3652 CVE-2018-0790 264 2018-01-09 2018-01-29
6.5
None Remote Low Single system Partial Partial Partial
Microsoft SharePoint Foundation 2010, Microsoft SharePoint Server 2013 and Microsoft SharePoint Server 2016 allow an elevation of privilege vulnerability due to the way web requests are handled, aka "Microsoft SharePoint Elevation of Privilege Vulnerability". This CVE is unique from CVE-2018-0789.
3653 CVE-2018-0788 264 2018-01-04 2018-01-18
6.9
None Local Medium Not required Complete Complete Complete
The Windows Adobe Type Manager Font Driver (Atmfd.dll) in Windows 7 SP1, Windows 8.1 and RT 8.1, Windows Server 2008 SP2 and R2 SP1, and Windows Server 2012 and R2 allows an elevation of privilege vulnerability due to the way objects are handled in memory, aka "OpenType Font Driver Elevation of Privilege Vulnerability".
3654 CVE-2018-0787 640 2018-03-14 2018-04-11
6.8
None Remote Medium Not required Partial Partial Partial
ASP.NET Core 1.0. 1.1, and 2.0 allow an elevation of privilege vulnerability due to how web applications that are created from templates validate web requests, aka "ASP.NET Core Elevation Of Privilege Vulnerability".
3655 CVE-2018-0784 264 2018-01-09 2018-02-01
6.8
None Remote Medium Not required Partial Partial Partial
ASP.NET Core 1.0. 1.1, and 2.0 allow an elevation of privilege vulnerability due to the ASP.NET Core project templates, aka "ASP.NET Core Elevation Of Privilege Vulnerability". This CVE is unique from CVE-2018-0808.
3656 CVE-2018-0704 22 Dir. Trav. 2019-01-09 2019-01-15
6.4
None Remote Low Not required None Partial Partial
Directory traversal vulnerability in Cybozu Office 10.0.0 to 10.8.1 allows remote attackers to delete arbitrary files via Keitai Screen.
3657 CVE-2018-0703 22 Dir. Trav. 2019-01-09 2019-01-15
6.4
None Remote Low Not required None Partial Partial
Directory traversal vulnerability in Cybozu Office 10.0.0 to 10.8.1 allows remote attackers to delete arbitrary files via HTTP requests.
3658 CVE-2018-0702 22 Dir. Trav. 2019-01-09 2019-01-15
6.4
None Remote Low Not required None Partial Partial
Directory traversal vulnerability in Cybozu Mailwise 5.0.0 to 5.4.5 allows remote attackers to delete arbitrary files via unspecified vectors.
3659 CVE-2018-0686 434 2018-11-15 2018-12-17
6.5
None Remote Low Single system Partial Partial Partial
Denbun by NEOJAPAN Inc. (Denbun POP version V3.3P R4.0 and earlier, Denbun IMAP version V3.3I R4.0 and earlier) allows remote authenticated attackers to upload and execute any executable files via unspecified vectors.
3660 CVE-2018-0685 89 Exec Code Sql 2018-11-15 2018-12-17
6.5
None Remote Low Single system Partial Partial Partial
SQL injection vulnerability in the Denbun POP version V3.3P R4.0 and earlier allows remote authenticated attackers to execute arbitrary SQL commands via HTTP requests for mail search.
3661 CVE-2018-0675 94 2018-09-04 2018-11-20
6.8
None Remote Medium Not required Partial Partial Partial
AttacheCase ver.3.3.0.0 and earlier allows an arbitrary script execution via unspecified vectors.
3662 CVE-2018-0674 94 2018-09-04 2018-11-20
6.8
None Remote Medium Not required Partial Partial Partial
AttacheCase ver.2.8.4.0 and earlier allows an arbitrary script execution via unspecified vectors.
3663 CVE-2018-0667 426 +Priv 2019-01-09 2019-01-22
6.8
None Remote Medium Not required Partial Partial Partial
Untrusted search path vulnerability in Installer of INplc SDK Express 3.08 and earlier and Installer of INplc SDK Pro+ 3.08 and earlier allows an attacker to gain privileges via a Trojan horse DLL in an unspecified directory.
3664 CVE-2018-0658 20 Exec Code 2018-09-07 2018-11-20
6.5
None Remote Low Single system Partial Partial Partial
Input validation issue in EC-CUBE Payment Module (2.12) version 3.5.23 and earlier, EC-CUBE Payment Module (2.11) version 2.3.17 and earlier, GMO-PG Payment Module (PG Multi-Payment Service) (2.12) version 3.5.23 and earlier, GMO-PG Payment Module (PG Multi-Payment Service) (2.11) version 2.3.17 and earlier allows an attacker with administrative rights to execute arbitrary PHP code on the server via unspecified vectors.
