CVEdetails.com the ultimate security vulnerability data source
(e.g.: CVE-2009-1234 or 2010-1234 or 20101234)
Log In   Register
Vulnerability Feeds & WidgetsNew   www.itsecdb.com  

Security Vulnerabilities (CVSS score between 6 and 6.99)

Press ESC to close
# CVE ID CWE ID # of Exploits Vulnerability Type(s) Publish Date Update Date Score Gained Access Level Access Complexity Authentication Conf. Integ. Avail.
1 CVE-2018-1000014 352 CSRF 2018-01-23 2018-02-07
6.8
None Remote Medium Not required Partial Partial Partial
Jenkins Translation Assistance Plugin 1.15 and earlier did not require form submissions to be submitted via POST, resulting in a CSRF vulnerability allowing attackers to override localized strings displayed to all users on the current Jenkins instance if the victim is a Jenkins administrator.
2 CVE-2018-1000013 352 CSRF 2018-01-23 2018-02-07
6.8
None Remote Medium Not required Partial Partial Partial
Jenkins Release Plugin 2.9 and earlier did not require form submissions to be submitted via POST, resulting in a CSRF vulnerability allowing attackers to trigger release builds.
3 CVE-2018-1000012 611 2018-01-23 2018-02-07
6.5
None Remote Low Single system Partial Partial Partial
Jenkins Warnings Plugin 4.64 and earlier processes XML external entities in files it parses as part of the build process, allowing attackers with user permissions in Jenkins to extract secrets from the Jenkins master, perform server-side request forgery, or denial-of-service attacks.
4 CVE-2018-1000011 611 2018-01-23 2018-02-07
6.5
None Remote Low Single system Partial Partial Partial
Jenkins FindBugs Plugin 4.71 and earlier processes XML external entities in files it parses as part of the build process, allowing attackers with user permissions in Jenkins to extract secrets from the Jenkins master, perform server-side request forgery, or denial-of-service attacks.
5 CVE-2018-1000010 611 2018-01-23 2018-02-07
6.5
None Remote Low Single system Partial Partial Partial
Jenkins DRY Plugin 2.49 and earlier processes XML external entities in files it parses as part of the build process, allowing attackers with user permissions in Jenkins to extract secrets from the Jenkins master, perform server-side request forgery, or denial-of-service attacks.
6 CVE-2018-1000009 611 2018-01-23 2018-02-07
6.5
None Remote Low Single system Partial Partial Partial
Jenkins Checkstyle Plugin 3.49 and earlier processes XML external entities in files it parses as part of the build process, allowing attackers with user permissions in Jenkins to extract secrets from the Jenkins master, perform server-side request forgery, or denial-of-service attacks.
7 CVE-2018-1000008 611 2018-01-23 2018-02-07
6.5
None Remote Low Single system Partial Partial Partial
Jenkins PMD Plugin 3.49 and earlier processes XML external entities in files it parses as part of the build process, allowing attackers with user permissions in Jenkins to extract secrets from the Jenkins master, perform server-side request forgery, or denial-of-service attacks.
8 CVE-2018-1000005 125 2018-01-24 2018-02-09
6.4
None Remote Low Not required Partial None Partial
libcurl 7.49.0 to and including 7.57.0 contains an out bounds read in code handling HTTP/2 trailers. It was reported (https://github.com/curl/curl/pull/2231) that reading an HTTP/2 trailer could mess up future trailers since the stored size was one byte less than required. The problem is that the code that creates HTTP/1-like headers from the HTTP/2 trailer data once appended a string like `:` to the target buffer, while this was recently changed to `: ` (a space was added after the colon) but the following math wasn't updated correspondingly. When accessed, the data is read out of bounds and causes either a crash or that the (too large) data gets passed to client write. This could lead to a denial-of-service situation or an information disclosure if someone has a service that echoes back or uses the trailers for something.
9 CVE-2018-6543 190 DoS Overflow 2018-02-02 2018-02-15
6.8
None Remote Medium Not required Partial Partial Partial
In GNU Binutils 2.30, there's an integer overflow in the function load_specific_debug_section() in objdump.c, which results in `malloc()` with 0 size. A crafted ELF file allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact.
10 CVE-2018-6525 20 DoS 2018-02-01 2018-02-13
6.1
None Local Low Not required Partial Partial Complete
In nProtect AVS V4.0 before 4.0.0.39, the driver file (TKFsAv.SYS) allows local users to cause a denial of service (BSOD) or possibly have unspecified other impact because of not validating input values from IOCtl 0x220458.
11 CVE-2018-6524 20 DoS 2018-02-01 2018-02-13
6.1
None Local Low Not required Partial Partial Complete
In nProtect AVS V4.0 before 4.0.0.39, the driver file (TKFsAv.SYS) allows local users to cause a denial of service (BSOD) or possibly have unspecified other impact because of not validating input values from IOCtl 0x220c20.
