CVEs published June 1, 2018
151 CVEs were published on June 1, 2018: 0 critical, 3 high.
- Published
- 151
- Critical
- 0
- High
- 3
- Medium
- 3
- Low
- 0
- Unrated
- 145
- Now in CISA KEV
- 0
- Fix available
- 20
Most affected products
- F5 Networks BIG-IP
- 7
- Huawei Technologies Co. 1288H V5; 2288H V5; 2488 V5 ; CH121…
- 3
- Talos Natus
- 3
- org.graylog2:graylog2-server
- 2
- Synology Drive
- 2
- closure-util
- 1
- F5 Networks BIG-IP · F5 Networks Enterprise Manager
- 1
- HackerOne air-sdk node module · air-sdk
- 1
- HackerOne apk-parser2 node module · apk-parser2
- 1
- HackerOne apk-parser3 node module · apk-parser3
- 1
High 3
- CVE-2017-2852An exploitable denial-of-service vulnerability exists in the unserialization of lists functionality of Natus Xltek NeuroWorks 8.Talos Natus
- CVE-2017-2858An exploitable denial-of-service vulnerability exists in the traversal of lists functionality of Natus Xltek NeuroWorks 8.Talos Natus
- CVE-2017-2860An exploitable denial-of-service vulnerability exists in the lookup entry functionality of KeyTrees in Natus Xltek NeuroWorks 8.Talos Natus
Medium, low and unrated 148
- CVE-2018-1002100In Kubernetes versions 1.5.x, 1.6.x, 1.7.x, 1.8.x, and prior to version 1.9.6, the kubectl cp command insecurely handles tar data returned fKubernetes · k8s.io/kubernetes
- CVE-2018-11143Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 1 of 46).
- CVE-2018-11144Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 2 of 46).
- CVE-2018-11145Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 3 of 46).
- CVE-2018-11146Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 4 of 46).
- CVE-2018-11147Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 5 of 46).
- CVE-2018-11148Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 6 of 46).
- CVE-2018-11149Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 7 of 46).
- CVE-2018-11150Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 8 of 46).
- CVE-2018-11151Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 9 of 46).
- CVE-2018-11152Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 10 of 46).
- CVE-2018-11153Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 11 of 46).
- CVE-2018-11154Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 12 of 46).
- CVE-2018-11155Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 13 of 46).
- CVE-2018-11156Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 14 of 46).
- CVE-2018-11157Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 15 of 46).
- CVE-2018-11158Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 16 of 46).
- CVE-2018-11159Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 17 of 46).
- CVE-2018-11160Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 18 of 46).
- CVE-2018-11161Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 19 of 46).
- CVE-2018-11162Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 20 of 46).
- CVE-2018-11163Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 21 of 46).
- CVE-2018-11164Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 22 of 46).
- CVE-2018-11165Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 23 of 46).
- CVE-2018-11166Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 24 of 46).
- CVE-2018-11167Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 25 of 46).
- CVE-2018-11168Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 26 of 46).
- CVE-2018-11169Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 27 of 46).
- CVE-2018-11170Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 28 of 46).
- CVE-2018-11171Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 29 of 46).
- CVE-2018-11172Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 30 of 46).
- CVE-2018-11173Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 31 of 46).
- CVE-2018-11174Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 32 of 46).
- CVE-2018-11175Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 33 of 46).
- CVE-2018-11176Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 34 of 46).
- CVE-2018-11177Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 35 of 46).
- CVE-2018-11178Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 36 of 46).
- CVE-2018-11179Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 37 of 46).
- CVE-2018-11180Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 38 of 46).
- CVE-2018-11181Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 39 of 46).
- CVE-2018-11182Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 40 of 46).
- CVE-2018-11183Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 41 of 46).
- CVE-2018-11184Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 42 of 46).
- CVE-2018-11185Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 43 of 46).
- CVE-2018-11186Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 44 of 46).
- CVE-2018-11187Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 45 of 46).
- CVE-2018-11188Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 46 of 46).
- CVE-2018-11189Quest DR Series Disk Backup software version before 4.0.3.1 allows privilege escalation (issue 1 of 6).
- CVE-2018-11190Quest DR Series Disk Backup software version before 4.0.3.1 allows privilege escalation (issue 2 of 6).
