CVEdetails.com the ultimate security vulnerability data source
(e.g.: CVE-2009-1234 or 2010-1234 or 20101234)
Log In   Register
  Take a third party risk management course for FREE
Vulnerability Feeds & WidgetsNew   www.itsecdb.com  

Security Vulnerabilities Published In April 2018

CVSS Scores Greater Than: 0   1   2   3   4   5   6   7   8   9  
Press ESC to close
# CVE ID CWE ID # of Exploits Vulnerability Type(s) Publish Date Update Date Score Gained Access Level Access Complexity Authentication Conf. Integ. Avail.
1201 CVE-2017-7071 119 DoS Exec Code Overflow Mem. Corr. 2018-04-03 2018-04-27
6.8
 None Remote Medium Not required Partial Partial Partial
An issue was discovered in certain Apple products. Safari before 10.1 is affected. The issue involves the "WebKit" component. It allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site.
1202 CVE-2017-7070 Bypass 2018-04-03 2019-10-03
4.6
 None Local Low Not required Partial Partial Partial
An issue was discovered in certain Apple products. macOS before 10.12.4 is affected. The issue involves the "Kernel" component. It allows physically proximate attackers to bypass the screen-locking protection mechanism that should have been in place upon closing the lid.
1203 CVE-2017-7066 119 DoS Overflow Mem. Corr. 2018-04-03 2019-03-08
3.3
 None Local Network Low Not required None None Partial
An issue was discovered in certain Apple products. iOS before 10.3.3 is affected. tvOS before 10.2.2 is affected. The issue involves the "Wi-Fi" component. It allows attackers to cause a denial of service (memory corruption on the Wi-Fi chip) by leveraging proximity for 802.11.
1204 CVE-2017-7065 119 DoS Exec Code Overflow Mem. Corr. 2018-04-03 2019-03-08
5.8
 None Local Network Low Not required Partial Partial Partial
An issue was discovered in certain Apple products. iOS before 10.3.3 is affected. macOS before 10.12.6 is affected. tvOS before 10.2.2 is affected. The issue involves the "Wi-Fi" component. It allows remote attackers to execute arbitrary code (on the Wi-Fi chip) or cause a denial of service (memory corruption) by leveraging proximity for 802.11.
1205 CVE-2017-7005 119 DoS Exec Code Overflow Mem. Corr. 2018-04-03 2019-03-08
6.8
 None Remote Medium Not required Partial Partial Partial
An issue was discovered in certain Apple products. iOS before 10.3.2 is affected. Safari before 10.1.1 is affected. tvOS before 10.2.1 is affected. The issue involves the "JavaScriptCore" component. It allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site.
1206 CVE-2017-7004 362 Bypass 2018-04-03 2018-05-04
5.1
 None Remote High Not required Partial Partial Partial
An issue was discovered in certain Apple products. iOS before 10.3.2 is affected. macOS before 10.12.5 is affected. The issue involves the "Security" component. A race condition allows attackers to bypass intended entitlement restrictions for sending XPC messages via a crafted app.
1207 CVE-2017-7003 20 DoS 2018-04-03 2019-03-08
4.3
 None Remote Medium Not required None None Partial
An issue was discovered in certain Apple products. iOS before 10.3.2 is affected. macOS before 10.12.5 is affected. tvOS before 10.2.1 is affected. watchOS before 3.2.2 is affected. The issue involves the "CoreText" component. It allows remote attackers to cause a denial of service (application crash) via a crafted file.
1208 CVE-2017-7002 119 DoS Exec Code Overflow Mem. Corr. 2018-04-03 2018-04-27
6.8
 None Remote Medium Not required Partial Partial Partial
An issue was discovered in certain Apple products. iOS before 10.3.2 is affected. macOS before 10.12.5 is affected. The issue involves the "SQLite" component. It allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site.
1209 CVE-2017-7001 119 DoS Exec Code Overflow Mem. Corr. 2018-04-03 2018-04-27
6.8
 None Remote Medium Not required Partial Partial Partial
An issue was discovered in certain Apple products. iOS before 10.3.2 is affected. macOS before 10.12.5 is affected. The issue involves the "SQLite" component. It allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site.