3665 CVE-2018-0656 426 +Priv 2018-09-04 2018-11-06
6.8
None Remote Medium Not required Partial Partial Partial
Untrusted search path vulnerability in The installer of Digital Paper App version 1.4.0.16050 and earlier allows an attacker to gain privileges via a Trojan horse DLL in an unspecified directory.
3666 CVE-2018-0648 426 +Priv 2018-09-07 2018-11-13
6.8
None Remote Medium Not required Partial Partial Partial
Untrusted search path vulnerability in installer of ChatWork Desktop App for Windows 2.3.0 and earlier allows an attacker to gain privileges via a Trojan horse DLL in an unspecified directory.
3667 CVE-2018-0647 352 CSRF 2018-09-07 2018-10-30
6.8
None Remote Medium Not required Partial Partial Partial
Cross-site request forgery (CSRF) vulnerability in WL-330NUL Firmware version prior to 3.0.0.46 allows remote attackers to hijack the authentication of administrators via unspecified vectors.
3668 CVE-2018-0646 22 Dir. Trav. 2018-09-04 2018-11-06
6.8
None Remote Medium Not required Partial Partial Partial
Directory traversal vulnerability in Explzh v.7.58 and earlier allows an attacker to read arbitrary files via unspecified vectors.
3669 CVE-2018-0641 119 Exec Code Overflow 2019-01-09 2019-01-16
6.5
None Remote Low Single system Partial Partial Partial
Buffer overflow in Aterm HC100RC Ver1.0.1 and earlier allows attacker with administrator rights to execute arbitrary code via tools_system.cgi date parameter, time parameter, and offset parameter.
3670 CVE-2018-0640 119 Exec Code Overflow 2019-01-09 2019-01-16
6.5
None Remote Low Single system Partial Partial Partial
Buffer overflow in Aterm HC100RC Ver1.0.1 and earlier allows attacker with administrator rights to execute arbitrary code via netWizard.cgi date parameter, time parameter, and offset parameter.
3671 CVE-2018-0633 119 Exec Code Overflow 2019-01-09 2019-01-16
6.5
None Remote Low Single system Partial Partial Partial
Buffer overflow in Aterm W300P Ver1.0.13 and earlier allows attacker with administrator rights to execute arbitrary code via submit-url parameter.
3672 CVE-2018-0632 119 Exec Code Overflow 2019-01-09 2019-01-16
6.5
None Remote Low Single system Partial Partial Partial
Buffer overflow in Aterm W300P Ver1.0.13 and earlier allows attacker with administrator rights to execute arbitrary code via HTTP request and response.
3673 CVE-2018-0624 426 +Priv 2018-09-07 2018-10-30
6.8
None Remote Medium Not required Partial Partial Partial
Untrusted search path vulnerability in Multiple Yayoi 17 Series products (Yayoi Kaikei 17 Series Ver.23.1.1 and earlier, Yayoi Aoiro Shinkoku 17 Ver.23.1.1 and earlier, Yayoi Kyuuyo 17 Ver.20.1.4 and earlier, Yayoi Kyuuyo Keisan 17 Ver.20.1.4 and earlier, Yayoi Hanbai 17 Series Ver.20.0.2 and earlier, and Yayoi Kokyaku Kanri 17 Ver.11.0.2 and earlier) allows an attacker to gain privileges via a Trojan horse DLL in an unspecified directory. This flaw exists within the handling of ykkapi.dll loaded by the vulnerable products.
3674 CVE-2018-0623 426 +Priv 2018-09-07 2018-10-30
6.8
None Remote Medium Not required Partial Partial Partial
Untrusted search path vulnerability in Multiple Yayoi 17 Series products (Yayoi Kaikei 17 Series Ver.23.1.1 and earlier, Yayoi Aoiro Shinkoku 17 Ver.23.1.1 and earlier, Yayoi Kyuuyo 17 Ver.20.1.4 and earlier, Yayoi Kyuuyo Keisan 17 Ver.20.1.4 and earlier, Yayoi Hanbai 17 Series Ver. 20.0.2 and earlier, and Yayoi Kokyaku Kanri 17 Ver.11.0.2 and earlier) allows an attacker to gain privileges via a Trojan horse DLL in an unspecified directory. This flaw exists within the handling of msjet49.dll loaded by the vulnerable products.
