CVEs published July 13, 2018
86 CVEs were published on July 13, 2018: 1 critical, 1 high. Browse them by severity, product and exploitation status.
- Published
- 86
- Critical
- 1
- High
- 1
- Medium
- 3
- Low
- 1
- Unrated
- 80
- Now in CISA KEV
- 0
- Fix available
- 16
Most affected products
- IEEE Standard
- 7
- iTrack Easy
- 5
- PHP FormMail Generator
- 5
- Hughes Satellite Modem HN7740S · Hughes Satellite Modem… +1
- 4
- ManageEngine Applications Manager
- 3
- Accellion FTP Server
- 2
- ASUS RP-AC52 Access Point
- 2
- bootstrap · org.webjars:bootstrap +3
- 2
- IBM Security Identity Governance and Intelligence
- 2
- Microsoft Windows SecureConnector agent
- 2
Critical 1
High 1
Medium, low and unrated 84
- CVE-2013-0570The Fibre Channel over Ethernet (FCoE) feature in IBM System Networking and Blade Network Technology (BNT) switches running IBM Networking…
- CVE-2016-6542The MAC address/device tracking ID of an iTrack Easy can be obtained within range of the deviceiTrack Easy
- CVE-2016-6543A captured MAC/device ID of an iTrack Easy can be registered under multiple user accounts allowing access to getgps GPS dataiTrack Easy
- CVE-2016-6544iTrack Easy's getgps data can be modified without authenticationiTrack Easy
- CVE-2016-6545iTrack Easy does not use session cookies to maintain sessions and POSTs the users password over HTTPS for each requestiTrack Easy
- CVE-2016-6546iTrack Easy mobile application stores the user password in base-64 encoding/cleartextiTrack Easy
- CVE-2016-6547Zizai Tech Nut stores the account password in cleartextZizai Technology Tech Nut Mobile Application
- CVE-2016-6548Zizai Tech Nut mobile application makes requests using HTTP, which includes the users session tokenZizai Technology Tech Nut Mobile Application
- CVE-2016-6549Zizai Tech Nut allows for unauthenticated Bluetooth pairingZizai Technology Tech Nut
- CVE-2016-6551Intellian Satellite TV antennas t-Series and v-Series, firmware version 1.07, uses default credentialsIntellian Satellite TV Antennas
- CVE-2016-6552Green Packet DX-350 uses default credentialsGreen Packet WiFi Access Point
- CVE-2016-6553Nuuo NT-4040 Titan, firmware NT-4040_01.07.0000.0015_1120, uses default credentialsNuuo NT-4040 Titan
- CVE-2016-6554Synology NAS servers DS107, DS116, and DS213, use default credentialsSynology NAS server DS107 · Synology NAS server DS116 +1
- CVE-2016-6557The ASUS RP-AC52 access point, firmware version 1.0.1.1s and possibly earlier, is vulnerable to cross-site request forgeryASUS RP-AC52 Access Point
- CVE-2016-6558The ASUS RP-AC52 access point, firmware version 1.0.1.1s and possibly earlier, is vulnerable to command injectionASUS RP-AC52 Access Point
- CVE-2016-6559The BSD libc library's link_ntoa() function may be vulnerable to a classic buffer overflowBSD libc library
- CVE-2016-6562ShoreTel Mobility Client for iOS and Android, version 9.1.3.109 and earlier, fails to properly validate SSL certificates provided by HTTPS…ShoreTel Mobility Client iOS · ShoreTel Mobility Client And…
- CVE-2016-6563D-Link DIR routers contain a stack-based buffer overflow in the HNAP Login actionD-Link DIR-823 · D-Link DIR-822 +7
- CVE-2016-6564Ragentek Android software contains an over-the-air update mechanism that communicates over an unencrypted channel, which can allow a…Ragentek Android software
- CVE-2016-6565The Imagely NextGen Gallery plugin for Wordpress prior to version 2.1.57 may execute code from an uploaded malicious fileImagely NextGen Gallery plugin
- CVE-2016-6566The Sungard eTRAKiT3 software version 3.2.1.17 may be vulnerable to SQL injection which may allow a remote unauthenticated attacker to run…Sungard eTRAKiT3
- CVE-2016-6567SHDesigns' Resident Download Manager (as well as the Ethernet Download Manager) does not authenticate firmware downloads before executing…SHDesigns Resident Download Manager · SHDesigns Ethernet Do…
- CVE-2016-6578CodeLathe FileCloud, version 13.0.0.32841 and earlier, is vulnerable to cross-site request forgery (CSRF)CodeLathe FileCloud
- CVE-2016-9482PHP FormMail Generator generates PHP code for standard web forms, and the code generated is vulnerable to authentication bypassPHP FormMail Generator
- CVE-2016-9483PHP FormMail Generator generates PHP code for standard web forms, and the code generated is vulnerable to unsafe deserialization of…PHP FormMail Generator
Show all 84 entriesShow fewer entries
