# CVEs published 2018-06-05

60 CVEs were published on June 5, 2018: 0 critical, 2 high. Days are UTC.

- [CVE-2017-7635](https://cve.now/CVE-2017-7635.md): QNAP NAS application Proxy Server through version 1.2.0 does not utilize CSRF protections. (no CVSS)
- [CVE-2017-7636](https://cve.now/CVE-2017-7636.md): Cross-site scripting (XSS) vulnerability in QNAP NAS application Proxy Server through version 1.2.0 allows remote attackers to inject arbitr (no CVSS)
- [CVE-2017-7637](https://cve.now/CVE-2017-7637.md): QNAP NAS application Proxy Server through version 1.2.0 allows remote attackers to run arbitrary OS commands against the system with root pr (no CVSS)
- [CVE-2017-7639](https://cve.now/CVE-2017-7639.md): QNAP NAS application Proxy Server through version 1.2.0 does not authenticate requests properly. (no CVSS)
- [CVE-2018-1000192](https://cve.now/CVE-2018-1000192.md): A information exposure vulnerability exists in Jenkins 2.120 and older, LTS 2.107.2 and older in AboutJenkins.java, ListPluginsCommand.java (no CVSS, org.jenkins-ci.main:jenkins-core)
- [CVE-2018-1000193](https://cve.now/CVE-2018-1000193.md): A improper neutralization of control sequences vulnerability exists in Jenkins 2.120 and older, LTS 2.107.2 and older in HudsonPrivateSecuri (no CVSS, org.jenkins-ci.main:jenkins-core)
- [CVE-2018-1000194](https://cve.now/CVE-2018-1000194.md): A path traversal vulnerability exists in Jenkins 2.120 and older, LTS 2.107.2 and older in FilePath.java, SoloFilePathFilter.java that allow (no CVSS, org.jenkins-ci.main:jenkins-core)
- [CVE-2018-1000195](https://cve.now/CVE-2018-1000195.md): A server-side request forgery vulnerability exists in Jenkins 2.120 and older, LTS 2.107.2 and older in ZipExtractionInstaller.java that all (no CVSS, org.jenkins-ci.main:jenkins-core)
- [CVE-2018-1000196](https://cve.now/CVE-2018-1000196.md): A exposure of sensitive information vulnerability exists in Jenkins Gitlab Hook Plugin 1.4.2 and older in gitlab\_notifier.rb, views/gitlab\_n (no CVSS, org.jenkins-ci.ruby-plugins:gitlab-hook)
- [CVE-2018-1000197](https://cve.now/CVE-2018-1000197.md): An improper authorization vulnerability exists in Jenkins Black Duck Hub Plugin 3.0.3 and older in PostBuildScanDescriptor.java that allows (no CVSS, com.blackducksoftware.integration:blackduck-hub)
- [CVE-2018-1000198](https://cve.now/CVE-2018-1000198.md): A XML external entity processing vulnerability exists in Jenkins Black Duck Hub Plugin 3.1.0 and older in PostBuildScanDescriptor.java that (no CVSS, com.blackducksoftware.integration:blackduck-hub)
- [CVE-2018-1000202](https://cve.now/CVE-2018-1000202.md): A persisted cross-site scripting vulnerability exists in Jenkins Groovy Postbuild Plugin 2.3.1 and older in various Jelly files that allows (no CVSS, org.jvnet.hudson.plugins:groovy-postbuild)
- [CVE-2018-10057](https://cve.now/CVE-2018-10057.md): The remote management interface of cgminer 4.10.0 and bfgminer 5.5.0 allows an authenticated remote attacker to write the miner configuratio (no CVSS)
- [CVE-2018-10058](https://cve.now/CVE-2018-10058.md): The remote management interface of cgminer 4.10.0 and bfgminer 5.5.0 allows an authenticated remote attacker to execute arbitrary code due t (no CVSS)
