# CVEs published 2018-06-15

48 CVEs were published on June 15, 2018: 1 critical, 3 high. Days are UTC.

- [CVE-2017-17062](https://cve.now/CVE-2017-17062.md): The backend component in Open-Xchange OX App Suite before 7.6.3-rev35, 7.8.x before 7.8.2-rev38, 7.8.3 before 7.8.3-rev41, and 7.8.4 before (no CVSS)
- [CVE-2018-11221](https://cve.now/CVE-2018-11221.md): Unauthenticated untrusted file upload in Artica Pandora FMS through version 7.23 allows an attacker to upload an arbitrary plugin via includ (no CVSS)
- [CVE-2018-11222](https://cve.now/CVE-2018-11222.md): Local File Inclusion (LFI) in Artica Pandora FMS through version 7.23 allows an attacker to call any php file via the /pandora\_console/ajax. (no CVSS)
- [CVE-2018-11223](https://cve.now/CVE-2018-11223.md): XSS in Artica Pandora FMS before 7.0 NG 723 allows an attacker to execute arbitrary code via a crafted "refr" parameter in a "/pandora\_conso (no CVSS)
- [CVE-2018-5751](https://cve.now/CVE-2018-5751.md): The backend component in Open-Xchange OX App Suite before 7.6.3-rev36, 7.8.x before 7.8.2-rev39, 7.8.3 before 7.8.3-rev44, and 7.8.4 before (no CVSS)
- [CVE-2018-5752](https://cve.now/CVE-2018-5752.md): The backend component in Open-Xchange OX App Suite before 7.6.3-rev36, 7.8.x before 7.8.2-rev39, 7.8.3 before 7.8.3-rev44, and 7.8.4 before (no CVSS)
- [CVE-2018-5753](https://cve.now/CVE-2018-5753.md): The frontend component in Open-Xchange OX App Suite before 7.6.3-rev31, 7.8.x before 7.8.2-rev31, 7.8.3 before 7.8.3-rev41, and 7.8.4 before (no CVSS)
- [CVE-2018-5754](https://cve.now/CVE-2018-5754.md): Cross-site scripting (XSS) vulnerability in the office-web component in Open-Xchange OX App Suite before 7.8.3-rev12 and 7.8.4 before 7.8.4- (no CVSS)
- [CVE-2018-5755](https://cve.now/CVE-2018-5755.md): Absolute path traversal vulnerability in the readerengine component in Open-Xchange OX App Suite before 7.6.3-rev3, 7.8.x before 7.8.2-rev4, (no CVSS)
- [CVE-2018-5756](https://cve.now/CVE-2018-5756.md): The backend component in Open-Xchange OX App Suite before 7.6.3-rev36, 7.8.x before 7.8.2-rev39, 7.8.3 before 7.8.3-rev44, and 7.8.4 before (no CVSS)
- [CVE-2018-6496](https://cve.now/CVE-2018-6496.md): MFSBGN03809 rev.1 - Universal CMDB, Deserialization Java Objects and CSRF (CVSS 7.5, Micro Focus UCMDB Browser)
- [CVE-2018-6497](https://cve.now/CVE-2018-6497.md): MFSBGN03810 rev.1 - Universal CMDB, Deserialization Java Objects and CSRF (CVSS 7.5, Micro Focus Universal CMDB Server · Micro Focus CMS Server)
- [CVE-2018-9859](https://cve.now/CVE-2018-9859.md): The path of Whale update service was unquoted in NAVER Whale before 1.0.40.7. (no CVSS)
- [CVE-2017-18169](https://cve.now/CVE-2017-18169.md): User process can perform the kernel DOS in ashmem when doing cache maintenance operation in all Android releases(Android for MSM, Firefox OS (no CVSS, Qualcomm Android for MSM, Firefox OS for MSM, QRD Android)
- [CVE-2018-5860](https://cve.now/CVE-2018-5860.md): In the MDSS driver in all Android releases(Android for MSM, Firefox OS for MSM, QRD Android) from CAF using the Linux kernel, a data structu (no CVSS, Qualcomm Android for MSM, Firefox OS for MSM, QRD Android)
