CVEs published June 5, 2018
60 CVEs were published on June 5, 2018: 0 critical, 2 high.
- Published
- 60
- Critical
- 0
- High
- 2
- Medium
- 4
- Low
- 0
- Unrated
- 54
- Now in CISA KEV
- 0
- Fix available
- 25
Most affected products
- org.jenkins-ci.main:jenkins-core
- 4
- com.blackducksoftware.integration:blackduck-hub
- 3
- IBM InfoSphere Information Server
- 3
- ICS-CERT IntelliVue Patient Monitors, Avalon Fetal/Maternal…
- 3
- Apache Software Foundation Apache Storm · org.apache.storm:…
- 2
- com.coravy.hudson.plugins.github:github
- 2
- ManageEngine Applications Manager
- 2
- The Eclipse Foundation Eclipse Mosquitto
- 2
- com.synopsys.integration:synopsys-detect
- 1
- Huawei Technologies Co. 1288H V5; 2288H V5; 2488 V5 ; CH121…
- 1
High 2
- CVE-2017-1350IBM InfoSphere Information Server 9.1, 11.3, 11.5, and 11.7 could allow a user to escalate their privileges to administrator due to improperIBM InfoSphere Information Server
- CVE-2018-6662SB10232 - McAfee Management of Native Encryption (MNE) - Privilege Escalation vulnerabilityMcAfee Management of Native Encryption
Medium, low and unrated 58
- CVE-2017-7635QNAP NAS application Proxy Server through version 1.2.0 does not utilize CSRF protections.
- CVE-2017-7636Cross-site scripting (XSS) vulnerability in QNAP NAS application Proxy Server through version 1.2.0 allows remote attackers to inject arbitr
- CVE-2017-7637QNAP NAS application Proxy Server through version 1.2.0 allows remote attackers to run arbitrary OS commands against the system with root pr
- CVE-2017-7639QNAP NAS application Proxy Server through version 1.2.0 does not authenticate requests properly.
- CVE-2018-1000192A information exposure vulnerability exists in Jenkins 2.120 and older, LTS 2.107.2 and older in AboutJenkins.java, ListPluginsCommand.java org.jenkins-ci.main:jenkins-core
- CVE-2018-1000193A improper neutralization of control sequences vulnerability exists in Jenkins 2.120 and older, LTS 2.107.2 and older in HudsonPrivateSecuriorg.jenkins-ci.main:jenkins-core
- CVE-2018-1000194A path traversal vulnerability exists in Jenkins 2.120 and older, LTS 2.107.2 and older in FilePath.java, SoloFilePathFilter.java that alloworg.jenkins-ci.main:jenkins-core
- CVE-2018-1000195A server-side request forgery vulnerability exists in Jenkins 2.120 and older, LTS 2.107.2 and older in ZipExtractionInstaller.java that allorg.jenkins-ci.main:jenkins-core
- CVE-2018-1000196A exposure of sensitive information vulnerability exists in Jenkins Gitlab Hook Plugin 1.4.2 and older in gitlab_notifier.rb, views/gitlab_norg.jenkins-ci.ruby-plugins:gitlab-hook
- CVE-2018-1000197An improper authorization vulnerability exists in Jenkins Black Duck Hub Plugin 3.0.3 and older in PostBuildScanDescriptor.java that allows com.blackducksoftware.integration:blackduck-hub
- CVE-2018-1000198A XML external entity processing vulnerability exists in Jenkins Black Duck Hub Plugin 3.1.0 and older in PostBuildScanDescriptor.java that com.blackducksoftware.integration:blackduck-hub
- CVE-2018-1000202A persisted cross-site scripting vulnerability exists in Jenkins Groovy Postbuild Plugin 2.3.1 and older in various Jelly files that allows org.jvnet.hudson.plugins:groovy-postbuild
- CVE-2018-10057The remote management interface of cgminer 4.10.0 and bfgminer 5.5.0 allows an authenticated remote attacker to write the miner configuratio
- CVE-2018-10058The remote management interface of cgminer 4.10.0 and bfgminer 5.5.0 allows an authenticated remote attacker to execute arbitrary code due t
- CVE-2018-11586XML external entity (XXE) vulnerability in api/rest/status in SearchBlox 8.6.7 allows remote unauthenticated users to read arbitrary files o
- CVE-2018-3691Some implementations in Intel Integrated Performance Primitives Cryptography Library before version 2018 U3.1 do not properly ensure constanIntel Integrated Performance Primitives Cryptography Library
- CVE-2018-7884An issue was discovered in DisplayLink Core Software Cleaner Application 8.2.1956.
