Filtered by vendor Subscriptions
Total 322230 CVE
CVE Vendors Products Updated CVSS v3.1
CVE-2018-17158 1 Freebsd 1 Freebsd 2024-11-21 N/A
In FreeBSD before 11.2-STABLE(r340854) and 11.2-RELEASE-p5, an integer overflow error can occur when handling the client address length field in an NFSv4 request. Unprivileged remote users with access to the NFS server can crash the system by sending a specially crafted NFSv4 request.
CVE-2018-17157 1 Freebsd 1 Freebsd 2024-11-21 N/A
In FreeBSD before 11.2-STABLE(r340854) and 11.2-RELEASE-p5, an integer overflow error when handling opcodes can cause memory corruption by sending a specially crafted NFSv4 request. Unprivileged remote users with access to the NFS server may be able to execute arbitrary code.
CVE-2018-17156 1 Freebsd 1 Freebsd 2024-11-21 N/A
In FreeBSD before 11.2-STABLE(r340268) and 11.2-RELEASE-p5, due to incorrectly accounting for padding on 64-bit platforms, a buffer underwrite could occur when constructing an ICMP reply packet when using a non-standard value for the net.inet.icmp.quotelen sysctl.
CVE-2018-17155 1 Freebsd 1 Freebsd 2024-11-21 N/A
In FreeBSD before 11.2-STABLE(r338983), 11.2-RELEASE-p4, 11.1-RELEASE-p15, 10.4-STABLE(r338984), and 10.4-RELEASE-p13, due to insufficient initialization of memory copied to userland in the getcontext and swapcontext system calls, small amounts of kernel memory may be disclosed to userland processes. Unprivileged authenticated local users may be able to access small amounts privileged kernel data.
CVE-2018-17154 1 Freebsd 1 Freebsd 2024-11-21 N/A
In FreeBSD before 11.2-STABLE(r338987), 11.2-RELEASE-p4, and 11.1-RELEASE-p15, due to insufficient memory checking in the freebsd4_getfsstat system call, a NULL pointer dereference can occur. Unprivileged authenticated local users may be able to cause a denial of service.
CVE-2018-17153 1 Western Digital 21 My Cloud Dl2100, My Cloud Dl4100, My Cloud Dl4100 Firmware and 18 more 2024-11-21 N/A
It was discovered that the Western Digital My Cloud device before 2.30.196 is affected by an authentication bypass vulnerability. An unauthenticated attacker can exploit this vulnerability to authenticate as an admin user without needing to provide a password, thereby gaining full control of the device. (Whenever an admin logs into My Cloud, a server-side session is created that is bound to the user's IP address. After the session is created, it is possible to call authenticated CGI modules by sending the cookie username=admin in the HTTP request. The invoked CGI will check if a valid session is present and bound to the user's IP address.) It was found that it is possible for an unauthenticated attacker to create a valid session without a login. The network_mgr.cgi CGI module contains a command called "cgi_get_ipv6" that starts an admin session -- tied to the IP address of the user making the request -- if the additional parameter "flag" with the value "1" is provided. Subsequent invocation of commands that would normally require admin privileges now succeed if an attacker sets the username=admin cookie.
CVE-2018-17152 1 Intersystems 1 Cache 2024-11-21 N/A
Intersystems Cache 2017.2.2.865.0 allows XXE.
CVE-2018-17151 1 Intersystems 1 Cache 2024-11-21 N/A
Intersystems Cache 2017.2.2.865.0 has Incorrect Access Control.
CVE-2018-17150 1 Intersystems 1 Cache 2024-11-21 N/A
Intersystems Cache 2017.2.2.865.0 allows XSS.
CVE-2018-17148 1 Nagios 1 Nagios Xi 2024-11-21 N/A
An Insufficient Access Control vulnerability (leading to credential disclosure) in coreconfigsnapshot.php (aka configuration snapshot page) in Nagios XI before 5.5.4 allows remote attackers to gain access to configuration files containing confidential credentials.
CVE-2018-17147 1 Nagios 1 Nagios Xi 2024-11-21 N/A
Nagios XI before 5.5.4 has XSS in the auto login admin management page.
CVE-2018-17146 1 Nagios 1 Nagios Xi 2024-11-21 N/A
A cross-site scripting vulnerability exists in Nagios XI before 5.5.4 via the 'name' parameter within the Account Information page. Exploitation of this vulnerability allows an attacker to execute arbitrary JavaScript code within the auto login admin management page.
CVE-2018-17145 7 Bcoin, Bitcoin, Bitcoinknots and 4 more 7 Bcoin, Bitcoin Core, Bitcoin Knots and 4 more 2024-11-21 7.5 High
Bitcoin Core 0.16.x before 0.16.2 and Bitcoin Knots 0.16.x before 0.16.2 allow remote denial of service via a flood of multiple transaction inv messages with random hashes, aka INVDoS. NOTE: this can also affect other cryptocurrencies, e.g., if they were forked from Bitcoin Core after 2017-11-15.
CVE-2018-17144 2 Bitcoin, Bitcoinknots 2 Bitcoin Core, Bitcoin Knots 2024-11-21 7.5 High
Bitcoin Core 0.14.x before 0.14.3, 0.15.x before 0.15.2, and 0.16.x before 0.16.3 and Bitcoin Knots 0.14.x through 0.16.x before 0.16.3 allow a remote denial of service (application crash) exploitable by miners via duplicate input. An attacker can make bitcoind or Bitcoin-Qt crash.
CVE-2018-17143 2 Fedoraproject, Golang 2 Fedora, Net 2024-11-21 7.5 High
The html package (aka x/net/html) through 2018-09-17 in Go mishandles <template><tBody><isindex/action=0>, leading to a "panic: runtime error" in inBodyIM in parse.go during an html.Parse call.
CVE-2018-17142 2 Fedoraproject, Golang 2 Fedora, Net 2024-11-21 7.5 High
The html package (aka x/net/html) through 2018-09-17 in Go mishandles <math><template><mo><template>, leading to a "panic: runtime error" in parseCurrentToken in parse.go during an html.Parse call.
CVE-2018-17141 2 Debian, Hylafax 3 Debian Linux, Hylafax, Hylafax\+ 2024-11-21 N/A
HylaFAX 6.0.6 and HylaFAX+ 5.6.0 allow remote attackers to execute arbitrary code via a dial-in session that provides a FAX page with the JPEG bit enabled, which is mishandled in FaxModem::writeECMData() in the faxd/CopyQuality.c++ file.
CVE-2018-17140 1 Vms-studio 1 Quizlord 2024-11-21 N/A
The Quizlord plugin through 2.0 for WordPress is prone to Stored XSS via the title parameter in a ql_insert action to wp-admin/admin.php.
CVE-2018-17139 1 Ultimatefosters 1 Ultimatepos 2024-11-21 N/A
UltimatePOS 2.5 allows users to upload arbitrary files, which leads to remote command execution by posting to a /products URI with PHP code in a .php file with the image/jpeg content type.
CVE-2018-17138 1 Nickelpro 1 Jibu Pro 2024-11-21 N/A
The Jibu Pro plugin through 1.7 for WordPress is prone to Stored XSS via the wp-content/plugins/jibu-pro/quiz_action.php name (aka Quiz Name) field.