# CVEs published 2018-07-13

86 CVEs were published on July 13, 2018: 1 critical, 1 high. Days are UTC.

- [CVE-2018-10875](https://cve.now/CVE-2018-10875.md): A flaw was found in ansible. (CVSS 7.8, \[UNKNOWN\] ansible · ansible)
- [CVE-2013-0570](https://cve.now/CVE-2013-0570.md): The Fibre Channel over Ethernet (FCoE) feature in IBM System Networking and Blade Network Technology (BNT) switches running IBM Networking… (no CVSS)
- [CVE-2016-6542](https://cve.now/CVE-2016-6542.md): The MAC address/device tracking ID of an iTrack Easy can be obtained within range of the device (no CVSS, iTrack Easy)
- [CVE-2016-6543](https://cve.now/CVE-2016-6543.md): A captured MAC/device ID of an iTrack Easy can be registered under multiple user accounts allowing access to getgps GPS data (no CVSS, iTrack Easy)
- [CVE-2016-6544](https://cve.now/CVE-2016-6544.md): iTrack Easy's getgps data can be modified without authentication (no CVSS, iTrack Easy)
- [CVE-2016-6545](https://cve.now/CVE-2016-6545.md): iTrack Easy does not use session cookies to maintain sessions and POSTs the users password over HTTPS for each request (no CVSS, iTrack Easy)
- [CVE-2016-6546](https://cve.now/CVE-2016-6546.md): iTrack Easy mobile application stores the user password in base-64 encoding/cleartext (no CVSS, iTrack Easy)
- [CVE-2016-6547](https://cve.now/CVE-2016-6547.md): Zizai Tech Nut stores the account password in cleartext (no CVSS, Zizai Technology Tech Nut Mobile Application)
- [CVE-2016-6548](https://cve.now/CVE-2016-6548.md): Zizai Tech Nut mobile application makes requests using HTTP, which includes the users session token (no CVSS, Zizai Technology Tech Nut Mobile Application)
- [CVE-2016-6549](https://cve.now/CVE-2016-6549.md): Zizai Tech Nut allows for unauthenticated Bluetooth pairing (no CVSS, Zizai Technology Tech Nut)
- [CVE-2016-6551](https://cve.now/CVE-2016-6551.md): Intellian Satellite TV antennas t-Series and v-Series, firmware version 1.07, uses default credentials (no CVSS, Intellian Satellite TV Antennas)
- [CVE-2016-6552](https://cve.now/CVE-2016-6552.md): Green Packet DX-350 uses default credentials (no CVSS, Green Packet WiFi Access Point)
- [CVE-2016-6553](https://cve.now/CVE-2016-6553.md): Nuuo NT-4040 Titan, firmware NT-4040\_01.07.0000.0015\_1120, uses default credentials (no CVSS, Nuuo NT-4040 Titan)
- [CVE-2016-6554](https://cve.now/CVE-2016-6554.md): Synology NAS servers DS107, DS116, and DS213, use default credentials (no CVSS, Synology NAS server DS107 · Synology NAS server DS116 +1)
- [CVE-2016-6557](https://cve.now/CVE-2016-6557.md): The ASUS RP-AC52 access point, firmware version 1.0.1.1s and possibly earlier, is vulnerable to cross-site request forgery (no CVSS, ASUS RP-AC52 Access Point)
- [CVE-2016-6558](https://cve.now/CVE-2016-6558.md): The ASUS RP-AC52 access point, firmware version 1.0.1.1s and possibly earlier, is vulnerable to command injection (no CVSS, ASUS RP-AC52 Access Point)
- [CVE-2016-6559](https://cve.now/CVE-2016-6559.md): The BSD libc library's link\_ntoa() function may be vulnerable to a classic buffer overflow (no CVSS, BSD libc library)
- [CVE-2016-6562](https://cve.now/CVE-2016-6562.md): ShoreTel Mobility Client for iOS and Android, version 9.1.3.109 and earlier, fails to properly validate SSL certificates provided by HTTPS… (no CVSS, ShoreTel Mobility Client iOS · ShoreTel Mobility Client And…)