- [CVE-2018-11586](https://cve.now/CVE-2018-11586.md): XML external entity (XXE) vulnerability in api/rest/status in SearchBlox 8.6.7 allows remote unauthenticated users to read arbitrary files o (no CVSS)
- [CVE-2018-3691](https://cve.now/CVE-2018-3691.md): Some implementations in Intel Integrated Performance Primitives Cryptography Library before version 2018 U3.1 do not properly ensure constan (no CVSS, Intel Integrated Performance Primitives Cryptography Library)
- [CVE-2018-7884](https://cve.now/CVE-2018-7884.md): An issue was discovered in DisplayLink Core Software Cleaner Application 8.2.1956. (no CVSS)
- [CVE-2017-7653](https://cve.now/CVE-2017-7653.md): The Eclipse Mosquitto broker up to version 1.4.15 does not reject strings that are not valid UTF-8. (no CVSS, The Eclipse Foundation Eclipse Mosquitto)
- [CVE-2017-7654](https://cve.now/CVE-2017-7654.md): In Eclipse Mosquitto 1.4.15 and earlier, a Memory Leak vulnerability was found within the Mosquitto Broker. (no CVSS, The Eclipse Foundation Eclipse Mosquitto)
- [CVE-2018-1000182](https://cve.now/CVE-2018-1000182.md): A server-side request forgery vulnerability exists in Jenkins Git Plugin 3.9.0 and older in AssemblaWeb.java, GitBlitRepositoryBrowser.java, (no CVSS, org.jenkins-ci.plugins:git)
- [CVE-2018-1000183](https://cve.now/CVE-2018-1000183.md): A exposure of sensitive information vulnerability exists in Jenkins GitHub Plugin 1.29.0 and older in GitHubServerConfig.java that allows at (no CVSS, com.coravy.hudson.plugins.github:github)
- [CVE-2018-1000184](https://cve.now/CVE-2018-1000184.md): A server-side request forgery vulnerability exists in Jenkins GitHub Plugin 1.29.0 and older in GitHubPluginConfig.java that allows attacker (no CVSS, com.coravy.hudson.plugins.github:github)
- [CVE-2018-1000185](https://cve.now/CVE-2018-1000185.md): A server-side request forgery vulnerability exists in Jenkins GitHub Branch Source Plugin 2.3.4 and older in Endpoint.java that allows attac (no CVSS, org.jenkins-ci.plugins:github-branch-source)
- [CVE-2018-1000186](https://cve.now/CVE-2018-1000186.md): A exposure of sensitive information vulnerability exists in Jenkins GitHub Pull Request Builder Plugin 1.41.0 and older in GhprbGitHubAuth.j (no CVSS, org.jenkins-ci.plugins:ghprb)
- [CVE-2018-1000187](https://cve.now/CVE-2018-1000187.md): A exposure of sensitive information vulnerability exists in Jenkins Kubernetes Plugin 1.7.0 and older in ContainerExecDecorator.java that re (no CVSS, org.csanchez.jenkins.plugins:kubernetes)
- [CVE-2018-1000188](https://cve.now/CVE-2018-1000188.md): A server-side request forgery vulnerability exists in Jenkins CAS Plugin 1.4.1 and older in CasSecurityRealm.java that allows attackers with (no CVSS, org.jenkins-ci.plugins:cas-plugin)
- [CVE-2018-1000189](https://cve.now/CVE-2018-1000189.md): A command execution vulnerability exists in Jenkins Absint Astree Plugin 1.0.5 and older in AstreeBuilder.java that allows attackers with Ov (no CVSS, org.jenkins-ci.plugins:absint-astree)
- [CVE-2018-1000190](https://cve.now/CVE-2018-1000190.md): A exposure of sensitive information vulnerability exists in Jenkins Black Duck Hub Plugin 4.0.0 and older in PostBuildScanDescriptor.java th (no CVSS, com.blackducksoftware.integration:blackduck-hub)
