CVEs published June 26, 2018
144 CVEs were published on June 26, 2018: 1 critical, 1 high.
- Published
- 144
- Critical
- 1
- High
- 1
- Medium
- 7
- Low
- 1
- Unrated
- 134
- Now in CISA KEV
- 0
- Fix available
- 27
Most affected products
- baserCMS Users Community baserCMS · baserproject/basercms
- 7
- Cybozu Office
- 6
- Siemens AG SCALANCE M875
- 6
- Cybozu Mailwise
- 3
- Pixelpost.org Pixelpost
- 3
- The Eclipse Foundation Eclipse Jetty · org.eclipse.jetty:je…
- 3
- io.jenkins:configuration-as-code
- 2
- Talos Pixar Renderman
- 2
- [UNKNOWN] ovirt-engine-setup
- 1
- [UNKNOWN] sssd
- 1
Critical 1
High 1
Medium, low and unrated 142
- CVE-2018-11053iSM: Dell EMC iDRAC Service Module Improper File Permission VulnerabilityDell EMC iDRAC Service Module
- CVE-2018-12900Heap-based buffer overflow in the cpSeparateBufToContigBuf function in tiffcp.c in LibTIFF 3.9.3, 3.9.4, 3.9.5, 3.9.6, 3.9.7, 4.0.0beta7, 4.
- CVE-2018-12902In Easy Magazine through 2012-10-26, there is XSS in the search bar of the web site.
- CVE-2018-12903In CyberArk Endpoint Privilege Manager (formerly Viewfinity) 10.2.1.603, there is persistent XSS via an account name on the create token scr
- CVE-2018-3840A denial-of-service vulnerability exists in the Pixar Renderman IT Display Service 21.6 (0x67).Talos Pixar Renderman
- CVE-2018-3841A denial-of-service vulnerability exists in the Pixar Renderman IT Display Service 21.6 (0x69).Talos Pixar Renderman
- CVE-2018-10594Delta Industrial Automation COMMGR from Delta Electronics versions 1.08 and prior with accompanying PLC Simulators (DVPSimulator EH2, EH3, EICS-CERT Delta Industrial Automation COMMGR and accompanyin…
- CVE-2018-12895WordPress through 4.9.6 allows Author users to execute arbitrary code by leveraging directory traversal in the wp-admin/post.php thumb param
- CVE-2018-1374An IBM WebSphere MQ (Maintenance levels 7.1.0.0 - 7.1.0.9, 7.5.0.0 - 7.5.0.8, 8.0.0.0 - 8.0.0.8, 9.0.0.0 - 9.0.0.2, and 9.0.0 - 9.0.4) clienIBM WebSphere MQ
- CVE-2018-1614IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 using malformed SAML responses from the SAML identity provider could allow a remote IBM WebSphere Application Server
- CVE-2018-12711An XSS issue was discovered in the language switcher module in Joomla! 1.6.0 through 3.8.8 before 3.8.9.
- CVE-2018-12712An issue was discovered in Joomla! 2.5.0 through 3.8.8 before 3.8.9.
- CVE-2018-3760There is an information leak vulnerability in Sprockets.HackerOne Sprockets · sprockets
- CVE-2018-10658There was a Memory Corruption issue discovered in multiple models of Axis IP Cameras which causes a denial of service (crash).
- CVE-2018-10659There was a Memory Corruption issue discovered in multiple models of Axis IP Cameras which allows remote attackers to cause a denial of serv
- CVE-2018-10660An issue was discovered in multiple models of Axis IP Cameras.
- CVE-2018-10661An issue was discovered in multiple models of Axis IP Cameras.
- CVE-2018-10662An issue was discovered in multiple models of Axis IP Cameras.
- CVE-2018-10663An issue was discovered in multiple models of Axis IP Cameras.
- CVE-2018-10664An issue was discovered in the httpd process in multiple models of Axis IP Cameras.
