Total
404199 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2018-17254 | 1 Arkextensions | 1 Jck Editor | 2026-06-17 | 7.5 HIGH | 9.8 CRITICAL |
| The JCK Editor component 6.4.4 for Joomla! allows SQL Injection via the jtreelink/dialogs/links.php parent parameter. | |||||
| CVE-2018-17247 | 1 Elastic | 1 Elasticsearch | 2026-06-17 | 4.3 MEDIUM | 5.9 MEDIUM |
| Elasticsearch Security versions 6.5.0 and 6.5.1 contain an XXE flaw in Machine Learning's find_file_structure API. If a policy allowing external network access has been added to Elasticsearch's Java Security Manager then an attacker could send a specially crafted request capable of leaking content of local files on the Elasticsearch node. This could allow a user to access information that they should not have access to. | |||||
| CVE-2018-17246 | 2 Elastic, Redhat | 2 Kibana, Openshift Container Platform | 2026-06-17 | 7.5 HIGH | 9.8 CRITICAL |
| Kibana versions before 6.4.3 and 5.6.13 contain an arbitrary file inclusion flaw in the Console plugin. An attacker with access to the Kibana Console API could send a request that will attempt to execute javascript code. This could possibly lead to an attacker executing arbitrary commands with permissions of the Kibana process on the host system. | |||||
| CVE-2018-17245 | 1 Elastic | 1 Kibana | 2026-06-17 | 5.0 MEDIUM | 9.8 CRITICAL |
| Kibana versions 4.0 to 4.6, 5.0 to 5.6.12, and 6.0 to 6.4.2 contain an error in the way authorization credentials are used when generating PDF reports. If a report requests external resources plaintext credentials are included in the HTTP request that could be recovered by an external resource provider. | |||||
| CVE-2018-17244 | 1 Elastic | 1 Elasticsearch | 2026-06-17 | 4.0 MEDIUM | 6.5 MEDIUM |
| Elasticsearch Security versions 6.4.0 to 6.4.2 contain an error in the way request headers are applied to requests when using the Active Directory, LDAP, Native, or File realms. A request may receive headers intended for another request if the same username is being authenticated concurrently; when used with run as, this can result in the request running as the incorrect user. This could allow a user to access information that they should not have access to. | |||||
| CVE-2018-17243 | 1 Zohocorp | 1 Manageengine Opmanager | 2026-06-17 | 7.5 HIGH | 9.8 CRITICAL |
| Global Search in Zoho ManageEngine OpManager before 12.3 123205 allows SQL Injection. | |||||
| CVE-2018-17240 | 1 Netwavepr | 4 Indoor Ip Camera, Indoor Ip Camera Firmware, Outdoor Ip Camera and 1 more | 2026-06-17 | 5.0 MEDIUM | 7.5 HIGH |
| There is a memory dump vulnerability on Netwave IP camera devices at //proc/kcore that allows an unauthenticated attacker to exfiltrate sensitive information from the network configuration (e.g., username and password). | |||||
| CVE-2018-17237 | 1 Hdfgroup | 1 Hdf5 | 2026-06-17 | 4.3 MEDIUM | 6.5 MEDIUM |
| A SIGFPE signal is raised in the function H5D__chunk_set_info_real() of H5Dchunk.c in the HDF HDF5 1.10.3 library during an attempted parse of a crafted HDF file, because of incorrect protection against division by zero. This issue is different from CVE-2018-11207. | |||||
| CVE-2018-17236 | 1 Mp4v2 Project | 1 Mp4v2 | 2026-06-17 | 4.3 MEDIUM | 6.5 MEDIUM |
