# CVEs published 2018-06-25 29 CVEs were published on June 25, 2018: 0 critical, 0 high. Days are UTC. - [CVE-2018-12603](https://cve.now/CVE-2018-12603.md): Cross-site request forgery (CSRF) vulnerability in admin.php in LFCMS 3.7.0 allows remote attackers to hijack the authentication of unspecif (no CVSS) - [CVE-2018-11587](https://cve.now/CVE-2018-11587.md): There is Remote Code Execution in Centreon 3.4.6 including Centreon Web 2.8.23 via the RPN value in the Virtual Metric form in centreonGraph (no CVSS, centreon/centreon) - [CVE-2018-11588](https://cve.now/CVE-2018-11588.md): Centreon 3.4.6 including Centreon Web 2.8.23 is vulnerable to an authenticated user injecting a payload into the username or command descrip (no CVSS) - [CVE-2018-11589](https://cve.now/CVE-2018-11589.md): Multiple SQL injection vulnerabilities in Centreon 3.4.6 including Centreon Web 2.8.23 allow attacks via the searchU parameter in viewLogs.p (no CVSS) - [CVE-2018-12735](https://cve.now/CVE-2018-12735.md): SAJ Solar Inverter allows remote attackers to obtain potentially sensitive information via a direct request for the inverter\_info.htm or eng (no CVSS) - [CVE-2017-9312](https://cve.now/CVE-2017-9312.md): Improperly implemented option-field processing in the TCP/IP stack on Allen-Bradley L30ERMS safety devices v30 and earlier causes a denial o (no CVSS) - [CVE-2018-10956](https://cve.now/CVE-2018-10956.md): IPConfigure Orchid Core VMS 2.0.5 allows Directory Traversal. (no CVSS) - [CVE-2018-11039](https://cve.now/CVE-2018-11039.md): Spring Framework (versions 5.0.x prior to 5.0.7, versions 4.3.x prior to 4.3.18, and older unsupported versions) allow web applications to c (no CVSS, Pivotal Spring Framework · org.springframework:spring-web) - [CVE-2018-11040](https://cve.now/CVE-2018-11040.md): Spring Framework, versions 5.0.x prior to 5.0.7 and 4.3.x prior to 4.3.18 and older unsupported versions, allows web applications to enable (no CVSS, Pivotal Spring Framework · org.springframework:spring-core) - [CVE-2018-11041](https://cve.now/CVE-2018-11041.md): Cloud Foundry UAA, versions later than 4.6.0 and prior to 4.19.0 except 4.10.1 and 4.7.5 and uaa-release versions later than v48 and prior t (no CVSS, Cloud Foundry UAA · org.cloudfoundry.identity:cloudfoundry-…) - [CVE-2018-11046](https://cve.now/CVE-2018-11046.md): Pivotal Operations Manager, versions 2.1.x prior to 2.1.6 and version 2.0.14, includes NGINX packages that lacks security vulnerability patc (no CVSS, Pivotal Operations Manager) - [CVE-2018-12602](https://cve.now/CVE-2018-12602.md): A CSRF vulnerability exists in LFCMS 3.7.0: users can be added arbitrarily. (no CVSS) - [CVE-2018-8755](https://cve.now/CVE-2018-8755.md): NuCom WR644GACV devices before STA006 allow an attacker to download the configuration file without credentials. (no CVSS) - [CVE-2018-11446](https://cve.now/CVE-2018-11446.md): The buy function of a smart contract implementation for Gold Reward (GRX), an Ethereum ERC20 token, allows a potential trap that could be us (no CVSS) - [CVE-2018-12062](https://cve.now/CVE-2018-12062.md): The sell function of a smart contract implementation for SwftCoin (SWFTC), a tradable Ethereum ERC20 token, allows a potential trap that cou (no CVSS) - [CVE-2018-12063](https://cve.now/CVE-2018-12063.md): The sell function of a smart contract implementation for Internet Node Token (INT), a tradable Ethereum ERC20 token, allows a potential trap (no CVSS) - [CVE-2018-12067](https://cve.now/CVE-2018-12067.md): The sell function of a smart contract implementation for Substratum (SUB), a tradable Ethereum ERC20 token, allows a potential trap that cou (no CVSS) - [CVE-2018-12068](https://cve.now/CVE-2018-12068.md): The sell function of a smart contract implementation for Target Coin (TGT), a tradable Ethereum ERC20 token, allows a potential trap that co (no CVSS) - [CVE-2018-12070](https://cve.now/CVE-2018-12070.md): The sell function of a smart contract implementation for SEC, a tradable Ethereum ERC20 token, allows a potential trap that could be used to (no CVSS) - [CVE-2018-12078](https://cve.now/CVE-2018-12078.md): The mintToken function of a smart contract implementation for PolyAI (AI), a tradable Ethereum ERC20 token, has no period constraint, which (no CVSS) - [CVE-2018-12079](https://cve.now/CVE-2018-12079.md): The mintToken function of a smart contract implementation for Substratum (SUB), a tradable Ethereum ERC20 token, has no period constraint, w (no CVSS) - [CVE-2018-12080](https://cve.now/CVE-2018-12080.md): The mintToken function of a smart contract implementation for Internet Node Token (INT), a tradable Ethereum ERC20 token, has no period cons (no CVSS) - [CVE-2018-12081](https://cve.now/CVE-2018-12081.md): The mintToken function of a smart contract implementation for Target Coin (TGT), a tradable Ethereum ERC20 token, has no period constraint, (no CVSS) - [CVE-2018-12082](https://cve.now/CVE-2018-12082.md): The mintToken function of a smart contract implementation for Fujinto (NTO), a tradable Ethereum ERC20 token, has no period constraint, whic (no CVSS) - [CVE-2018-12083](https://cve.now/CVE-2018-12083.md): The mintToken function of a smart contract implementation for GOAL Bonanza (GOAL), a tradable Ethereum ERC20 token, has no period constraint (no CVSS) - [CVE-2018-12084](https://cve.now/CVE-2018-12084.md): The mintToken function of a smart contract implementation for BitAsean (BAS), a tradable Ethereum ERC20 token, has no period constraint, whi (no CVSS) - [CVE-2018-12702](https://cve.now/CVE-2018-12702.md): The approveAndCallcode function of a smart contract implementation for Globalvillage ecosystem (GVE), an Ethereum ERC20 token, allows attack (no CVSS) - [CVE-2018-12703](https://cve.now/CVE-2018-12703.md): The approveAndCallcode function of a smart contract implementation for Block 18 (18T), an tradable Ethereum ERC20 token, allows attackers to (no CVSS) - [CVE-2018-12716](https://cve.now/CVE-2018-12716.md): The API service on Google Home and Chromecast devices before mid-July 2018 does not prevent DNS rebinding attacks from reading the scan\_resu (no CVSS) --- Source: cve.now, built and run by Sazabi (AI-native observability and security) Page: https://cve.now/daily/2018-06-25 Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.