CVEs published August 1, 2018
79 CVEs were published on August 1, 2018: 2 critical, 11 high. Browse them by severity, product and exploitation status.
- Published
- 79
- Critical
- 2
- High
- 11
- Medium
- 21
- Low
- 6
- Unrated
- 39
- Now in CISA KEV
- 0
- Fix available
- 24
Most affected products
- The Curl Project curl
- 6
- Computerinsel Photoline
- 3
- Intel Saffron MemoryBase
- 3
- Intel Smart Sound Technology
- 3
- Cisco Small Business 300 Series Managed Switches unknown
- 2
- de.tracetronic.jenkins.plugins:ecutest
- 2
- Foxit
- 2
- opensuse openbuildservice
- 2
- The Foreman Project foreman
- 2
- The Jasper Project jasper
- 2
Critical 2
High 11
- CVE-2018-3924An exploitable use-after-free vulnerability exists in the JavaScript engine of Foxit Software's Foxit PDF Reader version 9.1.5096.Foxit
- CVE-2018-3939An exploitable use-after-free vulnerability exists in the JavaScript engine of Foxit Software's PDF Reader, version 9.1.0.5096.Foxit
- CVE-2018-3847Multiple exploitable buffer overflow vulnerabilities exist in image parsing functionality of the CFITSIO library version 3.42.NASA CFITSIO
- CVE-2018-8034The host name verification when using TLS with the WebSocket client was missing.Apache Software Foundation Apache Tomcat · org.apache.tomca…
- CVE-2018-10897A directory traversal issue was found in reposync, a part of yum-utils, where reposync fails to sanitize paths in remote repository…The RPM Project yum-utils:
- CVE-2018-1595IBM Spectrum Symphony and Platform Symphony 7.1.2 and 7.2.0.2 could allow an authenticated user to execute arbitrary commands due to…IBM Spectrum Symphony
- CVE-2016-8654A heap-buffer overflow vulnerability was found in QMFB code in JPC codec caused by buffer being allocated with too small size.The Jasper Project jasper
- CVE-2018-3921A memory corruption vulnerability exists in the PSD-parsing functionality of Computerinsel Photoline 20.54.Computerinsel Photoline
- CVE-2018-3922A memory corruption vulnerability exists in the ANI-parsing functionality of Computerinsel Photoline 20.54.Computerinsel Photoline
- CVE-2018-3923A memory corruption vulnerability exists in the PCX-parsing functionality of Computerinsel Photoline 20.54.Computerinsel Photoline
- CVE-2016-8648It was found that the Karaf container used by Red Hat JBoss Fuse 6.x, and Red Hat JBoss A-MQ 6.x, deserializes objects passed to MBeans…Apache Software Foundation Karaf
Medium, low and unrated 66
- CVE-2015-9262_XcursorThemeInherits in library.c in libXcursor before 1.1.15 allows remote attackers to cause denial of service or potentially code…
- CVE-2018-10624Johnson Controls Metasys and BCPro Generation of Error Message Containing Sensitive InformationJohnson Controls Metasys System · Johnson Controls BCPro
- CVE-2018-0391A vulnerability in the password change function of Cisco Prime Collaboration Provisioning could allow an authenticated, remote attacker to…Cisco Prime Collaboration Provisioning unknown
- CVE-2018-0397A vulnerability in Cisco AMP for Endpoints Mac Connector Software installed on Apple macOS 10.12 could allow an unauthenticated, remote…Cisco AMP for Endpoints Mac Connector unknown
- CVE-2018-0406A vulnerability in the web-based management interface of Cisco Web Security Appliance (WSA) could allow an unauthenticated, remote…Cisco Web Security Appliance unknown
- CVE-2018-0407A vulnerability in the web-based management interface of Cisco Small Business 300 Series (Sx300) Managed Switches could allow an…Cisco Small Business 300 Series Managed Switches unknown
- CVE-2018-0408A vulnerability in the web-based management interface of Cisco Small Business 300 Series (Sx300) Managed Switches could allow an…Cisco Small Business 300 Series Managed Switches unknown
- CVE-2018-0411A vulnerability in the web-based management interface of Cisco Unified Communications Manager could allow an unauthenticated, remote…Cisco Unified Communications Manager unknown
- CVE-2018-0413A vulnerability in the web-based management interface of Cisco Identity Services Engine (ISE) could allow an unauthenticated, remote…Cisco Identity Services Engine unknown
- CVE-2018-14777An issue was discovered in DataLife Engine (DLE) through 13.0.
