CVE-2018-11xxx records
Browse official CVE Program records with vulnerability descriptions, affected products, CVSS scores and source references. Browse by the year and numeric range in each CVE ID; publication and update dates appear on each record.
865 records · Page 8 of 9
Quest DR Series Disk Backup software version before 4.0.3.1 allows privilege escalation (issue 1 of 6).
UpdatedQuest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 46 of 46).
UpdatedQuest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 45 of 46).
UpdatedQuest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 44 of 46).
UpdatedQuest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 43 of 46).
UpdatedQuest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 42 of 46).
UpdatedQuest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 41 of 46).
UpdatedQuest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 40 of 46).
UpdatedQuest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 39 of 46).
UpdatedQuest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 38 of 46).
UpdatedQuest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 37 of 46).
UpdatedQuest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 36 of 46).
UpdatedQuest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 35 of 46).
UpdatedQuest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 34 of 46).
UpdatedQuest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 33 of 46).
UpdatedQuest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 32 of 46).
UpdatedQuest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 31 of 46).
UpdatedQuest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 30 of 46).
UpdatedQuest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 29 of 46).
UpdatedQuest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 28 of 46).
UpdatedQuest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 27 of 46).
UpdatedQuest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 26 of 46).
UpdatedQuest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 25 of 46).
UpdatedQuest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 24 of 46).
UpdatedQuest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 23 of 46).
UpdatedQuest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 22 of 46).
UpdatedQuest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 21 of 46).
UpdatedQuest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 20 of 46).
UpdatedQuest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 19 of 46).
UpdatedQuest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 18 of 46).
UpdatedQuest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 17 of 46).
UpdatedQuest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 16 of 46).
UpdatedQuest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 15 of 46).
UpdatedQuest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 14 of 46).
UpdatedQuest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 13 of 46).
UpdatedQuest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 12 of 46).
UpdatedQuest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 11 of 46).
UpdatedQuest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 10 of 46).
UpdatedQuest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 9 of 46).
UpdatedQuest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 8 of 46).
UpdatedQuest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 7 of 46).
UpdatedQuest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 6 of 46).
UpdatedQuest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 5 of 46).
UpdatedQuest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 4 of 46).
UpdatedQuest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 3 of 46).
UpdatedQuest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 2 of 46).
UpdatedQuest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 1 of 46).
UpdatedThe 'systemui/settings_network.php' and 'systemui/settings_patching.php' scripts in the Quest KACE System Management Appliance 8.0.318 are accessible only from localhost. This restriction can be bypassed by modifying the 'Host' and 'X_Forwarded_For' HTTP headers in a POST request. An anonymous user can abuse this vulnerability to execute critical functions without authorization.
UpdatedThe 'IMAGES_JSON' and 'attachments_to_remove[]' parameters of the '/adminui/advisory.php' script in the Quest KACE System Management Virtual Appliance 8.0.318 can be abused to write and delete files respectively via Directory Traversal. Files can be at any location where the 'www' user has write permissions.
UpdatedThe 'reportID' parameter received by the '/common/run_report.php' script in the Quest KACE System Management Appliance 8.0.318 is not sanitized, leading to SQL injection (in particular, an error-based type).
UpdatedThe '/common/ajax_email_connection_test.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by any authenticated user and can be abused to execute arbitrary commands on the system. This script is vulnerable to command injection via the unsanitized user input 'TEST_SERVER' sent to the script via the POST method.
UpdatedThe '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by anonymous users and can be abused to execute arbitrary commands on the system.
UpdatedThe 'checksum' parameter of the '/common/download_attachment.php' script in the Quest KACE System Management Appliance 8.0.318 can be abused to read arbitrary files with 'www' privileges via Directory Traversal. No administrator privileges are needed to execute this script.
UpdatedThe 'orgID' parameter received by the '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance 8.0.318 is not sanitized, leading to SQL injection (in particular, a blind time-based type).
UpdatedThe script '/adminui/error_details.php' in the Quest KACE System Management Appliance 8.0.318 allows authenticated users to conduct PHP object injection attacks.
UpdatedIn order to perform actions that requires higher privileges, the Quest KACE System Management Appliance 8.0.318 relies on a message queue managed that runs with root privileges and only allows a set of commands. One of the available commands allows changing any user's password (including root). A low-privilege user could abuse this feature by changing the password of the 'kace_support' account, wh
UpdatedThe 'fmt' parameter of the '/common/run_cross_report.php' script in the the Quest KACE System Management Appliance 8.0.318 is vulnerable to cross-site scripting.
UpdatedIn order to perform actions that require higher privileges, the Quest KACE System Management Appliance 8.0.318 relies on a message queue that runs daemonized with root privileges and only allows a set of commands to be executed. A command injection vulnerability exists within this message queue which allows low-privilege users to append arbitrary commands that will be run as root.
UpdatedThe header::add_FORMAT_descriptor function in header.cpp in VCFtools 0.1.15 allows remote attackers to cause a denial of service (use-after-free) or possibly have unspecified other impact via a crafted vcf file.
