# CVEs published 2018-06-14

71 CVEs were published on June 14, 2018: 1 critical, 0 high. Days are UTC.

- [CVE-2018-12431](https://cve.now/CVE-2018-12431.md): SeaCMS V6.61 has XSS via the site name parameter on an adm1n/admin\_config.php page (aka a system management page). (no CVSS)
- [CVE-2018-12432](https://cve.now/CVE-2018-12432.md): JavaMelody through 1.60.0 has XSS via the counter parameter in a clear\_counter action to the /monitoring URI. (no CVSS, net.bull.javamelody:javamelody-core)
- [CVE-2018-12420](https://cve.now/CVE-2018-12420.md): IceHrm before 23.0.1.OS has a risky usage of a hashed password in a request. (no CVSS)
- [CVE-2018-12423](https://cve.now/CVE-2018-12423.md): In Synapse before 0.31.2, unauthorised users can hijack rooms when there is no m.room.power\_levels event in force. (no CVSS, matrix-synapse)
- [CVE-2018-6516](https://cve.now/CVE-2018-6516.md): On Windows only, with a specifically crafted configuration file an attacker could get Puppet PE client tools (aka pe-client-tools) 16.4.x pr (no CVSS, Puppet pe-client-tools)
- [CVE-2017-12070](https://cve.now/CVE-2017-12070.md): Unsigned versions of the DLLs distributed by the OPC Foundation may be replaced with malicious code. (no CVSS)
- [CVE-2018-11574](https://cve.now/CVE-2018-11574.md): Improper input validation together with an integer overflow in the EAP-TLS protocol implementation in PPPD may cause a crash, information di (CVSS 9.8)
- [CVE-2018-11689](https://cve.now/CVE-2018-11689.md): Web Viewer for Hanwha DVR 2.17 and Smart Viewer in Samsung Web Viewer for Samsung DVR are vulnerable to XSS via the /cgi-bin/webviewer\_login (no CVSS)
- [CVE-2018-11690](https://cve.now/CVE-2018-11690.md): The Balbooa Gridbox extension version 2.4.0 and previous versions for Joomla! is vulnerable to cross-site scripting, caused by improper vali (no CVSS)
- [CVE-2018-8819](https://cve.now/CVE-2018-8819.md): An XXE issue was discovered in Automated Logic Corporation (ALC) WebCTRL Versions 6.0, 6.1 and 6.5. (no CVSS)
- [CVE-2018-12421](https://cve.now/CVE-2018-12421.md): LTB (aka LDAP Tool Box) Self Service Password before 1.3 allows a change to a user password (without knowing the old password) via a crafted (no CVSS)
- [CVE-2018-12114](https://cve.now/CVE-2018-12114.md): Maccms 10 allows CSRF via admin.php/admin/admin/info.html to add user accounts. (no CVSS)
- [CVE-2018-10821](https://cve.now/CVE-2018-10821.md): Cross-site scripting (XSS) vulnerability in backend/pages/modify.php in BlackCatCMS 1.3 allows remote authenticated users with the Admin rol (no CVSS)
- [CVE-2018-12418](https://cve.now/CVE-2018-12418.md): Archive.java in Junrar before 1.0.1, as used in Apache Tika and other products, is affected by a denial of service vulnerability due to an i (no CVSS, com.github.junrar:junrar)
- [CVE-2018-4833](https://cve.now/CVE-2018-4833.md): A vulnerability has been identified in RFID 181EIP (All versions), RUGGEDCOM Win (V4.4, V4.5, V5.0, and V5.1), SCALANCE X-200 switch family (no CVSS, Siemens RFID 181EIP · Siemens RUGGEDCOM Win +7)
- [CVE-2017-17172](https://cve.now/CVE-2017-17172.md): Huawei smart phones LYO-L21 with software LYO-L21C479B107, LYO-L21C479B107 have a privilege escalation vulnerability. (no CVSS, Huawei Technologies Co. LYO-L21)
- [CVE-2017-17173](https://cve.now/CVE-2017-17173.md): Due to insufficient parameters verification GPU driver of Mate 9 Pro Huawei smart phones with the versions before LON-AL00B 8.0.0.356(C00) h (no CVSS, Huawei Technologies Co. Mate 9 Pro)
- [CVE-2017-17309](https://cve.now/CVE-2017-17309.md): Huawei HG255s-10 V100R001C163B025SP02 has a path traversal vulnerability due to insufficient validation of the received HTTP requests, a rem (no CVSS, Huawei Technologies Co. HG255s-10)
- [CVE-2018-8927](https://cve.now/CVE-2018-8927.md): Improper authorization vulnerability in SYNO.Cal.Event in Calendar before 2.1.2-0511 allows remote authenticated users to create arbitrary e (CVSS 5.4, Synology Calendar)