1210 CVE-2017-7000 119 DoS Exec Code Overflow Mem. Corr. 2018-04-03 2018-04-27
6.8
 None Remote Medium Not required Partial Partial Partial
An issue was discovered in certain Apple products. iOS before 10.3.2 is affected. macOS before 10.12.5 is affected. The issue involves the "SQLite" component. It allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site.
1211 CVE-2017-6976 Bypass 2018-04-03 2019-10-03
4.3
 None Remote Medium Not required Partial None None
An issue was discovered in certain Apple products. iOS before 10.3 is affected. The issue involves the "Sandbox Profiles" component. It allows attackers to bypass intended access restrictions (for iCloud user records) via a crafted app.
1212 CVE-2017-6910 200 Bypass +Info 2018-04-12 2021-04-19
5.0
 None Remote Low Not required Partial None None
The HTTP and WebSocket engine components in the server in Kaazing Gateway before 4.5.3 hotfix-1, Gateway - JMS Edition before 4.0.5 hotfix-15, 4.0.6 before hotfix-4, 4.0.7, 4.0.9 before hotfix-19, 4.4.x before 4.4.2 hotfix-1, 4.5.x before 4.5.3 hotfix-1, and Gateway Community and Enterprise Editions before 5.6.0 allow remote attackers to bypass intended access restrictions and obtain sensitive information via vectors related to HTTP request handling.
1213 CVE-2017-6888 772 2018-04-25 2021-02-25
4.3
 None Remote Medium Not required None None Partial
An error in the "read_metadata_vorbiscomment_()" function (src/libFLAC/stream_decoder.c) in FLAC version 1.3.2 can be exploited to cause a memory leak via a specially crafted FLAC file.
1214 CVE-2017-6426 200 +Info 2018-04-04 2018-05-04
4.3
 None Remote Medium Not required Partial None None
An information disclosure vulnerability in the Qualcomm SPMI driver. Product: Android. Versions: Android kernel. Android ID: A-33644474. References: QC-CR#1106842.
1215 CVE-2017-6425 200 +Info 2018-04-04 2018-05-04
4.3
 None Remote Medium Not required Partial None None
An information disclosure vulnerability in the Qualcomm video driver. Product: Android. Versions: Android kernel. Android ID: A-32577085. References: QC-CR#1103689.
1216 CVE-2017-6424 2018-04-04 2019-10-03
6.9
 None Local Medium Not required Complete Complete Complete
An elevation of privilege vulnerability in the Qualcomm WiFi driver. Product: Android. Versions: Android kernel. Android ID: A-32086742. References: QC-CR#1102648.
1217 CVE-2017-6423 2018-04-04 2019-10-03
6.9
 None Local Medium Not required Complete Complete Complete
An elevation of privilege vulnerability in the Qualcomm kyro L2 driver. Product: Android. Versions: Android kernel. Android ID: A-32831370. References: QC-CR#1103158.
1218 CVE-2017-6323 611 DoS 2018-04-16 2018-05-23
5.2
 None Local Network Low ??? Partial Partial Partial
The Symantec Management Console prior to ITMS 8.1 RU1, ITMS 8.0_POST_HF6, and ITMS 7.6_POST_HF7 has an issue whereby XML input containing a reference to an external entity is processed by a weakly configured XML parser. This attack may lead to the disclosure of confidential data, denial of service, server side request forgery, port scanning from the perspective of the machine where the parser is located, and other system impacts.
1219 CVE-2017-6158 2018-04-13 2019-10-03
6.4
 None Remote Low Not required None Partial Partial
In F5 BIG-IP 12.0.0-12.1.2, 11.6.0-11.6.1, 11.5.1-11.5.5, or 11.2.1 there is a vulnerability in TMM related to handling of invalid IP addresses.
1220 CVE-2017-6156 2018-04-13 2019-10-03
6.0
 None Remote Medium ??? Partial Partial Partial
When the F5 BIG-IP 12.1.0-12.1.1, 11.6.0-11.6.1, 11.5.1-11.5.5, or 11.2.1 system is configured with a wildcard IPSec tunnel endpoint, it may allow a remote attacker to disrupt or impersonate the tunnels that have completed phase 1 IPSec negotiations. The attacker must possess the necessary credentials to negotiate the phase 1 of the IPSec exchange to exploit this vulnerability; in many environment this limits the attack surface to other endpoints under the same administration.
