CVEs from 2018

3,719 normalized CVEs published or assigned in this year.

Total
3,719
critical
critical 225
high
high 266
medium
medium 224
low
low 32
% Critical
6.1%
% with KEV
2.4%
% with exploit
2.4%

Top products

  • erpnext 4
  • terminal_services_manager 1
  • ultraiso 1
  • dolibarr_erp\/crm 1
  • gitbucket 1
  • pdfunite 1
  • qemu 1
  • virtualization_manager 1
0
KEVHas exploit
Reset
CVE Severity CVSS Risk Published Description Impact
CVE-2018-6115 critical 9.5 multiple issues in chromium arch
CVE-2018-6118 critical 9.5 arbitrary code execution in chromium arch
CVE-2018-17464 critical 9.5 multiple issues in chromium arch
CVE-2018-0202 critical 9.5 clamscan in ClamAV before 0.99.4 contains a vulnerability that could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device. The vulnerability is… archsusedebian
CVE-2018-5129 critical 9.5 A lack of parameter validation on IPC messages results in a potential out-of-bounds write through malformed IPC messages. This can potentially allow for sandbox escape through memory corruption in th… archsusedebian
CVE-2018-5185 critical 9.5 Plaintext of decrypted emails can leak through by user submitting an embedded form. This vulnerability affects Thunderbird ESR < 52.8 and Thunderbird < 52.8. archdebian
CVE-2018-5187 critical 9.5 Memory safety bugs present in Firefox 60 and Firefox ESR 60. Some of these bugs showed evidence of memory corruption and we presume that with enough effort that some of these could be exploited to ru… archsusedebian
CVE-2018-5183 critical 9.5 Mozilla developers backported selected changes in the Skia library. These changes correct memory corruption issues including invalid buffer reads and writes during graphic operations. This vulnerabil… archdebian
CVE-2018-18492 critical 9.5 A use-after-free vulnerability can occur after deleting a selection element due to a weak reference to the select element in the options collection. This results in a potentially exploitable crash. T… archsusedebian
CVE-2018-5162 critical 9.5 Plaintext of decrypted emails can leak through the src attribute of remote images, or links. This vulnerability affects Thunderbird ESR < 52.8 and Thunderbird < 52.8. archdebian
CVE-2018-18342 critical 9.5 multiple issues in chromium archdebian
CVE-2018-5170 critical 9.5 It is possible to spoof the filename of an attachment and display an arbitrary attachment name. This could lead to a user opening a remote attachment which is a different file type than expected. Thi… archdebian
CVE-2018-18509 critical 9.5 A flaw during verification of certain S/MIME signatures causes emails to be shown in Thunderbird as having a valid digital signature, even if the shown message contents aren't covered by the signatur… archdebian
CVE-2018-17481 critical 9.5 multiple issues in chromium archdebian
CVE-2018-5182 critical 9.5 If a text string that happens to be a filename in the operating system's native format is dragged and dropped onto the addressbar the specified local file will be opened. This is contrary to policy a… archdebian
CVE-2018-5180 critical 9.5 A use-after-free vulnerability can occur during WebGL operations. While this results in a potentially exploitable crash, the vulnerability is limited because the memory is freed and reused in a brief… archdebian
CVE-2018-5161 critical 9.5 Crafted message headers can cause a Thunderbird process to hang on receiving the message. This vulnerability affects Thunderbird ESR < 52.8 and Thunderbird < 52.8. archdebian
CVE-2018-18339 critical 9.5 multiple issues in chromium archdebian
CVE-2018-1057 critical 9.5 On a Samba 4 AD DC the LDAP server in all versions of Samba from 4.0.0 onwards incorrectly validates permissions to modify passwords over LDAP allowing authenticated users to change any other users' … archdebian
CVE-2018-18358 critical 9.5 multiple issues in chromium archdebian
CVE-2018-5179 critical 9.5 multiple issues in chromium arch
CVE-2018-11354 critical 9.5 In Wireshark 2.6.0, the IEEE 1905.1a dissector could crash. This was addressed in epan/dissectors/packet-ieee1905.c by making a certain correction to string handling. archsusedebian
CVE-2018-12389 critical 9.5 Mozilla developers and community members reported memory safety bugs present in Firefox ESR 60.2. Some of these bugs showed evidence of memory corruption and we presume that with enough effort that s… archdebian
CVE-2018-17466 critical 9.5 multiple issues in chromium archsusedebian
CVE-2018-17469 critical 9.5 multiple issues in chromium arch
CVE-2018-18649 critical 9.5 multiple issues in gitlab arch
CVE-2018-12403 critical 9.5 If a site is loaded over a HTTPS connection but loads a favicon resource over HTTP, the mixed content warning is not displayed to users. This vulnerability affects Firefox < 63. archsusedebian
CVE-2018-6111 critical 9.5 multiple issues in chromium arch