- CVE-2018-11191Quest DR Series Disk Backup software version before 4.0.3.1 allows privilege escalation (issue 3 of 6).
- CVE-2018-11192Quest DR Series Disk Backup software version before 4.0.3.1 allows privilege escalation (issue 4 of 6).
- CVE-2018-11193Quest DR Series Disk Backup software version before 4.0.3.1 allows privilege escalation (issue 5 of 6).
- CVE-2018-11194Quest DR Series Disk Backup software version before 4.0.3.1 allows privilege escalation (issue 6 of 6).
- CVE-2018-11522Yosoro 1.0.4 has stored XSS.
- CVE-2018-11564Stored XSS in YOOtheme Pagekit 1.0.13 and earlier allows a user to upload malicious code via the picture upload feature.pagekit/pagekit
- CVE-2018-11195Mahara 17.04 before 17.04.8 and 17.10 before 17.10.5 and 18.04 before 18.04.1 are vulnerable to the browser "back and refresh" attack.
- CVE-2018-11196Mahara 17.04 before 17.04.8 and 17.10 before 17.10.5 and 18.04 before 18.04.1 can be used as medium to transmit viruses by placing infected
- CVE-2018-11538servlet/UserServlet in SearchBlox 8.6.6 has CSRF via the u_name, u_passwd1, u_passwd2, role, and X-XSRF-TOKEN POST parameters because of CSR
- CVE-2018-3756Hyperledger Iroha versions v1.0_beta and v1.0.0_beta-1 are vulnerable to transaction and block signature verification bypass in the transact
- CVE-2018-3757Command injection exists in pdf-image v2.0.0 due to an unescaped string parameter.pdf-image
- CVE-2018-3809Information exposure through directory listings in serve 6.5.3 allows directory listing and file access even when they have been set to be iserve
- CVE-2016-10574apk-parser3 is a module to extract Android Manifest info from an APK file.HackerOne apk-parser3 node module · apk-parser3
- CVE-2016-10575Kindlegen is a simple Node.js wrapper of the official kindlegen program.HackerOne kindlegen node module · kindlegen
- CVE-2016-10576Fuseki server wrapper and management API in fuseki before 1.0.1 downloads binary resources over HTTP, which leaves it vulnerable to MITM attHackerOne fuseki node module · fuseki
- CVE-2016-10579Chromedriver is an NPM wrapper for selenium ChromeDriver.HackerOne chromedriver node module · chromedriver
- CVE-2016-10580nodewebkit is an installer for node-webkit.HackerOne nodewebkit node module · nodewebkit
- CVE-2016-10581Steroids is PhoneGap on Steroids, providing native UI elements, multiple WebViews and enhancements for better developer productivity.HackerOne steroids node module · steroids
- CVE-2016-10582closurecompiler is a Closure Compiler for node.js.HackerOne closurecompiler node module · closurecompiler
- CVE-2016-10583closure-utils is Utilities for Closure Library based projects.closure-util
- CVE-2016-10585libxl provides Node bindings for the libxl library for reading and writing excel (XLS and XLSX) spreadsheets.HackerOne libxl node module · libxl
- CVE-2016-10587wasdk is a toolkit for creating WebAssembly modules.HackerOne wasdk node module · wasdk
- CVE-2016-10588nw is an installer for nw.js.HackerOne nw node module · nw
- CVE-2016-10592jser-stat is a JSer.info stat library.HackerOne jser-stat node module · jser-stat
- CVE-2016-10594ipip is a Node.js module to query geolocation information for an IP or domain, based on database by ipip.net.HackerOne ipip node module · ipip
- CVE-2016-10595jdf-sass is a fork from node-sass, jdf use only.HackerOne jdf-sass node module · jdf-sass
- CVE-2016-10596imageoptim is a Node.js wrapper for some images compression algorithms.HackerOne imageoptim node module · imageoptim
- CVE-2016-10597cobalt-cli downloads resources over HTTP, which leaves it vulnerable to MITM attacks.HackerOne cobalt-cli node module · cobalt-cli
- CVE-2016-10598arrayfire-js is a module for ArrayFire for the Node.js platform.HackerOne arrayfire-js node module · arrayfire-js
- CVE-2016-10599sauce-connect is a Node.js wrapper over the SauceLabs SauceConnect.jar program for establishing a secure tunnel for intranet testing.HackerOne sauce-connect node module · sauce-connect
- CVE-2016-10600webrtc-native uses WebRTC from chromium project.HackerOne webrtc-native node module · webrtc-native
- CVE-2016-10602haxe is a cross-platform toolkit haxe downloads zipped resources over HTTP, which leaves it vulnerable to MITM attacks.HackerOne haxe node module · haxe
