# CVEs published 2018-06-17 26 CVEs were published on June 17, 2018: 0 critical, 0 high. Days are UTC. - [CVE-2018-12026](https://cve.now/CVE-2018-12026.md): During the spawning of a malicious Passenger-managed application, SpawningKit in Phusion Passenger 5.3.x before 5.3.2 allows such applicatio (no CVSS, passenger) - [CVE-2018-12027](https://cve.now/CVE-2018-12027.md): An Insecure Permissions vulnerability in SpawningKit in Phusion Passenger 5.3.x before 5.3.2 causes information disclosure in the following (no CVSS, passenger) - [CVE-2018-12028](https://cve.now/CVE-2018-12028.md): An Incorrect Access Control vulnerability in SpawningKit in Phusion Passenger 5.3.x before 5.3.2 allows a Passenger-managed malicious applic (no CVSS, passenger) - [CVE-2018-12029](https://cve.now/CVE-2018-12029.md): A race condition in the nginx module in Phusion Passenger 3.x through 5.x before 5.3.2 allows local escalation of privileges when a non-stan (no CVSS, passenger) - [CVE-2018-12071](https://cve.now/CVE-2018-12071.md): A Session Fixation issue exists in CodeIgniter before 3.1.9 because session.use\_strict\_mode in the Session Library was mishandled. (no CVSS, codeigniter/framework) - [CVE-2018-12072](https://cve.now/CVE-2018-12072.md): An issue was discovered in Cloud Media Popcorn A-200 03-05-130708-21-POP-411-000 firmware. (no CVSS) - [CVE-2018-12073](https://cve.now/CVE-2018-12073.md): An issue was discovered on Eminent EM4544 9.10 devices. (no CVSS) - [CVE-2018-12104](https://cve.now/CVE-2018-12104.md): Cross-site scripting (XSS) vulnerability in Airbnb Knowledge Repo 0.7.4 allows remote attackers to inject arbitrary web scripts or HTML via (no CVSS, knowledge-repo) - [CVE-2018-10997](https://cve.now/CVE-2018-10997.md): Etere EtereWeb before 28.1.20 has a pre-authentication blind SQL injection in the POST parameters txUserName and txPassword. (no CVSS) - [CVE-2018-11218](https://cve.now/CVE-2018-11218.md): Memory Corruption was discovered in the cmsgpack library in the Lua subsystem in Redis before 3.2.12, 4.x before 4.0.10, and 5.x before 5.0 (no CVSS) - [CVE-2018-11219](https://cve.now/CVE-2018-11219.md): An Integer Overflow issue was discovered in the struct library in the Lua subsystem in Redis before 3.2.12, 4.x before 4.0.10, and 5.x befor (no CVSS) - [CVE-2018-10377](https://cve.now/CVE-2018-10377.md): PortSwigger Burp Suite before 1.7.34 has Improper Certificate Validation of the Collaborator server certificate, which might allow man-in-th (no CVSS) - [CVE-2018-10969](https://cve.now/CVE-2018-10969.md): SQL injection vulnerability in the Pie Register plugin before 3.0.10 for WordPress allows remote attackers to execute arbitrary SQL commands (no CVSS) - [CVE-2018-11647](https://cve.now/CVE-2018-11647.md): index.js in oauth2orize-fprm before 0.2.1 has XSS via a crafted URL. (no CVSS, oauth2orize-fprm) - [CVE-2018-12329](https://cve.now/CVE-2018-12329.md): Protection Mechanism Failure in ECOS Secure Boot Stick (aka SBS) 5.6.5 allows a local attacker to duplicate an authentication factor via clo (no CVSS) - [CVE-2018-12330](https://cve.now/CVE-2018-12330.md): Protection Mechanism Failure in ECOS Secure Boot Stick (aka SBS) 5.6.5 allows an attacker to compromise authentication and encryption keys v (no CVSS) - [CVE-2018-12331](https://cve.now/CVE-2018-12331.md): Authentication Bypass by Spoofing vulnerability in ECOS System Management Appliance (aka SMA) 5.2.68 allows a man-in-the-middle attacker to (no CVSS) - [CVE-2018-12332](https://cve.now/CVE-2018-12332.md): Incomplete Cleanup vulnerability in ECOS Secure Boot Stick (aka SBS) 5.6.5 allows an attacker to compromise authentication and encryption ke (no CVSS) - [CVE-2018-12333](https://cve.now/CVE-2018-12333.md): Insufficient Verification of Data Authenticity vulnerability in ECOS Secure Boot Stick (aka SBS) 5.6.5 allows an attacker to manipulate secu (no CVSS) - [CVE-2018-12334](https://cve.now/CVE-2018-12334.md): Protection Mechanism Failure in ECOS Secure Boot Stick (aka SBS) 5.6.5 allows an attacker to compromise authentication and encryption keys v (no CVSS) - [CVE-2018-12335](https://cve.now/CVE-2018-12335.md): Incorrect access control in ECOS System Management Appliance (aka SMA) 5.2.68 allows a user to compromise authentication keys, and access an (no CVSS) - [CVE-2018-12336](https://cve.now/CVE-2018-12336.md): Undocumented Factory Backdoor in ECOS Secure Boot Stick (aka SBS) 5.6.5 allows the vendor to extract confidential information via remote roo (no CVSS) - [CVE-2018-12337](https://cve.now/CVE-2018-12337.md): Reliance on Security Through Obscurity vulnerability in ECOS Secure Boot Stick (aka SBS) 5.6.5 allows an attacker to partially extract confi (no CVSS) - [CVE-2018-12338](https://cve.now/CVE-2018-12338.md): Undocumented Factory Backdoor in ECOS System Management Appliance (aka SMA) 5.2.68 allows the vendor to extract confidential information and (no CVSS) - [CVE-2018-12326](https://cve.now/CVE-2018-12326.md): Buffer overflow in redis-cli of Redis before 4.0.10 and 5.x before 5.0 RC3 allows an attacker to achieve code execution and escalate to high (no CVSS) - [CVE-2018-12454](https://cve.now/CVE-2018-12454.md): The \_addguess function of a simplelottery smart contract implementation for 1000 Guess, an Ethereum gambling game, generates a random value (no CVSS) --- Source: cve.now, built and run by Sazabi (AI-native observability and security) Page: https://cve.now/daily/2018-06-17 Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.