CVE-2018-18345 critical 9.5 multiple issues in chromium archdebian
CVE-2018-17476 critical 9.5 multiple issues in chromium arch
CVE-2018-17471 critical 9.5 multiple issues in chromium arch
CVE-2018-18336 critical 9.5 multiple issues in chromium archdebian
CVE-2018-11361 critical 9.5 In Wireshark 2.6.0, the IEEE 802.11 protocol dissector could crash. This was addressed in epan/crypt/dot11decrypt.c by avoiding a buffer overflow during FTE processing in Dot11DecryptTDLSDeriveKey. archsusedebian
CVE-2018-6113 critical 9.5 multiple issues in chromium arch
CVE-2018-12407 critical 9.5 A buffer overflow occurs when drawing and validating elements with the ANGLE graphics library, used for WebGL content, when working with the VertexBuffer11 module. This results in a potentially explo… archsusedebian
CVE-2018-18349 critical 9.5 multiple issues in chromium archdebian
CVE-2018-6117 critical 9.5 multiple issues in chromium arch
CVE-2018-18346 critical 9.5 multiple issues in chromium archdebian
CVE-2018-18335 critical 9.5 multiple issues in chromium archdebiansuse
CVE-2018-6090 critical 9.5 multiple issues in chromium arch
CVE-2018-17468 critical 9.5 multiple issues in chromium arch
CVE-2018-17465 critical 9.5 multiple issues in chromium arch
CVE-2018-17474 critical 9.5 multiple issues in chromium arch
CVE-2018-5160 critical 9.5 WebRTC can use a "WrappedI420Buffer" pixel buffer but the owning image object can be freed while it is still in use. This can result in the WebRTC encoder using uninitialized memory, leading to a pot… archdebian
CVE-2018-11233 critical 9.5 In Git before 2.13.7, 2.14.x before 2.14.4, 2.15.x before 2.15.2, 2.16.x before 2.16.4, and 2.17.x before 2.17.1, code to sanity-check pathnames on NTFS can result in reading out-of-bounds memory. archdebian
CVE-2018-17462 critical 9.5 multiple issues in chromium arch
CVE-2018-18350 critical 9.5 multiple issues in chromium archdebian
CVE-2018-18359 critical 9.5 multiple issues in chromium archdebian
CVE-2018-18356 critical 9.5 multiple issues in chromium archdebiansuse
CVE-2018-18352 critical 9.5 multiple issues in chromium archdebian
CVE-2018-5155 critical 9.5 A use-after-free vulnerability can occur while adjusting layout during SVG animations with text paths. This results in a potentially exploitable crash. This vulnerability affects Thunderbird < 52.8, … archsusedebian
CVE-2018-12396 critical 9.5 A vulnerability where a WebExtension can run content scripts in disallowed contexts following navigation or other events. This allows for potential privilege escalation by the WebExtension on sites w… archsusedebian
CVE-2018-17475 critical 9.5 multiple issues in chromium arch
CVE-2018-18357 critical 9.5 multiple issues in chromium archdebian
CVE-2018-18348 critical 9.5 multiple issues in chromium archdebian
CVE-2018-18343 critical 9.5 multiple issues in chromium archdebian
CVE-2018-18355 critical 9.5 multiple issues in chromium archdebian
CVE-2018-18354 critical 9.5 multiple issues in chromium archdebian
CVE-2018-18347 critical 9.5 multiple issues in chromium archdebian
CVE-2018-20346 critical 9.5 SQLite before 3.25.3, when the FTS3 extension is enabled, encounters an integer overflow (and resultant buffer overflow) for FTS3 queries that occur after crafted changes to FTS3 shadow tables, allow… archdebiansuse
CVE-2018-17467 critical 9.5 multiple issues in chromium arch
CVE-2018-6089 critical 9.5 multiple issues in chromium arch
CVE-2018-6092 critical 9.5 multiple issues in chromium arch
CVE-2018-18497 critical 9.5 Limitations on the URIs allowed to WebExtensions by the browser.windows.create API can be bypassed when a pipe in the URL field is used within the extension to load multiple pages as a single argumen… archsusedebian
CVE-2018-6099 critical 9.5 multiple issues in chromium arch
CVE-2018-6100 critical 9.5 multiple issues in chromium arch
CVE-2018-6098 critical 9.5 multiple issues in chromium arch
CVE-2018-6102 critical 9.5 multiple issues in chromium arch
CVE-2018-6104 critical 9.5 multiple issues in chromium arch
CVE-2018-6107 critical 9.5 multiple issues in chromium arch
CVE-2018-6108 critical 9.5 multiple issues in chromium arch
CVE-2018-6103 critical 9.5 multiple issues in chromium arch
CVE-2018-18640 critical 9.5 multiple issues in gitlab arch
CVE-2018-5154 critical 9.5 A use-after-free vulnerability can occur while enumerating attributes during SVG animations with clip paths. This results in a potentially exploitable crash. This vulnerability affects Thunderbird < … archdebian
CVE-2018-18338 critical 9.5 multiple issues in chromium archdebian
CVE-2018-18353 critical 9.5 multiple issues in chromium archdebian
CVE-2018-18351 critical 9.5 multiple issues in chromium archdebian
CVE-2018-19628 critical 9.5 In Wireshark 2.6.0 to 2.6.4, the ZigBee ZCL dissector could crash. This was addressed in epan/dissectors/packet-zbee-zcl-lighting.c by preventing a divide-by-zero error. archdebian