12 CVE-2018-6523 20 DoS 2018-02-01 2018-02-13
6.1
None Local Low Not required Partial Partial Complete
In nProtect AVS V4.0 before 4.0.0.39, the driver file (TKFsAv.SYS) allows local users to cause a denial of service (BSOD) or possibly have unspecified other impact because of not validating input values from IOCtl 0x22045c.
13 CVE-2018-6522 20 DoS 2018-02-01 2018-02-13
6.1
None Local Low Not required Partial Partial Complete
In nProtect AVS V4.0 before 4.0.0.39, the driver file (TKRgFtXp.SYS) allows local users to cause a denial of service (BSOD) or possibly have unspecified other impact because of not validating input values from IOCtl 0x220408.
14 CVE-2018-6474 20 DoS 2018-01-31 2018-02-13
6.1
None Local Low Not required Partial Partial Complete
In SUPERAntiSpyware Professional Trial 6.0.1254, the driver file (SASKUTIL.SYS) allows local users to cause a denial of service (BSOD) or possibly have unspecified other impact because of not validating input values from IOCtl 0x9C402148.
15 CVE-2018-6473 20 DoS 2018-01-31 2018-02-13
6.1
None Local Low Not required Partial Partial Complete
In SUPERAntiSpyware Professional Trial 6.0.1254, the driver file (SASKUTIL.SYS) allows local users to cause a denial of service (BSOD) or possibly have unspecified other impact because of not validating input values from IOCtl 0x9C402080.
16 CVE-2018-6472 20 DoS 2018-01-31 2018-02-13
6.1
None Local Low Not required Partial Partial Complete
In SUPERAntiSpyware Professional Trial 6.0.1254, the driver file (SASKUTIL.SYS) allows local users to cause a denial of service (BSOD) or possibly have unspecified other impact because of not validating input values from IOCtl 0x9C40204c.
17 CVE-2018-6471 20 DoS 2018-01-31 2018-02-13
6.1
None Local Low Not required Partial Partial Complete
In SUPERAntiSpyware Professional Trial 6.0.1254, the driver file (SASKUTIL.SYS) allows local users to cause a denial of service (BSOD) or possibly have unspecified other impact because of not validating input values from IOCtl 0x9C402078.
18 CVE-2018-6393 89 Sql 2018-01-29 2018-02-15
6.5
None Remote Low Single system Partial Partial Partial
** DISPUTED ** FreePBX 10.13.66-32bit and 14.0.1.24 (SNG7-PBX-64bit-1712-2) allow post-authentication SQL injection via the order parameter. NOTE: the vendor disputes this issue because it is intentional that a user can "directly modify SQL tables ... [or] run shell scripts ... once ... logged in to the administration interface; there is no need to try to find input validation errors."
19 CVE-2018-6391 352 CSRF 2018-01-29 2018-02-14
6.8
None Remote Medium Not required Partial Partial Partial
A cross-site request forgery web vulnerability has been discovered on Netis WF2419 V2.2.36123 devices. A remote attacker is able to delete Address Reservation List settings.
20 CVE-2018-6359 416 DoS 2018-01-27 2018-02-13
6.8
None Remote Medium Not required Partial Partial Partial
The decompileIF function (util/decompile.c) in libming through 0.4.8 is vulnerable to a use-after-free, which may allow attackers to cause a denial of service or unspecified other impact via a crafted SWF file.
21 CVE-2018-6358 119 DoS Overflow 2018-01-27 2018-02-13
6.8
None Remote Medium Not required Partial Partial Partial
The printDefineFont2 function (util/listfdb.c) in libming through 0.4.8 is vulnerable to a heap-based buffer overflow, which may allow attackers to cause a denial of service or unspecified other impact via a crafted FDB file.
22 CVE-2018-6357 352 XSS CSRF 2018-01-27 2018-02-15
6.8
None Remote Medium Not required Partial Partial Partial
The acx_asmw_saveorder_callback function in function.php in the acurax-social-media-widget plugin before 3.2.6 for WordPress has CSRF via the recordsArray parameter to wp-admin/admin-ajax.php, with resultant social_widget_icon_array_order XSS.
23 CVE-2018-6323 190 DoS Overflow 2018-01-26 2018-02-16
6.8
None Remote Medium Not required Partial Partial Partial
The elf_object_p function in elfcode.h in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29.1, has an unsigned integer overflow because bfd_size_type multiplication is not used. A crafted ELF file allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact.
24 CVE-2018-6317 134 DoS 2018-02-02 2018-02-15
6.4
None Remote Low Not required Partial None Partial
The remote management interface in Claymore Dual Miner 10.5 and earlier is vulnerable to an unauthenticated format string vulnerability, allowing remote attackers to read memory or cause a denial of service.