| The function MP4Free() in mp4property.cpp in libmp4v2 2.1.0 internally calls free() on a invalid pointer, raising a SIGABRT signal. | |||||
| CVE-2018-17235 | 1 Mp4v2 Project | 1 Mp4v2 | 2026-06-17 | 4.3 MEDIUM | 6.5 MEDIUM |
| The function mp4v2::impl::MP4Track::FinishSdtp() in mp4track.cpp in libmp4v2 2.1.0 mishandles compatibleBrand while processing a crafted mp4 file, which leads to a heap-based buffer over-read, causing denial of service. | |||||
| CVE-2018-17234 | 1 Hdfgroup | 1 Hdf5 | 2026-06-17 | 4.3 MEDIUM | 6.5 MEDIUM |
| Memory leak in the H5O__chunk_deserialize() function in H5Ocache.c in the HDF HDF5 through 1.10.3 library allows attackers to cause a denial of service (memory consumption) via a crafted HDF5 file. | |||||
| CVE-2018-17233 | 1 Hdfgroup | 1 Hdf5 | 2026-06-17 | 4.3 MEDIUM | 6.5 MEDIUM |
| A SIGFPE signal is raised in the function H5D__create_chunk_file_map_hyper() of H5Dchunk.c in the HDF HDF5 through 1.10.3 library during an attempted parse of a crafted HDF file, because of incorrect protection against division by zero. It could allow a remote denial of service attack. | |||||
| CVE-2018-17232 | 1 Slack Archivebot Project | 1 Slack Archivebot | 2026-06-17 | 7.5 HIGH | 9.8 CRITICAL |
| SQL injection vulnerability in archivebot.py in docmarionum1 Slack ArchiveBot (aka slack-archive-bot) before 2018-09-19 allows remote attackers to execute arbitrary SQL commands via the text parameter to cursor.execute(). | |||||
| CVE-2018-17231 | 1 Telegram | 1 Telegram Desktop | 2026-06-17 | 5.0 MEDIUM | 7.5 HIGH |
| Telegram Desktop (aka tdesktop) 1.3.14 might allow attackers to cause a denial of service (assertion failure and application exit) via an "Edit color palette" search that triggers an "index out of range" condition. NOTE: this issue is disputed by multiple third parties because the described attack scenario does not cross a privilege boundary | |||||
| CVE-2018-17230 | 1 Exiv2 | 1 Exiv2 | 2026-06-17 | 4.3 MEDIUM | 6.5 MEDIUM |
| Exiv2::ul2Data in types.cpp in Exiv2 v0.26 allows remote attackers to cause a denial of service (heap-based buffer overflow) via a crafted image file. | |||||
| CVE-2018-17229 | 1 Exiv2 | 1 Exiv2 | 2026-06-17 | 4.3 MEDIUM | 6.5 MEDIUM |
| Exiv2::d2Data in types.cpp in Exiv2 v0.26 allows remote attackers to cause a denial of service (heap-based buffer overflow) via a crafted image file. | |||||
| CVE-2018-17228 | 1 Nmap4j Project | 1 Nmap4j | 2026-06-17 | 7.5 HIGH | 9.8 CRITICAL |
| nmap4j 1.1.0 allows attackers to execute arbitrary commands via shell metacharacters in an includeHosts call. | |||||
| CVE-2018-17218 | 1 Ptc | 1 Thingworx Platform | 2026-06-17 | 3.5 LOW | 5.4 MEDIUM |
| An issue was discovered in PTC ThingWorx Platform 6.5 through 8.2. There is reflected XSS in the SQUEAL search function. | |||||
| CVE-2018-17217 | 1 Ptc | 1 Thingworx Platform | 2026-06-17 | 5.0 MEDIUM | 7.5 HIGH |
| An issue was discovered in PTC ThingWorx Platform 6.5 through 8.2. There is a hardcoded encryption key. | |||||
| CVE-2018-17216 | 1 Ptc | 1 Thingworx Platform | 2026-06-17 | 4.0 MEDIUM | 6.5 MEDIUM |
| An issue was discovered in PTC ThingWorx Platform 6.5 through 8.2. There is password hash exposure to privileged users. | |||||