CVEs published June 8, 2018
96 CVEs were published on June 8, 2018: 0 critical, 9 high.
- Published
- 96
- Critical
- 0
- High
- 9
- Medium
- 4
- Low
- 1
- Unrated
- 82
- Now in CISA KEV
- 0
- Fix available
- 11
Most affected products
- Trend Micro OfficeScan
- 4
- IBM Security Identity Manager
- 2
- openSUSE Open Build Service
- 2
- Synology DiskStation Manager
- 2
- Synology Photo Station
- 2
- Apache Software Foundation Apache MXNet
- 1
- Cisco AppDynamics App iQ Platform before 4.4.3.10598 (HF4)…
- 1
- openSUSE obs-service-set_version
- 1
- SUSE crowbar
- 1
- SUSE kdump
- 1
High 9
- CVE-2018-4233An issue was discovered in certain Apple products.
- CVE-2013-3703No write permission check in change_role commandopenSUSE Open Build Service
- CVE-2014-0593sed command injectionopenSUSE obs-service-set_version
- CVE-2014-0594CSRF protection incorrectly disabledopenSUSE Open Build Service
- CVE-2017-12075Command injection vulnerability in EZ-Internet in Synology DiskStation Manager (DSM) before 6.2-23739 allows remote authenticated users to eSynology DiskStation Manager
- CVE-2017-12078Command injection vulnerability in EZ-Internet in Synology Router Manager (SRM) before 1.1.6-6931 allows remote authenticated users to execuSynology Router Manager
- CVE-2018-1453IBM Security Identity Manager Virtual Appliance 7.0 allows an authenticated attacker to upload or transfer files of dangerous types that canIBM Security Identity Manager
- CVE-2018-8925Cross-site request forgery (CSRF) vulnerability in admin/user.php in Synology Photo Station before 6.8.5-3471 and before 6.3-2975 allows remSynology Photo Station
- CVE-2018-8926Permissive regular expression vulnerability in synophoto_dsm_user in Synology Photo Station before 6.8.5-3471 and before 6.3-2975 allows remSynology Photo Station
Medium, low and unrated 87
- CVE-2018-12020mainproc.c in GnuPG before 2.2.8 mishandles the original filename during decryption and verification actions, which allows remote attackers
- CVE-2018-0225The Enterprise Console in Cisco AppDynamics App iQ Platform before 4.4.3.10598 (HF4) allows SQL injection, aka the Security Advisory 2089 isCisco AppDynamics App iQ Platform before 4.4.3.10598 (HF4)…
- CVE-2018-1281The clustered setup of Apache MXNet allows users to specify which IP address and port the scheduler will listen on via the DMLC_PS_ROOT_URI Apache Software Foundation Apache MXNet
- CVE-2018-4141An issue was discovered in certain Apple products.
- CVE-2018-4159An issue was discovered in certain Apple products.
- CVE-2018-4171An issue was discovered in certain Apple products.
- CVE-2018-4184An issue was discovered in certain Apple products.
- CVE-2018-4187An issue was discovered in certain Apple products.
- CVE-2018-4188An issue was discovered in certain Apple products.
- CVE-2018-4190An issue was discovered in certain Apple products.
- CVE-2018-4192An issue was discovered in certain Apple products.
- CVE-2018-4193An issue was discovered in certain Apple products.
- CVE-2018-4196An issue was discovered in certain Apple products.
- CVE-2018-4198An issue was discovered in certain Apple products.
- CVE-2018-4199An issue was discovered in certain Apple products.
- CVE-2018-4200An issue was discovered in certain Apple products.
- CVE-2018-4201An issue was discovered in certain Apple products.
- CVE-2018-4202An issue was discovered in certain Apple products.
- CVE-2018-4204An issue was discovered in certain Apple products.
- CVE-2018-4205An issue was discovered in certain Apple products.
- CVE-2018-4206An issue was discovered in certain Apple products.
- CVE-2018-4211An issue was discovered in certain Apple products.
- CVE-2018-4214An issue was discovered in certain Apple products.
- CVE-2018-4215An issue was discovered in certain Apple products.
- CVE-2018-4218An issue was discovered in certain Apple products.
- CVE-2018-4219An issue was discovered in certain Apple products.
- CVE-2018-4220An issue was discovered in certain Apple products.
- CVE-2018-4221An issue was discovered in certain Apple products.
- CVE-2018-4222An issue was discovered in certain Apple products.
- CVE-2018-4223An issue was discovered in certain Apple products.
- CVE-2018-4224An issue was discovered in certain Apple products.
- CVE-2018-4225An issue was discovered in certain Apple products.
- CVE-2018-4226An issue was discovered in certain Apple products.
- CVE-2018-4227An issue was discovered in certain Apple products.
- CVE-2018-4228An issue was discovered in certain Apple products.
- CVE-2018-4229An issue was discovered in certain Apple products.
- CVE-2018-4230An issue was discovered in certain Apple products.
- CVE-2018-4232An issue was discovered in certain Apple products.
- CVE-2018-4234An issue was discovered in certain Apple products.
- CVE-2018-4235An issue was discovered in certain Apple products.
- CVE-2018-4236An issue was discovered in certain Apple products.
- CVE-2018-4237An issue was discovered in certain Apple products.
- CVE-2018-4238An issue was discovered in certain Apple products.
- CVE-2018-4239An issue was discovered in certain Apple products.
- CVE-2018-4240An issue was discovered in certain Apple products.
- CVE-2018-4241An issue was discovered in certain Apple products.
- CVE-2018-4242An issue was discovered in certain Apple products.