3675 CVE-2018-0621 426 +Priv 2018-07-26 2018-09-20
6.8
None Remote Medium Not required Partial Partial Partial
Untrusted search path vulnerability in LOGICOOL CONNECTION UTILITY SOFTWARE versions before 2.30.9 allows an attacker to gain privileges via a Trojan horse DLL in an unspecified directory.
3676 CVE-2018-0620 426 +Priv 2018-07-26 2018-09-20
6.8
None Remote Medium Not required Partial Partial Partial
Untrusted search path vulnerability in LOGICOOL Game Software versions before 8.87.116 allows an attacker to gain privileges via a Trojan horse DLL in an unspecified directory.
3677 CVE-2018-0619 426 +Priv 2018-07-26 2018-09-20
6.8
None Remote Medium Not required Partial Partial Partial
Untrusted search path vulnerability in the installer of Glarysoft Glary Utilities (Glary Utilities 5.99 and earlier and Glary Utilities Pro 5.99 and earlier) allows an attacker to gain privileges via a Trojan horse DLL in an unspecified directory.
3678 CVE-2018-0613 264 Bypass 2018-07-26 2018-10-03
6.5
None Remote Low Single system Partial Partial Partial
NEC Platforms Calsos CSDX and CSDJ series products (CSDX 1.37210411 and earlier, CSDX(P) 4.37210411 and earlier, CSDX(D) 3.37210411 and earlier, CSDX(S) 2.37210411 and earlier, CSDJ-B 01.03.00 and earlier, CSDJ-H 01.03.00 and earlier, CSDJ-D 01.03.00 and earlier, CSDJ-A 03.00.00) allows remote authenticated attackers to bypass access restriction to conduct arbitrary operations with administrative privilege via unspecified vectors.
3679 CVE-2018-0610 264 Exec Code +Info File Inclusion 2018-06-26 2018-08-17
6.5
None Remote Low Single system Partial Partial Partial
Local file inclusion vulnerability in Zenphoto 1.4.14 and earlier allows a remote attacker with an administrative privilege to execute arbitrary code or obtain sensitive information.
3680 CVE-2018-0609 426 +Priv 2018-06-26 2018-08-17
6.8
None Remote Medium Not required Partial Partial Partial
Untrusted search path vulnerability in LINE for Windows versions before 5.8.0 allows an attacker to gain privileges via a Trojan horse DLL in an unspecified directory.
3681 CVE-2018-0607 89 Exec Code Sql 2018-07-26 2018-09-24
6.5
None Remote Low Single system Partial Partial Partial
SQL injection vulnerability in the Notifications application in the Cybozu Garoon 3.5.0 to 4.6.2 allows remote authenticated attackers to execute arbitrary SQL commands via unspecified vectors.
3682 CVE-2018-0606 89 Exec Code Sql 2018-06-26 2018-08-17
6.5
None Remote Low Single system Partial Partial Partial
SQL injection vulnerability in the Pixelpost v1.7.3 and earlier allows remote authenticated attackers to execute arbitrary SQL commands via unspecified vectors.
3683 CVE-2018-0604 284 Exec Code 2018-06-26 2018-08-17
6.5
None Remote Low Single system Partial Partial Partial
Pixelpost v1.7.3 and earlier allows remote code execution via unspecified vectors.
3684 CVE-2018-0600 426 +Priv 2018-06-26 2018-08-17
6.8
None Remote Medium Not required Partial Partial Partial
Untrusted search path vulnerability in the installer of PlayMemories Home for Windows ver.5.5.01 and earlier allows an attacker to gain privileges via a Trojan horse DLL in an unspecified directory.
3685 CVE-2018-0597 426 +Priv 2018-06-26 2018-11-23
6.8
None Remote Medium Not required Partial Partial Partial
Untrusted search path vulnerability in the installer of Visual Studio Code allows an attacker to gain privileges via a Trojan horse DLL in an unspecified directory.
3686 CVE-2018-0596 426 +Priv 2018-06-26 2018-08-17
6.8
None Remote Medium Not required Partial Partial Partial
Untrusted search path vulnerability in the installer of Visual Studio Community allows an attacker to gain privileges via a Trojan horse DLL in an unspecified directory.
3687 CVE-2018-0595 426 +Priv 2018-06-26 2018-08-17
6.8
None Remote Medium Not required Partial Partial Partial
Untrusted search path vulnerability in the installer of Skype for Windows allows an attacker to gain privileges via a Trojan horse DLL in an unspecified directory.
3688 CVE-2018-0594 426 +Priv 2018-06-26 2018-08-17
6.8
None Remote Medium Not required Partial Partial Partial
Untrusted search path vulnerability in Skype for Windows allows an attacker to gain privileges via a Trojan horse DLL in an unspecified directory.
