CVEs published June 14, 2018
71 CVEs were published on June 14, 2018: 1 critical, 0 high.
- Published
- 71
- Critical
- 1
- High
- 0
- Medium
- 1
- Low
- 0
- Unrated
- 69
- Now in CISA KEV
- 0
- Fix available
- 7
Most affected products
- Microsoft Windows Server · Microsoft Windows
- 16
- Microsoft Windows
- 9
- Microsoft Edge
- 6
- Microsoft Internet Explorer
- 4
- Microsoft Windows 10 Servers · Microsoft Windows
- 4
- Microsoft Edge · Microsoft ChakraCore +1
- 2
- Microsoft Office
- 2
- com.github.junrar:junrar
- 1
- Huawei Technologies Co. HG255s-10
- 1
- Huawei Technologies Co. LYO-L21
- 1
Critical 1
Medium, low and unrated 70
- CVE-2018-12431SeaCMS V6.61 has XSS via the site name parameter on an adm1n/admin_config.php page (aka a system management page).
- CVE-2018-12432JavaMelody through 1.60.0 has XSS via the counter parameter in a clear_counter action to the /monitoring URI.net.bull.javamelody:javamelody-core
- CVE-2018-12420IceHrm before 23.0.1.OS has a risky usage of a hashed password in a request.
- CVE-2018-12423In Synapse before 0.31.2, unauthorised users can hijack rooms when there is no m.room.power_levels event in force.matrix-synapse
- CVE-2018-6516On Windows only, with a specifically crafted configuration file an attacker could get Puppet PE client tools (aka pe-client-tools) 16.4.x prPuppet pe-client-tools
- CVE-2017-12070Unsigned versions of the DLLs distributed by the OPC Foundation may be replaced with malicious code.
- CVE-2018-11689Web Viewer for Hanwha DVR 2.17 and Smart Viewer in Samsung Web Viewer for Samsung DVR are vulnerable to XSS via the /cgi-bin/webviewer_login
- CVE-2018-11690The Balbooa Gridbox extension version 2.4.0 and previous versions for Joomla! is vulnerable to cross-site scripting, caused by improper vali
- CVE-2018-8819An XXE issue was discovered in Automated Logic Corporation (ALC) WebCTRL Versions 6.0, 6.1 and 6.5.
- CVE-2018-12421LTB (aka LDAP Tool Box) Self Service Password before 1.3 allows a change to a user password (without knowing the old password) via a crafted
- CVE-2018-12114Maccms 10 allows CSRF via admin.php/admin/admin/info.html to add user accounts.
- CVE-2018-10821Cross-site scripting (XSS) vulnerability in backend/pages/modify.php in BlackCatCMS 1.3 allows remote authenticated users with the Admin rol
- CVE-2018-12418Archive.java in Junrar before 1.0.1, as used in Apache Tika and other products, is affected by a denial of service vulnerability due to an icom.github.junrar:junrar
- CVE-2018-4833A vulnerability has been identified in RFID 181EIP (All versions), RUGGEDCOM Win (V4.4, V4.5, V5.0, and V5.1), SCALANCE X-200 switch family Siemens RFID 181EIP · Siemens RUGGEDCOM Win +7
- CVE-2017-17172Huawei smart phones LYO-L21 with software LYO-L21C479B107, LYO-L21C479B107 have a privilege escalation vulnerability.Huawei Technologies Co. LYO-L21
- CVE-2017-17173Due to insufficient parameters verification GPU driver of Mate 9 Pro Huawei smart phones with the versions before LON-AL00B 8.0.0.356(C00) hHuawei Technologies Co. Mate 9 Pro
- CVE-2017-17309Huawei HG255s-10 V100R001C163B025SP02 has a path traversal vulnerability due to insufficient validation of the received HTTP requests, a remHuawei Technologies Co. HG255s-10
- CVE-2018-8927Improper authorization vulnerability in SYNO.Cal.Event in Calendar before 2.1.2-0511 allows remote authenticated users to create arbitrary eSynology Calendar
- CVE-2018-0871An information disclosure vulnerability exists when Edge improperly marks files, aka "Microsoft Edge Information Disclosure Vulnerability." Microsoft Edge
- CVE-2018-0978A remote code execution vulnerability exists when Internet Explorer improperly accesses objects in memory, aka "Internet Explorer Memory CorMicrosoft Internet Explorer
- CVE-2018-0982An elevation of privilege vulnerability exists in the way that the Windows Kernel API enforces permissions, aka "Windows Elevation of PrivilMicrosoft Windows Server · Microsoft Windows
- CVE-2018-1036An elevation of privilege vulnerability exists when NTFS improperly checks access, aka "NTFS Elevation of Privilege Vulnerability." This affMicrosoft Windows
- CVE-2018-1040A denial of service vulnerability exists in the way that the Windows Code Integrity Module performs hashing, aka "Windows Code Integrity ModMicrosoft Windows