- CVE-2018-4243An issue was discovered in certain Apple products.
- CVE-2018-4244An issue was discovered in certain Apple products.
- CVE-2018-4246An issue was discovered in certain Apple products.
- CVE-2018-4247An issue was discovered in certain Apple products.
- CVE-2018-4250An issue was discovered in certain Apple products.
- CVE-2018-4251An issue was discovered in certain Apple products.
- CVE-2018-4252An issue was discovered in certain Apple products.
- CVE-2018-4253An issue was discovered in certain Apple products.
- CVE-2011-4190Missing verification of host key for kdump serverSUSE kdump
- CVE-2012-0433insecure permissions on files containing confidential dataSUSE crowbar
- CVE-2014-5220The mdcheck script of the mdadm package for openSUSE 13.2 prior to version 3.3.1-5.14.1 does not properly sanitize device names, which allow
- CVE-2018-10358A pool corruption privilege escalation vulnerability in Trend Micro OfficeScan 11.0 SP1 and XG could allow a local attacker to escalate privTrend Micro OfficeScan
- CVE-2018-10359A pool corruption privilege escalation vulnerability in Trend Micro OfficeScan 11.0 SP1 and XG could allow a local attacker to escalate privTrend Micro OfficeScan
- CVE-2018-10505A pool corruption privilege escalation vulnerability in Trend Micro OfficeScan 11.0 SP1 and XG could allow a local attacker to escalate privTrend Micro OfficeScan
- CVE-2018-10506A out-of-bounds read information disclosure vulnerability in Trend Micro OfficeScan 11.0 SP1 and XG could allow a local attacker to discloseTrend Micro OfficeScan
- CVE-2018-12066BIRD Internet Routing Daemon before 1.6.4 allows local users to cause a denial of service (stack consumption and daemon crash) via BGP mask
- CVE-2011-3172unix2_chkpwd do not check for a valid accountSUSE Linux Enterprise
- CVE-2017-1405IBM Security Identity Manager Virtual Appliance 7.0 processes patches, image backups and other updates without sufficiently verifying the orIBM Security Identity Manager
- CVE-2018-8916Unverified password change vulnerability in Change Password in Synology DiskStation Manager (DSM) before 6.2-23739 allows remote authenticatSynology DiskStation Manager
- CVE-2018-10088Buffer overflow in XiongMai uc-httpd 1.0.0 has unspecified impact and attack vectors, a different vulnerability than CVE-2017-16725.
- CVE-2018-11409Splunk through 7.0.1 allows information disclosure by appending __raw/services/server/info/server-info?output_mode=json to a query, as demon
- CVE-2018-12064tinyexr 0.9.5 has a heap-based buffer over-read via tinyexr::ReadChannelInfo in tinyexr.h.
- CVE-2018-12065A Local File Inclusion vulnerability in /system/WCore/WHelper.php in Creatiwity wityCMS 0.6.2 allows remote attackers to include local PHP f
- CVE-2018-12051Arbitrary File Upload and Remote Code Execution exist in PHP Scripts Mall Schools Alert Management Script via $_FILE in /webmasterst/general
- CVE-2018-12052SQL Injection exists in PHP Scripts Mall Schools Alert Management Script via the q Parameter in get_sec.php.
- CVE-2018-12053Arbitrary File Deletion exists in PHP Scripts Mall Schools Alert Management Script via the img parameter in delete_img.php by using director
- CVE-2018-12054Arbitrary File Read exists in PHP Scripts Mall Schools Alert Management Script via the f parameter in img.php, aka absolute path traversal.
- CVE-2018-12055Multiple SQL Injections exist in PHP Scripts Mall Schools Alert Management Script via crafted POST data in contact_us.php, faq.php, about.ph
- CVE-2018-11228Crestron TSW-1060, TSW-760, TSW-560, TSW-1060-NC, TSW-760-NC, and TSW-560-NC devices before 2.001.0037.001 allow unauthenticated remote code
- CVE-2018-11229Crestron TSW-1060, TSW-760, TSW-560, TSW-1060-NC, TSW-760-NC, and TSW-560-NC devices before 2.001.0037.001 allow unauthenticated remote code
- CVE-2018-12041An issue was discovered on the MediaTek AWUS036NH wireless USB adapter through 5.1.25.0.
- CVE-2018-12045DedeCMS through V5.7SP2 allows arbitrary file upload in dede/file_manage_control.php via a dede/file_manage_view.php?fmdo=upload request wit
- CVE-2018-12046DedeCMS through 5.7SP2 allows arbitrary file write in dede/file_manage_control.php via a dede/file_manage_view.php?fmdo=newfile request with
- CVE-2018-12047xfind/search in Ximdex 4.0 has XSS via the filter[n][value] parameters for non-negative values of n, as demonstrated by n equal to 0 through
- CVE-2018-12048A remote attacker can bypass the Management Mode on the Canon LBP7110Cw web interface without a PIN for /checkLogin.cgi via vectors involvin
- CVE-2018-12049A remote attacker can bypass the System Manager Mode on the Canon LBP6030w web interface without a PIN for /checkLogin.cgi via vectors invol
- CVE-2018-9177Twonky Server before 8.5.1 has XSS via a folder name on the Shared Folders screen.
- CVE-2018-9182Twonky Server before 8.5.1 has XSS via a modified "language" parameter in the Language section.
- CVE-2018-9246The PGObject::Util::DBAdmin module before 0.120.0 for Perl, as used in LedgerSMB through 1.5.x, insufficiently sanitizes or escapes variable
- CVE-2018-4249An issue was discovered in certain Apple products.