- CVE-2016-8640A SQL injection vulnerability in pycsw all versions before 2.0.2, 1.10.5 and 1.8.6 that leads to read and extract of any data from any…https://github.com/geopython pycsw · pycsw
- CVE-2018-10618Davolink DVW-3200N all version prior to Version 1.00.06.Davolink DVW-3200N
- CVE-2016-8609It was found that the keycloak before 2.3.0 did not implement authentication flow correctly.Red Hat keycloak · org.keycloak:keycloak-core
- CVE-2016-9583An out-of-bounds heap read vulnerability was found in the jpc_pi_nextpcrl() function of jasper before 2.0.6 when processing crafted input.The Jasper Project jasper
- CVE-2018-10894It was found that SAML authentication in Keycloak 3.4.3.Final incorrectly authenticated expired certificates.Red Hat keycloak · org.keycloak:keycloak-saml-adapter-co… +1
- CVE-2018-10896The default cloud-init configuration, in cloud-init 0.6.2 and newer, included "ssh_deletekeys: 0", disabling cloud-init's deletion of ssh…Canonical cloud-init
- CVE-2016-8651An input validation flaw was found in the way OpenShift 3 handles requests for images.Red Hat OpenShift Enterprise
- CVE-2016-9572A NULL pointer dereference flaw was found in the way openjpeg 2.1.2 decoded certain input images.The OpenJPEG Project openjpeg
- CVE-2016-9579A flaw was found in the way Ceph Object Gateway would process cross-origin HTTP requests if the CORS policy was set to allow origin on a…Red Hat ceph
- CVE-2016-9580An integer overflow vulnerability was found in tiftoimage function in openjpeg 2.1.2, resulting in heap buffer overflow.The OpenJPEG Project openjpeg2
- CVE-2017-5692Out-of-bounds read condition in older versions of some Intel Graphics Driver for Windows code branches allows local users to perform a…Mobile, Desktop, Server, Workstation, and Embedded processo…
- CVE-2018-12466openbuildservice allowed deleting packages via project linksopensuse openbuildservice
- CVE-2018-12467delete package via link exploit in open buildserviceopensuse openbuildservice
- CVE-2018-3650Insufficient Input Validation in Bleach module in INTEL Distribution for Python versions prior to IDP 2018 Update 2 allows unprivileged…Intel Distribution for Python
- CVE-2018-3662Escalation of privilege in Intel Saffron MemoryBase before version 11.4 potentially allows an authorized user of the Saffron application…Intel Saffron MemoryBase
Show all 66 entriesShow fewer entries
- CVE-2018-3663Escalation of privilege in Intel Saffron MemoryBase before 11.4 allows an authenticated user access to privileged information.Intel Saffron MemoryBase
- CVE-2018-3666Driver module in Intel Smart Sound Technology before version 9.21.00.3541 potentially allows a local attacker to execute arbitrary code as…Intel Smart Sound Technology
- CVE-2018-3670Driver module in Intel Smart Sound Technology before version 9.21.00.3541 potentially allows a local attacker to execute arbitrary code as…Intel Smart Sound Technology
- CVE-2018-3671Escalation of privilege in Intel Saffron admin application before 11.4 allows an authenticated user to access unauthorized information.Intel Saffron MemoryBase
- CVE-2018-3672Driver module in Intel Smart Sound Technology before version 9.21.00.3541 potentially allows a local attacker to execute arbitrary code as…Intel Smart Sound Technology
- CVE-2016-8608JBoss BRMS 6 and BPM Suite 6 are vulnerable to a stored XSS via business process editor.Red Hat BRMS
- CVE-2016-8641A privilege escalation vulnerability was found in nagios 4.2.x that occurs in daemon-init.in when creating necessary files and insecurely…Nagios Enterprises nagios
- CVE-2016-8653It was found that the JMX endpoint of Red Hat JBoss Fuse 6, and Red Hat A-MQ 6 deserializes the credentials passed to it.Red Hat Fuse
- CVE-2016-9581An infinite loop vulnerability in tiftoimage that results in heap buffer overflow in convert_32s_C1P1 was found in openjpeg 2.1.2.The OpenJPEG Project openjpeg2
- CVE-2018-10916It has been discovered that lftp up to and including version 4.8.3 does not properly sanitize remote file names, leading to a loss of…[UNKNOWN] lftp
- CVE-2016-8635It was found that Diffie Hellman Client key exchange handling in NSS 3.21.x was vulnerable to small subgroup confinement attack.Mozilla nss
- CVE-2016-8637A local information disclosure issue was found in dracut before 045 when generating initramfs images with world-readable permissions when…The Dracut Project dracut
- CVE-2016-8639It was found that foreman before 1.13.0 is vulnerable to a stored XSS via an organization or location name.The Foreman Project foreman
- CVE-2018-1999025A man in the middle vulnerability exists in Jenkins TraceTronic ECU-TEST Plugin 2.3 and earlier in ATXPublisher.java, ATXValidator.java…de.tracetronic.jenkins.plugins:ecutest
