# CVEs published 2018-06-13

59 CVEs were published on June 13, 2018: 0 critical, 3 high. Days are UTC.

- [CVE-2018-0495](https://cve.now/CVE-2018-0495.md): Libgcrypt before 1.7.10 and 1.8.x before 1.8.3 allows a memory-cache side-channel attack on ECDSA signatures that can be mitigated through t (no CVSS, Libgcrypt before 1.7.10 and 1.8.x before)
- [CVE-2018-12019](https://cve.now/CVE-2018-12019.md): The signature verification routine in Enigmail before 2.0.7 interprets user ids as status/control messages and does not correctly keep track (no CVSS)
- [CVE-2018-12271](https://cve.now/CVE-2018-12271.md): An issue was discovered in the com.getdropbox.Dropbox app 100.2 for iOS. (no CVSS)
- [CVE-2018-12353](https://cve.now/CVE-2018-12353.md): Knowage (formerly SpagoBI) 6.1.1 allows XSS via the name field to the "Business Model's Catalogue" catalogue. (no CVSS)
- [CVE-2018-12354](https://cve.now/CVE-2018-12354.md): Knowage (formerly SpagoBI) 6.1.1 allows CSRF via every form, as demonstrated by a /knowage/restful-services/2.0/analyticalDrivers/ POST requ (no CVSS)
- [CVE-2018-12355](https://cve.now/CVE-2018-12355.md): Knowage (formerly SpagoBI) 6.1.1 allows XSS via the name or description field to the "Olap Schemas' Catalogue" catalogue. (no CVSS)
- [CVE-2018-10403](https://cve.now/CVE-2018-10403.md): An issue was discovered in F-Secure XFENCE and Little Flocker. (no CVSS)
- [CVE-2018-10404](https://cve.now/CVE-2018-10404.md): An issue was discovered in Objective-See KnockKnock, LuLu, TaskExplorer, WhatsYourSign, and procInfo. (no CVSS)
- [CVE-2018-10405](https://cve.now/CVE-2018-10405.md): An issue was discovered in Google Santa and molcodesignchecker. (no CVSS)
- [CVE-2018-10406](https://cve.now/CVE-2018-10406.md): An issue was discovered in Yelp OSXCollector. (no CVSS, osxcollector)
- [CVE-2018-10407](https://cve.now/CVE-2018-10407.md): An issue was discovered in Carbon Black Cb Response. (no CVSS)
- [CVE-2018-10408](https://cve.now/CVE-2018-10408.md): An issue was discovered in VirusTotal. (no CVSS)
- [CVE-2018-12040](https://cve.now/CVE-2018-12040.md): Reflected Cross-site scripting (XSS) vulnerability in the web profiler in SensioLabs Symfony 3.3.6 allows remote attackers to inject arbitra (no CVSS)
- [CVE-2017-3907](https://cve.now/CVE-2017-3907.md): McAfee Threat Intelligence Exchange (TIE) Server - Code Injection vulnerability (CVSS 5.4, McAfee Threat Intelligence Exchange (TIE) Server)
- [CVE-2017-3936](https://cve.now/CVE-2017-3936.md): McAfee ePolicy Orchestrator (ePO) - OS Command Injection vulnerability (CVSS 6.2, McAfee ePolicy Orchestrator)
- [CVE-2017-3968](https://cve.now/CVE-2017-3968.md): McAfee Network Security Management (NSM) and Network Data Loss Prevention (NDLP)- Password recovery exploitation vulnerability (CVSS 7.5, McAfee Network Security Management · McAfee Network Data Lo…)
- [CVE-2018-10850](https://cve.now/CVE-2018-10850.md): 389-ds-base before versions 1.4.0.10, 1.3.8.3 is vulnerable to a race condition in the way 389-ds-base handles persistent search, resulting (CVSS 5.9, \[UNKNOWN\] 389-ds-base)
- [CVE-2018-1121](https://cve.now/CVE-2018-1121.md): procps-ng, procps is vulnerable to a process hiding through race condition. (CVSS 3.9, \[UNKNOWN\] procps-ng, procps)
- [CVE-2018-5488](https://cve.now/CVE-2018-5488.md): NetApp SANtricity Web Services Proxy versions 1.10.x000.0002 through 2.12.X000.0002 and SANtricity Storage Manager 11.30.0X00.0004 through 1 (no CVSS, NetApp SANtricity Products)
- [CVE-2018-12339](https://cve.now/CVE-2018-12339.md): ArticleCMS through 2017-02-19 has XSS via an "add an article" action. (no CVSS)
- [CVE-2017-11672](https://cve.now/CVE-2017-11672.md): The OPC Foundation Local Discovery Server (LDS) before 1.03.367 is installed as a Windows Service without adding double quotes around the op (no CVSS)
