CVEs published June 15, 2018
48 CVEs were published on June 15, 2018: 1 critical, 3 high.
- Published
- 48
- Critical
- 1
- High
- 3
- Medium
- 2
- Low
- 1
- Unrated
- 41
- Now in CISA KEV
- 0
- Fix available
- 3
Most affected products
- Qualcomm Android for MSM, Firefox OS for MSM, QRD Android
- 5
- McAfee ePolicy Orchestrator
- 2
- [UNKNOWN] openshift-ansible
- 1
- express-cart
- 1
- IBM MQ
- 1
- IBM PureData System for Analytics
- 1
- Micro Focus UCMDB Browser
- 1
- Micro Focus Universal CMDB Server · Micro Focus CMS Server
- 1
Critical 1
High 3
- CVE-2018-6496MFSBGN03809 rev.1 - Universal CMDB, Deserialization Java Objects and CSRFMicro Focus UCMDB Browser
- CVE-2018-6497MFSBGN03810 rev.1 - Universal CMDB, Deserialization Java Objects and CSRFMicro Focus Universal CMDB Server · Micro Focus CMS Server
- CVE-2018-1460IBM Netezza Platform Software (IBM PureData System for Analytics 1.0.0) could allow a local user to modify a world writable file, which coulIBM PureData System for Analytics
Medium, low and unrated 44
- CVE-2017-17062The backend component in Open-Xchange OX App Suite before 7.6.3-rev35, 7.8.x before 7.8.2-rev38, 7.8.3 before 7.8.3-rev41, and 7.8.4 before
- CVE-2018-11221Unauthenticated untrusted file upload in Artica Pandora FMS through version 7.23 allows an attacker to upload an arbitrary plugin via includ
- CVE-2018-11222Local File Inclusion (LFI) in Artica Pandora FMS through version 7.23 allows an attacker to call any php file via the /pandora_console/ajax.
- CVE-2018-11223XSS in Artica Pandora FMS before 7.0 NG 723 allows an attacker to execute arbitrary code via a crafted "refr" parameter in a "/pandora_conso
- CVE-2018-5751The backend component in Open-Xchange OX App Suite before 7.6.3-rev36, 7.8.x before 7.8.2-rev39, 7.8.3 before 7.8.3-rev44, and 7.8.4 before
- CVE-2018-5752The backend component in Open-Xchange OX App Suite before 7.6.3-rev36, 7.8.x before 7.8.2-rev39, 7.8.3 before 7.8.3-rev44, and 7.8.4 before
- CVE-2018-5753The frontend component in Open-Xchange OX App Suite before 7.6.3-rev31, 7.8.x before 7.8.2-rev31, 7.8.3 before 7.8.3-rev41, and 7.8.4 before
- CVE-2018-5754Cross-site scripting (XSS) vulnerability in the office-web component in Open-Xchange OX App Suite before 7.8.3-rev12 and 7.8.4 before 7.8.4-
- CVE-2018-5755Absolute path traversal vulnerability in the readerengine component in Open-Xchange OX App Suite before 7.6.3-rev3, 7.8.x before 7.8.2-rev4,
- CVE-2018-5756The backend component in Open-Xchange OX App Suite before 7.6.3-rev36, 7.8.x before 7.8.2-rev39, 7.8.3 before 7.8.3-rev44, and 7.8.4 before
- CVE-2018-9859The path of Whale update service was unquoted in NAVER Whale before 1.0.40.7.
- CVE-2017-18169User process can perform the kernel DOS in ashmem when doing cache maintenance operation in all Android releases(Android for MSM, Firefox OSQualcomm Android for MSM, Firefox OS for MSM, QRD Android
- CVE-2018-5860In the MDSS driver in all Android releases(Android for MSM, Firefox OS for MSM, QRD Android) from CAF using the Linux kernel, a data structuQualcomm Android for MSM, Firefox OS for MSM, QRD Android
- CVE-2018-5863If userspace provides a too-large WPA RSN IE length in wlan_hdd_cfg80211_set_ie(), a buffer overflow occurs in all Android releases(Android Qualcomm Android for MSM, Firefox OS for MSM, QRD Android
- CVE-2018-12498spider.admincp.php in iCMS v7.0.8 has SQL Injection via the id parameter in an app=spider&do=batch request to admincp.php.
- CVE-2018-12491PHPOK 4.9.032 has an arbitrary file upload vulnerability in the import_f function in framework/admin/modulec_control.php, as demonstrated by
- CVE-2018-12492PHPOK 4.9.032 has an arbitrary file deletion vulnerability in the delfile_f function in framework/admin/tpl_control.php.
