CVEs published June 5, 2018
60 CVEs were published on June 5, 2018: 0 critical, 2 high. Browse them by severity, product and exploitation status.
- Published
- 60
- Critical
- 0
- High
- 2
- Medium
- 4
- Low
- 0
- Unrated
- 54
- Now in CISA KEV
- 0
- Fix available
- 25
Most affected products
- org.jenkins-ci.main:jenkins-core
- 4
- com.blackducksoftware.integration:blackduck-hub
- 3
- IBM InfoSphere Information Server
- 3
- ICS-CERT IntelliVue Patient Monitors, Avalon Fetal/Maternal…
- 3
- Apache Software Foundation Apache Storm · org.apache.storm:…
- 2
- com.coravy.hudson.plugins.github:github
- 2
- ManageEngine Applications Manager
- 2
- The Eclipse Foundation Eclipse Mosquitto
- 2
- com.synopsys.integration:synopsys-detect
- 1
- Huawei Technologies Co. 1288H V5; 2288H V5; 2488 V5 ; CH121…
- 1
High 2
- CVE-2017-1350IBM InfoSphere Information Server 9.1, 11.3, 11.5, and 11.7 could allow a user to escalate their privileges to administrator due to…IBM InfoSphere Information Server
- CVE-2018-6662SB10232 - McAfee Management of Native Encryption (MNE) - Privilege Escalation vulnerabilityMcAfee Management of Native Encryption
Medium, low and unrated 58
- CVE-2017-7635QNAP NAS application Proxy Server through version 1.2.0 does not utilize CSRF protections.
- CVE-2017-7636Cross-site scripting (XSS) vulnerability in QNAP NAS application Proxy Server through version 1.2.0 allows remote attackers to inject…
- CVE-2017-7637QNAP NAS application Proxy Server through version 1.2.0 allows remote attackers to run arbitrary OS commands against the system with root…
- CVE-2017-7639QNAP NAS application Proxy Server through version 1.2.0 does not authenticate requests properly.
- CVE-2018-1000192A information exposure vulnerability exists in Jenkins 2.120 and older, LTS 2.107.2 and older in AboutJenkins.java…org.jenkins-ci.main:jenkins-core
- CVE-2018-1000193A improper neutralization of control sequences vulnerability exists in Jenkins 2.120 and older, LTS 2.107.2 and older in…org.jenkins-ci.main:jenkins-core
- CVE-2018-1000194A path traversal vulnerability exists in Jenkins 2.120 and older, LTS 2.107.2 and older in FilePath.java, SoloFilePathFilter.java that…org.jenkins-ci.main:jenkins-core
- CVE-2018-1000195A server-side request forgery vulnerability exists in Jenkins 2.120 and older, LTS 2.107.2 and older in ZipExtractionInstaller.java that…org.jenkins-ci.main:jenkins-core
- CVE-2018-1000196A exposure of sensitive information vulnerability exists in Jenkins Gitlab Hook Plugin 1.4.2 and older in gitlab_notifier.rb…org.jenkins-ci.ruby-plugins:gitlab-hook
- CVE-2018-1000197An improper authorization vulnerability exists in Jenkins Black Duck Hub Plugin 3.0.3 and older in PostBuildScanDescriptor.java that…com.blackducksoftware.integration:blackduck-hub
- CVE-2018-1000198A XML external entity processing vulnerability exists in Jenkins Black Duck Hub Plugin 3.1.0 and older in PostBuildScanDescriptor.java…com.blackducksoftware.integration:blackduck-hub
- CVE-2018-1000202A persisted cross-site scripting vulnerability exists in Jenkins Groovy Postbuild Plugin 2.3.1 and older in various Jelly files that…org.jvnet.hudson.plugins:groovy-postbuild
- CVE-2018-10057The remote management interface of cgminer 4.10.0 and bfgminer 5.5.0 allows an authenticated remote attacker to write the miner…
- CVE-2018-10058The remote management interface of cgminer 4.10.0 and bfgminer 5.5.0 allows an authenticated remote attacker to execute arbitrary code due…
- CVE-2018-11586XML external entity (XXE) vulnerability in api/rest/status in SearchBlox 8.6.7 allows remote unauthenticated users to read arbitrary files…
- CVE-2018-3691Some implementations in Intel Integrated Performance Primitives Cryptography Library before version 2018 U3.1 do not properly ensure…Intel Integrated Performance Primitives Cryptography Library
- CVE-2018-7884An issue was discovered in DisplayLink Core Software Cleaner Application 8.2.1956.