- CVE-2018-1072ovirt-engine before version ovirt 4.2.2 is vulnerable to an information exposure through log files.[UNKNOWN] ovirt-engine-setup
- CVE-2018-11447A vulnerability has been identified in SCALANCE M875 (All versions).Siemens AG SCALANCE M875
- CVE-2018-11448A vulnerability has been identified in SCALANCE M875 (All versions).Siemens AG SCALANCE M875
- CVE-2018-11449A vulnerability has been identified in SCALANCE M875 (All versions).Siemens AG SCALANCE M875
- CVE-2018-4845A vulnerability has been identified in RAPIDLab 1200 systems / RAPIDPoint 400 systems / RAPIDPoint 500 systems (All versions_without_ use ofSiemens AG RAPIDLab 1200 systems / RAPIDPoint 400 systems /…
- CVE-2018-4846A vulnerability has been identified in RAPIDLab 1200 systems / RAPIDPoint 400 systems / RAPIDPoint 500 systems (All versions_without_ use ofSiemens AG RAPIDLab 1200 systems RAPIDPoint 400 systems RAP…
- CVE-2018-4859A vulnerability has been identified in SCALANCE M875 (All versions).Siemens AG SCALANCE M875
- CVE-2018-4860A vulnerability has been identified in SCALANCE M875 (All versions).Siemens AG SCALANCE M875
- CVE-2018-4861A vulnerability has been identified in SCALANCE M875 (All versions).Siemens AG SCALANCE M875
- CVE-2017-7658In Eclipse Jetty Server, versions 9.2.x and older, 9.3.x (all non HTTP/1.x configurations), and 9.4.x (all HTTP/1.x configurations), when prThe Eclipse Foundation Eclipse Jetty · org.eclipse.jetty:je…
- CVE-2018-1000600A exposure of sensitive information vulnerability exists in Jenkins GitHub Plugin 1.29.1 and earlier in GitHubTokenCredentialsCreator.java tcom.coravy.hudson.plugins.github:github
- CVE-2018-1000601A arbitrary file read vulnerability exists in Jenkins SSH Credentials Plugin 1.13 and earlier in BasicSSHUserPrivateKey.java that allows attorg.jenkins-ci.plugins:ssh-credentials · org.jenkins-ci.plu…
- CVE-2018-1000602A session fixation vulnerability exists in Jenkins SAML Plugin 1.0.6 and earlier in SamlSecurityRealm.java that allows unauthorized attackerorg.jenkins-ci.plugins:saml
- CVE-2018-1000603A exposure of sensitive information vulnerability exists in Jenkins Openstack Cloud Plugin 2.35 and earlier in BootSource.java, InstancesToRorg.jenkins-ci.plugins:openstack-cloud
- CVE-2018-1000604A persisted cross-site scripting vulnerability exists in Jenkins Badge Plugin 1.4 and earlier in BadgeSummaryAction.java, HtmlBadgeAction.jaorg.jenkins-ci.plugins:badge
- CVE-2018-1000605A man in the middle vulnerability exists in Jenkins CollabNet Plugin 2.0.4 and earlier in CollabNetApp.java, CollabNetPlugin.java, CNFormFieorg.jenkins-ci.plugins:collabnet
- CVE-2018-1000606A server-side request forgery vulnerability exists in Jenkins URLTrigger Plugin 0.41 and earlier in URLTrigger.java that allows attackers wiorg.jenkins-ci.plugins:urltrigger
- CVE-2018-1000607A arbitrary file write vulnerability exists in Jenkins Fortify CloudScan Plugin 1.5.1 and earlier in ArchiveUtil.java that allows attackers org.jenkins-ci.plugins:fortify-cloudscan-jenkins-plugin
- CVE-2018-1000608A exposure of sensitive information vulnerability exists in Jenkins z/OS Connector Plugin 1.2.6.1 and earlier in SCLMSCM.java that allows anorg.jenkins-ci.plugins:zos-connector
- CVE-2018-1000609A exposure of sensitive information vulnerability exists in Jenkins Configuration as Code Plugin 0.7-alpha and earlier in ConfigurationAsCodio.jenkins:configuration-as-code
- CVE-2018-1000610A exposure of sensitive information vulnerability exists in Jenkins Configuration as Code Plugin 0.7-alpha and earlier in DataBoundConfiguraio.jenkins:configuration-as-code
- CVE-2017-7657In Eclipse Jetty, versions 9.2.x and older, 9.3.x (all configurations), and 9.4.x (non-default configuration with RFC2616 compliance enabledThe Eclipse Foundation Eclipse Jetty · org.eclipse.jetty:je…
- CVE-2018-1000205U-Boot contains a CWE-20: Improper Input Validation vulnerability in Verified boot signature validation that can result in Bypass verified b
- CVE-2018-1000500Busybox contains a Missing SSL certificate validation vulnerability in The "busybox wget" applet that can result in arbitrary code execution
- CVE-2018-1000501Instant Update CMS contains a Password Reset Vulnerability vulnerability in /iu-application/controllers/administration/auth.php that can res
- CVE-2018-1000502MyBB Group MyBB contains a File Inclusion vulnerability in Admin panel (Tools and Maintenance -> Task Manager -> Add New Task) that can resu
- CVE-2018-1000503MyBB Group MyBB contains a Incorrect Access Control vulnerability in Private forums that can result in Users can view posts from private for
- CVE-2018-1000504Redirection version 2.7.3 contains a ACE via file inclusion vulnerability in Pass-through mode that can result in allows admins to execute a
- CVE-2018-1000505Tooltipy (tooltips for WP) version 5 contains a Cross ite Request Forgery (CSRF) vulnerability in Settings page that can result in could all
- CVE-2018-1000506Metronet Tag Manager version 1.2.7 contains a Cross ite Request Forgery (CSRF) vulnerability in Settings page /wp-admin/options-general.php?