UpdatedThe header::add_INFO_descriptor function in header.cpp in VCFtools 0.1.15 allows remote attackers to cause a denial of service (use-after-free) or possibly have unspecified other impact via a crafted vcf file.
UpdatedThe ObjReader::ReadObj() function in ObjReader.cpp in vincent0629 PDFParser allows remote attackers to cause a denial of service (stack-based buffer overflow) or possibly execute arbitrary code via a crafted pdf file.
Updatede107 2.1.7 has CSRF resulting in arbitrary user deletion.
Updateddg-user/?controller=users&action=add in doorGets 7.0 has CSRF that results in adding an administrator account.
UpdatedDO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none
Updated · Rejected recordCross-site scripting (XSS) vulnerability in Attributes functionality in Open-AudIT Community edition before 2.2.2 allows remote attackers to inject arbitrary web script or HTML via a crafted attribute name of an Attribute.
UpdatedServices/COPage/classes/class.ilPCSourceCode.php in ILIAS 5.1.x, 5.2.x, and 5.3.x before 5.3.5 has XSS.
UpdatedILIAS 5.1.x, 5.2.x, and 5.3.x before 5.3.5 redirects a logged-in user to a third-party site via the return_to_url parameter.
UpdatedThe RSS subsystem in ILIAS 5.1.x, 5.2.x, and 5.3.x before 5.3.5 has XSS via a URI to Services/Feeds/classes/class.ilExternalFeedItem.php.
UpdatedServices/Feeds/classes/class.ilExternalFeedItem.php in ILIAS 5.1.x, 5.2.x, and 5.3.x before 5.3.5 has XSS via a link attribute.
UpdatedOpenWrt mishandles access control in /etc/config/rpcd and the /usr/share/rpcd/acl.d files, which allows remote authenticated users to call arbitrary methods (i.e., achieve ubus access over HTTP) that were only supposed to be accessible to a specific user, as demonstrated by the file, log, and service namespaces, potentially leading to remote Information Disclosure or Code Execution. NOTE: The deve
UpdatedNETGEAR has released fixes for a pre-authentication command injection in request_handler.php security vulnerability on the following product models: WC7500, running firmware versions prior to 6.5.3.5; WC7520, running firmware versions prior to 2.5.0.46; WC7600v1, running firmware versions prior to 6.5.3.5; WC7600v2, running firmware versions prior to 6.5.3.5; and WC9500, running firmware versions
UpdatedThere is stored cross site scripting in the wp-live-chat-support plugin before 8.0.08 for WordPress via the "name" (aka wplc_name) and "email" (aka wplc_email) input fields to wp-json/wp_live_chat_support/v1/start_chat whenever a malicious attacker would initiate a new chat with an administrator. NOTE: this issue exists because of an incomplete fix for CVE-2018-9864.
UpdatedDO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none.
Updated · Rejected recordAn issue was discovered in Libav 12.3. A read access violation in the mov_probe function in libavformat/mov.c allows remote attackers to cause a denial of service (application crash), as demonstrated by avconv.
UpdatedOpen Whisper Signal (aka Signal-Desktop) through 1.10.1 allows XSS via a resource location specified in an attribute of a SCRIPT, IFRAME, or IMG element, leading to JavaScript execution after a reply, a different vulnerability than CVE-2018-10994. The attacker needs to send HTML code directly as a message, and then reply to that message to trigger this vulnerability. The Signal-Desktop software fa
UpdatedThe decompileSETTARGET function in decompile.c in libming through 0.4.8 mishandles cases where the header indicates a file size greater than the actual size, which allows remote attackers to cause a denial of service (Segmentation fault and application crash) or possibly have unspecified other impact.
UpdatedThe header::add_INFO_descriptor function in header.cpp in VCFtools 0.1.15 allows remote attackers to cause information disclosure (heap-based buffer over-read) via a crafted vcf file.
UpdatedAn issue was discovered in Frog CMS 0.9.5. There is a file upload vulnerability via the admin/?/plugin/file_manager/upload URI, a similar issue to CVE-2014-4912.
UpdatedAn issue was discovered in cloudwu/cstring through 2016-11-09. There is a memory leak vulnerability that could lead to a program crash.
UpdatedHorse Market Sell & Rent Portal Script 1.5.7 has a CSRF vulnerability through which an attacker can change all of the target's account information remotely.
UpdatedThe decompileJUMP function in decompile.c in libming through 0.4.8 mishandles cases where the header indicates a file size greater than the actual size, which allows remote attackers to cause a denial of service (Segmentation fault and application crash) or possibly have unspecified other impact.
UpdatedAn issue was discovered on Intelbras NCLOUD 300 1.0 devices. /cgi-bin/ExportSettings.sh, /goform/updateWPS, /goform/RebootSystem, and /goform/vpnBasicSettings do not require authentication. For example, when an HTTP POST request is made to /cgi-bin/ExportSettings.sh, the username, password, and other details are retrieved.
UpdatedCross-site scripting (XSS) vulnerability in the Link package for CKEditor 5 before 10.0.1 allows remote attackers to inject arbitrary web script through a crafted href attribute of a link (A) element.