- [CVE-2016-6563](https://cve.now/CVE-2016-6563.md): D-Link DIR routers contain a stack-based buffer overflow in the HNAP Login action (no CVSS, D-Link DIR-823 · D-Link DIR-822 +7)
- [CVE-2016-6564](https://cve.now/CVE-2016-6564.md): Ragentek Android software contains an over-the-air update mechanism that communicates over an unencrypted channel, which can allow a… (no CVSS, Ragentek Android software)
- [CVE-2016-6565](https://cve.now/CVE-2016-6565.md): The Imagely NextGen Gallery plugin for Wordpress prior to version 2.1.57 may execute code from an uploaded malicious file (no CVSS, Imagely NextGen Gallery plugin)
- [CVE-2016-6566](https://cve.now/CVE-2016-6566.md): The Sungard eTRAKiT3 software version 3.2.1.17 may be vulnerable to SQL injection which may allow a remote unauthenticated attacker to run… (no CVSS, Sungard eTRAKiT3)
- [CVE-2016-6567](https://cve.now/CVE-2016-6567.md): SHDesigns' Resident Download Manager (as well as the Ethernet Download Manager) does not authenticate firmware downloads before executing… (no CVSS, SHDesigns Resident Download Manager · SHDesigns Ethernet Do…)
- [CVE-2016-6578](https://cve.now/CVE-2016-6578.md): CodeLathe FileCloud, version 13.0.0.32841 and earlier, is vulnerable to cross-site request forgery (CSRF) (no CVSS, CodeLathe FileCloud)
- [CVE-2016-9482](https://cve.now/CVE-2016-9482.md): PHP FormMail Generator generates PHP code for standard web forms, and the code generated is vulnerable to authentication bypass (no CVSS, PHP FormMail Generator)
- [CVE-2016-9483](https://cve.now/CVE-2016-9483.md): PHP FormMail Generator generates PHP code for standard web forms, and the code generated is vulnerable to unsafe deserialization of… (no CVSS, PHP FormMail Generator)
- [CVE-2016-9484](https://cve.now/CVE-2016-9484.md): PHP FormMail Generator generates PHP code for standard web forms, and the code generated does not properly validate user input folder… (no CVSS, PHP FormMail Generator)
- [CVE-2016-9485](https://cve.now/CVE-2016-9485.md): On Windows endpoints, the SecureConnector agent is vulnerable to privilege escalation whereby an authenticated unprivileged user can… (no CVSS, Microsoft Windows SecureConnector agent)
- [CVE-2016-9486](https://cve.now/CVE-2016-9486.md): On Windows endpoints, the SecureConnector agent is vulnerable to privilege escalation whereby an authenticated unprivileged user can… (no CVSS, Microsoft Windows SecureConnector agent)
- [CVE-2016-9487](https://cve.now/CVE-2016-9487.md): EpubCheck 4.0.1 is vulnerable to external XML entity processing attacks (no CVSS, EpubCheck)
- [CVE-2016-9489](https://cve.now/CVE-2016-9489.md): ManageEngine Applications Manager 12 and 13 is vulnerable to privilege escalation and authentication bypass (no CVSS, ManageEngine Applications Manager)
- [CVE-2016-9491](https://cve.now/CVE-2016-9491.md): ManageEngine Applications Manager 12 and 13 is vulnerable to privilege escalation due to improper restriction of an XML external entity (no CVSS, ManageEngine Applications Manager)
- [CVE-2016-9492](https://cve.now/CVE-2016-9492.md): PHP forms generated using the PHP FormMail Generator are vulnerable to unrestricted upload of dangerous file types (no CVSS, PHP FormMail Generator)