- CVE-2018-1000507WP User Groups version 2.0.0 contains a Cross ite Request Forgery (CSRF) vulnerability in Settings page that can result in allows anybody to
- CVE-2018-1000508WP ULike version 2.8.1, 3.1 contains a Cross Site Scripting (XSS) vulnerability in Settings screen that can result in allows unauthorised us
- CVE-2018-1000509Redirection version 2.7.1 contains a Serialisation vulnerability possibly allowing ACE vulnerability in Settings page AJAX that can result i
- CVE-2018-1000510WP Image Zoom version 1.23 contains a Incorrect Access Control vulnerability in AJAX settings that can result in allows anybody to cause den
- CVE-2018-1000511WP ULike version 2.8.1, 3.1 contains a Incorrect Access Control vulnerability in AJAX that can result in allows anybody to delete any row in
- CVE-2018-1000512Tooltipy Tooltipy (tooltips for WP) version 5 contains a Cross Site Scripting (XSS) vulnerability in Glossary shortcode that can result in c
- CVE-2018-1000513LimeSurvey version 3.0.0-beta.3+17110 contains a Cross Site Scripting (XSS) vulnerability in Boxes that can result in JS code execution agai
- CVE-2018-1000514LimeSurvey version 3.0.0-beta.3+17110 contains a Cross ite Request Forgery (CSRF) vulnerability in Boxes that can result in CSRF admins to d
- CVE-2018-1000515ventrian News-Articles version NewsArticles.00.09.11 contains a XML External Entity (XXE) vulnerability in News-Articles/API/MetaWebLog/Hand
- CVE-2018-1000516The Galaxy Project Galaxy version v14.10 contains a CWE-79: Improper Neutralization of Input During Web Page Generation vulnerability in Mangalaxy-app
- CVE-2018-1000518aaugustin websockets version 4 contains a CWE-409: Improper Handling of Highly Compressed Data (Data Amplification) vulnerability in Serverswebsockets
- CVE-2018-1000519aio-libs aiohttp-session contains a Session Fixation vulnerability in load_session function for RedisStorage (see: https://github.com/aio-liaiohttp-session
- CVE-2018-1000520ARM mbedTLS version 2.7.0 and earlier contains a Ciphersuite Allows Incorrectly Signed Certificates vulnerability in mbedtls_ssl_get_verify_
- CVE-2018-1000521BigTree-CMS contains a Cross Site Scripting (XSS) vulnerability in /users/create that can result in The low-privileged users can use this vu
- CVE-2018-1000523topydo contains a CWE-20: Improper Input Validation vulnerability in ListFormatParser::parse, file topydo/lib/ListFormat.py line 292 as of dtopydo
- CVE-2018-1000524miniSphere version 5.2.9 and earlier contains a Integer Overflow vulnerability in layer_resize() function in map_engine.c that can result in
- CVE-2018-1000525openpsa contains a PHP Object Injection vulnerability in Form data passed as GET request variables that can result in Possible information d
- CVE-2018-1000526Openpsa contains a XML Injection vulnerability in RSS file upload feature that can result in Remote denial of service.
- CVE-2018-1000527Froxlor version <= 0.9.39.5 contains a PHP Object Injection vulnerability in Domain name form that can result in Possible information disclofroxlor/froxlor
- CVE-2018-1000528GONICUS GOsa version before commit 56070d6289d47ba3f5918885954dcceb75606001 contains a Cross Site Scripting (XSS) vulnerability in change pa
- CVE-2018-1000529Grails Fields plugin version 2.2.7 contains a Cross Site Scripting (XSS) vulnerability in Using the display tag that can result in XSS .org.grails.plugins:fields · org.grails:grails-core
- CVE-2018-1000531inversoft prime-jwt version prior to commit abb0d479389a2509f939452a6767dc424bb5e6ba contains a CWE-20 vulnerability in JWTDecoder.decode th
- CVE-2018-1000532beep version 1.3 and up contains a External Control of File Name or Path vulnerability in --device option that can result in Local unprivile
- CVE-2018-1000533klaussilveira GitList version <= 0.6 contains a Passing incorrectly sanitized input to system function vulnerability in `searchTree` functio
- CVE-2018-1000534Joplin version prior to 1.0.90 contains a XSS evolving into code execution due to enabled nodeIntegration for that particular BrowserWindow joplin
- CVE-2018-1000535lms version <= LMS_011123 contains a Local File Disclosure vulnerability in File reading functionality in LMS module that can result in Poss
- CVE-2018-1000536Medis version 0.6.1 and earlier contains a XSS vulnerability evolving into code execution due to enabled nodeIntegration for the renderer pr
- CVE-2018-1000537Marlin Firmware Marlin version 1.1.x and earlier contains a Buffer Overflow vulnerability in cardreader.cpp (Depending on branch/version) th
- CVE-2018-1000538Minio Inc.
