Skip to content
OpenAdvisories

Archive

August 2018

Vulnerabilities first published in this month (UTC), newest first.

← July 2018 2018 / August September 2018 →
  1. 179
  2. 240
  3. 350
  4. 41
  5. 521
  6. 681
  7. 712
  8. 824
  9. 914
  10. 1028
  11. 11 
  12. 123
  13. 1336
  14. 1434
  15. 15109
  16. 1615
  17. 1729
  18. 188
  19. 19 
  20. 2067
  21. 2128
  22. 2225
  23. 2346
  24. 2434
  25. 2527
  26. 268
  27. 2727
  28. 2854
  29. 2946
  30. 3056
  31. 3113
All Critical High Medium Low Exploited only Public exploit

11 results · Clear filters · Feed

  • High 8.1
    CVE-2018-10936 Public exploit

    Moderate severity vulnerability that affects org.postgresql:pgjdbc-aggregate

    A weakness was found in postgresql-jdbc before version 42.2.5. It was possible to provide an SSL Factory and not check the host name if a host name verifier was not provided to the driver. This could lead to a condition where a man-in-the-middle attacker coul…

    [UNKNOWN] PostgreSQL libpgjava libpgjava Debian Ubuntu Maven
  • High 8.8
    CVE-2018-15845 Public exploit

    Gleez CMS CSRF Allows Adding of Administrator Accounts

    There is a CSRF vulnerability that can add an administrator account in Gleez CMS 1.2.0 via admin/users/add.

    gleez/cms Packagist
  • High 8.1
    CVE-2018-15685 Public exploit EPSS 10%

    Electron webPreferences vulnerability can be used to perform remote code execution

    GitHub Electron 1.7.15, 1.8.7, 2.0.7, and 3.0.0-beta.6, in certain scenarios involving IFRAME elements and "nativeWindowOpen: true" or "sandbox: true" options, is affected by a WebPreferences vulnerability that can be leveraged to perform remote code executio…

    electron npm
  • High 8.1
    CVE-2018-11776 Exploited Public exploit EPSS 100%

    Apache Struts vulnerable to remote command execution (RCE) due to improper input validation

    Apache Struts versions 2.3 to 2.3.34 and 2.5 to 2.5.16 suffer from possible Remote Code Execution when alwaysSelectFullNamespace is true (either by user or a plugin like Convention Plugin) and then: results are used with no namespace and in same time, its upp…

    Apache Software Foundation Apache Struts org.apache.struts:struts2-core Maven
    KEV Nov 3, 2021
  • High 8.8
    CVE-2018-14057 Public exploit

    Pimcore CSRF Vulnerability

    Pimcore before 5.3.0 allows remote attackers to conduct cross-site request forgery (CSRF) attacks by leveraging validation of the X-pimcore-csrf-token anti-CSRF token only in the "Settings > Users / Roles" function.

    pimcore/pimcore Packagist
  • High 7.5
    CVE-2018-8384 Public exploit EPSS 64%

    ChakraCore RCE Vulnerability

    A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka "Chakra Scripting Engine Memory Corruption Vulnerability." This affects ChakraCore. This CVE ID is unique from CVE-2018-8…

    Microsoft ChakraCore Microsoft.ChakraCore NuGet
  • High 7.5
    CVE-2018-8355 Public exploit EPSS 68%

    ChakraCore RCE Vulnerability

    A remote code execution vulnerability exists in the way the scripting engine handles objects in memory in Microsoft browsers, aka "Scripting Engine Memory Corruption Vulnerability." This affects ChakraCore, Internet Explorer 11, Microsoft Edge. This CVE ID is…

    Microsoft Microsoft Edge ChakraCore Internet Explorer 11 Browsers NuGet
  • High 8.8
    CVE-2018-8414 Exploited Public exploit EPSS 73%

    A remote code execution vulnerability exists when the Windows Shell does not properly validate file paths, aka "Windows…

    Microsoft Windows 10 Windows 10 Servers Windows
    KEV Mar 25, 2022
  • High 8.1
    CVE-2018-15133 Exploited Public exploit EPSS 77%

    Laravel Framework RCE Vulnerability

    In Laravel Framework through 5.5.40 and 5.6.x through 5.6.29, remote code execution might occur as a result of an unserialize call on a potentially untrusted X-XSRF-TOKEN value. This involves the decrypt method in Illuminate/Encryption/Encrypter.php and Pendi…

    laravel/framework Packagist
    KEV Jan 16, 2024
  • High 7.5
    CVE-2018-14716 Public exploit EPSS 33%

    SEOmatic plugin for Craft CMS SSTI Vulnerability

    A Server Side Template Injection (SSTI) was discovered in the SEOmatic plugin before 3.1.4 for Craft CMS, because requests that don't match any elements incorrectly generate the canonicalUrl, and can lead to execution of Twig code.

    nystudio107/craft-seomatic Packagist
  • High 7.5
    CVE-2018-10920 Public exploit

    Improper input validation bug in DNS resolver component of Knot Resolver before 2.4.1 allows remote attacker to poison …

    CZ.NIC knot-resolver knot-resolver knot-resolver Debian Ubuntu