- CVE-2018-8110A remote code execution vulnerability exists when Microsoft Edge improperly accesses objects in memory, aka "Microsoft Edge Memory CorruptioMicrosoft Edge
- CVE-2018-8111A remote code execution vulnerability exists when Microsoft Edge improperly accesses objects in memory, aka "Microsoft Edge Memory CorruptioMicrosoft Edge
- CVE-2018-8113A security feature bypass vulnerability exists in Internet Explorer that allows for bypassing Mark of the Web Tagging (MOTW), aka "Internet Microsoft Internet Explorer
- CVE-2018-8121An information disclosure vulnerability exists when the Windows kernel improperly initializes objects in memory, aka "Windows Kernel InformaMicrosoft Windows 10 Servers · Microsoft Windows
- CVE-2018-8140An Elevation of Privilege vulnerability exists when Cortana retrieves data from user input services without consideration for status, aka "CMicrosoft Windows 10 Servers · Microsoft Windows
- CVE-2018-8169An elevation of privilege vulnerability exists when the (Human Interface Device) HID Parser Library driver improperly handles objects in memMicrosoft Windows
- CVE-2018-8175An denial of service vulnerability exists when Windows NT WEBDAV Minirdr attempts to query a WEBDAV directory, aka "WEBDAV Denial of ServiceMicrosoft Windows 10 Servers · Microsoft Windows
- CVE-2018-8201A security feature bypass vulnerability exists in Device Guard that could allow an attacker to inject malicious code into a Windows PowerSheMicrosoft Windows Server · Microsoft Windows
- CVE-2018-8205A denial of service vulnerability exists when Windows improperly handles objects in memory, aka "Windows Denial of Service Vulnerability." TMicrosoft Windows
- CVE-2018-8207An information disclosure vulnerability exists when the Windows kernel improperly handles objects in memory, aka "Windows Kernel InformationMicrosoft Windows
- CVE-2018-8208An elevation of privilege vulnerability exists in Windows when Desktop Bridge does not properly manage the virtual registry, aka "Windows DeMicrosoft Windows Server · Microsoft Windows
- CVE-2018-8209An information disclosure vulnerability exists when Windows allows a normal user to access the Wireless LAN profile of an administrative useMicrosoft Windows Server · Microsoft Windows
- CVE-2018-8210A remote code execution vulnerability exists when Windows improperly handles objects in memory, aka "Windows Remote Code Execution VulnerabiMicrosoft Windows Server 2012 R2 · Microsoft Windows RT +2
- CVE-2018-8211A security feature bypass vulnerability exists in Device Guard that could allow an attacker to inject malicious code into a Windows PowerSheMicrosoft Windows 10 Servers · Microsoft Windows
- CVE-2018-8212A security feature bypass vulnerability exists in Device Guard that could allow an attacker to inject malicious code into a Windows PowerSheMicrosoft Windows Server · Microsoft Windows
- CVE-2018-8213A remote code execution vulnerability exists when Windows improperly handles objects in memory, aka "Windows Remote Code Execution VulnerabiMicrosoft Windows Server · Microsoft Windows
- CVE-2018-8214An elevation of privilege vulnerability exists in Windows when Desktop Bridge does not properly manage the virtual registry, aka "Windows DeMicrosoft Windows Server · Microsoft Windows
- CVE-2018-8215A security feature bypass vulnerability exists in Device Guard that could allow an attacker to inject malicious code into a Windows PowerSheMicrosoft Windows Server · Microsoft Windows
- CVE-2018-8216A security feature bypass vulnerability exists in Device Guard that could allow an attacker to inject malicious code into a Windows PowerSheMicrosoft Windows Server · Microsoft Windows
- CVE-2018-8217A security feature bypass vulnerability exists in Device Guard that could allow an attacker to inject malicious code into a Windows PowerSheMicrosoft Windows Server · Microsoft Windows
- CVE-2018-8218A denial of service vulnerability exists when Microsoft Hyper-V Network Switch on a host server fails to properly validate input from a privMicrosoft Windows
- CVE-2018-8219An elevation of privilege vulnerability exists when Windows Hyper-V instruction emulation fails to properly enforce privilege levels, aka "HMicrosoft Windows Server · Microsoft Windows