UpdatedAn issue was discovered in the Admin Notes plugin 1.1 for MyBB. CSRF allows an attacker to remotely delete all admin notes via an admin/index.php?empty=table (aka Clear Table) action.
UpdatedAn issue was discovered in MyBiz MyProcureNet 5.0.0. A malicious file can be uploaded to the webserver by an attacker. It is possible for an attacker to upload a script to issue operating system commands. This vulnerability occurs because an attacker is able to adjust the "HiddenFieldControlCustomWhiteListedExtensions" parameter and add arbitrary extensions to the whitelist during the upload. For
UpdatedAn XSS issue was discovered in MyBiz MyProcureNet 5.0.0. This vulnerability within "ProxyPage.aspx" allows an attacker to inject malicious client side scripting which will be executed in the browser of users if they visit the manipulated site.
UpdatedPivotal Applications Manager in Pivotal Application Service, versions 2.0 prior to 2.0.21 and 2.1 prior to 2.1.13 and 2.2 prior to 2.2.5, contains a bug which may allow escalation of privileges. A space developer with access to the system org may be able to access an artifact which contains the CF admin credential, allowing them to escalate to an admin role.
Updated- CVE-2018-11087: TLS validation error Unscored
Pivotal Spring AMQP, 1.x versions prior to 1.7.10 and 2.x versions prior to 2.0.6, expose a man-in-the-middle vulnerability due to lack of hostname validation. A malicious user that has the ability to intercept traffic would be able to view data in transit.
Updated Pivotal Usage Service in Pivotal Application Service, versions 2.0 prior to 2.0.21 and 2.1 prior to 2.1.13 and 2.2 prior to 2.2.5, contains a bug which may allow escalation of privileges. A space developer with access to the system org may be able to access an artifact which contains the CF admin credential, allowing them to escalate to an admin role.
UpdatedDO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2018. Notes: none
Updated · Rejected recordCloud Foundry Garden-runC release, versions prior to 1.16.1, prevents deletion of some app environments based on file attributes. A remote authenticated malicious user may create and delete apps with crafted file attributes to cause a denial of service for new app instances or scaling up of existing apps.
UpdatedCloud Foundry BOSH, versions v264 prior to v264.14.0 and v265 prior to v265.7.0 and v266 prior to v266.8.0 and v267 prior to v267.2.0, allows refresh tokens to be as access tokens when using UAA for authentication. A remote attacker with an admin refresh token given by UAA can be used to access BOSH resources without obtaining an access token, even if their user no longer has access to those resou
UpdatedCloud Foundry UAA, all versions prior to 4.20.0 and Cloud Foundry UAA Release, all versions prior to 61.0, allows brute forcing of MFA codes. A remote unauthenticated malicious user in possession of a valid username and password can brute force MFA to login as the targeted user.
UpdatedPivotal Operations Manager, versions 2.2.x prior to 2.2.1, 2.1.x prior to 2.1.11, 2.0.x prior to 2.0.16, and 1.11.x prior to 2, fails to write the Operations Manager UAA config onto the temp RAM disk, thus exposing the configs directly onto disk. A remote user that has gained access to the Operations Manager VM, can now file search and find the UAA credentials for Operations Manager on the system
UpdatedDell EMC Secure Remote Services, versions prior to 3.32.00.08, contains Improper File Permission Vulnerabilities. The application contains multiple configuration files with world-readable permissions that could allow an authenticated malicious user to utilize the file contents to potentially elevate their privileges.
UpdatedDell EMC Secure Remote Services, versions prior to 3.32.00.08, contains a Plaintext Password Storage vulnerability. Database credentials are stored in plaintext in a configuration file. An authenticated malicious user with access to the configuration file may obtain the exposed password to gain access to the application database.
UpdatedDell EMC VPlex GeoSynchrony, versions prior to 6.1, contains an Insecure File Permissions vulnerability. A remote authenticated malicious user could read from VPN configuration files on and potentially author a MITM attack on the VPN traffic.
Updated'getlogs' utility in Dell EMC Avamar Server versions 7.2.0, 7.2.1, 7.3.0, 7.3.1, 7.4.0, 7.4.1, 7.5.0, 7.5.1 and 18.1 and Dell EMC Integrated Data Protection Appliance (IDPA) versions 2.0, 2.1 and 2.2 is affected by an OS command injection vulnerability. A malicious Avamar admin user may potentially be able to execute arbitrary commands under root privilege.
UpdatedDell EMC Avamar Server versions 7.2.0, 7.2.1, 7.3.0, 7.3.1, 7.4.0 and 7.4.1 and Dell EMC Integrated Data Protection Appliance (IDPA) 2.0 are affected by an information exposure vulnerability. Avamar Java management console's SSL/TLS private key may be leaked in the Avamar Java management client package. The private key could potentially be used by an unauthenticated attacker on the same data-link
UpdatedRSA Authentication Manager versions prior to 8.3 P3 contain a reflected cross-site scripting vulnerability in a Security Console page. A remote, unauthenticated malicious user, with the knowledge of a target user's anti-CSRF token, could potentially exploit this vulnerability by tricking a victim Security Console user to supply malicious HTML or JavaScript code to the vulnerable web application, w
Updated