1221 CVE-2017-6155 2018-04-13 2019-10-03
5.0
 None Remote Low Not required None None Partial
On F5 BIG-IP 13.0.0, 12.0.0-12.1.3.1, 11.6.0-11.6.2, 11.4.1-11.5.5, or 11.2.1, malformed SPDY or HTTP/2 requests may result in a disruption of service to TMM. Data plane is only exposed when a SPDY or HTTP/2 profile is attached to a virtual server. There is no control plane exposure.
1222 CVE-2017-6148 20 2018-04-13 2018-05-21
5.0
 None Remote Low Not required None None Partial
Responses to SOCKS proxy requests made through F5 BIG-IP version 13.0.0, 12.0.0-12.1.3.1, 11.6.1-11.6.2, or 11.5.1-11.5.5 may cause a disruption of services provided by TMM. The data plane is impacted and exposed only when a SOCKS proxy profile is attached to a Virtual Server. The control plane is not impacted by this vulnerability.
1223 CVE-2017-6143 295 2018-04-13 2018-05-21
5.8
 None Remote Medium Not required Partial Partial None
X509 certificate verification was not correctly implemented in the IP Intelligence Subscription and IP Intelligence feed-list features, and thus the remote server's identity is not properly validated in F5 BIG-IP 12.0.0-12.1.2, 11.6.0-11.6.2, or 11.5.0-11.5.5.
1224 CVE-2017-6020 22 Dir. Trav. 2018-04-17 2019-10-09
4.0
 None Remote Low ??? Partial None None
Leao Consultoria e Desenvolvimento de Sistemas (LCDS) LTDA ME LAquis SCADA software versions prior to version 4.1.0.3237 do not neutralize external input to ensure that users are not calling for absolute path sequences outside of their privilege level.
1225 CVE-2017-5703 269 DoS 2018-04-03 2019-10-03
3.6
 None Local Low Not required None Partial Partial
Configuration of SPI Flash in platforms based on multiple Intel platforms allow a local attacker to alter the behavior of the SPI flash potentially leading to a Denial of Service.
1226 CVE-2017-4028 74 2018-04-03 2019-10-09
2.1
 None Local Low Not required None Partial None
Maliciously misconfigured registry vulnerability in all Microsoft Windows products in McAfee consumer and corporate products allows an administrator to inject arbitrary code into a debugged McAfee process via manipulation of registry parameters.
1227 CVE-2017-3972 200 Exec Code +Info 2018-04-03 2019-10-09
7.5
 None Remote Low Not required Partial Partial Partial
Infrastructure-based foot printing vulnerability in the web interface in McAfee Network Security Management (NSM) before 8.2.7.42.2 allows attackers to execute arbitrary code via the server banner leaking potentially sensitive or security relevant information.
1228 CVE-2017-3971 326 2018-04-04 2019-10-09
4.0
 None Remote Low ??? Partial None None
Cryptanalysis vulnerability in the web interface in McAfee Network Security Management (NSM) before 8.2.7.42.2 allows attackers to view confidential information via insecure use of RC4 encryption cyphers.
1229 CVE-2017-3969 417 2018-04-04 2019-10-09
4.3
 None Remote Medium Not required Partial None None
Abuse of communication channels vulnerability in the server in McAfee Network Security Management (NSM) before 8.2.7.42.2 allows man-in-the-middle attackers to decrypt messages via an inadequate implementation of SSL.
1230 CVE-2017-3967 94 2018-04-04 2019-10-09
4.3
 None Remote Medium Not required None Partial None
Target influence via framing vulnerability in the web interface in McAfee Network Security Management (NSM) before 8.2.7.42.2 allows remote attackers to inject arbitrary web script or HTML via application pages inability to break out of 3rd party HTML frames.
1231 CVE-2017-3966 613 2018-04-04 2019-10-09
6.5
 None Remote Low ??? Partial Partial Partial
Exploitation of session variables, resource IDs and other trusted credentials vulnerability in the web interface in McAfee Network Security Management (NSM) before 8.2.7.42.2 allows remote attackers to exploit or harm a user's browser via reusing the exposed session token in the application URL.
1232 CVE-2017-3965 352 CSRF 2018-04-04 2019-10-09
6.8
 None Remote Medium Not required Partial Partial Partial
Cross-Site Request Forgery (CSRF) (aka Session Riding) vulnerability in the web interface in McAfee Network Security Management (NSM) before 8.2.7.42.2 allows remote attackers to perform unauthorized tasks such as retrieving internal system information or manipulating the database via specially crafted URLs.