- [CVE-2018-5863](https://cve.now/CVE-2018-5863.md): If userspace provides a too-large WPA RSN IE length in wlan\_hdd\_cfg80211\_set\_ie(), a buffer overflow occurs in all Android releases(Android (no CVSS, Qualcomm Android for MSM, Firefox OS for MSM, QRD Android)
- [CVE-2018-12498](https://cve.now/CVE-2018-12498.md): spider.admincp.php in iCMS v7.0.8 has SQL Injection via the id parameter in an app=spider&do=batch request to admincp.php. (no CVSS)
- [CVE-2018-12491](https://cve.now/CVE-2018-12491.md): PHPOK 4.9.032 has an arbitrary file upload vulnerability in the import\_f function in framework/admin/modulec\_control.php, as demonstrated by (no CVSS)
- [CVE-2018-12492](https://cve.now/CVE-2018-12492.md): PHPOK 4.9.032 has an arbitrary file deletion vulnerability in the delfile\_f function in framework/admin/tpl\_control.php. (no CVSS)
- [CVE-2018-12493](https://cve.now/CVE-2018-12493.md): An issue was discovered in PublicCMS V4.0.20180210. (no CVSS)
- [CVE-2018-12494](https://cve.now/CVE-2018-12494.md): An issue was discovered in PublicCMS V4.0.20180210. (no CVSS)
- [CVE-2018-12495](https://cve.now/CVE-2018-12495.md): The quoteblock function in markdown.c in libmarkdown.a in DISCOUNT 2.2.3a allows remote attackers to cause a denial of service (heap-based b (no CVSS)
- [CVE-2018-12030](https://cve.now/CVE-2018-12030.md): Chevereto Free before 1.0.13 has XSS. (no CVSS)
- [CVE-2018-12034](https://cve.now/CVE-2018-12034.md): In YARA 3.7.1 and prior, parsing a specially crafted compiled rule file can cause an out of bounds read vulnerability in yr\_execute\_code in (no CVSS)
- [CVE-2018-12035](https://cve.now/CVE-2018-12035.md): In YARA 3.7.1 and prior, parsing a specially crafted compiled rule file can cause an out of bounds write vulnerability in yr\_execute\_code in (no CVSS)
- [CVE-2018-12422](https://cve.now/CVE-2018-12422.md): addressbook/backends/ldap/e-book-backend-ldap.c in Evolution-Data-Server in GNOME Evolution through 3.29.2 might allow attackers to trigger (no CVSS)
- [CVE-2018-12481](https://cve.now/CVE-2018-12481.md): The Olive Tree Ftp Server application 1.32 for Android has a "Sensitive Data on the Clipboard" vulnerability, as demonstrated by reading the (no CVSS)
- [CVE-2018-12458](https://cve.now/CVE-2018-12458.md): An improper integer type in the mpeg4\_encode\_gop\_header function in libavcodec/mpeg4videoenc.c in FFmpeg 2.8 and 4.0 may trigger an assertio (no CVSS)
- [CVE-2018-12459](https://cve.now/CVE-2018-12459.md): An inconsistent bits-per-sample value in the ff\_mpeg4\_decode\_picture\_header function in libavcodec/mpeg4videodec.c in FFmpeg 4.0 may trigger (no CVSS)
- [CVE-2018-12460](https://cve.now/CVE-2018-12460.md): libavcodec in FFmpeg 4.0 may trigger a NULL pointer dereference if the studio profile is incorrectly detected while converting a crafted AVI (no CVSS)
- [CVE-2018-5854](https://cve.now/CVE-2018-5854.md): A stack-based buffer overflow can occur in fastboot from all Android releases(Android for MSM, Firefox OS for MSM, QRD Android) from CAF usi (no CVSS, Qualcomm Android for MSM, Firefox OS for MSM, QRD Android)
- [CVE-2018-5857](https://cve.now/CVE-2018-5857.md): In the WCD CPE codec, a Use After Free condition can occur in all Android releases(Android for MSM, Firefox OS for MSM, QRD Android) from CA (no CVSS, Qualcomm Android for MSM, Firefox OS for MSM, QRD Android)