CVE-2018-18337 critical 9.5 multiple issues in chromium archdebian
CVE-2018-17473 critical 9.5 multiple issues in chromium arch
CVE-2018-6109 critical 9.5 multiple issues in chromium arch
CVE-2018-12374 critical 9.5 Plaintext of decrypted emails can leak through by user submitting an embedded form by pressing enter key within a text input field. This vulnerability affects Thunderbird < 52.9. archsusedebian
CVE-2018-11357 critical 9.5 In Wireshark 2.6.0, 2.4.0 to 2.4.6, and 2.2.0 to 2.2.14, the LTP dissector and other dissectors could consume excessive memory. This was addressed in epan/tvbuff.c by rejecting negative lengths. archsusedebian
CVE-2018-5186 critical 9.5 Memory safety bugs present in Firefox 60. Some of these bugs showed evidence of memory corruption and we presume that with enough effort that some of these could be exploited to run arbitrary code. T… archsusedebian
CVE-2018-19876 critical 9.5 cairo 1.16.0, in cairo_ft_apply_variations() in cairo-ft-font.c, would free memory using a free function incompatible with WebKit's fastMalloc, leading to an application crash with a "free(): invalid… archdebian
CVE-2018-15688 critical 9.5 A buffer overflow vulnerability in the dhcp6 client of systemd allows a malicious dhcp6 server to overwrite heap memory in systemd-networkd. Affected releases are systemd: versions up to and includin… archsusedebian
CVE-2018-11358 critical 9.5 In Wireshark 2.6.0, 2.4.0 to 2.4.6, and 2.2.0 to 2.2.14, the Q.931 dissector could crash. This was addressed in epan/dissectors/packet-q931.c by avoiding a use-after-free after a malformed packet pre… archsusedebian
CVE-2018-5176 critical 9.5 The JSON Viewer displays clickable hyperlinks for strings that are parseable as URLs, including "javascript:" links. If a JSON file contains malicious JavaScript script embedded as "javascript:" link… archdebian
CVE-2018-5175 critical 9.5 A mechanism to bypass Content Security Policy (CSP) protections on sites that have a "script-src" policy of "'strict-dynamic'". If a target website contains an HTML injection flaw an attacker could i… archdebian
CVE-2018-15686 critical 9.5 A vulnerability in unit_deserialize of systemd allows an attacker to supply arbitrary state across systemd re-execution via NotifyAccess. This can be used to improperly influence systemd execution an… archsusedebian
CVE-2018-12383 critical 9.5 If a user saved passwords before Firefox 58 and then later set a master password, an unencrypted copy of these passwords is still accessible. This is because the older stored password file was not de… archdebian
CVE-2018-5173 critical 9.5 The filename appearing in the "Downloads" panel improperly renders some Unicode characters, allowing for the file name to be spoofed. This can be used to obscure the file extension of potentially exe… archdebian
CVE-2018-5166 critical 9.5 WebExtensions can use request redirection and a "filterReponseData" filter to bypass host permission settings to redirect network traffic and access content from a host for which they do not have exp… archdebian
CVE-2018-5167 critical 9.5 The web console and JavaScript debugger do not sanitize all output that can be hyperlinked. Both will display "chrome:" links as active, clickable hyperlinks in their output. Web sites should not be … archdebian
CVE-2018-5157 critical 9.5 Same-origin protections for the PDF viewer can be bypassed, allowing a malicious site to intercept messages meant for the viewer. This could allow the site to retrieve PDF files restricted to viewing… archdebian
CVE-2018-5168 critical 9.5 Sites can bypass security checks on permissions to install lightweight themes by manipulating the "baseURI" property of the theme element. This could allow a malicious site to install a theme without… archdebian
CVE-2018-5159 critical 9.5 An integer overflow can occur in the Skia library due to 32-bit integer use in an array without integer overflow checks, resulting in possible out-of-bounds writes. This could lead to a potentially e… archdebian
CVE-2018-5164 critical 9.5 Content Security Policy (CSP) is not applied correctly to all parts of multipart content sent with the "multipart/x-mixed-replace" MIME type. This could allow for script to run where CSP should block… archdebian
CVE-2018-5163 critical 9.5 If a malicious attacker has used another vulnerability to gain full control over a content process, they may be able to replace the alternate data resources stored in the JavaScript Start-up Bytecode… archdebian
CVE-2018-5153 critical 9.5 If websocket data is sent with mixed text and binary in a single message, the binary data can be corrupted. This can result in an out-of-bounds read with the read memory sent to the originating serve… archdebian