- CVE-2017-7653The Eclipse Mosquitto broker up to version 1.4.15 does not reject strings that are not valid UTF-8.The Eclipse Foundation Eclipse Mosquitto
- CVE-2017-7654In Eclipse Mosquitto 1.4.15 and earlier, a Memory Leak vulnerability was found within the Mosquitto Broker.The Eclipse Foundation Eclipse Mosquitto
- CVE-2018-1000182A server-side request forgery vulnerability exists in Jenkins Git Plugin 3.9.0 and older in AssemblaWeb.java…org.jenkins-ci.plugins:git
- CVE-2018-1000183A exposure of sensitive information vulnerability exists in Jenkins GitHub Plugin 1.29.0 and older in GitHubServerConfig.java that allows…com.coravy.hudson.plugins.github:github
- CVE-2018-1000184A server-side request forgery vulnerability exists in Jenkins GitHub Plugin 1.29.0 and older in GitHubPluginConfig.java that allows…com.coravy.hudson.plugins.github:github
- CVE-2018-1000185A server-side request forgery vulnerability exists in Jenkins GitHub Branch Source Plugin 2.3.4 and older in Endpoint.java that allows…org.jenkins-ci.plugins:github-branch-source
- CVE-2018-1000186A exposure of sensitive information vulnerability exists in Jenkins GitHub Pull Request Builder Plugin 1.41.0 and older in…org.jenkins-ci.plugins:ghprb
- CVE-2018-1000187A exposure of sensitive information vulnerability exists in Jenkins Kubernetes Plugin 1.7.0 and older in ContainerExecDecorator.java that…org.csanchez.jenkins.plugins:kubernetes
Show all 58 entriesShow fewer entries
- CVE-2018-1000188A server-side request forgery vulnerability exists in Jenkins CAS Plugin 1.4.1 and older in CasSecurityRealm.java that allows attackers…org.jenkins-ci.plugins:cas-plugin
- CVE-2018-1000189A command execution vulnerability exists in Jenkins Absint Astree Plugin 1.0.5 and older in AstreeBuilder.java that allows attackers with…org.jenkins-ci.plugins:absint-astree
- CVE-2018-1000190A exposure of sensitive information vulnerability exists in Jenkins Black Duck Hub Plugin 4.0.0 and older in PostBuildScanDescriptor.java…com.blackducksoftware.integration:blackduck-hub
- CVE-2018-1000191A exposure of sensitive information vulnerability exists in Jenkins Black Duck Detect Plugin 1.4.0 and older in…com.synopsys.integration:synopsys-detect
- CVE-2018-10597IntelliVue Patient Monitors MP Series (including MP2/X2/MP30/MP50/MP70/NP90/MX700/800) Rev B-M, IntelliVue Patient Monitors MX (MX400-550)…ICS-CERT IntelliVue Patient Monitors, Avalon Fetal/Maternal…
- CVE-2018-10599IntelliVue Patient Monitors MP Series (including MP2/X2/MP30/MP50/MP70/NP90/MX700/800) Rev B-M, IntelliVue Patient Monitors MX (MX400-550)…ICS-CERT IntelliVue Patient Monitors, Avalon Fetal/Maternal…
- CVE-2018-10601IntelliVue Patient Monitors MP Series (including MP2/X2/MP30/MP50/MP70/NP90/MX700/800) Rev B-M, IntelliVue Patient Monitors MX (MX400-550)…ICS-CERT IntelliVue Patient Monitors, Avalon Fetal/Maternal…
- CVE-2018-1332Apache Storm version 1.0.6 and earlier, 1.2.1 and earlier, and version 1.1.2 and earlier expose a vulnerability that could allow a user to…Apache Software Foundation Apache Storm · org.apache.storm:…
- CVE-2018-8008Apache Storm version 1.0.6 and earlier, 1.2.1 and earlier, and version 1.1.2 and earlier expose an arbitrary file write vulnerability…Apache Software Foundation Apache Storm · org.apache.storm:…
- CVE-2018-10813In Dedos-web 1.0, the cookie and session secrets used in the Express.js application have hardcoded values that are visible in the source…
- CVE-2018-10966An issue was discovered in GamerPolls 0.4.6, related to config/environments/all.js and config/initializers/02_passport.js.