- [CVE-2018-0871](https://cve.now/CVE-2018-0871.md): An information disclosure vulnerability exists when Edge improperly marks files, aka "Microsoft Edge Information Disclosure Vulnerability." (no CVSS, Microsoft Edge)
- [CVE-2018-0978](https://cve.now/CVE-2018-0978.md): A remote code execution vulnerability exists when Internet Explorer improperly accesses objects in memory, aka "Internet Explorer Memory Cor (no CVSS, Microsoft Internet Explorer)
- [CVE-2018-0982](https://cve.now/CVE-2018-0982.md): An elevation of privilege vulnerability exists in the way that the Windows Kernel API enforces permissions, aka "Windows Elevation of Privil (no CVSS, Microsoft Windows Server · Microsoft Windows)
- [CVE-2018-1036](https://cve.now/CVE-2018-1036.md): An elevation of privilege vulnerability exists when NTFS improperly checks access, aka "NTFS Elevation of Privilege Vulnerability." This aff (no CVSS, Microsoft Windows)
- [CVE-2018-1040](https://cve.now/CVE-2018-1040.md): A denial of service vulnerability exists in the way that the Windows Code Integrity Module performs hashing, aka "Windows Code Integrity Mod (no CVSS, Microsoft Windows)
- [CVE-2018-8110](https://cve.now/CVE-2018-8110.md): A remote code execution vulnerability exists when Microsoft Edge improperly accesses objects in memory, aka "Microsoft Edge Memory Corruptio (no CVSS, Microsoft Edge)
- [CVE-2018-8111](https://cve.now/CVE-2018-8111.md): A remote code execution vulnerability exists when Microsoft Edge improperly accesses objects in memory, aka "Microsoft Edge Memory Corruptio (no CVSS, Microsoft Edge)
- [CVE-2018-8113](https://cve.now/CVE-2018-8113.md): A security feature bypass vulnerability exists in Internet Explorer that allows for bypassing Mark of the Web Tagging (MOTW), aka "Internet (no CVSS, Microsoft Internet Explorer)
- [CVE-2018-8121](https://cve.now/CVE-2018-8121.md): An information disclosure vulnerability exists when the Windows kernel improperly initializes objects in memory, aka "Windows Kernel Informa (no CVSS, Microsoft Windows 10 Servers · Microsoft Windows)
- [CVE-2018-8140](https://cve.now/CVE-2018-8140.md): An Elevation of Privilege vulnerability exists when Cortana retrieves data from user input services without consideration for status, aka "C (no CVSS, Microsoft Windows 10 Servers · Microsoft Windows)
- [CVE-2018-8169](https://cve.now/CVE-2018-8169.md): An elevation of privilege vulnerability exists when the (Human Interface Device) HID Parser Library driver improperly handles objects in mem (no CVSS, Microsoft Windows)
- [CVE-2018-8175](https://cve.now/CVE-2018-8175.md): An denial of service vulnerability exists when Windows NT WEBDAV Minirdr attempts to query a WEBDAV directory, aka "WEBDAV Denial of Service (no CVSS, Microsoft Windows 10 Servers · Microsoft Windows)
- [CVE-2018-8201](https://cve.now/CVE-2018-8201.md): A security feature bypass vulnerability exists in Device Guard that could allow an attacker to inject malicious code into a Windows PowerShe (no CVSS, Microsoft Windows Server · Microsoft Windows)
- [CVE-2018-8205](https://cve.now/CVE-2018-8205.md): A denial of service vulnerability exists when Windows improperly handles objects in memory, aka "Windows Denial of Service Vulnerability." T (no CVSS, Microsoft Windows)
- [CVE-2018-8207](https://cve.now/CVE-2018-8207.md): An information disclosure vulnerability exists when the Windows kernel improperly handles objects in memory, aka "Windows Kernel Information (no CVSS, Microsoft Windows)
- [CVE-2018-8208](https://cve.now/CVE-2018-8208.md): An elevation of privilege vulnerability exists in Windows when Desktop Bridge does not properly manage the virtual registry, aka "Windows De (no CVSS, Microsoft Windows Server · Microsoft Windows)
- [CVE-2018-8209](https://cve.now/CVE-2018-8209.md): An information disclosure vulnerability exists when Windows allows a normal user to access the Wireless LAN profile of an administrative use (no CVSS, Microsoft Windows Server · Microsoft Windows)