1233 CVE-2017-3964 79 XSS 2018-04-04 2019-10-09
3.5
 None Remote Medium ??? None Partial None
Reflective Cross-Site Scripting (XSS) vulnerability in the web interface in McAfee Network Security Management (NSM) before 8.2.7.42.2 allows attackers to inject arbitrary web script or HTML via a URL parameter.
1234 CVE-2017-3776 200 +Info 2018-04-19 2018-05-22
5.0
 None Remote Low Not required Partial None None
Lenovo Help Android mobile app versions earlier than 6.1.2.0327 allowed information to be transmitted over an HTTP channel, permitting others observing the channel to potentially see this information.
1235 CVE-2017-3774 119 Overflow 2018-04-19 2018-05-24
7.5
 None Remote Low Not required Partial Partial Partial
A stack overflow vulnerability was discovered within the web administration service in Integrated Management Module 2 (IMM2) earlier than version 4.70 used in some Lenovo servers and earlier than version 6.60 used in some IBM servers. An attacker providing a crafted user ID and password combination can cause a portion of the authentication routine to overflow its stack, resulting in stack corruption.
1236 CVE-2017-2924 119 Exec Code Overflow Mem. Corr. 2018-04-24 2022-04-19
6.8
 None Remote Medium Not required Partial Partial Partial
An exploitable heap-based buffer overflow vulnerability exists in the read_legacy_biff function of FreeXL 1.0.3. A specially crafted XLS file can cause a memory corruption resulting in remote code execution. An attacker can send malicious XLS file to trigger this vulnerability.
1237 CVE-2017-2923 119 Exec Code Overflow Mem. Corr. 2018-04-24 2022-04-19
6.8
 None Remote Medium Not required Partial Partial Partial
An exploitable heap based buffer overflow vulnerability exists in the 'read_biff_next_record function' of FreeXL 1.0.3. A specially crafted XLS file can cause a memory corruption resulting in remote code execution. An attacker can send malicious XLS file to trigger this vulnerability.
1238 CVE-2017-2918 190 Exec Code Overflow 2018-04-24 2022-04-19
6.8
 None Remote Medium Not required Partial Partial Partial
An exploitable integer overflow exists in the Image loading functionality of the Blender open-source 3d creation suite v2.78c. A specially crafted .blend file can cause an integer overflow resulting in a buffer overflow which can allow for code execution under the context of the application. An attacker can convince a user to open the file or use it as a library in order to trigger this vulnerability.
1239 CVE-2017-2908 190 Exec Code Overflow 2018-04-24 2022-04-19
6.8
 None Remote Medium Not required Partial Partial Partial
An exploitable integer overflow exists in the thumbnail functionality of the Blender open-source 3d creation suite version 2.78c. A specially crafted .blend file can cause an integer overflow resulting in a buffer overflow which can allow for code execution under the context of the application. An attacker can convince a user to render the thumbnail for the file while in the File->Open dialog.
1240 CVE-2017-2907 190 Exec Code Overflow 2018-04-24 2022-04-19
6.8
 None Remote Medium Not required Partial Partial Partial
An exploitable integer overflow exists in the animation playing functionality of the Blender open-source 3d creation suite version 2.78c. A specially created '.avi' file can cause an integer overflow resulting in a buffer overflow which can allow for code execution under the context of the application. An attacker can convince a user to use the file as an asset in order to trigger this vulnerability.
1241 CVE-2017-2906 190 Exec Code Overflow 2018-04-24 2022-04-19
6.8
 None Remote Medium Not required Partial Partial Partial
An exploitable integer overflow exists in the animation playing functionality of the Blender open-source 3d creation suite version 2.78c. A specially created '.avi' file can cause an integer overflow resulting in a buffer overflow which can allow for code execution under the context of the application. An attacker can convince a user to use the file as an asset in order to trigger this vulnerability.
1242 CVE-2017-2905 190 Exec Code Overflow 2018-04-24 2022-04-19
6.8
 None Remote Medium Not required Partial Partial Partial
An exploitable integer overflow exists in the bmp loading functionality of the Blender open-source 3d creation suite version 2.78c. A specially crafted '.bmp' file can cause an integer overflow resulting in a buffer overflow which can allow for code execution under the context of the application. An attacker can convince a user to use the file as an asset via the sequencer in order to trigger this vulnerability.
