CVEs published June 13, 2018
59 CVEs were published on June 13, 2018: 0 critical, 3 high.
- Published
- 59
- Critical
- 0
- High
- 3
- Medium
- 6
- Low
- 2
- Unrated
- 48
- Now in CISA KEV
- 0
- Fix available
- 16
Most affected products
- The Node.js Project Node.js
- 4
- symfony/symfony · symfony/security-http +1
- 2
- TIBCO Software TIBCO Administrator - Enterprise Edition
- 2
- [UNKNOWN] 389-ds-base
- 1
- [UNKNOWN] procps-ng, procps
- 1
- Apache Software Foundation Apache Geode · org.apache.geode:…
- 1
- HackerOne private_address_check ruby gem · private_address_…
- 1
- IBM Financial Transaction Manager
- 1
- IBM Spectrum Scale
- 1
- Libgcrypt before 1.7.10 and 1.8.x before
- 1
High 3
- CVE-2017-3968McAfee Network Security Management (NSM) and Network Data Loss Prevention (NDLP)- Password recovery exploitation vulnerabilityMcAfee Network Security Management · McAfee Network Data Lo…
- CVE-2018-1431A vulnerability in GSKit affects IBM Spectrum Scale 4.1.1, 4.2.0, 4.2.1, 4.2.3, and 5.0.0 that could allow a local attacker to obtain controIBM Spectrum Scale
- CVE-2018-5432TIBCO Administrator - Enterprise Edition Cross-Site Scripting VulnerabilityTIBCO Software TIBCO Administrator - Enterprise Edition
Medium, low and unrated 56
- CVE-2018-0495Libgcrypt before 1.7.10 and 1.8.x before 1.8.3 allows a memory-cache side-channel attack on ECDSA signatures that can be mitigated through tLibgcrypt before 1.7.10 and 1.8.x before
- CVE-2018-12019The signature verification routine in Enigmail before 2.0.7 interprets user ids as status/control messages and does not correctly keep track
- CVE-2018-12271An issue was discovered in the com.getdropbox.Dropbox app 100.2 for iOS.
- CVE-2018-12353Knowage (formerly SpagoBI) 6.1.1 allows XSS via the name field to the "Business Model's Catalogue" catalogue.
- CVE-2018-12354Knowage (formerly SpagoBI) 6.1.1 allows CSRF via every form, as demonstrated by a /knowage/restful-services/2.0/analyticalDrivers/ POST requ
- CVE-2018-12355Knowage (formerly SpagoBI) 6.1.1 allows XSS via the name or description field to the "Olap Schemas' Catalogue" catalogue.
- CVE-2018-10403An issue was discovered in F-Secure XFENCE and Little Flocker.
- CVE-2018-10404An issue was discovered in Objective-See KnockKnock, LuLu, TaskExplorer, WhatsYourSign, and procInfo.
- CVE-2018-10405An issue was discovered in Google Santa and molcodesignchecker.
- CVE-2018-10406An issue was discovered in Yelp OSXCollector.osxcollector
- CVE-2018-10407An issue was discovered in Carbon Black Cb Response.
- CVE-2018-10408An issue was discovered in VirusTotal.
- CVE-2018-12040Reflected Cross-site scripting (XSS) vulnerability in the web profiler in SensioLabs Symfony 3.3.6 allows remote attackers to inject arbitra
- CVE-2017-3907McAfee Threat Intelligence Exchange (TIE) Server - Code Injection vulnerabilityMcAfee Threat Intelligence Exchange (TIE) Server
- CVE-2017-3936McAfee ePolicy Orchestrator (ePO) - OS Command Injection vulnerabilityMcAfee ePolicy Orchestrator
- CVE-2018-10850389-ds-base before versions 1.4.0.10, 1.3.8.3 is vulnerable to a race condition in the way 389-ds-base handles persistent search, resulting [UNKNOWN] 389-ds-base
- CVE-2018-1121procps-ng, procps is vulnerable to a process hiding through race condition.[UNKNOWN] procps-ng, procps
- CVE-2018-5488NetApp SANtricity Web Services Proxy versions 1.10.x000.0002 through 2.12.X000.0002 and SANtricity Storage Manager 11.30.0X00.0004 through 1NetApp SANtricity Products
- CVE-2018-12339ArticleCMS through 2017-02-19 has XSS via an "add an article" action.
- CVE-2017-11672The OPC Foundation Local Discovery Server (LDS) before 1.03.367 is installed as a Windows Service without adding double quotes around the op
- CVE-2017-17443OPC Foundation Local Discovery Server (LDS) 1.03.370 required a security update to resolve multiple vulnerabilities that allow attackers to
- CVE-2018-10363An issue was discovered in the WpDevArt "Booking calendar, Appointment Booking System" plugin 2.2.2 for WordPress.