- CVE-2016-10603air-sdk is a NPM wrapper for the Adobe AIR SDK.HackerOne air-sdk node module · air-sdk
- CVE-2016-10604dalek-browser-chrome is Google Chrome bindings for DalekJS.HackerOne dalek-browser-chrome node module · dalek-browser-…
- CVE-2016-10605dalek-browser-ie is Internet Explorer bindings for DalekJS.HackerOne dalek-browser-ie node module · dalek-browser-ie
- CVE-2016-10606grunt-webdriver-qunit is a grunt plugin to run qunit with webdriver in grunt grunt-webdriver-qunit downloads binary resources over HTTP, whiHackerOne grunt-webdriver-qunit node module · grunt-webdriv…
- CVE-2016-10607openframe-glsviewer is a Openframe extension which adds support for shaders via glslViewer.HackerOne openframe-glslviewer node module · openframe-glsl…
- CVE-2016-10608robot-js is a module for native system automation for node.js.HackerOne robot-js node module · robot-js
- CVE-2016-10609chromedriver126 is chromedriver version 1.26 for linux OS.HackerOne chromedriver126 node module · chromedriver126
- CVE-2016-10610unicode-json is a unicode lookup table.HackerOne unicode-json node module · unicode-json
- CVE-2016-10612dalek-browser-ie-canary is Internet Explorer bindings for DalekJS.HackerOne dalek-browser-ie-canary node module · dalek-brows…
- CVE-2016-10613bionode-sra is a Node.js wrapper for SRA Toolkit.HackerOne bionode-sra node module · bionode-sra
- CVE-2016-10614httpsync is a port of libcurl to node.js.HackerOne httpsync node module · httpsync
- CVE-2016-10615curses is bindings for the native curses library, a full featured console IO library.HackerOne curses node module · curses
- CVE-2016-10616openframe-image is an Openframe extension which adds support for images via fbi.HackerOne openframe-image node module · openframe-image
- CVE-2016-10617box2d-native downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks.HackerOne box2d-native node module · box2d-native
- CVE-2016-10618node-browser is a wrapper webdriver by nodejs.HackerOne node-browser node module · node-browser
- CVE-2016-10619pennyworth is a natural language templating engine.HackerOne pennyworth node module · pennyworth
- CVE-2016-10620atom-node-module-installer installs node modules for atom-shell applications.HackerOne atom-node-module-installer node module · atom-nod…
- CVE-2016-10621fibjs is a runtime for javascript applictions built on google v8 JS.HackerOne fibjs node module · fibjs
- CVE-2016-10622nodeschnaps is a NodeJS compatibility layer for Java (Rhino).HackerOne nodeschnaps node module · nodeschnaps
- CVE-2016-10623macaca-chromedriver-zxa is a Node.js wrapper for the selenium chromedriver.HackerOne macaca-chromedriver-zxa node module · macaca-chro…
- CVE-2016-10624selenium-chromedriver is a simple utility for downloading the Selenium Webdriver for Google Chrome selenium-chromedriver downloads binary reHackerOne selenium-chromedriver node module · selenium-chro…
- CVE-2016-10625headless-browser-lite is a minimal npm installer for phantomjs and slimerjs with no external dependencies.HackerOne headless-browser-lite node module · headless-brow…
- CVE-2016-10626mystem3 is a NodeJS wrapper for the Yandex MyStem 3.HackerOne mystem3 node module · mystem3
- CVE-2016-10628selenium-wrapper is a selenium server wrapper, including installation and chrome webdriver.HackerOne selenium-wrapper node module · selenium-wrapper
- CVE-2016-10629nw-with-arm is a NW Installer including ARM-Build.HackerOne nw-with-arm node module · nw-with-arm
- CVE-2016-10630install-g-test downloads resources over HTTP, which leaves it vulnerable to MITM attacks.HackerOne install-g-test node module · install-g-test
- CVE-2016-10631jvminstall is a module for downloading and unpacking jvm to local system.HackerOne jvminstall node module · jvminstall
- CVE-2016-10632apk-parser2 is a module which extracts Android Manifest info from an APK file.HackerOne apk-parser2 node module · apk-parser2
- CVE-2016-10633dwebp-bin is a dwebp node.js wrapper that convert WebP into PNG.HackerOne dwebp-bin node module · dwebp-bin
- CVE-2016-10634scala-standalone-bin is a Binary wrapper for ScalaJS.HackerOne scalajs-standalone-bin node module · scalajs-stan…
- CVE-2018-10382MODX Revolution 2.6.3 has XSS.