1243 CVE-2017-2904 190 Exec Code Overflow 2018-04-24 2022-04-19
6.8
 None Remote Medium Not required Partial Partial Partial
An exploitable integer overflow exists in the RADIANCE loading functionality of the Blender open-source 3d creation suite version 2.78c. A specially crafted '.hdr' file can cause an integer overflow resulting in a buffer overflow which can allow for code execution under the context of the application. An attacker can convince a user to use the file as an asset via the sequencer in order to trigger this vulnerability.
1244 CVE-2017-2903 190 Exec Code Overflow 2018-04-24 2022-04-19
6.8
 None Remote Medium Not required Partial Partial Partial
An exploitable integer overflow exists in the DPX loading functionality of the Blender open-source 3d creation suite version 2.78c. A specially crafted '.cin' file can cause an integer overflow resulting in a buffer overflow which can allow for code execution under the context of the application. An attacker can convince a user to use the file as an asset via the sequencer in order to trigger this vulnerability.
1245 CVE-2017-2902 190 Exec Code Overflow 2018-04-24 2022-04-19
6.8
 None Remote Medium Not required Partial Partial Partial
An exploitable integer overflow exists in the DPX loading functionality of the Blender open-source 3d creation suite version 2.78c. A specially crafted '.cin' file can cause an integer overflow resulting in a buffer overflow which can allow for code execution under the context of the application. An attacker can convince a user to use the file as an asset via the sequencer in order to trigger this vulnerability.
1246 CVE-2017-2901 190 Exec Code Overflow 2018-04-24 2022-04-19
6.8
 None Remote Medium Not required Partial Partial Partial
An exploitable integer overflow exists in the IRIS loading functionality of the Blender open-source 3d creation suite version 2.78c. A specially crafted '.iris' file can cause an integer overflow resulting in a buffer overflow which can allow for code execution under the context of the application. An attacker can convince a user to use the file as an asset via the sequencer in order to trigger this vulnerability.
1247 CVE-2017-2900 190 Exec Code Overflow 2018-04-24 2022-04-19
6.8
 None Remote Medium Not required Partial Partial Partial
An exploitable integer overflow exists in the PNG loading functionality of the Blender open-source 3d creation suite version 2.78c. A specially crafted '.png' file can cause an integer overflow resulting in a buffer overflow which can allow for code execution under the context of the application. An attacker can convince a user to use the file as an asset via the sequencer in order to trigger this vulnerability.
1248 CVE-2017-2899 190 Exec Code Overflow 2018-04-24 2022-04-19
6.8
 None Remote Medium Not required Partial Partial Partial
An exploitable integer overflow exists in the TIFF loading functionality of the Blender open-source 3d creation suite version 2.78c. A specially crafted '.tif' file can cause an integer overflow resulting in a buffer overflow which can allow for code execution under the context of the application. An attacker can convince a user to use the file as an asset via the sequencer in order to trigger this vulnerability.
1249 CVE-2017-2885 119 Exec Code Overflow 2018-04-24 2022-04-19
7.5
 None Remote Low Not required Partial Partial Partial
An exploitable stack based buffer overflow vulnerability exists in the GNOME libsoup 2.58. A specially crafted HTTP request can cause a stack overflow resulting in remote code execution. An attacker can send a special HTTP request to the vulnerable server to trigger this vulnerability.
1250 CVE-2017-2871 287 2018-04-17 2022-04-19
5.8
 None Local Network Low Not required Partial Partial Partial
Insufficient security checks exist in the recovery procedure used by the Foscam C1 Indoor HD Camera running application firmware 2.52.2.43. An attacker who is in the same subnetwork of the camera or has remote administrator access can fully compromise the device by performing a firmware recovery using a custom image.
Total number of vulnerabilities : 1672   Page : 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 (This Page)26 27 28 29 30 31 32 33 34
CVE is a registred trademark of the MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. CWE is a registred trademark of the MITRE Corporation and the authoritative source of CWE content is MITRE's CWE web site. OVAL is a registered trademark of The MITRE Corporation and the authoritative source of OVAL content is MITRE's OVAL web site.
Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.