- CVE-2017-7653The Eclipse Mosquitto broker up to version 1.4.15 does not reject strings that are not valid UTF-8.The Eclipse Foundation Eclipse Mosquitto
- CVE-2017-7654In Eclipse Mosquitto 1.4.15 and earlier, a Memory Leak vulnerability was found within the Mosquitto Broker.The Eclipse Foundation Eclipse Mosquitto
- CVE-2018-1000182A server-side request forgery vulnerability exists in Jenkins Git Plugin 3.9.0 and older in AssemblaWeb.java, GitBlitRepositoryBrowser.java,org.jenkins-ci.plugins:git
- CVE-2018-1000183A exposure of sensitive information vulnerability exists in Jenkins GitHub Plugin 1.29.0 and older in GitHubServerConfig.java that allows atcom.coravy.hudson.plugins.github:github
- CVE-2018-1000184A server-side request forgery vulnerability exists in Jenkins GitHub Plugin 1.29.0 and older in GitHubPluginConfig.java that allows attackercom.coravy.hudson.plugins.github:github
- CVE-2018-1000185A server-side request forgery vulnerability exists in Jenkins GitHub Branch Source Plugin 2.3.4 and older in Endpoint.java that allows attacorg.jenkins-ci.plugins:github-branch-source
- CVE-2018-1000186A exposure of sensitive information vulnerability exists in Jenkins GitHub Pull Request Builder Plugin 1.41.0 and older in GhprbGitHubAuth.jorg.jenkins-ci.plugins:ghprb
- CVE-2018-1000187A exposure of sensitive information vulnerability exists in Jenkins Kubernetes Plugin 1.7.0 and older in ContainerExecDecorator.java that reorg.csanchez.jenkins.plugins:kubernetes
- CVE-2018-1000188A server-side request forgery vulnerability exists in Jenkins CAS Plugin 1.4.1 and older in CasSecurityRealm.java that allows attackers withorg.jenkins-ci.plugins:cas-plugin
- CVE-2018-1000189A command execution vulnerability exists in Jenkins Absint Astree Plugin 1.0.5 and older in AstreeBuilder.java that allows attackers with Ovorg.jenkins-ci.plugins:absint-astree
- CVE-2018-1000190A exposure of sensitive information vulnerability exists in Jenkins Black Duck Hub Plugin 4.0.0 and older in PostBuildScanDescriptor.java thcom.blackducksoftware.integration:blackduck-hub
- CVE-2018-1000191A exposure of sensitive information vulnerability exists in Jenkins Black Duck Detect Plugin 1.4.0 and older in DetectPostBuildStepDescriptocom.synopsys.integration:synopsys-detect
- CVE-2018-10597IntelliVue Patient Monitors MP Series (including MP2/X2/MP30/MP50/MP70/NP90/MX700/800) Rev B-M, IntelliVue Patient Monitors MX (MX400-550) RICS-CERT IntelliVue Patient Monitors, Avalon Fetal/Maternal…
- CVE-2018-10599IntelliVue Patient Monitors MP Series (including MP2/X2/MP30/MP50/MP70/NP90/MX700/800) Rev B-M, IntelliVue Patient Monitors MX (MX400-550) RICS-CERT IntelliVue Patient Monitors, Avalon Fetal/Maternal…
- CVE-2018-10601IntelliVue Patient Monitors MP Series (including MP2/X2/MP30/MP50/MP70/NP90/MX700/800) Rev B-M, IntelliVue Patient Monitors MX (MX400-550) RICS-CERT IntelliVue Patient Monitors, Avalon Fetal/Maternal…
- CVE-2018-1332Apache Storm version 1.0.6 and earlier, 1.2.1 and earlier, and version 1.1.2 and earlier expose a vulnerability that could allow a user to iApache Software Foundation Apache Storm · org.apache.storm:…
- CVE-2018-8008Apache Storm version 1.0.6 and earlier, 1.2.1 and earlier, and version 1.1.2 and earlier expose an arbitrary file write vulnerability, that Apache Software Foundation Apache Storm · org.apache.storm:…
- CVE-2018-10813In Dedos-web 1.0, the cookie and session secrets used in the Express.js application have hardcoded values that are visible in the source cod
- CVE-2018-10966An issue was discovered in GamerPolls 0.4.6, related to config/environments/all.js and config/initializers/02_passport.js.