- [CVE-2018-1000191](https://cve.now/CVE-2018-1000191.md): A exposure of sensitive information vulnerability exists in Jenkins Black Duck Detect Plugin 1.4.0 and older in DetectPostBuildStepDescripto (no CVSS, com.synopsys.integration:synopsys-detect)
- [CVE-2018-10597](https://cve.now/CVE-2018-10597.md): IntelliVue Patient Monitors MP Series (including MP2/X2/MP30/MP50/MP70/NP90/MX700/800) Rev B-M, IntelliVue Patient Monitors MX (MX400-550) R (no CVSS, ICS-CERT IntelliVue Patient Monitors, Avalon Fetal/Maternal…)
- [CVE-2018-10599](https://cve.now/CVE-2018-10599.md): IntelliVue Patient Monitors MP Series (including MP2/X2/MP30/MP50/MP70/NP90/MX700/800) Rev B-M, IntelliVue Patient Monitors MX (MX400-550) R (no CVSS, ICS-CERT IntelliVue Patient Monitors, Avalon Fetal/Maternal…)
- [CVE-2018-10601](https://cve.now/CVE-2018-10601.md): IntelliVue Patient Monitors MP Series (including MP2/X2/MP30/MP50/MP70/NP90/MX700/800) Rev B-M, IntelliVue Patient Monitors MX (MX400-550) R (no CVSS, ICS-CERT IntelliVue Patient Monitors, Avalon Fetal/Maternal…)
- [CVE-2018-1332](https://cve.now/CVE-2018-1332.md): Apache Storm version 1.0.6 and earlier, 1.2.1 and earlier, and version 1.1.2 and earlier expose a vulnerability that could allow a user to i (no CVSS, Apache Software Foundation Apache Storm · org.apache.storm:…)
- [CVE-2018-8008](https://cve.now/CVE-2018-8008.md): Apache Storm version 1.0.6 and earlier, 1.2.1 and earlier, and version 1.1.2 and earlier expose an arbitrary file write vulnerability, that (no CVSS, Apache Software Foundation Apache Storm · org.apache.storm:…)
- [CVE-2017-1350](https://cve.now/CVE-2017-1350.md): IBM InfoSphere Information Server 9.1, 11.3, 11.5, and 11.7 could allow a user to escalate their privileges to administrator due to improper (CVSS 8.4, IBM InfoSphere Information Server)
- [CVE-2018-10813](https://cve.now/CVE-2018-10813.md): In Dedos-web 1.0, the cookie and session secrets used in the Express.js application have hardcoded values that are visible in the source cod (no CVSS)
- [CVE-2018-10966](https://cve.now/CVE-2018-10966.md): An issue was discovered in GamerPolls 0.4.6, related to config/environments/all.js and config/initializers/02\_passport.js. (no CVSS)
- [CVE-2018-1432](https://cve.now/CVE-2018-1432.md): IBM InfoSphere Information Server 9.1, 11.3, 11.5, and 11.7 is vulnerable to cross-frame scripting which is a vulnerability that allows an a (CVSS 6.1, IBM InfoSphere Information Server)
- [CVE-2018-1454](https://cve.now/CVE-2018-1454.md): IBM InfoSphere Information Server 11.3, 11.5, and 11.7 could allow a remote attacker to obtain sensitive information, caused by the failure (CVSS 5.9, IBM InfoSphere Information Server)
- [CVE-2018-7943](https://cve.now/CVE-2018-7943.md): There is an authentication bypass vulnerability in some Huawei servers. (no CVSS, Huawei Technologies Co. 1288H V5; 2288H V5; 2488 V5 ; CH121…)
- [CVE-2016-9488](https://cve.now/CVE-2016-9488.md): ManageEngine Applications Manager versions 12 and 13 suffer from remote SQL injection vulnerabilities (no CVSS, ManageEngine Applications Manager)
- [CVE-2016-9490](https://cve.now/CVE-2016-9490.md): ManageEngine Applications Manager versions 12 and 13 suffer from a Reflected Cross-Site Scripting vulnerability (no CVSS, ManageEngine Applications Manager)
- [CVE-2018-6662](https://cve.now/CVE-2018-6662.md): SB10232 - McAfee Management of Native Encryption (MNE) - Privilege Escalation vulnerability (CVSS 7.5, McAfee Management of Native Encryption)