- CVE-2018-11551AXON PBX 2.02 contains a DLL hijacking vulnerability that could allow an unauthenticated, remote attacker to execute arbitrary code on a tar
- CVE-2018-11552There is a reflected XSS vulnerability in AXON PBX 2.02 via the "AXON->Auto-Dialer->Agents->Name" field.
- CVE-2018-11581Cross-site scripting (XSS) vulnerability on Brother HL series printers allows remote attackers to inject arbitrary web script or HTML via th
- CVE-2018-11670An issue was discovered in GreenCMS v2.3.0603.
- CVE-2018-11671An issue was discovered in GreenCMS v2.3.0603.
- CVE-2018-3743Open redirect in hekto <=0.2.3 when target domain name is used as html filename on server.HackerOne hekto · hekto
- CVE-2018-3746The pdfinfojs NPM module versions <= 0.3.6 has a command injection vulnerability that allows an attacker to execute arbitrary commands on thHackerOne pdfinfojs · pdfinfojs
- CVE-2018-3755XSS in sexstatic <=0.6.2 causes HTML injection in directory name(s) leads to Stored XSS when malicious file is embed with <iframe> element uHackerOne sexstatic · sexstatic
- CVE-2018-11485The MULTIDOTS WooCommerce Quick Reports plugin 1.0.6 and earlier for WordPress is vulnerable to Stored XSS.
- CVE-2018-11486An issue was discovered in the MULTIDOTS Advance Search for WooCommerce plugin 1.0.9 and earlier for WordPress.
- CVE-2018-11628Data input into EMS Master Calendar before 8.0.0.201805210 via URL parameters is not properly sanitized, allowing malicious attackers to sen
- CVE-2018-11652CSV Injection vulnerability in Nikto 2.1.6 and earlier allows remote attackers to inject arbitrary OS commands via the Server field in an HT
- CVE-2018-11655In ImageMagick 7.0.7-20 Q16 x86_64, a memory leak vulnerability was found in the function GetImagePixelCache in MagickCore/cache.c, which al
- CVE-2018-11656In ImageMagick 7.0.7-20 Q16 x86_64, a memory leak vulnerability was found in the function ReadDCMImage in coders/dcm.c, which allows attacke
- CVE-2018-11657ngiflib.c in MiniUPnP ngiflib 0.4 has an infinite loop in DecodeGifImg and LoadGif.
- CVE-2017-17171Some Huawei smart phones have the denial of service (DoS) vulnerability due to the improper processing of malicious parameters.Huawei Technologies Co. HUAWEI Mate 8; HUAWEI P9; HUAWEI P9…
- CVE-2017-6153Features in F5 BIG-IP 13.0.0-13.1.0.3, 12.1.0-12.1.3.1, 11.6.1-11.6.3.1, 11.5.1-11.5.5, or 11.2.1 system that utilizes inflate functionalityF5 Networks BIG-IP
- CVE-2018-11649Hue 3.12 has XSS via the /pig/save/ name and script parameters.