- [CVE-2016-9493](https://cve.now/CVE-2016-9493.md): PHP forms generated using the PHP FormMail Generator are vulnerable to stored cross-site scripting (no CVSS, PHP FormMail Generator)
- [CVE-2016-9494](https://cve.now/CVE-2016-9494.md): Hughes high-performance broadband satellite modems, models HN7740S DW7000 HN7000S/SM, are potentially vulnerable to improper input… (no CVSS, Hughes Satellite Modem HN7740S · Hughes Satellite Modem… +1)
- [CVE-2016-9495](https://cve.now/CVE-2016-9495.md): Hughes high-performance broadband satellite modems, models HN7740S DW7000 HN7000S/SM, uses hard coded credentials (no CVSS, Hughes Satellite Modem HN7740S · Hughes Satellite Modem… +1)
- [CVE-2016-9496](https://cve.now/CVE-2016-9496.md): Hughes high-performance broadband satellite modems, models HN7740S DW7000 HN7000S/SM, lacks authentication to access certain pages (no CVSS, Hughes Satellite Modem HN7740S · Hughes Satellite Modem… +1)
- [CVE-2016-9497](https://cve.now/CVE-2016-9497.md): Hughes high-performance broadband satellite modems, models HN7740S DW7000 HN7000S/SM, is vulnerable to an authentication bypass using an… (no CVSS, Hughes Satellite Modem HN7740S · Hughes Satellite Modem… +1)
- [CVE-2016-9498](https://cve.now/CVE-2016-9498.md): ManageEngine Applications Manager 12 and 13, allows unserialization of unsafe Java objects (no CVSS, ManageEngine Applications Manager)
- [CVE-2016-9499](https://cve.now/CVE-2016-9499.md): The Accellion FTP server prior to version FTA\_9\_12\_220 is vulnerable to cross-site scripting. (no CVSS, Accellion FTP Server)
- [CVE-2016-9500](https://cve.now/CVE-2016-9500.md): The Accellion FTP server prior to version FTA\_9\_12\_220 is vulnerable to informaiton exposure (no CVSS, Accellion FTP Server)
- [CVE-2017-13091](https://cve.now/CVE-2017-13091.md): The P1735 IEEE standard describes flawed methods for encrypting electronic-design intellectual property (IP), including improperly… (no CVSS, IEEE Standard)
- [CVE-2017-13092](https://cve.now/CVE-2017-13092.md): The P1735 IEEE standard describes flawed methods for encrypting electronic-design intellectual property (IP), including improperly… (no CVSS, IEEE Standard)
- [CVE-2017-13093](https://cve.now/CVE-2017-13093.md): The P1735 IEEE standard describes flawed methods for encrypting electronic-design intellectual property (IP), including modification of… (no CVSS, IEEE Standard)
- [CVE-2017-13094](https://cve.now/CVE-2017-13094.md): The P1735 IEEE standard describes flawed methods for encrypting electronic-design intellectual property (IP), including modification of… (no CVSS, IEEE Standard)
- [CVE-2017-13095](https://cve.now/CVE-2017-13095.md): The P1735 IEEE standard describes flawed methods for encrypting electronic-design intellectual property (IP), including modification of a… (no CVSS, IEEE Standard)
- [CVE-2017-13096](https://cve.now/CVE-2017-13096.md): The P1735 IEEE standard describes flawed methods for encrypting electronic-design intellectual property (IP), including modification of… (no CVSS, IEEE Standard)
- [CVE-2017-13097](https://cve.now/CVE-2017-13097.md): The P1735 IEEE standard describes flawed methods for encrypting electronic-design intellectual property (IP), including modification of… (no CVSS, IEEE Standard)
