# CVEs published 2018-07-12

34 CVEs were published on July 12, 2018: 1 critical, 1 high. Days are UTC.

- [CVE-2018-14015](https://cve.now/CVE-2018-14015.md): The sdb\_set\_internal function in sdb.c in radare2 2.7.0 allows remote attackers to cause a denial of service (invalid read and application… (no CVSS)
- [CVE-2018-14016](https://cve.now/CVE-2018-14016.md): The r\_bin\_mdmp\_init\_directory\_entry function in mdmp.c in radare2 2.7.0 allows remote attackers to cause a denial of service (heap-based… (no CVSS)
- [CVE-2018-14017](https://cve.now/CVE-2018-14017.md): The r\_bin\_java\_annotation\_new function in shlr/java/class.c in radare2 2.7.0 allows remote attackers to cause a denial of service… (no CVSS)
- [CVE-2018-14012](https://cve.now/CVE-2018-14012.md): WolfSight CMS 3.2 allows SQL injection via the PATH\_INFO to the default URI. (no CVSS)
- [CVE-2018-14014](https://cve.now/CVE-2018-14014.md): In waimai Super Cms 20150505, there is a CSRF vulnerability that can add an admin account via admin.php?m=Member&a=adminadd. (no CVSS)
- [CVE-2018-12979](https://cve.now/CVE-2018-12979.md): An issue was discovered on WAGO e!DISPLAY 762-3000 through 762-3003 devices with firmware before FW 02. (no CVSS)
- [CVE-2018-12980](https://cve.now/CVE-2018-12980.md): An issue was discovered on WAGO e!DISPLAY 762-3000 through 762-3003 devices with firmware before FW 02. (no CVSS)
- [CVE-2018-12981](https://cve.now/CVE-2018-12981.md): An issue was discovered on WAGO e!DISPLAY 762-3000 through 762-3003 devices with firmware before FW 02. (no CVSS)
- [CVE-2018-13441](https://cve.now/CVE-2018-13441.md): qh\_help in Nagios Core version 4.4.1 and earlier is prone to a NULL pointer dereference vulnerability, which allows attacker to cause a… (no CVSS)
- [CVE-2018-13457](https://cve.now/CVE-2018-13457.md): qh\_echo in Nagios Core 4.4.1 and earlier is prone to a NULL pointer dereference vulnerability, which allows attackers to cause a local… (no CVSS)
- [CVE-2018-13458](https://cve.now/CVE-2018-13458.md): qh\_core in Nagios Core 4.4.1 and earlier is prone to a NULL pointer dereference vulnerability, which allows attackers to cause a local… (no CVSS)
- [CVE-2018-13796](https://cve.now/CVE-2018-13796.md): An issue was discovered in GNU Mailman before 2.1.28. (no CVSS, mailman)
- [CVE-2018-5529](https://cve.now/CVE-2018-5529.md): The svpn component of the F5 BIG-IP APM client prior to version 7.1.7 for Linux and Mac OS X runs as a privileged process and can allow an… (no CVSS, F5 Networks BIG-IP APM client for Linux and Mac OSX)
- [CVE-2017-14612](https://cve.now/CVE-2017-14612.md): "Shpock Boot Sale & Classifieds" app before 3.17.0 -- aka shpock-boot-sale-classifieds/id557153158 -- for iOS does not verify X.509… (no CVSS)
- [CVE-2017-14709](https://cve.now/CVE-2017-14709.md): The komoot GmbH "Komoot - Cycling & Hiking Maps" app before 9.3.2 -- aka komoot-cycling-hiking-maps/id447374873 -- for iOS does not verify… (no CVSS)
- [CVE-2017-14710](https://cve.now/CVE-2017-14710.md): The Shein Group Ltd. (no CVSS)
- [CVE-2018-12463](https://cve.now/CVE-2018-12463.md): MFSBGN03811 rev.1 - Fortify Software Security Center (SSC), Multiple vulnerabilities (CVSS 7.3, Micro Focus Fortify Software Security Center)
- [CVE-2018-14009](https://cve.now/CVE-2018-14009.md): Codiad through 2.8.4 allows Remote Code Execution, a different vulnerability than CVE-2017-11366 and CVE-2017-15689. (no CVSS, codiad/codiad)