- CVE-2018-7559An issue was discovered in OPC UA .NET Standard Stack and Sample Code before GitHub commit 2018-04-12, and OPC UA .NET Legacy Stack and SampOPCFoundation.NetStandard.Opc.Ua
- CVE-2017-15695When an Apache Geode server versions 1.0.0 to 1.4.0 is configured with a security manager, a user with DATA:WRITE privileges is allowed to dApache Software Foundation Apache Geode · org.apache.geode:…
- CVE-2017-16652An issue was discovered in Symfony 2.7.x before 2.7.38, 2.8.x before 2.8.31, 3.2.x before 3.2.14, and 3.3.x before 3.3.13.symfony/symfony · symfony/security-http +1
- CVE-2018-11385An issue was discovered in the Security component in Symfony 2.7.x before 2.7.48, 2.8.x before 2.8.41, 3.3.x before 3.3.17, 3.4.x before 3.4symfony/symfony · symfony/security-http +1
- CVE-2018-11386An issue was discovered in the HttpFoundation component in Symfony 2.7.x before 2.7.48, 2.8.x before 2.8.41, 3.3.x before 3.3.17, 3.4.x befosymfony/symfony · symfony/http-foundation
- CVE-2018-11406An issue was discovered in the Security component in Symfony 2.7.x before 2.7.48, 2.8.x before 2.8.41, 3.3.x before 3.3.17, 3.4.x before 3.4symfony/symfony · symfony/security-bundle +2
- CVE-2018-11407An issue was discovered in the Ldap component in Symfony 2.8.x before 2.8.37, 3.3.x before 3.3.17, 3.4.x before 3.4.7, and 4.0.x before 4.0.symfony/security-core · symfony/security +1
- CVE-2018-11408The security handlers in the Security component in Symfony in 2.7.x before 2.7.48, 2.8.x before 2.8.41, 3.3.x before 3.3.17, 3.4.x before 3.symfony/symfony · symfony/security-bundle
- CVE-2018-11688Ignite Realtime Openfire before 3.9.2 is vulnerable to cross-site scripting, caused by improper validation of user-supplied input.org.igniterealtime.openfire:parent
- CVE-2018-11806m_cat in slirp/mbuf.c in Qemu has a heap-based buffer overflow via incoming fragmented datagrams.
- CVE-2018-12320There is a use after free in radare2 2.6.0 in r_anal_bb_free() in libr/anal/bb.c via a crafted Java binary file.
- CVE-2018-12321There is a heap out of bounds read in radare2 2.6.0 in java_switch_op() in libr/anal/p/anal_java.c via a crafted Java binary file.
- CVE-2018-12322There is a heap out of bounds read in radare2 2.6.0 in _6502_op() in libr/anal/p/anal_6502.c via a crafted iNES ROM binary file.
- CVE-2018-12323An issue was discovered on Momentum Axel 720P 5.1.8 devices.
- CVE-2018-5242Norton App Lock prior to version 1.3.0.329 can be susceptible to a bypass exploit.Symantec Norton App Lock
- CVE-2018-7161All versions of Node.js 8.x, 9.x, and 10.x are vulnerable and the severity is HIGH.The Node.js Project Node.js
- CVE-2018-7162All versions of Node.js 9.x and 10.x are vulnerable and the severity is HIGH.The Node.js Project Node.js
- CVE-2018-7164Node.js versions 9.7.0 and later and 10.x are vulnerable and the severity is MEDIUM.The Node.js Project Node.js
- CVE-2018-7167Calling Buffer.fill() or Buffer.alloc() with some parameters can lead to a hang which could result in a Denial of Service.The Node.js Project Node.js
- CVE-2018-3759private_address_check ruby gem before 0.5.0 is vulnerable to a time-of-check time-of-use (TOCTOU) race condition due to the address the sockHackerOne private_address_check ruby gem · private_address_…
- CVE-2018-12290The Yii2-StateMachine extension v2.x.x for Yii2 has XSS.ptheofan/yii2-statemachine
- CVE-2018-12291The on_get_missing_events function in handlers/federation.py in Matrix Synapse before 0.31.1 has a security bug in the get_missing_events fematrix-synapse
- CVE-2018-12292A use-after-free vulnerability exists in DOMProxyHandler::EnsureExpandoObject in Pale Moon before 27.9.3.
- CVE-2018-1393IBM Financial Transaction Manager for ACH Services for Multi-Platform 3.0.6 could allow an authenticated user to execute a specially craftedIBM Financial Transaction Manager
- CVE-2011-4183open build service allows anyone to upload rpmsSUSE open build service
- CVE-2018-12272xowl/request.php in Ximdex 4.0 has XSS via the content parameter.
- CVE-2018-12273The /edit URI in the DMS component in Ximdex 4.0 has XSS via the Ciudad or Nombre parameter.
- CVE-2018-5433XML eXternal Entity Expansion Vulnerabilities with TIBCO AdministratorTIBCO Software TIBCO Administrator - Enterprise Edition
- CVE-2018-5434XML eXternal Entity Expansion Vulnerabilities with TIBCO Runtime AgentTIBCO Software TIBCO Runtime Agent
- CVE-2018-12263portfolioCMS 1.0.5 allows upload of arbitrary .php files via the admin/portfolio.php?newpage=true URI.
- CVE-2018-12264Exiv2 0.26 has integer overflows in LoaderTiff::getData() in preview.cpp, leading to an out-of-bounds read in Exiv2::ValueType::setDataArea
- CVE-2018-12265Exiv2 0.26 has an integer overflow in the LoaderExifJpeg class in preview.cpp, leading to an out-of-bounds read in Exiv2::MemIo::read in bas
- CVE-2018-12266system\errors\404.php in HongCMS 3.0.0 has XSS via crafted input that triggers a 404 HTTP status code.
- CVE-2018-12268acccheck.pl in acccheck 0.2.1 allows Command Injection via shell metacharacters in a username or password file, as demonstrated by injection