# CVEs published 2018-06-19

48 CVEs were published on June 19, 2018: 0 critical, 1 high. Days are UTC.

- [CVE-2018-10811](https://cve.now/CVE-2018-10811.md): strongSwan 5.6.0 and older allows Remote Denial of Service because of Missing Initialization of a Variable. (no CVSS)
- [CVE-2018-10945](https://cve.now/CVE-2018-10945.md): The mg\_handle\_cgi function in mongoose.c in Mongoose 6.11 allows remote attackers to cause a denial of service (heap-based buffer over-read (no CVSS)
- [CVE-2018-11116](https://cve.now/CVE-2018-11116.md): OpenWrt mishandles access control in /etc/config/rpcd and the /usr/share/rpcd/acl.d files, which allows remote authenticated users to call a (CVSS 8.8)
- [CVE-2018-11723](https://cve.now/CVE-2018-11723.md): The libpff\_name\_to\_id\_map\_entry\_read function in libpff\_name\_to\_id\_map.c in libyal libpff through 2018-04-28 allows remote attackers to caus (no CVSS)
- [CVE-2018-11724](https://cve.now/CVE-2018-11724.md): The mobi\_pk1\_decrypt function in encryption.c in Libmobi 0.3 allows remote attackers to cause a denial of service (heap-based buffer overflo (no CVSS)
- [CVE-2018-11725](https://cve.now/CVE-2018-11725.md): The mobi\_parse\_index\_entry function in index.c in Libmobi 0.3 allows remote attackers to cause an information disclosure (heap-based buffer (no CVSS)
- [CVE-2018-11726](https://cve.now/CVE-2018-11726.md): The mobi\_decode\_font\_resource function in util.c in Libmobi 0.3 allows remote attackers to cause a denial of service (heap-based buffer over (no CVSS)
- [CVE-2018-11727](https://cve.now/CVE-2018-11727.md): The libfsntfs\_attribute\_read\_from\_mft function in libfsntfs\_attribute.c in libfsntfs through 2018-04-20 allows remote attackers to cause an (CVSS 5.5)
- [CVE-2018-11728](https://cve.now/CVE-2018-11728.md): The libfsntfs\_reparse\_point\_values\_read\_data function in libfsntfs\_reparse\_point\_values.c in libfsntfs through 2018-04-20 allows remote atta (CVSS 5.5)
- [CVE-2018-11729](https://cve.now/CVE-2018-11729.md): The libfsntfs\_mft\_entry\_read\_header function in libfsntfs\_mft\_entry.c in libfsntfs through 2018-04-20 allows remote attackers to cause an in (no CVSS)
- [CVE-2018-11730](https://cve.now/CVE-2018-11730.md): The libfsntfs\_security\_descriptor\_values\_free function in libfsntfs\_security\_descriptor\_values.c in libfsntfs through 2018-04-20 allows remo (no CVSS)
- [CVE-2018-11731](https://cve.now/CVE-2018-11731.md): The libfsntfs\_mft\_entry\_read\_attributes function in libfsntfs\_mft\_entry.c in libfsntfs through 2018-04-20 allows remote attackers to cause a (no CVSS)
- [CVE-2018-12096](https://cve.now/CVE-2018-12096.md): The liblnk\_data\_string\_get\_utf8\_string\_size function in liblnk\_data\_string.c in liblnk through 2018-04-19 allows remote attackers to cause a (no CVSS)
- [CVE-2018-12097](https://cve.now/CVE-2018-12097.md): The liblnk\_location\_information\_read\_data function in liblnk\_location\_information.c in liblnk through 2018-04-19 allows remote attackers to (no CVSS)
- [CVE-2018-12098](https://cve.now/CVE-2018-12098.md): The liblnk\_data\_block\_read function in liblnk\_data\_block.c in liblnk through 2018-04-19 allows remote attackers to cause an information disc (no CVSS)
- [CVE-2018-12293](https://cve.now/CVE-2018-12293.md): The getImageData function in the ImageBufferCairo class in WebCore/platform/graphics/cairo/ImageBufferCairo.cpp in WebKit, as used in WebKit (no CVSS)
- [CVE-2018-12294](https://cve.now/CVE-2018-12294.md): WebCore/platform/graphics/texmap/TextureMapperLayer.cpp in WebKit, as used in WebKitGTK+ prior to version 2.20.2, is vulnerable to a use aft (no CVSS)
- [CVE-2018-12519](https://cve.now/CVE-2018-12519.md): An issue was discovered in ShopNx through 2017-11-17. (no CVSS)
- [CVE-2018-12588](https://cve.now/CVE-2018-12588.md): Cross-site scripting (XSS) vulnerability in templates/frontend/pages/searchResults.tpl in Public Knowledge Project (PKP) Open Monograph Pres (no CVSS)
- [CVE-2015-4043](https://cve.now/CVE-2015-4043.md): SQL injection vulnerability in ConnX ESP HR Management 4.4.0 allows remote attackers to execute arbitrary SQL commands via the ctl00$cphMain (no CVSS)
- [CVE-2018-11525](https://cve.now/CVE-2018-11525.md): The plugin "Advanced Order Export For WooCommerce" for WordPress (v1.5.4 and before) is vulnerable to CSV Injection. (no CVSS)
- [CVE-2018-11526](https://cve.now/CVE-2018-11526.md): The plugin "WordPress Comments Import & Export" for WordPress (v2.0.4 and before) is vulnerable to CSV Injection. (no CVSS)
- [CVE-2018-11537](https://cve.now/CVE-2018-11537.md): Auth0 angular-jwt before 0.1.10 treats whiteListedDomains entries as regular expressions, which allows remote attackers with knowledge of th (no CVSS, angular-jwt)
