# CVEs published 2018-06-22

26 CVEs were published on June 22, 2018: 0 critical, 1 high. Days are UTC.

- [CVE-2018-7682](https://cve.now/CVE-2018-7682.md): Micro Focus Solutions Business Manager versions prior to 11.4 allows a user to invoke SBM RESTful services across domains. (no CVSS, Micro Focus Solutions Business Manager)
- [CVE-2018-12689](https://cve.now/CVE-2018-12689.md): phpLDAPadmin 1.2.2 allows LDAP injection via a crafted server\_id parameter in a cmd.php?cmd=login\_form request, or a crafted username and… (no CVSS)
- [CVE-2018-12538](https://cve.now/CVE-2018-12538.md): In Eclipse Jetty versions 9.4.0 through 9.4.8, when using the optional Jetty provided FileSessionDataStore for persistent storage of… (no CVSS, The Eclipse Foundation Eclipse Jetty · org.eclipse.jetty:je…)
- [CVE-2018-12684](https://cve.now/CVE-2018-12684.md): Out-of-bounds Read in the send\_ssi\_file function in civetweb.c in CivetWeb through 1.10 allows attackers to cause a Denial of Service or… (no CVSS)
- [CVE-2018-12687](https://cve.now/CVE-2018-12687.md): tinyexr 0.9.5 has an assertion failure in DecodePixelData in tinyexr.h. (no CVSS)
- [CVE-2018-12688](https://cve.now/CVE-2018-12688.md): tinyexr 0.9.5 has a segmentation fault in the wav2Decode function. (no CVSS)
- [CVE-2018-1000201](https://cve.now/CVE-2018-1000201.md): ruby-ffi version 1.9.23 and earlier has a DLL loading issue which can be hijacked on Windows OS, when a Symbol is used as DLL name instead… (no CVSS, ffi)
- [CVE-2018-12678](https://cve.now/CVE-2018-12678.md): Portainer before 1.18.0 supports unauthenticated requests to the websocket endpoint with an unvalidated id query parameter for the… (no CVSS)
- [CVE-2018-12636](https://cve.now/CVE-2018-12636.md): The iThemes Security (better-wp-security) plugin before 7.0.3 for WordPress allows SQL Injection (by attackers with Admin privileges) via… (no CVSS)
- [CVE-2017-7568](https://cve.now/CVE-2017-7568.md): NetApp OnCommand Unified Manager for 7-Mode (core package) versions prior to 5.2.3 may disclose sensitive LDAP account information to… (no CVSS, NetApp OnCommand Unified Manager for 7-Mode)
- [CVE-2018-12654](https://cve.now/CVE-2018-12654.md): Reflected Cross-Site Scripting (XSS) exists in the Bibliography module in SLiMS 8 Akasia 8.3.1 via an… (no CVSS)
- [CVE-2018-12655](https://cve.now/CVE-2018-12655.md): Reflected Cross-Site Scripting (XSS) exists in the Circulation module in SLiMS 8 Akasia 8.3.1 via an… (no CVSS)
- [CVE-2018-12656](https://cve.now/CVE-2018-12656.md): Reflected Cross-Site Scripting (XSS) exists in the Membership module in SLiMS 8 Akasia 8.3.1 via an… (no CVSS)
- [CVE-2018-12657](https://cve.now/CVE-2018-12657.md): Reflected Cross-Site Scripting (XSS) exists in the Master File module in SLiMS 8 Akasia 8.3.1 via an… (no CVSS)
- [CVE-2018-12658](https://cve.now/CVE-2018-12658.md): Reflected Cross-Site Scripting (XSS) exists in the Stock Take module in SLiMS 8 Akasia 8.3.1 via an… (no CVSS)
- [CVE-2018-12659](https://cve.now/CVE-2018-12659.md): SLiMS 8 Akasia 8.3.1 allows remote attackers to bypass the CSRF protection mechanism and obtain admin access by omitting the csrf\_token… (no CVSS)
- [CVE-2018-12649](https://cve.now/CVE-2018-12649.md): An issue was discovered in app/Controller/UsersController.php in MISP 2.4.92. (no CVSS)
- [CVE-2018-1655](https://cve.now/CVE-2018-1655.md): IBM AIX 5.3, 6.1, 7.1, and 7.2 contains a vulnerability in the rmsock command that may be used to expose kernel memory. (CVSS 4.0, IBM AIX)
- [CVE-2017-2668](https://cve.now/CVE-2017-2668.md): 389-ds-base before versions 1.3.5.17 and 1.3.6.10 is vulnerable to an invalid pointer dereference in the way LDAP bind requests are handled. (CVSS 6.5, \[UNKNOWN\] 389-ds-base)
- [CVE-2017-7466](https://cve.now/CVE-2017-7466.md): Ansible before version 2.3 has an input validation vulnerability in the handling of data sent from client systems. (CVSS 8.0, \[UNKNOWN\] ansible · ansible)
- [CVE-2018-12648](https://cve.now/CVE-2018-12648.md): The WEBP::GetLE32 function in XMPFiles/source/FormatSupport/WEBP\_Support.hpp in Exempi 2.4.5 has a NULL pointer dereference. (no CVSS)
- [CVE-2018-12641](https://cve.now/CVE-2018-12641.md): An issue was discovered in arm\_pt in cplus-dem.c in GNU libiberty, as distributed in GNU Binutils 2.30. (no CVSS)
- [CVE-2018-12642](https://cve.now/CVE-2018-12642.md): Froxlor through 0.9.39.5 has Incorrect Access Control for tickets not owned by the current user. (no CVSS, froxlor/froxlor)
- [CVE-2018-12633](https://cve.now/CVE-2018-12633.md): An issue was discovered in the Linux kernel through 4.17.2. (no CVSS)
- [CVE-2018-12634](https://cve.now/CVE-2018-12634.md): CirCarLife Scada before 4.3 allows remote attackers to obtain sensitive information via a direct request for the html/log or… (no CVSS)
- [CVE-2018-12635](https://cve.now/CVE-2018-12635.md): CirCarLife Scada v4.2.4 allows unauthorized upgrades via requests to the html/upgrade.html and services/system/firmware.upgrade URIs. (no CVSS)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/archive/2018-06-22
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.