- [CVE-2018-8210](https://cve.now/CVE-2018-8210.md): A remote code execution vulnerability exists when Windows improperly handles objects in memory, aka "Windows Remote Code Execution Vulnerabi (no CVSS, Microsoft Windows Server 2012 R2 · Microsoft Windows RT +2)
- [CVE-2018-8211](https://cve.now/CVE-2018-8211.md): A security feature bypass vulnerability exists in Device Guard that could allow an attacker to inject malicious code into a Windows PowerShe (no CVSS, Microsoft Windows 10 Servers · Microsoft Windows)
- [CVE-2018-8212](https://cve.now/CVE-2018-8212.md): A security feature bypass vulnerability exists in Device Guard that could allow an attacker to inject malicious code into a Windows PowerShe (no CVSS, Microsoft Windows Server · Microsoft Windows)
- [CVE-2018-8213](https://cve.now/CVE-2018-8213.md): A remote code execution vulnerability exists when Windows improperly handles objects in memory, aka "Windows Remote Code Execution Vulnerabi (no CVSS, Microsoft Windows Server · Microsoft Windows)
- [CVE-2018-8214](https://cve.now/CVE-2018-8214.md): An elevation of privilege vulnerability exists in Windows when Desktop Bridge does not properly manage the virtual registry, aka "Windows De (no CVSS, Microsoft Windows Server · Microsoft Windows)
- [CVE-2018-8215](https://cve.now/CVE-2018-8215.md): A security feature bypass vulnerability exists in Device Guard that could allow an attacker to inject malicious code into a Windows PowerShe (no CVSS, Microsoft Windows Server · Microsoft Windows)
- [CVE-2018-8216](https://cve.now/CVE-2018-8216.md): A security feature bypass vulnerability exists in Device Guard that could allow an attacker to inject malicious code into a Windows PowerShe (no CVSS, Microsoft Windows Server · Microsoft Windows)
- [CVE-2018-8217](https://cve.now/CVE-2018-8217.md): A security feature bypass vulnerability exists in Device Guard that could allow an attacker to inject malicious code into a Windows PowerShe (no CVSS, Microsoft Windows Server · Microsoft Windows)
- [CVE-2018-8218](https://cve.now/CVE-2018-8218.md): A denial of service vulnerability exists when Microsoft Hyper-V Network Switch on a host server fails to properly validate input from a priv (no CVSS, Microsoft Windows)
- [CVE-2018-8219](https://cve.now/CVE-2018-8219.md): An elevation of privilege vulnerability exists when Windows Hyper-V instruction emulation fails to properly enforce privilege levels, aka "H (no CVSS, Microsoft Windows Server · Microsoft Windows)
- [CVE-2018-8221](https://cve.now/CVE-2018-8221.md): A security feature bypass vulnerability exists in Device Guard that could allow an attacker to inject malicious code into a Windows PowerShe (no CVSS, Microsoft Windows Server · Microsoft Windows)
- [CVE-2018-8224](https://cve.now/CVE-2018-8224.md): An elevation of privilege vulnerability exists when the Windows kernel fails to properly handle objects in memory, aka "Windows Kernel Eleva (no CVSS, Microsoft Windows Server · Microsoft Windows)
- [CVE-2018-8225](https://cve.now/CVE-2018-8225.md): A remote code execution vulnerability exists in Windows Domain Name System (DNS) DNSAPI.dll when it fails to properly handle DNS responses, (no CVSS, Microsoft Windows)
- [CVE-2018-8226](https://cve.now/CVE-2018-8226.md): A denial of service vulnerability exists in the HTTP 2.0 protocol stack (HTTP.sys) when HTTP.sys improperly parses specially crafted HTTP 2. (no CVSS, Microsoft Windows Server · Microsoft Windows)
- [CVE-2018-8227](https://cve.now/CVE-2018-8227.md): A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka "C (no CVSS, Microsoft Edge · Microsoft ChakraCore +1)
- [CVE-2018-8229](https://cve.now/CVE-2018-8229.md): A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka "C (no CVSS, Microsoft Edge · Microsoft ChakraCore +1)
- [CVE-2018-8231](https://cve.now/CVE-2018-8231.md): A remote code execution vulnerability exists when HTTP Protocol Stack (Http.sys) improperly handles objects in memory, aka "HTTP Protocol St (no CVSS, Microsoft Windows Server · Microsoft Windows)