- [CVE-2018-8923](https://cve.now/CVE-2018-8923.md): Cross-site scripting (XSS) vulnerability in Attachment Preview in Synology File Station before 1.1.4-0122 allows remote authenticated users (CVSS 6.5, Synology File Station)
- [CVE-2018-8924](https://cve.now/CVE-2018-8924.md): Cross-site scripting (XSS) vulnerability in Title Tootip in Synology Office before 3.0.3-2143 allows remote authenticated users to inject ar (CVSS 6.5, Synology Office)
- [CVE-2018-1000180](https://cve.now/CVE-2018-1000180.md): Bouncy Castle BC 1.54 - 1.59, BC-FJA 1.0.0, BC-FJA 1.0.1 and earlier have a flaw in the Low-level interface to RSA key pair generator, speci (no CVSS, org.bouncycastle:bcprov-jdk14 · org.bouncycastle:bcprov-… +1)
- [CVE-2018-1000181](https://cve.now/CVE-2018-1000181.md): Kitura 2.3.0 and earlier have an unintended read access to unauthorised files and folders that can be exploited by a crafted URL resulting i (no CVSS)
- [CVE-2018-1000200](https://cve.now/CVE-2018-1000200.md): The Linux Kernel versions 4.14, 4.15, and 4.16 has a null pointer dereference which can result in an out of memory (OOM) killing of large ml (no CVSS)
- [CVE-2018-11743](https://cve.now/CVE-2018-11743.md): The init\_copy function in kernel.c in mruby 1.4.1 makes initialize\_copy calls for TT\_ICLASS objects, which allows attackers to cause a denia (no CVSS)
- [CVE-2018-11722](https://cve.now/CVE-2018-11722.md): WUZHI CMS 4.1.0 has a SQL Injection in api/uc.php via the 'code' parameter, because 'UC\_KEY' is hard coded. (no CVSS)
- [CVE-2018-1252](https://cve.now/CVE-2018-1252.md): RSA Web Threat Detection SQL Injection Vulnerability (no CVSS, RSA Web Threat Detection)
- [CVE-2018-11554](https://cve.now/CVE-2018-11554.md): The forgotten-password feature in index.php/member/reset/reset\_email.html in YzmCMS v3.2 through v3.7 has a Response Discrepancy Information (no CVSS)
- [CVE-2018-11678](https://cve.now/CVE-2018-11678.md): plugins/box/users/users.plugin.php in Monstra CMS 3.0.4 allows Login Rate Limiting Bypass via manipulation of the login\_attempts cookie. (no CVSS)
- [CVE-2018-11737](https://cve.now/CVE-2018-11737.md): An issue was discovered in libtskfs.a in The Sleuth Kit (TSK) from release 4.0.2 through to 4.6.1. (no CVSS)
- [CVE-2018-11738](https://cve.now/CVE-2018-11738.md): An issue was discovered in libtskfs.a in The Sleuth Kit (TSK) from release 4.0.2 through to 4.6.1. (no CVSS)
- [CVE-2018-11739](https://cve.now/CVE-2018-11739.md): An issue was discovered in libtskimg.a in The Sleuth Kit (TSK) from release 4.0.2 through to 4.6.1. (no CVSS)
- [CVE-2018-11740](https://cve.now/CVE-2018-11740.md): An issue was discovered in libtskbase.a in The Sleuth Kit (TSK) from release 4.0.2 through to 4.6.1. (no CVSS)
- [CVE-2017-18286](https://cve.now/CVE-2017-18286.md): nZEDb v0.7.3.3 has XSS in the 404 error page. (no CVSS, nzedb/nzedb)
- [CVE-2018-11735](https://cve.now/CVE-2018-11735.md): index.php?action=createaccount in Ximdex 4.0 has XSS via the sname or fname parameter. (no CVSS)
- [CVE-2018-11736](https://cve.now/CVE-2018-11736.md): An issue was discovered in Pluck before 4.7.7-dev2. (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2018-06-05
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.