- CVE-2018-1000539Nov json-jwt version >= 0.5.0 && < 1.9.4 contains a CWE-347: Improper Verification of Cryptographic Signature vulnerability in Decryption ofjson-jwt
- CVE-2018-1000540LoboEvolution version < 9b75694cedfa4825d4a2330abf2719d470c654cd contains a XML External Entity (XXE) vulnerability in XML Parsing when view
- CVE-2018-1000542netbeans-mmd-plugin version <= 1.4.3 contains a XML External Entity (XXE) vulnerability in MMD file import that can result in Possible infor
- CVE-2018-1000543Akiee version 0.0.3 contains a XSS leading to code execution due to the use of node integration vulnerability in "Details" of a task is not
- CVE-2018-1000544rubyzip gem rubyzip version 1.2.1 and earlier contains a Directory Traversal vulnerability in Zip::File component that can result in write arubyzip
- CVE-2018-1000546Triplea version <= 1.9.0.0.10291 contains a XML External Entity (XXE) vulnerability in Importing game data that can result in Possible infor
- CVE-2018-1000547coreBOS version 7.0 and earlier contains a Incorrect Access Control vulnerability in Module: Contacts that can result in The error allows yo
- CVE-2018-1000548Umlet version < 14.3 contains a XML External Entity (XXE) vulnerability in File parsing that can result in disclosure of confidential data,
- CVE-2018-1000549Wekan version 1.04.0 contains a Email / Username Enumeration vulnerability in Register' and 'Forgot your password?' pages that can result in
- CVE-2018-1000550The Sympa Community Sympa version prior to version 6.2.32 contains a Directory Traversal vulnerability in wwsympa.fcgi template editing func
- CVE-2018-1000551Trovebox version <= 4.0.0-rc6 contains a PHP Type juggling vulnerability in album view component that can result in Authentication bypass.
- CVE-2018-1000552Trovebox version <= 4.0.0-rc6 contains a SQL Injection vulnerability in album component that can result in SQL code injection.
- CVE-2018-1000553Trovebox version <= 4.0.0-rc6 contains a Server-Side request forgery vulnerability in webhook component that can result in read or update in
- CVE-2018-1000554Trovebox version <= 4.0.0-rc6 contains a Unsafe password reset token generation vulnerability in user component that can result in Password
- CVE-2018-1000556WordPress version 4.8 + contains a Cross Site Scripting (XSS) vulnerability in plugins.php or core wordpress on delete function that can res
- CVE-2018-1000557OCS Inventory OCS Inventory NG version ocsreports 2.4 contains a Cross Site Scripting (XSS) vulnerability in login form and search functiona
- CVE-2018-1000558OCS Inventory NG ocsreports 2.4 and ocsreports 2.3.1 version 2.4 and 2.3.1 contains a SQL Injection vulnerability in web search that can res
- CVE-2018-1000559qutebrowser version introduced in v0.11.0 (1179ee7a937fb31414d77d9970bac21095358449) contains a Cross Site Scripting (XSS) vulnerability in qutebrowser
- CVE-2017-7656In Eclipse Jetty, versions 9.2.x and older, 9.3.x (all configurations), and 9.4.x (non-default configuration with RFC2616 compliance enabledThe Eclipse Foundation Eclipse Jetty · org.eclipse.jetty:je…
- CVE-2018-0526Cybozu Office 10.0.0 to 10.7.0 allow remote attackers to display an image located in an external server via unspecified vectors.
