# CVEs published 2018-06-22

26 CVEs were published on June 22, 2018: 0 critical, 1 high. Days are UTC.

- [CVE-2018-7682](https://cve.now/CVE-2018-7682.md): Micro Focus Solutions Business Manager versions prior to 11.4 allows a user to invoke SBM RESTful services across domains. (no CVSS, Micro Focus Solutions Business Manager)
- [CVE-2018-12689](https://cve.now/CVE-2018-12689.md): phpLDAPadmin 1.2.2 allows LDAP injection via a crafted server\_id parameter in a cmd.php?cmd=login\_form request, or a crafted username and pa (no CVSS)
- [CVE-2018-12538](https://cve.now/CVE-2018-12538.md): In Eclipse Jetty versions 9.4.0 through 9.4.8, when using the optional Jetty provided FileSessionDataStore for persistent storage of HttpSes (no CVSS, The Eclipse Foundation Eclipse Jetty · org.eclipse.jetty:je…)
- [CVE-2018-12684](https://cve.now/CVE-2018-12684.md): Out-of-bounds Read in the send\_ssi\_file function in civetweb.c in CivetWeb through 1.10 allows attackers to cause a Denial of Service or Inf (no CVSS)
- [CVE-2018-12687](https://cve.now/CVE-2018-12687.md): tinyexr 0.9.5 has an assertion failure in DecodePixelData in tinyexr.h. (no CVSS)
- [CVE-2018-12688](https://cve.now/CVE-2018-12688.md): tinyexr 0.9.5 has a segmentation fault in the wav2Decode function. (no CVSS)
- [CVE-2018-1000201](https://cve.now/CVE-2018-1000201.md): ruby-ffi version 1.9.23 and earlier has a DLL loading issue which can be hijacked on Windows OS, when a Symbol is used as DLL name instead o (no CVSS, ffi)
- [CVE-2018-12678](https://cve.now/CVE-2018-12678.md): Portainer before 1.18.0 supports unauthenticated requests to the websocket endpoint with an unvalidated id query parameter for the /websocke (no CVSS)
- [CVE-2018-12636](https://cve.now/CVE-2018-12636.md): The iThemes Security (better-wp-security) plugin before 7.0.3 for WordPress allows SQL Injection (by attackers with Admin privileges) via th (no CVSS)
- [CVE-2017-7568](https://cve.now/CVE-2017-7568.md): NetApp OnCommand Unified Manager for 7-Mode (core package) versions prior to 5.2.3 may disclose sensitive LDAP account information to authen (no CVSS, NetApp OnCommand Unified Manager for 7-Mode)
- [CVE-2018-12654](https://cve.now/CVE-2018-12654.md): Reflected Cross-Site Scripting (XSS) exists in the Bibliography module in SLiMS 8 Akasia 8.3.1 via an admin/modules/bibliography/index.php?k (no CVSS)
- [CVE-2018-12655](https://cve.now/CVE-2018-12655.md): Reflected Cross-Site Scripting (XSS) exists in the Circulation module in SLiMS 8 Akasia 8.3.1 via an admin/modules/circulation/loan\_rules.ph (no CVSS)
- [CVE-2018-12656](https://cve.now/CVE-2018-12656.md): Reflected Cross-Site Scripting (XSS) exists in the Membership module in SLiMS 8 Akasia 8.3.1 via an admin/modules/membership/index.php?keywo (no CVSS)
- [CVE-2018-12657](https://cve.now/CVE-2018-12657.md): Reflected Cross-Site Scripting (XSS) exists in the Master File module in SLiMS 8 Akasia 8.3.1 via an admin/modules/master\_file/rda\_cmc.php?k (no CVSS)
- [CVE-2018-12658](https://cve.now/CVE-2018-12658.md): Reflected Cross-Site Scripting (XSS) exists in the Stock Take module in SLiMS 8 Akasia 8.3.1 via an admin/modules/stock\_take/index.php?keywo (no CVSS)
- [CVE-2018-12659](https://cve.now/CVE-2018-12659.md): SLiMS 8 Akasia 8.3.1 allows remote attackers to bypass the CSRF protection mechanism and obtain admin access by omitting the csrf\_token para (no CVSS)
- [CVE-2018-12649](https://cve.now/CVE-2018-12649.md): An issue was discovered in app/Controller/UsersController.php in MISP 2.4.92. (no CVSS)
- [CVE-2018-1655](https://cve.now/CVE-2018-1655.md): IBM AIX 5.3, 6.1, 7.1, and 7.2 contains a vulnerability in the rmsock command that may be used to expose kernel memory. (CVSS 4.0, IBM AIX)
- [CVE-2017-2668](https://cve.now/CVE-2017-2668.md): 389-ds-base before versions 1.3.5.17 and 1.3.6.10 is vulnerable to an invalid pointer dereference in the way LDAP bind requests are handled. (CVSS 6.5, \[UNKNOWN\] 389-ds-base)
- [CVE-2017-7466](https://cve.now/CVE-2017-7466.md): Ansible before version 2.3 has an input validation vulnerability in the handling of data sent from client systems. (CVSS 8.0, \[UNKNOWN\] ansible · ansible)
- [CVE-2018-12648](https://cve.now/CVE-2018-12648.md): The WEBP::GetLE32 function in XMPFiles/source/FormatSupport/WEBP\_Support.hpp in Exempi 2.4.5 has a NULL pointer dereference. (no CVSS)
- [CVE-2018-12641](https://cve.now/CVE-2018-12641.md): An issue was discovered in arm\_pt in cplus-dem.c in GNU libiberty, as distributed in GNU Binutils 2.30. (no CVSS)
- [CVE-2018-12642](https://cve.now/CVE-2018-12642.md): Froxlor through 0.9.39.5 has Incorrect Access Control for tickets not owned by the current user. (no CVSS, froxlor/froxlor)
- [CVE-2018-12633](https://cve.now/CVE-2018-12633.md): An issue was discovered in the Linux kernel through 4.17.2. (no CVSS)
- [CVE-2018-12634](https://cve.now/CVE-2018-12634.md): CirCarLife Scada before 4.3 allows remote attackers to obtain sensitive information via a direct request for the html/log or services/system (no CVSS)
- [CVE-2018-12635](https://cve.now/CVE-2018-12635.md): CirCarLife Scada v4.2.4 allows unauthorized upgrades via requests to the html/upgrade.html and services/system/firmware.upgrade URIs. (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2018-06-22
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.