- CVE-2016-9484PHP FormMail Generator generates PHP code for standard web forms, and the code generated does not properly validate user input folder…PHP FormMail Generator
- CVE-2016-9485On Windows endpoints, the SecureConnector agent is vulnerable to privilege escalation whereby an authenticated unprivileged user can…Microsoft Windows SecureConnector agent
- CVE-2016-9486On Windows endpoints, the SecureConnector agent is vulnerable to privilege escalation whereby an authenticated unprivileged user can…Microsoft Windows SecureConnector agent
- CVE-2016-9487EpubCheck 4.0.1 is vulnerable to external XML entity processing attacksEpubCheck
- CVE-2016-9489ManageEngine Applications Manager 12 and 13 is vulnerable to privilege escalation and authentication bypassManageEngine Applications Manager
- CVE-2016-9491ManageEngine Applications Manager 12 and 13 is vulnerable to privilege escalation due to improper restriction of an XML external entityManageEngine Applications Manager
- CVE-2016-9492PHP forms generated using the PHP FormMail Generator are vulnerable to unrestricted upload of dangerous file typesPHP FormMail Generator
- CVE-2016-9493PHP forms generated using the PHP FormMail Generator are vulnerable to stored cross-site scriptingPHP FormMail Generator
- CVE-2016-9494Hughes high-performance broadband satellite modems, models HN7740S DW7000 HN7000S/SM, are potentially vulnerable to improper input…Hughes Satellite Modem HN7740S · Hughes Satellite Modem… +1
- CVE-2016-9495Hughes high-performance broadband satellite modems, models HN7740S DW7000 HN7000S/SM, uses hard coded credentialsHughes Satellite Modem HN7740S · Hughes Satellite Modem… +1
- CVE-2016-9496Hughes high-performance broadband satellite modems, models HN7740S DW7000 HN7000S/SM, lacks authentication to access certain pagesHughes Satellite Modem HN7740S · Hughes Satellite Modem… +1
- CVE-2016-9497Hughes high-performance broadband satellite modems, models HN7740S DW7000 HN7000S/SM, is vulnerable to an authentication bypass using an…Hughes Satellite Modem HN7740S · Hughes Satellite Modem… +1
- CVE-2016-9498ManageEngine Applications Manager 12 and 13, allows unserialization of unsafe Java objectsManageEngine Applications Manager
- CVE-2016-9499The Accellion FTP server prior to version FTA_9_12_220 is vulnerable to cross-site scripting.Accellion FTP Server
- CVE-2016-9500The Accellion FTP server prior to version FTA_9_12_220 is vulnerable to informaiton exposureAccellion FTP Server
- CVE-2017-13091The P1735 IEEE standard describes flawed methods for encrypting electronic-design intellectual property (IP), including improperly…IEEE Standard
- CVE-2017-13092The P1735 IEEE standard describes flawed methods for encrypting electronic-design intellectual property (IP), including improperly…IEEE Standard
- CVE-2017-13093The P1735 IEEE standard describes flawed methods for encrypting electronic-design intellectual property (IP), including modification of…IEEE Standard
- CVE-2017-13094The P1735 IEEE standard describes flawed methods for encrypting electronic-design intellectual property (IP), including modification of…IEEE Standard
- CVE-2017-13095The P1735 IEEE standard describes flawed methods for encrypting electronic-design intellectual property (IP), including modification of a…IEEE Standard
- CVE-2017-13096The P1735 IEEE standard describes flawed methods for encrypting electronic-design intellectual property (IP), including modification of…IEEE Standard
- CVE-2017-13097The P1735 IEEE standard describes flawed methods for encrypting electronic-design intellectual property (IP), including modification of…IEEE Standard
- CVE-2018-10631Medtronic N'Vision Clinician Programmer Protection Mechanism FailureMedtronic 8840 N’Vision Clinician Programmer · Medtronic 88…
- CVE-2018-8847Eaton 9000X DriveA versions 2.0.29 and prior has a stack-based buffer overflow vulnerability, which may allow remote code execution.ICS-CERT Eaton 9000X Drive
- CVE-2018-1000206JFrog Artifactory version since 5.11 contains a Cross ite Request Forgery (CSRF) vulnerability in UI rest endpoints that can result in…
- CVE-2018-1000207MODX Revolution version <=2.6.4 contains a Incorrect Access Control vulnerability in Filtering user parameters before passing them into…modx/revolution
- CVE-2018-1000208MODX Revolution version <=2.6.4 contains a Directory Traversal vulnerability in /core/model/modx/modmanagerrequest.class.php that can…
- CVE-2018-1000209Sensu, Inc.