25 CVE-2018-6315 125 DoS Overflow 2018-01-25 2018-02-12
6.8
None Remote Medium Not required Partial Partial Partial
The outputSWF_TEXT_RECORD function (util/outputscript.c) in libming through 0.4.8 is vulnerable to an integer overflow and resultant out-of-bounds read, which may allow attackers to cause a denial of service or unspecified other impact via a crafted SWF file.
26 CVE-2018-6209 20 DoS 2018-01-24 2018-02-07
6.1
None Local Low Not required Partial Partial Complete
In Max Secure Anti Virus 19.0.3.019,, the driver file (MaxCryptMon.sys) allows local users to cause a denial of service (BSOD) or possibly have unspecified other impact because of not validating input values from IOCtl 0x220019.
27 CVE-2018-6208 20 DoS 2018-01-24 2018-02-07
6.1
None Local Low Not required Partial Partial Complete
In Max Secure Anti Virus 19.0.3.019,, the driver file (MaxProtector32.sys) allows local users to cause a denial of service (BSOD) or possibly have unspecified other impact because of not validating input values from IOCtl 0x22000d.
28 CVE-2018-6207 20 DoS 2018-01-24 2018-02-07
6.1
None Local Low Not required Partial Partial Complete
In Max Secure Anti Virus 19.0.3.019,, the driver file (MaxProtector32.sys) allows local users to cause a denial of service (BSOD) or possibly have unspecified other impact because of not validating input values from IOCtl 0x220019.
29 CVE-2018-6206 20 DoS 2018-01-24 2018-02-07
6.1
None Local Low Not required Partial Partial Complete
In Max Secure Anti Virus 19.0.3.019,, the driver file (MaxProtector32.sys) allows local users to cause a denial of service (BSOD) or possibly have unspecified other impact because of not validating input values from IOCtl 0x220011.
30 CVE-2018-6205 20 DoS 2018-01-24 2018-02-07
6.1
None Local Low Not required Partial Partial Complete
In Max Secure Anti Virus 19.0.3.019,, the driver file (MaxProtector32.sys) allows local users to cause a denial of service (BSOD) or possibly have unspecified other impact because of not validating input values from IOCtl 0x220009.
31 CVE-2018-6204 20 DoS 2018-01-24 2018-02-07
6.1
None Local Low Not required Partial Partial Complete
In Max Secure Anti Virus 19.0.3.019,, the driver file (SDActMon.sys) allows local users to cause a denial of service (BSOD) or possibly have unspecified other impact because of not validating input values from IOCtl 0x220019.
32 CVE-2018-6203 20 DoS 2018-01-24 2018-02-08
6.1
None Local Low Not required Partial Partial Complete
In eScan Antivirus 14.0.1400.2029, the driver file (econceal.sys) allows local users to cause a denial of service (BSOD) or possibly have unspecified other impact because of not validating input values from IOCtl 0x8300210C.
33 CVE-2018-6202 20 DoS 2018-01-24 2018-02-08
6.1
None Local Low Not required Partial Partial Complete
In eScan Antivirus 14.0.1400.2029, the driver file (econceal.sys) allows local users to cause a denial of service (BSOD) or possibly have unspecified other impact because of not validating input values from IOCtl 0x830020F8.
34 CVE-2018-6201 20 DoS 2018-01-24 2018-02-08
6.1
None Local Low Not required Partial Partial Complete
In eScan Antivirus 14.0.1400.2029, the driver file (econceal.sys) allows local users to cause a denial of service (BSOD) or possibly have unspecified other impact because of not validating input values from IOCtl 0x830020E0 or 0x830020E4.
35 CVE-2018-6195 94 2018-01-30 2018-02-15
6.5
None Remote Low Single system Partial Partial Partial
admin/partials/wp-splashing-admin-main.php in the Splashing Images plugin (wp-splashing-images) before 2.1.1 for WordPress allows authenticated (administrator, editor, or author) remote attackers to conduct PHP Object Injection attacks via crafted serialized data in the 'session' HTTP GET parameter to wp-admin/upload.php.
36 CVE-2018-6018 310 2018-01-24 2018-02-12
6.4
None Remote Low Not required Partial Partial None
Fixed sizes of HTTPS responses in Tinder iOS app and Tinder Android app allow an attacker to extract private sensitive information by sniffing network traffic.
37 CVE-2018-6017 310 2018-01-24 2018-02-13
6.4
None Remote Low Not required Partial Partial None
Unencrypted transmission of images in Tinder iOS app and Tinder Android app allows an attacker to extract private sensitive information by sniffing network traffic.