- CVE-2018-1432IBM InfoSphere Information Server 9.1, 11.3, 11.5, and 11.7 is vulnerable to cross-frame scripting which is a vulnerability that allows an aIBM InfoSphere Information Server
- CVE-2018-1454IBM InfoSphere Information Server 11.3, 11.5, and 11.7 could allow a remote attacker to obtain sensitive information, caused by the failure IBM InfoSphere Information Server
- CVE-2018-7943There is an authentication bypass vulnerability in some Huawei servers.Huawei Technologies Co. 1288H V5; 2288H V5; 2488 V5 ; CH121…
- CVE-2016-9488ManageEngine Applications Manager versions 12 and 13 suffer from remote SQL injection vulnerabilitiesManageEngine Applications Manager
- CVE-2016-9490ManageEngine Applications Manager versions 12 and 13 suffer from a Reflected Cross-Site Scripting vulnerabilityManageEngine Applications Manager
- CVE-2018-8923Cross-site scripting (XSS) vulnerability in Attachment Preview in Synology File Station before 1.1.4-0122 allows remote authenticated users Synology File Station
- CVE-2018-8924Cross-site scripting (XSS) vulnerability in Title Tootip in Synology Office before 3.0.3-2143 allows remote authenticated users to inject arSynology Office
- CVE-2018-1000180Bouncy Castle BC 1.54 - 1.59, BC-FJA 1.0.0, BC-FJA 1.0.1 and earlier have a flaw in the Low-level interface to RSA key pair generator, speciorg.bouncycastle:bcprov-jdk14 · org.bouncycastle:bcprov-… +1
- CVE-2018-1000181Kitura 2.3.0 and earlier have an unintended read access to unauthorised files and folders that can be exploited by a crafted URL resulting i
- CVE-2018-1000200The Linux Kernel versions 4.14, 4.15, and 4.16 has a null pointer dereference which can result in an out of memory (OOM) killing of large ml
- CVE-2018-11743The init_copy function in kernel.c in mruby 1.4.1 makes initialize_copy calls for TT_ICLASS objects, which allows attackers to cause a denia
- CVE-2018-11722WUZHI CMS 4.1.0 has a SQL Injection in api/uc.php via the 'code' parameter, because 'UC_KEY' is hard coded.
- CVE-2018-1252RSA Web Threat Detection SQL Injection VulnerabilityRSA Web Threat Detection
- CVE-2018-11554The forgotten-password feature in index.php/member/reset/reset_email.html in YzmCMS v3.2 through v3.7 has a Response Discrepancy Information
- CVE-2018-11678plugins/box/users/users.plugin.php in Monstra CMS 3.0.4 allows Login Rate Limiting Bypass via manipulation of the login_attempts cookie.
- CVE-2018-11737An issue was discovered in libtskfs.a in The Sleuth Kit (TSK) from release 4.0.2 through to 4.6.1.
- CVE-2018-11738An issue was discovered in libtskfs.a in The Sleuth Kit (TSK) from release 4.0.2 through to 4.6.1.
- CVE-2018-11739An issue was discovered in libtskimg.a in The Sleuth Kit (TSK) from release 4.0.2 through to 4.6.1.
- CVE-2018-11740An issue was discovered in libtskbase.a in The Sleuth Kit (TSK) from release 4.0.2 through to 4.6.1.
- CVE-2017-18286nZEDb v0.7.3.3 has XSS in the 404 error page.nzedb/nzedb
- CVE-2018-11735index.php?action=createaccount in Ximdex 4.0 has XSS via the sname or fname parameter.
- CVE-2018-11736An issue was discovered in Pluck before 4.7.7-dev2.