- [CVE-2018-6210](https://cve.now/CVE-2018-6210.md): D-Link DIR-620 devices, with a certain Rostelekom variant of firmware 1.0.37, have a hardcoded rostel account, which makes it easier for rem (no CVSS)
- [CVE-2018-8727](https://cve.now/CVE-2018-8727.md): Path Traversal in Gateway in Mirasys DVMS Workstation 5.12.6 and earlier allows an attacker to traverse the file system to access files or d (no CVSS)
- [CVE-2018-12582](https://cve.now/CVE-2018-12582.md): An issue was discovered in AKCMS 6.1. (no CVSS)
- [CVE-2018-12583](https://cve.now/CVE-2018-12583.md): An issue was discovered in AKCMS 6.1. (no CVSS)
- [CVE-2018-12580](https://cve.now/CVE-2018-12580.md): library/DBTech/Security/Action/Sessions.php in DragonByte vBSecurity 3.x through 3.3.0 for vBulletin 3 and vBulletin 4 allows self-XSS via $ (no CVSS)
- [CVE-2018-12578](https://cve.now/CVE-2018-12578.md): There is a heap-based buffer overflow in bmp\_compress1\_row in appliers.cpp in sam2p 0.49.4 that leads to a denial of service or possibly uns (no CVSS)
- [CVE-2018-1117](https://cve.now/CVE-2018-1117.md): ovirt-ansible-roles before version 1.0.6 has a vulnerability due to a missing no\_log directive, resulting in the 'Add oVirt Provider to Mana (CVSS 5.0, \[UNKNOWN\] ovirt-ansible-roles)
- [CVE-2018-11701](https://cve.now/CVE-2018-11701.md): FastStone Image Viewer 6.2 has a User Mode Write AV at 0x005cb509, triggered when the user opens a malformed JPEG file that is mishandled by (no CVSS)
- [CVE-2018-11702](https://cve.now/CVE-2018-11702.md): FastStone Image Viewer 6.2 has a User Mode Write AV at 0x00578cb3, triggered when the user opens a malformed JPEG file that is mishandled by (no CVSS)
- [CVE-2018-11703](https://cve.now/CVE-2018-11703.md): FastStone Image Viewer 6.2 has a User Mode Write AV at 0x00402d6a, triggered when the user opens a malformed JPEG file that is mishandled by (no CVSS)
- [CVE-2018-11704](https://cve.now/CVE-2018-11704.md): FastStone Image Viewer 6.2 has a User Mode Write AV at 0x00402d7d, triggered when the user opens a malformed JPEG file that is mishandled by (no CVSS)
- [CVE-2018-11705](https://cve.now/CVE-2018-11705.md): FastStone Image Viewer 6.2 has a User Mode Write AV at 0x00578cc4, triggered when the user opens a malformed JPEG file that is mishandled by (no CVSS)
- [CVE-2018-11706](https://cve.now/CVE-2018-11706.md): FastStone Image Viewer 6.2 has a User Mode Write AV at 0x00578dd8, triggered when the user opens a malformed JPEG file that is mishandled by (no CVSS)
- [CVE-2018-11707](https://cve.now/CVE-2018-11707.md): FastStone Image Viewer 6.2 has a User Mode Read and Execute AV at 0x0057898e, triggered when the user opens a malformed JPEG file that is mi (no CVSS)
- [CVE-2018-8030](https://cve.now/CVE-2018-8030.md): A Denial of Service vulnerability was found in Apache Qpid Broker-J versions 7.0.0-7.0.4 when AMQP protocols 0-8, 0-9 or 0-91 are used to pu (no CVSS, Apache Software Foundation Apache Qpid Broker-J · org.apach…)
- [CVE-2018-1061](https://cve.now/CVE-2018-1061.md): python before versions 2.7.15, 3.4.9, 3.5.6rc1, 3.6.5rc1 and 3.7.0 is vulnerable to catastrophic backtracking in the difflib.IS\_LINE\_JUNK me (CVSS 6.5, \[UNKNOWN\] python)
- [CVE-2018-1073](https://cve.now/CVE-2018-1073.md): The web console login form in ovirt-engine before version 4.2.3 returned different errors for non-existent users and invalid passwords, allo (CVSS 5.3, \[UNKNOWN\] ovirt-engine)
- [CVE-2018-12557](https://cve.now/CVE-2018-12557.md): An issue was discovered in Zuul 3.x before 3.1.0. (no CVSS)
- [CVE-2018-12559](https://cve.now/CVE-2018-12559.md): An issue was discovered in the cantata-mounter D-Bus service in Cantata through 2.3.1. (no CVSS)
- [CVE-2018-12560](https://cve.now/CVE-2018-12560.md): An issue was discovered in the cantata-mounter D-Bus service in Cantata through 2.3.1. (no CVSS)
- [CVE-2018-12561](https://cve.now/CVE-2018-12561.md): An issue was discovered in the cantata-mounter D-Bus service in Cantata through 2.3.1. (no CVSS)
- [CVE-2018-12562](https://cve.now/CVE-2018-12562.md): An issue was discovered in the cantata-mounter D-Bus service in Cantata through 2.3.1. (no CVSS)
- [CVE-2018-12563](https://cve.now/CVE-2018-12563.md): An issue was discovered in Linaro LAVA before 2018.5.post1. (no CVSS)
- [CVE-2018-12564](https://cve.now/CVE-2018-12564.md): An issue was discovered in Linaro LAVA before 2018.5.post1. (no CVSS)
- [CVE-2018-12565](https://cve.now/CVE-2018-12565.md): An issue was discovered in Linaro LAVA before 2018.5.post1. (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2018-06-19
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.