- CVE-2018-1999026A server-side request forgery vulnerability exists in Jenkins TraceTronic ECU-TEST Plugin 2.3 and earlier in ATXPublisher.java that allows…de.tracetronic.jenkins.plugins:ecutest
- CVE-2018-1999027An exposure of sensitive information vulnerability exists in Jenkins SaltStack Plugin 3.1.6 and earlier in SaltAPIBuilder.java…org.jenkins-ci.plugins:saltstack
- CVE-2018-1999028An exposure of sensitive information vulnerability exists in Jenkins Accurev Plugin 0.7.16 and earlier in AccurevSCM.java that allows…org.jenkins-ci.plugins:accurev
- CVE-2018-1999029A cross-site scripting vulnerability exists in Jenkins Shelve Project Plugin 1.5 and earlier in ShelveProjectAction/index.jelly…org.jenkins-ci.plugins:shelve-project-plugin
- CVE-2018-1999030An exposure of sensitive information vulnerability exists in Jenkins Maven Artifact ChoiceListProvider (Nexus) Plugin 1.3.1 and earlier in…org.jenkins-ci.plugins:maven-artifact-choicelistprovider
- CVE-2018-1999031An exposure of sensitive information vulnerability exists in Jenkins meliora-testlab Plugin 1.14 and earlier in TestlabNotifier.java that…org.jenkins-ci.plugins:meliora-testlab
- CVE-2018-1999032A data modification vulnerability exists in Jenkins Agiletestware Pangolin Connector for TestRail Plugin 2.1 and earlier in…org.jenkins-ci.plugins:pangolin-testrail-connector
- CVE-2018-1999033An exposure of sensitive information vulnerability exists in Jenkins Anchore Container Image Scanner Plugin 10.16 and earlier in…org.jenkins-ci.plugins:anchore-container-scanner
- CVE-2018-1999034A man in the middle vulnerability exists in Jenkins Inedo ProGet Plugin 0.8 and earlier in ProGetApi.java, ProGetConfig.java…com.inedo.proget:inedo-proget
- CVE-2018-1999035A man in the middle vulnerability exists in Jenkins Inedo BuildMaster Plugin 1.3 and earlier in BuildMasterConfiguration.java…com.inedo.buildmaster:inedo-buildmaster
- CVE-2018-1999036An exposure of sensitive information vulnerability exists in Jenkins SSH Agent Plugin 1.15 and earlier in SSHAgentStepExecution.java that…org.jenkins-ci.plugins:ssh-agent
- CVE-2018-1999037A data modification vulnerability exists in Jenkins Resource Disposer Plugin 0.11 and earlier in AsyncResourceDisposer.java that allows…org.jenkins-ci.plugins:resource-disposer
- CVE-2018-1999038A confused deputy vulnerability exists in Jenkins Publisher Over CIFS Plugin 0.10 and earlier in CifsPublisherPluginDescriptor.java that…org.jenkins-ci.plugins:publish-over-cifs
- CVE-2018-1999039A server-side request forgery vulnerability exists in Jenkins Confluence Publisher Plugin 2.0.1 and earlier in ConfluenceSite.java that…org.jenkins-ci.plugins:confluence-publisher
- CVE-2018-1999040An exposure of sensitive information vulnerability exists in Jenkins Kubernetes Plugin 1.10.1 and earlier in KubernetesCloud.java that…org.csanchez.jenkins.plugins:kubernetes
- CVE-2018-1999041An exposure of sensitive information vulnerability exists in Jenkins Tinfoil Security Plugin 1.6.1 and earlier in TinfoilScanRecorder.java…com.tinfoilsecurity.plugins:tinfoil-scan
- CVE-2016-8634A vulnerability was found in foreman 1.14.0.The Foreman Project foreman
- CVE-2016-8615A flaw was found in curl before version 7.51.The Curl Project curl
- CVE-2016-8616A flaw was found in curl before version 7.51.0 When re-using a connection, curl was doing case insensitive comparisons of user name and…The Curl Project curl
- CVE-2016-8619The function `read_data()` in security.c in curl before version 7.51.0 is vulnerable to memory double free.The Curl Project curl
- CVE-2016-8620The 'globbing' feature in curl before version 7.51.0 has a flaw that leads to integer overflow and out-of-bounds read via user controlled…The Curl Project curl
- CVE-2016-8623A flaw was found in curl before version 7.51.0.The Curl Project curl
- CVE-2016-8625curl before version 7.51.0 uses outdated IDNA 2003 standard to handle International Domain Names and this may lead users to potentially…The Curl Project curl
- CVE-2016-9573An out-of-bounds read vulnerability was found in OpenJPEG 2.1.2, in the j2k_to_image tool.The OpenJPEG Project openjpeg
- CVE-2018-11050Dell EMC NetWorker versions between 9.0 and 9.1.1.8 through 9.2.1.3, and the version 18.1.0.1 contain a Clear-Text authentication over…Dell EMC Networker
- CVE-2018-14775tss_alloc in sys/arch/i386/i386/gdt.c in OpenBSD 6.2 and 6.3 has a Local Denial of Service (system crash) due to incorrect I/O port access…
- CVE-2018-14776Click Studios Passwordstate before 8.3 Build 8397 allows XSS by authenticated users via an uploaded HTML document.