38 CVE-2018-6009 352 CSRF 2018-01-22 2018-02-09
6.8
None Remote Medium Not required Partial Partial Partial
In Yii Framework 2.x before 2.0.14, the switchIdentity function in web/User.php did not regenerate the CSRF token upon a change of identity.
39 CVE-2018-6007 352 CSRF 2018-01-29 2018-02-15
6.8
None Remote Medium Not required Partial Partial Partial
CSRF exists in the JS Support Ticket 1.1.0 component for Joomla! and allows attackers to inject HTML or edit a ticket.
40 CVE-2018-5996 388 DoS Exec Code Mem. Corr. 2018-01-31 2018-02-15
6.8
None Remote Medium Not required Partial Partial Partial
Insufficient exception handling in the method NCompress::NRar3::CDecoder::Code of 7-Zip before 18.00 and p7zip can lead to multiple memory corruptions within the PPMd code, allows remote attackers to cause a denial of service (segmentation fault) or execute arbitrary code via a crafted RAR archive.
41 CVE-2018-5976 352 CSRF 2018-01-24 2018-02-12
6.8
None Remote Medium Not required Partial Partial Partial
Cross Site Request Forgery (CSRF) exists in RSVP Invitation Online 1.0 via function/account.php, as demonstrated by modifying the admin password.
42 CVE-2018-5969 352 CSRF 2018-01-24 2018-02-12
6.8
None Remote Medium Not required Partial Partial Partial
Cross Site Request Forgery (CSRF) exists in Photography CMS 1.0 via clients/resources/ajax/ajax_new_admin.php, as demonstrated by adding an admin account.
43 CVE-2018-5960 89 Sql 2018-01-21 2018-02-12
6.5
None Remote Low Single system Partial Partial Partial
Zenario v7.1 - v7.6 has SQL injection via the `Name` input field of organizer.php or admin_boxes.ajax.php in the `Categories - Edit` module.
44 CVE-2018-5958 20 DoS 2018-01-21 2018-02-05
6.1
None Local Low Not required Partial Partial Complete
In Zillya! Antivirus 3.0.2230.0, the driver file (zef.sys) allows local users to cause a denial of service (BSOD) or possibly have unspecified other impact because of not validating input values from IOCtl 0x9C402424.
45 CVE-2018-5956 20 DoS 2018-01-21 2018-02-05
6.1
None Local Low Not required Partial Partial Complete
In Zillya! Antivirus 3.0.2230.0, the driver file (zef.sys) allows local users to cause a denial of service (BSOD) or possibly have unspecified other impact because of not validating input values from IOCtl 0x9C402414.
46 CVE-2018-5766 119 DoS Overflow 2018-01-18 2018-02-02
6.8
None Remote Medium Not required Partial Partial Partial
In Libav through 12.2, there is an invalid memcpy in the av_packet_ref function of libavcodec/avpacket.c. Remote attackers could leverage this vulnerability to cause a denial of service (segmentation fault) via a crafted avi file.
47 CVE-2018-5721 119 Exec Code Overflow 2018-01-17 2018-02-02
6.5
None Remote Low Single system Partial Partial Partial
Stack-based buffer overflow in the ej_update_variables function in router/httpd/web.c on ASUS routers (when using software from https://github.com/RMerl/asuswrt-merlin) allows web authenticated attackers to execute code via a request that updates a setting. In ej_update_variables, the length of the variable action_script is not checked, as long as it includes a "_wan_if" substring.
48 CVE-2018-5714 20 DoS 2018-01-16 2018-02-05
6.1
None Local Low Not required Partial Partial Complete
In Malwarefox Anti-Malware 2.72.169, the driver file (zam64.sys) allows local users to cause a denial of service (BSOD) or possibly have unspecified other impact because of not validating input values from IOCtl 0x80002054.
49 CVE-2018-5713 20 DoS 2018-01-16 2018-02-05
6.1
None Local Low Not required Partial Partial Complete
In Malwarefox Anti-Malware 2.72.169, the driver file (zam64.sys) allows local users to cause a denial of service (BSOD) or possibly have unspecified other impact because of not validating input values from IOCtl 0x80002010.
50 CVE-2018-5706 264 2018-01-16 2018-02-02
6.5
None Remote Low Single system Partial Partial Partial
An issue was discovered in Octopus Deploy before 4.1.9. Any user with user editing permissions can modify teams to give themselves Administer System permissions even if they didn't have them, as demonstrated by use of the RoleEdit or TeamEdit permission.
CVE is a registred trademark of the MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. CWE is a registred trademark of the MITRE Corporation and the authoritative source of CWE content is MITRE's CWE web site. OVAL is a registered trademark of The MITRE Corporation and the authoritative source of OVAL content is MITRE's OVAL web site.
Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.