- CVE-2018-1000210YamlDotNet version 4.3.2 and earlier contains a Insecure Direct Object Reference vulnerability in The default behavior of…YamlDotNet · YamlDotNet.Signed
- CVE-2018-1000211Doorkeeper version 4.2.0 and later contains a Incorrect Access Control vulnerability in Token revocation API's authorized method that can…doorkeeper
- CVE-2018-10018The GDASPAMLib.AntiSpam ActiveX control ASK\GDASpam.dll in G DATA Total Security 25.4.0.3 has a buffer overflow via a long IsBlackListed…
- CVE-2018-10098In MicroWorld eScan Internet Security Suite (ISS) for Business 14.0.1400.2029, the driver econceal.sys allows a non-privileged user to…
- CVE-2018-1255Reflected Cross-Site Scripting VulnerabilityRSA Identity Governance and Lifecycle
- CVE-2018-7535An issue was discovered in TotalAV v4.1.7.
- CVE-2017-1367IBM Security Identity Governance and Intelligence Virtual Appliance 5.2 through 5.2.3.2 stores sensitive information in URL parameters.IBM Security Identity Governance and Intelligence
- CVE-2017-1395IBM Security Identity Governance and Intelligence Virtual Appliance 5.2 through 5.2.3.2 could allow a remote attacker to obtain sensitive…IBM Security Identity Governance and Intelligence
- CVE-2018-14047An issue has been found in PNGwriter 0.7.0.
- CVE-2018-14048An issue has been found in libpng 1.6.34.
- CVE-2018-14049An issue has been found in libwav through 2017-04-20.
- CVE-2018-14050An issue has been found in libwav through 2017-04-20.
- CVE-2018-14051The function wav_read in libwav.c in libwav through 2017-04-20 has an infinite loop.
- CVE-2018-14052An issue has been found in libwav through 2017-04-20.
- CVE-2018-9067The Lenovo Help Android app versions earlier than 6.1.2.0327 had insufficient access control for some functions which, if exploited, could…Lenovo Group Lenovo Help Android application
- CVE-2018-9070For the Lenovo Smart Assistant Android app versions earlier than 12.1.82, an attacker with physical access to the smart speaker can, by…Lenovo Group Lenovo Smart Assistant
- CVE-2018-14044The RateTransposer::setChannels function in RateTransposer.cpp in libSoundTouch.a in Olli Parviainen SoundTouch 2.0 allows remote…
- CVE-2018-14045The FIRFilter::evaluateFilterMulti function in FIRFilter.cpp in libSoundTouch.a in Olli Parviainen SoundTouch 2.0 allows remote attackers…
- CVE-2018-14046Exiv2 0.26 has a heap-based buffer over-read in WebPImage::decodeChunks in webpimage.cpp.
- CVE-2018-14040In Bootstrap before 4.1.2, XSS is possible in the collapse data-parent attribute.bootstrap · org.webjars:bootstrap +3
- CVE-2018-14041In Bootstrap before 4.1.2, XSS is possible in the data-target property of scrollspy.bootstrap · typo3/cms-core +4
- CVE-2018-14042In Bootstrap before 4.1.2, XSS is possible in the data-container property of tooltip.bootstrap · org.webjars:bootstrap +3
- CVE-2018-14043mstdlib (aka the M Standard Library for C) 1.2.0 has incorrect file access control in situations where M_fs_perms_can_access attempts to…
- CVE-2018-6969VMware Tools (10.x and prior before 10.3.0) contains an out-of-bounds read vulnerability in HGFS.VMware Tools
- CVE-2018-14036Directory Traversal with ../ sequences occurs in AccountsService before 0.6.50 because of an insufficient path check in…
- CVE-2018-14029CSRF vulnerability in admin/user/edit in Creatiwity wityCMS 0.6.2 allows an attacker to take over a user account, as demonstrated by…
- CVE-2018-14031An issue was discovered in the HDF HDF5 1.8.20 library.
- CVE-2018-14033An issue was discovered in the HDF HDF5 1.8.20 library.
- CVE-2018-14034An issue was discovered in the HDF HDF5 1.8.20 library.
- CVE-2018-14035An issue was discovered in the HDF HDF5 1.8.20 library.
- CVE-2018-14054A double free exists in the MP4StringProperty class in mp4property.cpp in MP4v2 2.0.0.