- [CVE-2017-17443](https://cve.now/CVE-2017-17443.md): OPC Foundation Local Discovery Server (LDS) 1.03.370 required a security update to resolve multiple vulnerabilities that allow attackers to (no CVSS)
- [CVE-2018-10363](https://cve.now/CVE-2018-10363.md): An issue was discovered in the WpDevArt "Booking calendar, Appointment Booking System" plugin 2.2.2 for WordPress. (no CVSS)
- [CVE-2018-7559](https://cve.now/CVE-2018-7559.md): An issue was discovered in OPC UA .NET Standard Stack and Sample Code before GitHub commit 2018-04-12, and OPC UA .NET Legacy Stack and Samp (no CVSS, OPCFoundation.NetStandard.Opc.Ua)
- [CVE-2017-15695](https://cve.now/CVE-2017-15695.md): When an Apache Geode server versions 1.0.0 to 1.4.0 is configured with a security manager, a user with DATA:WRITE privileges is allowed to d (no CVSS, Apache Software Foundation Apache Geode · org.apache.geode:…)
- [CVE-2017-16652](https://cve.now/CVE-2017-16652.md): An issue was discovered in Symfony 2.7.x before 2.7.38, 2.8.x before 2.8.31, 3.2.x before 3.2.14, and 3.3.x before 3.3.13. (no CVSS, symfony/symfony · symfony/security-http +1)
- [CVE-2018-11385](https://cve.now/CVE-2018-11385.md): An issue was discovered in the Security component in Symfony 2.7.x before 2.7.48, 2.8.x before 2.8.41, 3.3.x before 3.3.17, 3.4.x before 3.4 (no CVSS, symfony/symfony · symfony/security-http +1)
- [CVE-2018-11386](https://cve.now/CVE-2018-11386.md): An issue was discovered in the HttpFoundation component in Symfony 2.7.x before 2.7.48, 2.8.x before 2.8.41, 3.3.x before 3.3.17, 3.4.x befo (no CVSS, symfony/symfony · symfony/http-foundation)
- [CVE-2018-11406](https://cve.now/CVE-2018-11406.md): An issue was discovered in the Security component in Symfony 2.7.x before 2.7.48, 2.8.x before 2.8.41, 3.3.x before 3.3.17, 3.4.x before 3.4 (no CVSS, symfony/symfony · symfony/security-bundle +2)
- [CVE-2018-11407](https://cve.now/CVE-2018-11407.md): An issue was discovered in the Ldap component in Symfony 2.8.x before 2.8.37, 3.3.x before 3.3.17, 3.4.x before 3.4.7, and 4.0.x before 4.0. (no CVSS, symfony/security-core · symfony/security +1)
- [CVE-2018-11408](https://cve.now/CVE-2018-11408.md): The security handlers in the Security component in Symfony in 2.7.x before 2.7.48, 2.8.x before 2.8.41, 3.3.x before 3.3.17, 3.4.x before 3. (no CVSS, symfony/symfony · symfony/security-bundle)
- [CVE-2018-11688](https://cve.now/CVE-2018-11688.md): Ignite Realtime Openfire before 3.9.2 is vulnerable to cross-site scripting, caused by improper validation of user-supplied input. (no CVSS, org.igniterealtime.openfire:parent)
- [CVE-2018-11806](https://cve.now/CVE-2018-11806.md): m\_cat in slirp/mbuf.c in Qemu has a heap-based buffer overflow via incoming fragmented datagrams. (no CVSS)
- [CVE-2018-12320](https://cve.now/CVE-2018-12320.md): There is a use after free in radare2 2.6.0 in r\_anal\_bb\_free() in libr/anal/bb.c via a crafted Java binary file. (no CVSS)
- [CVE-2018-12321](https://cve.now/CVE-2018-12321.md): There is a heap out of bounds read in radare2 2.6.0 in java\_switch\_op() in libr/anal/p/anal\_java.c via a crafted Java binary file. (no CVSS)
- [CVE-2018-12322](https://cve.now/CVE-2018-12322.md): There is a heap out of bounds read in radare2 2.6.0 in \_6502\_op() in libr/anal/p/anal\_6502.c via a crafted iNES ROM binary file. (no CVSS)
- [CVE-2018-12323](https://cve.now/CVE-2018-12323.md): An issue was discovered on Momentum Axel 720P 5.1.8 devices. (no CVSS)
- [CVE-2018-5242](https://cve.now/CVE-2018-5242.md): Norton App Lock prior to version 1.3.0.329 can be susceptible to a bypass exploit. (no CVSS, Symantec Norton App Lock)
- [CVE-2018-7161](https://cve.now/CVE-2018-7161.md): All versions of Node.js 8.x, 9.x, and 10.x are vulnerable and the severity is HIGH. (no CVSS, The Node.js Project Node.js)