- CVE-2018-11650Graylog before v2.4.4 has an XSS security issue with unescaped text in notifications, related to toastr and util/UserNotification.js.org.graylog2:graylog2-server
- CVE-2018-11651Graylog before v2.4.4 has an XSS security issue with unescaped text in dashboard names, related to components/dashboard/Dashboard.jsx, compoorg.graylog2:graylog2-server
- CVE-2018-5513On F5 BIG-IP 13.1.0-13.1.0.3, 13.0.0, 12.1.0-12.1.3.3, 11.6.1-11.6.3.1, 11.5.1-11.5.5, or 11.2.1, a malformed TLS handshake causes TMM to crF5 Networks BIG-IP
- CVE-2018-5521On F5 BIG-IP 12.1.0-12.1.3.1, 11.6.1-11.6.3.1, 11.5.1-11.5.5, or 11.2.1, carefully crafted URLs can be used to reflect arbitrary content intF5 Networks BIG-IP
- CVE-2018-5522On F5 BIG-IP 13.0.0, 12.0.0-12.1.2, 11.6.1-11.6.3.1, 11.5.1-11.5.5, or 11.2.1, when processing DIAMETER transactions with carefully crafted F5 Networks BIG-IP
- CVE-2018-5523On F5 BIG-IP 13.1.0-13.1.0.3, 13.0.0, 12.1.0-12.1.3.1, 11.6.1-11.6.3.1, 11.5.1-11.5.5, or 11.2.1 and Enterprise Manager 3.1.1, when authentiF5 Networks BIG-IP · F5 Networks Enterprise Manager
- CVE-2018-5524Under certain conditions, on F5 BIG-IP 13.0.0-13.1.0.5, 12.1.0-12.1.3.1, or 11.6.1 HF2-11.6.3.1, virtual servers configured with Client SSL F5 Networks BIG-IP
- CVE-2018-5525A local file vulnerability exists in the F5 BIG-IP Configuration utility on versions 13.0.0, 12.1.0-12.1.2, 11.6.1-11.6.3.1, 11.5.1-11.5.5, F5 Networks BIG-IP
- CVE-2018-5526Under certain conditions, on F5 BIG-IP ASM 13.1.0-13.1.0.5, Behavioral DOS (BADOS) protection may fail during an attack.F5 Networks BIG-IP
- CVE-2018-7949The iBMC (Intelligent Baseboard Management Controller) of some Huawei servers have a privilege escalation vulnerability.Huawei Technologies Co. 1288H V5; 2288H V5; 2488 V5 ; CH121…
- CVE-2018-7950The iBMC (Intelligent Baseboard Management Controller) of some Huawei servers have a JSON injection vulnerability due to insufficient input Huawei Technologies Co. 1288H V5; 2288H V5; 2488 V5 ; CH121…
- CVE-2018-7951The iBMC (Intelligent Baseboard Management Controller) of some Huawei servers have a JSON injection vulnerability due to insufficient input Huawei Technologies Co. 1288H V5; 2288H V5; 2488 V5 ; CH121…
- CVE-2018-7976There is a stored cross-site scripting (XSS) vulnerability in Huawei eSpace Desktop V300R001C00 and V300R001C50 version.Huawei Technologies Co. eSpace Desktop
- CVE-2018-11646webkitFaviconDatabaseSetIconForPageURL and webkitFaviconDatabaseSetIconURLForPageURL in UIProcess/API/glib/WebKitFaviconDatabase.cpp in WebK
- CVE-2018-8921Cross-site scripting (XSS) vulnerability in File Sharing Notify Toast in Synology Drive before 1.0.2-10275 allows remote authenticated usersSynology Drive
- CVE-2018-8922Improper access control vulnerability in Synology Drive before 1.0.2-10275 allows remote authenticated users to access non-shared files or fSynology Drive
- CVE-2018-11645psi/zfile.c in Artifex Ghostscript before 9.21rc1 permits the status command even if -dSAFER is used, which might allow remote attackers to
- CVE-2016-1000338In Bouncy Castle JCE Provider version 1.55 and earlier the DSA does not fully validate ASN.1 encoding of signature on verification.org.bouncycastle:bcprov-jdk14 · org.bouncycastle:bcprov-… +1