- [CVE-2018-12457](https://cve.now/CVE-2018-12457.md): expressCart before 1.1.6 allows remote attackers to create an admin user via a /admin/setup Referer header. (no CVSS, express-cart)
- [CVE-2018-1419](https://cve.now/CVE-2018-1419.md): IBM WebSphere MQ 8.0 and 9.0, when configured to use a PAM module for authentication, could allow a user to cause a deadlock in the IBM MQ P (CVSS 3.7, IBM MQ)
- [CVE-2018-1460](https://cve.now/CVE-2018-1460.md): IBM Netezza Platform Software (IBM PureData System for Analytics 1.0.0) could allow a local user to modify a world writable file, which coul (CVSS 8.4, IBM PureData System for Analytics)
- [CVE-2018-6671](https://cve.now/CVE-2018-6671.md): SB10240 - ePolicy Orchestrator (ePO) - Application Protection Bypass vulnerability (CVSS 4.7, McAfee ePolicy Orchestrator)
- [CVE-2018-6672](https://cve.now/CVE-2018-6672.md): SB10240 - ePolicy Orchestrator (ePO) - Information disclosure vulnerablity (CVSS 5.7, McAfee ePolicy Orchestrator)
- [CVE-2018-1085](https://cve.now/CVE-2018-1085.md): openshift-ansible before versions 3.9.23, 3.7.46 deploys a misconfigured etcd file that causes the SSL client certificate authentication to (CVSS 9.0, \[UNKNOWN\] openshift-ansible)
- [CVE-2018-12447](https://cve.now/CVE-2018-12447.md): The restore\_tqb\_pixels function in hevc\_filter.c in libavcodec, as used in libbpg 0.9.8 and other products, has an integer overflow that lea (no CVSS)
- [CVE-2018-12356](https://cve.now/CVE-2018-12356.md): An issue was discovered in password-store.sh in pass in Simple Password Store 1.7.x before 1.7.2. (no CVSS)
- [CVE-2018-12433](https://cve.now/CVE-2018-12433.md): cryptlib through 3.4.4 allows a memory-cache side-channel attack on DSA and ECDSA signatures, aka the Return Of the Hidden Number Problem or (no CVSS)
- [CVE-2018-12434](https://cve.now/CVE-2018-12434.md): LibreSSL before 2.6.5 and 2.7.x before 2.7.4 allows a memory-cache side-channel attack on DSA and ECDSA signatures, aka the Return Of the Hi (no CVSS)
- [CVE-2018-12435](https://cve.now/CVE-2018-12435.md): Botan 2.5.0 through 2.6.0 before 2.7.0 allows a memory-cache side-channel attack on ECDSA signatures, aka the Return Of the Hidden Number Pr (no CVSS)
- [CVE-2018-12436](https://cve.now/CVE-2018-12436.md): wolfcrypt/src/ecc.c in wolfSSL before 3.15.1.patch allows a memory-cache side-channel attack on ECDSA signatures, aka the Return Of the Hidd (no CVSS)
- [CVE-2018-12437](https://cve.now/CVE-2018-12437.md): LibTomCrypt through 1.18.1 allows a memory-cache side-channel attack on ECDSA signatures, aka the Return Of the Hidden Number Problem or ROH (no CVSS)
- [CVE-2018-12438](https://cve.now/CVE-2018-12438.md): The Elliptic Curve Cryptography library (aka sunec or libsunec) allows a memory-cache side-channel attack on ECDSA signatures, aka the Retur (no CVSS)
- [CVE-2018-12439](https://cve.now/CVE-2018-12439.md): MatrixSSL through 3.9.5 Open allows a memory-cache side-channel attack on ECDSA signatures, aka the Return Of the Hidden Number Problem or R (no CVSS)
- [CVE-2018-12440](https://cve.now/CVE-2018-12440.md): BoringSSL through 2018-06-14 allows a memory-cache side-channel attack on DSA signatures, aka the Return Of the Hidden Number Problem or ROH (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2018-06-15
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.