- [CVE-2018-7162](https://cve.now/CVE-2018-7162.md): All versions of Node.js 9.x and 10.x are vulnerable and the severity is HIGH. (no CVSS, The Node.js Project Node.js)
- [CVE-2018-7164](https://cve.now/CVE-2018-7164.md): Node.js versions 9.7.0 and later and 10.x are vulnerable and the severity is MEDIUM. (no CVSS, The Node.js Project Node.js)
- [CVE-2018-7167](https://cve.now/CVE-2018-7167.md): Calling Buffer.fill() or Buffer.alloc() with some parameters can lead to a hang which could result in a Denial of Service. (no CVSS, The Node.js Project Node.js)
- [CVE-2018-3759](https://cve.now/CVE-2018-3759.md): private\_address\_check ruby gem before 0.5.0 is vulnerable to a time-of-check time-of-use (TOCTOU) race condition due to the address the sock (no CVSS, HackerOne private\_address\_check ruby gem · private\_address\_…)
- [CVE-2018-12290](https://cve.now/CVE-2018-12290.md): The Yii2-StateMachine extension v2.x.x for Yii2 has XSS. (no CVSS, ptheofan/yii2-statemachine)
- [CVE-2018-12291](https://cve.now/CVE-2018-12291.md): The on\_get\_missing\_events function in handlers/federation.py in Matrix Synapse before 0.31.1 has a security bug in the get\_missing\_events fe (no CVSS, matrix-synapse)
- [CVE-2018-12292](https://cve.now/CVE-2018-12292.md): A use-after-free vulnerability exists in DOMProxyHandler::EnsureExpandoObject in Pale Moon before 27.9.3. (no CVSS)
- [CVE-2018-1393](https://cve.now/CVE-2018-1393.md): IBM Financial Transaction Manager for ACH Services for Multi-Platform 3.0.6 could allow an authenticated user to execute a specially crafted (CVSS 3.1, IBM Financial Transaction Manager)
- [CVE-2018-1431](https://cve.now/CVE-2018-1431.md): A vulnerability in GSKit affects IBM Spectrum Scale 4.1.1, 4.2.0, 4.2.1, 4.2.3, and 5.0.0 that could allow a local attacker to obtain contro (CVSS 7.4, IBM Spectrum Scale)
- [CVE-2011-4183](https://cve.now/CVE-2011-4183.md): open build service allows anyone to upload rpms (CVSS 6.5, SUSE open build service)
- [CVE-2018-12272](https://cve.now/CVE-2018-12272.md): xowl/request.php in Ximdex 4.0 has XSS via the content parameter. (no CVSS)
- [CVE-2018-12273](https://cve.now/CVE-2018-12273.md): The /edit URI in the DMS component in Ximdex 4.0 has XSS via the Ciudad or Nombre parameter. (no CVSS)
- [CVE-2018-5432](https://cve.now/CVE-2018-5432.md): TIBCO Administrator - Enterprise Edition Cross-Site Scripting Vulnerability (CVSS 8.0, TIBCO Software TIBCO Administrator - Enterprise Edition)
- [CVE-2018-5433](https://cve.now/CVE-2018-5433.md): XML eXternal Entity Expansion Vulnerabilities with TIBCO Administrator (CVSS 6.5, TIBCO Software TIBCO Administrator - Enterprise Edition)
- [CVE-2018-5434](https://cve.now/CVE-2018-5434.md): XML eXternal Entity Expansion Vulnerabilities with TIBCO Runtime Agent (CVSS 5.8, TIBCO Software TIBCO Runtime Agent)
- [CVE-2018-12263](https://cve.now/CVE-2018-12263.md): portfolioCMS 1.0.5 allows upload of arbitrary .php files via the admin/portfolio.php?newpage=true URI. (no CVSS)
- [CVE-2018-12264](https://cve.now/CVE-2018-12264.md): Exiv2 0.26 has integer overflows in LoaderTiff::getData() in preview.cpp, leading to an out-of-bounds read in Exiv2::ValueType::setDataArea (no CVSS)
- [CVE-2018-12265](https://cve.now/CVE-2018-12265.md): Exiv2 0.26 has an integer overflow in the LoaderExifJpeg class in preview.cpp, leading to an out-of-bounds read in Exiv2::MemIo::read in bas (no CVSS)
- [CVE-2018-12266](https://cve.now/CVE-2018-12266.md): system\\errors\\404.php in HongCMS 3.0.0 has XSS via crafted input that triggers a 404 HTTP status code. (no CVSS)
- [CVE-2018-12268](https://cve.now/CVE-2018-12268.md): acccheck.pl in acccheck 0.2.1 allows Command Injection via shell metacharacters in a username or password file, as demonstrated by injection (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2018-06-13
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.