3689 CVE-2018-0593 426 +Priv 2018-06-26 2018-08-17
6.8
None Remote Medium Not required Partial Partial Partial
Untrusted search path vulnerability in the installer of Microsoft OneDrive allows an attacker to gain privileges via a Trojan horse DLL in an unspecified directory.
3690 CVE-2018-0592 426 +Priv 2018-06-26 2018-08-17
6.8
None Remote Medium Not required Partial Partial Partial
Untrusted search path vulnerability in Microsoft OneDrive allows an attacker to gain privileges via a Trojan horse DLL in an unspecified directory.
3691 CVE-2018-0588 22 Dir. Trav. 2018-05-14 2018-06-18
6.4
None Remote Low Not required None Partial Partial
Directory traversal vulnerability in the AJAX function of Ultimate Member plugin prior to version 2.0.4 for WordPress allows remote attackers to read arbitrary files via unspecified vectors.
3692 CVE-2018-0580 426 +Priv 2018-05-14 2018-06-20
6.8
None Remote Medium Not required Partial Partial Partial
Untrusted search path vulnerability in CELSYS, Inc CLIP STUDIO series (CLIP STUDIO PAINT (for Windows) EX/PRO/DEBUT Ver.1.7.3 and earlier, CLIP STUDIO ACTION (for Windows) Ver.1.5.5 and earlier, with its timestamp prior to April 25, 2018, 12:11:31, and CLIP STUDIO MODELER (for Windows) Ver.1.6.3 and earlier, with its timestamp prior to April 25, 2018, 17:02:49) allows remote attackers to gain privileges via a Trojan horse DLL in an unspecified directory.
3693 CVE-2018-0569 78 Exec Code 2018-06-26 2018-08-21
6.5
None Remote Low Single system Partial Partial Partial
baserCMS (baserCMS 4.1.0.1 and earlier versions, baserCMS 3.0.15 and earlier versions) allows remote authenticated attackers to execute arbitrary OS commands via unspecified vectors.
3694 CVE-2018-0568 434 Exec Code 2018-05-14 2018-06-19
6.5
None Remote Low Single system Partial Partial Partial
Unrestricted file upload vulnerability in SiteBridge Inc. Joruri Gw Ver 3.2.0 and earlier allows remote authenticated users to execute arbitrary PHP code via unspecified vectors.
3695 CVE-2018-0567 284 Bypass 2018-06-26 2018-08-08
6.5
None Remote Low Single system Partial Partial Partial
Cybozu Office 10.0.0 to 10.8.0 allows authenticated attackers to bypass access restriction to access and write non-public data via unspecified vectors.
3696 CVE-2018-0552 426 +Priv 2018-03-22 2018-04-20
6.8
None Remote Medium Not required Partial Partial Partial
Untrusted search path vulnerability in The installer of PhishWall Client Firefox and Chrome edition for Windows Ver. 5.1.26 and earlier allows an attacker to gain privileges via a Trojan horse DLL in an unspecified directory.
3697 CVE-2018-0540 426 +Priv 2018-03-22 2018-04-20
6.8
None Remote Medium Not required Partial Partial Partial
Untrusted search path vulnerability in ViX version 2.21.148.0 allows an attacker to gain privileges via a Trojan horse DLL in an unspecified directory.
3698 CVE-2018-0530 89 Exec Code Sql 2018-04-16 2018-05-17
6.5
None Remote Low Single system Partial Partial Partial
SQL injection vulnerability in the Cybozu Garoon 3.5.0 to 4.2.6 allows remote authenticated attackers to execute arbitrary SQL commands via unspecified vectors.
3699 CVE-2018-0522 119 Exec Code Overflow 2018-03-09 2018-03-26
6.8
None Remote Medium Not required Partial Partial Partial
Buffer overflow in Buffalo WXR-1900DHP2 firmware Ver.2.48 and earlier allows an attacker to execute arbitrary code via a specially crafted file.
3700 CVE-2018-0520 352 CSRF 2018-02-23 2018-03-16
6.8
None Remote Medium Not required Partial Partial Partial
Cross-site request forgery (CSRF) vulnerability in FS010W firmware FS010W_00_V1.3.0 and earlier allows an attacker to hijack the authentication of administrators via unspecified vectors.
CVE is a registred trademark of the MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. CWE is a registred trademark of the MITRE Corporation and the authoritative source of CWE content is MITRE's CWE web site. OVAL is a registered trademark of The MITRE Corporation and the authoritative source of OVAL content is MITRE's OVAL web site.
Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.