- [CVE-2018-10631](https://cve.now/CVE-2018-10631.md): Medtronic N'Vision Clinician Programmer Protection Mechanism Failure (CVSS 6.3, Medtronic 8840 N’Vision Clinician Programmer · Medtronic 88…)
- [CVE-2018-8847](https://cve.now/CVE-2018-8847.md): Eaton 9000X DriveA versions 2.0.29 and prior has a stack-based buffer overflow vulnerability, which may allow remote code execution. (no CVSS, ICS-CERT Eaton 9000X Drive)
- [CVE-2018-1000206](https://cve.now/CVE-2018-1000206.md): JFrog Artifactory version since 5.11 contains a Cross ite Request Forgery (CSRF) vulnerability in UI rest endpoints that can result in… (no CVSS)
- [CVE-2018-1000207](https://cve.now/CVE-2018-1000207.md): MODX Revolution version \<=2.6.4 contains a Incorrect Access Control vulnerability in Filtering user parameters before passing them into… (no CVSS, modx/revolution)
- [CVE-2018-1000208](https://cve.now/CVE-2018-1000208.md): MODX Revolution version \<=2.6.4 contains a Directory Traversal vulnerability in /core/model/modx/modmanagerrequest.class.php that can… (no CVSS)
- [CVE-2018-1000209](https://cve.now/CVE-2018-1000209.md): Sensu, Inc. (no CVSS)
- [CVE-2018-1000210](https://cve.now/CVE-2018-1000210.md): YamlDotNet version 4.3.2 and earlier contains a Insecure Direct Object Reference vulnerability in The default behavior of… (no CVSS, YamlDotNet · YamlDotNet.Signed)
- [CVE-2018-1000211](https://cve.now/CVE-2018-1000211.md): Doorkeeper version 4.2.0 and later contains a Incorrect Access Control vulnerability in Token revocation API's authorized method that can… (no CVSS, doorkeeper)
- [CVE-2018-10018](https://cve.now/CVE-2018-10018.md): The GDASPAMLib.AntiSpam ActiveX control ASK\\GDASpam.dll in G DATA Total Security 25.4.0.3 has a buffer overflow via a long IsBlackListed… (no CVSS)
- [CVE-2018-10098](https://cve.now/CVE-2018-10098.md): In MicroWorld eScan Internet Security Suite (ISS) for Business 14.0.1400.2029, the driver econceal.sys allows a non-privileged user to… (no CVSS)
- [CVE-2018-1245](https://cve.now/CVE-2018-1245.md): Authorization ByPass Vulnerability (CVSS 9.0, RSA Identity Governance and Lifecycle)
- [CVE-2018-1255](https://cve.now/CVE-2018-1255.md): Reflected Cross-Site Scripting Vulnerability (CVSS 6.1, RSA Identity Governance and Lifecycle)
- [CVE-2018-7535](https://cve.now/CVE-2018-7535.md): An issue was discovered in TotalAV v4.1.7. (no CVSS)
- [CVE-2017-1367](https://cve.now/CVE-2017-1367.md): IBM Security Identity Governance and Intelligence Virtual Appliance 5.2 through 5.2.3.2 stores sensitive information in URL parameters. (CVSS 3.7, IBM Security Identity Governance and Intelligence)
- [CVE-2017-1395](https://cve.now/CVE-2017-1395.md): IBM Security Identity Governance and Intelligence Virtual Appliance 5.2 through 5.2.3.2 could allow a remote attacker to obtain sensitive… (CVSS 5.9, IBM Security Identity Governance and Intelligence)
- [CVE-2018-14047](https://cve.now/CVE-2018-14047.md): An issue has been found in PNGwriter 0.7.0. (no CVSS)
- [CVE-2018-14048](https://cve.now/CVE-2018-14048.md): An issue has been found in libpng 1.6.34. (no CVSS)
- [CVE-2018-14049](https://cve.now/CVE-2018-14049.md): An issue has been found in libwav through 2017-04-20. (no CVSS)
- [CVE-2018-14050](https://cve.now/CVE-2018-14050.md): An issue has been found in libwav through 2017-04-20. (no CVSS)
- [CVE-2018-14051](https://cve.now/CVE-2018-14051.md): The function wav\_read in libwav.c in libwav through 2017-04-20 has an infinite loop. (no CVSS)