- CVE-2018-12493An issue was discovered in PublicCMS V4.0.20180210.
- CVE-2018-12494An issue was discovered in PublicCMS V4.0.20180210.
- CVE-2018-12495The quoteblock function in markdown.c in libmarkdown.a in DISCOUNT 2.2.3a allows remote attackers to cause a denial of service (heap-based b
- CVE-2018-12030Chevereto Free before 1.0.13 has XSS.
- CVE-2018-12034In YARA 3.7.1 and prior, parsing a specially crafted compiled rule file can cause an out of bounds read vulnerability in yr_execute_code in
- CVE-2018-12035In YARA 3.7.1 and prior, parsing a specially crafted compiled rule file can cause an out of bounds write vulnerability in yr_execute_code in
- CVE-2018-12422addressbook/backends/ldap/e-book-backend-ldap.c in Evolution-Data-Server in GNOME Evolution through 3.29.2 might allow attackers to trigger
- CVE-2018-12481The Olive Tree Ftp Server application 1.32 for Android has a "Sensitive Data on the Clipboard" vulnerability, as demonstrated by reading the
- CVE-2018-12458An improper integer type in the mpeg4_encode_gop_header function in libavcodec/mpeg4videoenc.c in FFmpeg 2.8 and 4.0 may trigger an assertio
- CVE-2018-12459An inconsistent bits-per-sample value in the ff_mpeg4_decode_picture_header function in libavcodec/mpeg4videodec.c in FFmpeg 4.0 may trigger
- CVE-2018-12460libavcodec in FFmpeg 4.0 may trigger a NULL pointer dereference if the studio profile is incorrectly detected while converting a crafted AVI
- CVE-2018-5854A stack-based buffer overflow can occur in fastboot from all Android releases(Android for MSM, Firefox OS for MSM, QRD Android) from CAF usiQualcomm Android for MSM, Firefox OS for MSM, QRD Android
- CVE-2018-5857In the WCD CPE codec, a Use After Free condition can occur in all Android releases(Android for MSM, Firefox OS for MSM, QRD Android) from CAQualcomm Android for MSM, Firefox OS for MSM, QRD Android
- CVE-2018-12457expressCart before 1.1.6 allows remote attackers to create an admin user via a /admin/setup Referer header.express-cart
- CVE-2018-1419IBM WebSphere MQ 8.0 and 9.0, when configured to use a PAM module for authentication, could allow a user to cause a deadlock in the IBM MQ PIBM MQ
- CVE-2018-6671SB10240 - ePolicy Orchestrator (ePO) - Application Protection Bypass vulnerabilityMcAfee ePolicy Orchestrator
- CVE-2018-6672SB10240 - ePolicy Orchestrator (ePO) - Information disclosure vulnerablityMcAfee ePolicy Orchestrator
- CVE-2018-12447The restore_tqb_pixels function in hevc_filter.c in libavcodec, as used in libbpg 0.9.8 and other products, has an integer overflow that lea
- CVE-2018-12356An issue was discovered in password-store.sh in pass in Simple Password Store 1.7.x before 1.7.2.
- CVE-2018-12433cryptlib through 3.4.4 allows a memory-cache side-channel attack on DSA and ECDSA signatures, aka the Return Of the Hidden Number Problem or
- CVE-2018-12434LibreSSL before 2.6.5 and 2.7.x before 2.7.4 allows a memory-cache side-channel attack on DSA and ECDSA signatures, aka the Return Of the Hi
- CVE-2018-12435Botan 2.5.0 through 2.6.0 before 2.7.0 allows a memory-cache side-channel attack on ECDSA signatures, aka the Return Of the Hidden Number Pr
- CVE-2018-12436wolfcrypt/src/ecc.c in wolfSSL before 3.15.1.patch allows a memory-cache side-channel attack on ECDSA signatures, aka the Return Of the Hidd
- CVE-2018-12437LibTomCrypt through 1.18.1 allows a memory-cache side-channel attack on ECDSA signatures, aka the Return Of the Hidden Number Problem or ROH
- CVE-2018-12438The Elliptic Curve Cryptography library (aka sunec or libsunec) allows a memory-cache side-channel attack on ECDSA signatures, aka the Retur
- CVE-2018-12439MatrixSSL through 3.9.5 Open allows a memory-cache side-channel attack on ECDSA signatures, aka the Return Of the Hidden Number Problem or R
- CVE-2018-12440BoringSSL through 2018-06-14 allows a memory-cache side-channel attack on DSA signatures, aka the Return Of the Hidden Number Problem or ROH