- [CVE-2018-13836](https://cve.now/CVE-2018-13836.md): An integer overflow vulnerability exists in the function multiTransfer of Rocket Coin (XRC), an Ethereum token smart contract. (no CVSS)
- [CVE-2018-14001](https://cve.now/CVE-2018-14001.md): An integer overflow vulnerability exists in the function batchTransfer of SHARKTECH (SKT), an Ethereum token smart contract. (no CVSS)
- [CVE-2018-14002](https://cve.now/CVE-2018-14002.md): An integer overflow vulnerability exists in the function distribute of MP3 Coin (MP3), an Ethereum token smart contract. (no CVSS)
- [CVE-2018-14003](https://cve.now/CVE-2018-14003.md): An integer overflow vulnerability exists in the function batchTransfer of WeMediaChain (WMC), an Ethereum token smart contract. (no CVSS)
- [CVE-2018-14004](https://cve.now/CVE-2018-14004.md): An integer overflow vulnerability exists in the function transfer\_tokens\_after\_ICO of GlobeCoin (GLB), an Ethereum token smart contract. (no CVSS)
- [CVE-2018-14005](https://cve.now/CVE-2018-14005.md): An integer overflow vulnerability exists in the function transferAny of Malaysia coins (Xmc), an Ethereum token smart contract. (no CVSS)
- [CVE-2018-14006](https://cve.now/CVE-2018-14006.md): An integer overflow vulnerability exists in the function multipleTransfer of Neo Genesis Token (NGT), an Ethereum token smart contract. (no CVSS)
- [CVE-2017-18155](https://cve.now/CVE-2017-18155.md): While playing HEVC content using HD DMB in Snapdragon Automobile and Snapdragon Mobile in version MSM8996AU, SD 450, SD 625, SD 820, SD… (no CVSS, Qualcomm Snapdragon Automobile, Snapdragon Mobile)
- [CVE-2018-12540](https://cve.now/CVE-2018-12540.md): In version from 3.0.0 to 3.5.2 of Eclipse Vert.x, the CSRFHandler do not assert that the XSRF Cookie matches the returned XSRF header/form… (no CVSS, The Eclipse Foundation Eclipse Vert.x · io.vertx:vertx-web)
- [CVE-2018-1334](https://cve.now/CVE-2018-1334.md): In Apache Spark 1.0.0 to 2.1.2, 2.2.0 to 2.2.1, and 2.3.0, when using PySpark or SparkR, it's possible for a different local user to… (no CVSS, Apache Software Foundation Apache Spark · org.apache.spa… +2)
- [CVE-2018-8024](https://cve.now/CVE-2018-8024.md): In Apache Spark 2.1.0 to 2.1.2, 2.2.0 to 2.2.1, and 2.3.0, it's possible for a malicious user to construct a URL pointing to a Spark… (no CVSS, Apache Software Foundation Apache Spark · org.apache.spa… +1)
- [CVE-2018-10895](https://cve.now/CVE-2018-10895.md): qutebrowser before version 1.4.1 is vulnerable to a cross-site request forgery flaw that allows websites to access 'qute://\*' URLs. (CVSS 9.3, qutebrowser cross-site request forgery flaw allows sites to…)
- [CVE-2018-13996](https://cve.now/CVE-2018-13996.md): Genann through 2018-07-08 has a stack-based buffer over-read in genann\_train in genann.c. (no CVSS)
- [CVE-2018-13997](https://cve.now/CVE-2018-13997.md): Genann through 2018-07-08 has a SEGV in genann\_run in genann.c. (no CVSS)
- [CVE-2018-13998](https://cve.now/CVE-2018-13998.md): ClipperCMS 1.3.3 has stored XSS via the Full Name field of (1) Security -\> Manager Users or (2) Security -\> Web Users. (no CVSS)
- [CVE-2018-13999](https://cve.now/CVE-2018-13999.md): Catfish CMS v4.7.9 allows XSS via the admin/Index/write.html editorValue parameter (aka an article posted by an administrator). (no CVSS)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/archive/2018-07-12
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.