- [CVE-2018-14052](https://cve.now/CVE-2018-14052.md): An issue has been found in libwav through 2017-04-20. (no CVSS)
- [CVE-2018-9067](https://cve.now/CVE-2018-9067.md): The Lenovo Help Android app versions earlier than 6.1.2.0327 had insufficient access control for some functions which, if exploited, could… (no CVSS, Lenovo Group Lenovo Help Android application)
- [CVE-2018-9070](https://cve.now/CVE-2018-9070.md): For the Lenovo Smart Assistant Android app versions earlier than 12.1.82, an attacker with physical access to the smart speaker can, by… (no CVSS, Lenovo Group Lenovo Smart Assistant)
- [CVE-2018-14044](https://cve.now/CVE-2018-14044.md): The RateTransposer::setChannels function in RateTransposer.cpp in libSoundTouch.a in Olli Parviainen SoundTouch 2.0 allows remote… (no CVSS)
- [CVE-2018-14045](https://cve.now/CVE-2018-14045.md): The FIRFilter::evaluateFilterMulti function in FIRFilter.cpp in libSoundTouch.a in Olli Parviainen SoundTouch 2.0 allows remote attackers… (no CVSS)
- [CVE-2018-14046](https://cve.now/CVE-2018-14046.md): Exiv2 0.26 has a heap-based buffer over-read in WebPImage::decodeChunks in webpimage.cpp. (no CVSS)
- [CVE-2018-14040](https://cve.now/CVE-2018-14040.md): In Bootstrap before 4.1.2, XSS is possible in the collapse data-parent attribute. (no CVSS, bootstrap · org.webjars:bootstrap +3)
- [CVE-2018-14041](https://cve.now/CVE-2018-14041.md): In Bootstrap before 4.1.2, XSS is possible in the data-target property of scrollspy. (no CVSS, bootstrap · typo3/cms-core +4)
- [CVE-2018-14042](https://cve.now/CVE-2018-14042.md): In Bootstrap before 4.1.2, XSS is possible in the data-container property of tooltip. (no CVSS, bootstrap · org.webjars:bootstrap +3)
- [CVE-2018-14043](https://cve.now/CVE-2018-14043.md): mstdlib (aka the M Standard Library for C) 1.2.0 has incorrect file access control in situations where M\_fs\_perms\_can\_access attempts to… (no CVSS)
- [CVE-2018-6969](https://cve.now/CVE-2018-6969.md): VMware Tools (10.x and prior before 10.3.0) contains an out-of-bounds read vulnerability in HGFS. (no CVSS, VMware Tools)
- [CVE-2018-14036](https://cve.now/CVE-2018-14036.md): Directory Traversal with ../ sequences occurs in AccountsService before 0.6.50 because of an insufficient path check in… (no CVSS)
- [CVE-2018-14029](https://cve.now/CVE-2018-14029.md): CSRF vulnerability in admin/user/edit in Creatiwity wityCMS 0.6.2 allows an attacker to take over a user account, as demonstrated by… (no CVSS)
- [CVE-2018-14031](https://cve.now/CVE-2018-14031.md): An issue was discovered in the HDF HDF5 1.8.20 library. (no CVSS)
- [CVE-2018-14033](https://cve.now/CVE-2018-14033.md): An issue was discovered in the HDF HDF5 1.8.20 library. (no CVSS)
- [CVE-2018-14034](https://cve.now/CVE-2018-14034.md): An issue was discovered in the HDF HDF5 1.8.20 library. (no CVSS)
- [CVE-2018-14035](https://cve.now/CVE-2018-14035.md): An issue was discovered in the HDF HDF5 1.8.20 library. (no CVSS)
- [CVE-2018-14054](https://cve.now/CVE-2018-14054.md): A double free exists in the MP4StringProperty class in mp4property.cpp in MP4v2 2.0.0. (no CVSS)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/archive/2018-07-13
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.