- [CVE-2018-8233](https://cve.now/CVE-2018-8233.md): An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in memory, aka "Win32k (no CVSS, Microsoft Windows)
- [CVE-2018-8234](https://cve.now/CVE-2018-8234.md): An information disclosure vulnerability exists when Microsoft Edge improperly handles objects in memory, aka "Microsoft Edge Information Dis (no CVSS, Microsoft Edge)
- [CVE-2018-8235](https://cve.now/CVE-2018-8235.md): A security feature bypass vulnerability exists when Microsoft Edge improperly handles requests of different origins, aka "Microsoft Edge Sec (no CVSS, Microsoft Edge)
- [CVE-2018-8236](https://cve.now/CVE-2018-8236.md): A remote code execution vulnerability exists when Microsoft Edge improperly accesses objects in memory, aka "Microsoft Edge Memory Corruptio (no CVSS, Microsoft Edge)
- [CVE-2018-8239](https://cve.now/CVE-2018-8239.md): An information disclosure vulnerability exists when the Windows GDI component improperly discloses the contents of its memory, aka "Windows (no CVSS, Microsoft Windows Server · Microsoft Windows)
- [CVE-2018-8243](https://cve.now/CVE-2018-8243.md): A remote code execution vulnerability exists in the way that the ChakraCore scripting engine handles objects in memory, aka "Scripting Engin (no CVSS, Microsoft ChakraCore · Microsoft.ChakraCore)
- [CVE-2018-8244](https://cve.now/CVE-2018-8244.md): An elevation of privilege vulnerability exists when Microsoft Outlook does not validate attachment headers properly, aka "Microsoft Outlook (no CVSS, Microsoft Office · Microsoft Outlook)
- [CVE-2018-8245](https://cve.now/CVE-2018-8245.md): A remote code execution vulnerability exists when Microsoft Publisher fails to utilize features that lock down the Local Machine zone when i (no CVSS, Microsoft Publisher)
- [CVE-2018-8246](https://cve.now/CVE-2018-8246.md): An information disclosure vulnerability exists when Microsoft Excel improperly discloses the contents of its memory, aka "Microsoft Excel In (no CVSS)
- [CVE-2018-8247](https://cve.now/CVE-2018-8247.md): An elevation of privilege vulnerability exists when Office Web Apps Server 2013 and Office Online Server fail to properly handle web request (no CVSS, Microsoft Office)
- [CVE-2018-8248](https://cve.now/CVE-2018-8248.md): A remote code execution vulnerability exists in Microsoft Excel software when the software fails to properly handle objects in memory, aka " (no CVSS, Microsoft Office)
- [CVE-2018-8249](https://cve.now/CVE-2018-8249.md): A remote code execution vulnerability exists when Internet Explorer improperly accesses objects in memory, aka "Internet Explorer Memory Cor (no CVSS, Microsoft Internet Explorer)
- [CVE-2018-8251](https://cve.now/CVE-2018-8251.md): A memory corruption vulnerability exists when Windows Media Foundation improperly handles objects in memory, aka "Media Foundation Memory Co (no CVSS, Microsoft Windows)
- [CVE-2018-8252](https://cve.now/CVE-2018-8252.md): An elevation of privilege vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request t (no CVSS, Microsoft SharePoint)
- [CVE-2018-8254](https://cve.now/CVE-2018-8254.md): An elevation of privilege vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request t (no CVSS, Microsoft Project Server · Microsoft SharePoint)
- [CVE-2018-8267](https://cve.now/CVE-2018-8267.md): A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Internet Explorer, aka "Scrip (no CVSS, Microsoft Internet Explorer)
- [CVE-2018-4842](https://cve.now/CVE-2018-4842.md): A vulnerability has been identified in SCALANCE X-200IRT switch family (incl. (no CVSS, Siemens SCALANCE X-200IRT switch family · Siemens SCALAN… +1)
- [CVE-2018-4848](https://cve.now/CVE-2018-4848.md): A vulnerability has been identified in SCALANCE X-200 switch family (incl. (no CVSS, Siemens SCALANCE X-200 switch family · Siemens SCALANCE… +2)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2018-06-14
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.