- CVE-2018-8221A security feature bypass vulnerability exists in Device Guard that could allow an attacker to inject malicious code into a Windows PowerSheMicrosoft Windows Server · Microsoft Windows
- CVE-2018-8224An elevation of privilege vulnerability exists when the Windows kernel fails to properly handle objects in memory, aka "Windows Kernel ElevaMicrosoft Windows Server · Microsoft Windows
- CVE-2018-8225A remote code execution vulnerability exists in Windows Domain Name System (DNS) DNSAPI.dll when it fails to properly handle DNS responses, Microsoft Windows
- CVE-2018-8226A denial of service vulnerability exists in the HTTP 2.0 protocol stack (HTTP.sys) when HTTP.sys improperly parses specially crafted HTTP 2.Microsoft Windows Server · Microsoft Windows
- CVE-2018-8227A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka "CMicrosoft Edge · Microsoft ChakraCore +1
- CVE-2018-8229A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka "CMicrosoft Edge · Microsoft ChakraCore +1
- CVE-2018-8231A remote code execution vulnerability exists when HTTP Protocol Stack (Http.sys) improperly handles objects in memory, aka "HTTP Protocol StMicrosoft Windows Server · Microsoft Windows
- CVE-2018-8233An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in memory, aka "Win32k Microsoft Windows
- CVE-2018-8234An information disclosure vulnerability exists when Microsoft Edge improperly handles objects in memory, aka "Microsoft Edge Information DisMicrosoft Edge
- CVE-2018-8235A security feature bypass vulnerability exists when Microsoft Edge improperly handles requests of different origins, aka "Microsoft Edge SecMicrosoft Edge
- CVE-2018-8236A remote code execution vulnerability exists when Microsoft Edge improperly accesses objects in memory, aka "Microsoft Edge Memory CorruptioMicrosoft Edge
- CVE-2018-8239An information disclosure vulnerability exists when the Windows GDI component improperly discloses the contents of its memory, aka "Windows Microsoft Windows Server · Microsoft Windows
- CVE-2018-8243A remote code execution vulnerability exists in the way that the ChakraCore scripting engine handles objects in memory, aka "Scripting EnginMicrosoft ChakraCore · Microsoft.ChakraCore
- CVE-2018-8244An elevation of privilege vulnerability exists when Microsoft Outlook does not validate attachment headers properly, aka "Microsoft Outlook Microsoft Office · Microsoft Outlook
- CVE-2018-8245A remote code execution vulnerability exists when Microsoft Publisher fails to utilize features that lock down the Local Machine zone when iMicrosoft Publisher
- CVE-2018-8246An information disclosure vulnerability exists when Microsoft Excel improperly discloses the contents of its memory, aka "Microsoft Excel In
- CVE-2018-8247An elevation of privilege vulnerability exists when Office Web Apps Server 2013 and Office Online Server fail to properly handle web requestMicrosoft Office
- CVE-2018-8248A remote code execution vulnerability exists in Microsoft Excel software when the software fails to properly handle objects in memory, aka "Microsoft Office
- CVE-2018-8249A remote code execution vulnerability exists when Internet Explorer improperly accesses objects in memory, aka "Internet Explorer Memory CorMicrosoft Internet Explorer
- CVE-2018-8251A memory corruption vulnerability exists when Windows Media Foundation improperly handles objects in memory, aka "Media Foundation Memory CoMicrosoft Windows
- CVE-2018-8252An elevation of privilege vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request tMicrosoft SharePoint
- CVE-2018-8254An elevation of privilege vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request tMicrosoft Project Server · Microsoft SharePoint
- CVE-2018-8267A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Internet Explorer, aka "ScripMicrosoft Internet Explorer
- CVE-2018-4842A vulnerability has been identified in SCALANCE X-200IRT switch family (incl.Siemens SCALANCE X-200IRT switch family · Siemens SCALAN… +1
- CVE-2018-4848A vulnerability has been identified in SCALANCE X-200 switch family (incl.Siemens SCALANCE X-200 switch family · Siemens SCALANCE… +2