- CVE-2018-1432IBM InfoSphere Information Server 9.1, 11.3, 11.5, and 11.7 is vulnerable to cross-frame scripting which is a vulnerability that allows an…IBM InfoSphere Information Server
- CVE-2018-1454IBM InfoSphere Information Server 11.3, 11.5, and 11.7 could allow a remote attacker to obtain sensitive information, caused by the…IBM InfoSphere Information Server
- CVE-2018-7943There is an authentication bypass vulnerability in some Huawei servers.Huawei Technologies Co. 1288H V5; 2288H V5; 2488 V5 ; CH121…
- CVE-2016-9488ManageEngine Applications Manager versions 12 and 13 suffer from remote SQL injection vulnerabilitiesManageEngine Applications Manager
- CVE-2016-9490ManageEngine Applications Manager versions 12 and 13 suffer from a Reflected Cross-Site Scripting vulnerabilityManageEngine Applications Manager
- CVE-2018-8923Cross-site scripting (XSS) vulnerability in Attachment Preview in Synology File Station before 1.1.4-0122 allows remote authenticated…Synology File Station
- CVE-2018-8924Cross-site scripting (XSS) vulnerability in Title Tootip in Synology Office before 3.0.3-2143 allows remote authenticated users to inject…Synology Office
- CVE-2018-1000180Bouncy Castle BC 1.54 - 1.59, BC-FJA 1.0.0, BC-FJA 1.0.1 and earlier have a flaw in the Low-level interface to RSA key pair generator…org.bouncycastle:bcprov-jdk14 · org.bouncycastle:bcprov-… +1
- CVE-2018-1000181Kitura 2.3.0 and earlier have an unintended read access to unauthorised files and folders that can be exploited by a crafted URL resulting…
- CVE-2018-1000200The Linux Kernel versions 4.14, 4.15, and 4.16 has a null pointer dereference which can result in an out of memory (OOM) killing of large…
- CVE-2018-11743The init_copy function in kernel.c in mruby 1.4.1 makes initialize_copy calls for TT_ICLASS objects, which allows attackers to cause a…
- CVE-2018-11722WUZHI CMS 4.1.0 has a SQL Injection in api/uc.php via the 'code' parameter, because 'UC_KEY' is hard coded.
- CVE-2018-1252RSA Web Threat Detection SQL Injection VulnerabilityRSA Web Threat Detection
- CVE-2018-11554The forgotten-password feature in index.php/member/reset/reset_email.html in YzmCMS v3.2 through v3.7 has a Response Discrepancy…
- CVE-2018-11678plugins/box/users/users.plugin.php in Monstra CMS 3.0.4 allows Login Rate Limiting Bypass via manipulation of the login_attempts cookie.
- CVE-2018-11737An issue was discovered in libtskfs.a in The Sleuth Kit (TSK) from release 4.0.2 through to 4.6.1.
- CVE-2018-11738An issue was discovered in libtskfs.a in The Sleuth Kit (TSK) from release 4.0.2 through to 4.6.1.
- CVE-2018-11739An issue was discovered in libtskimg.a in The Sleuth Kit (TSK) from release 4.0.2 through to 4.6.1.
- CVE-2018-11740An issue was discovered in libtskbase.a in The Sleuth Kit (TSK) from release 4.0.2 through to 4.6.1.
- CVE-2017-18286nZEDb v0.7.3.3 has XSS in the 404 error page.nzedb/nzedb
- CVE-2018-11735index.php?action=createaccount in Ximdex 4.0 has XSS via the sname or fname parameter.
- CVE-2018-11736An issue was discovered in Pluck before 4.7.7-dev2.