- CVE-2018-0527Cross-site scripting vulnerability in Cybozu Office 10.0.0 to 10.7.0 allows remote attackers to inject arbitrary web script or HTML via unspCybozu Office
- CVE-2018-0528Cybozu Office 10.0.0 to 10.7.0 allows authenticated attackers to bypass authentication to view the schedules that are not permitted to accesCybozu Office
- CVE-2018-0529Cybozu Office 10.0.0 to 10.7.0 allows remote attackers to cause a denial of service via unspecified vectors.Cybozu Office
- CVE-2018-0557Stored cross-site scripting vulnerability in Cybozu Mailwise 5.0.0 to 5.4.1 allows remote attackers to inject arbitrary web script or HTML 'Cybozu Mailwise
- CVE-2018-0558Reflected cross-site scripting vulnerability in Cybozu Mailwise 5.0.0 to 5.4.1 allows remote attackers to inject arbitrary web script or HTMCybozu Mailwise
- CVE-2018-0559Cross-site scripting vulnerability in Cybozu Mailwise 5.0.0 to 5.4.1 allows remote attackers to inject arbitrary web script or HTML 'AddressCybozu Mailwise
- CVE-2018-0563Untrusted search path vulnerability in the installer of FLET'S VIRUS CLEAR Easy Setup & Application Tool ver.13.0 and earlier versions and FNIPPON TELEGRAPH AND TELEPHONE EAST the installer of FLET'S…
- CVE-2018-0565Cross-site scripting vulnerability in Cybozu Office 10.0.0 to 10.8.0 allows remote attackers to inject arbitrary web script or HTML via unspCybozu Office
- CVE-2018-0566Cybozu Office 10.0.0 to 10.8.0 allows authenticated attackers to bypass authentication to obtain the schedules without access privilege via Cybozu Office
- CVE-2018-0567Cybozu Office 10.0.0 to 10.8.0 allows authenticated attackers to bypass access restriction to access and write non-public data via unspecifiCybozu Office
- CVE-2018-0569baserCMS (baserCMS 4.1.0.1 and earlier versions, baserCMS 3.0.15 and earlier versions) allows remote authenticated attackers to execute arbibaserCMS Users Community baserCMS · baserproject/basercms
- CVE-2018-0570Cross-site scripting vulnerability in baserCMS (baserCMS 4.1.0.1 and earlier versions, baserCMS 3.0.15 and earlier versions) allows remote abaserCMS Users Community baserCMS · baserproject/basercms
- CVE-2018-0571baserCMS (baserCMS 4.1.0.1 and earlier versions, baserCMS 3.0.15 and earlier versions) allows remote attackers with a site operator privilegbaserCMS Users Community baserCMS · baserproject/basercms
- CVE-2018-0572baserCMS (baserCMS 4.1.0.1 and earlier versions, baserCMS 3.0.15 and earlier versions) allows remote authenticated attackers to bypass accesbaserCMS Users Community baserCMS · baserproject/basercms
- CVE-2018-0573baserCMS (baserCMS 4.1.0.1 and earlier versions, baserCMS 3.0.15 and earlier versions) allows remote attackers to bypass access restriction baserCMS Users Community baserCMS · baserproject/basercms
- CVE-2018-0574Cross-site scripting vulnerability in baserCMS (baserCMS 4.1.0.1 and earlier versions, baserCMS 3.0.15 and earlier versions) allows remote abaserCMS Users Community baserCMS · baserproject/basercms
- CVE-2018-0575baserCMS (baserCMS 4.1.0.1 and earlier versions, baserCMS 3.0.15 and earlier versions) allows remote attackers to bypass access restriction baserCMS Users Community baserCMS · baserproject/basercms
- CVE-2018-0584IIJ SmartKey App for Android version 2.1.0 and earlier allows remote attackers to bypass authentication [effect_of_bypassing_authentication]Internet Initiative Japan IIJ SmartKey App for Android
- CVE-2018-0592Untrusted search path vulnerability in Microsoft OneDrive allows an attacker to gain privileges via a Trojan horse DLL in an unspecified dirMicrosoft OneDrive
- CVE-2018-0593Untrusted search path vulnerability in the installer of Microsoft OneDrive allows an attacker to gain privileges via a Trojan horse DLL in aThe installer of Microsoft OneDrive
- CVE-2018-0594Untrusted search path vulnerability in Skype for Windows allows an attacker to gain privileges via a Trojan horse DLL in an unspecified direMicrosoft Skype for Windows
- CVE-2018-0595Untrusted search path vulnerability in the installer of Skype for Windows allows an attacker to gain privileges via a Trojan horse DLL in anMicrosoft The installer of Skype for Windows
- CVE-2018-0596Untrusted search path vulnerability in the installer of Visual Studio Community allows an attacker to gain privileges via a Trojan horse DLLMicrosoft The installer of Visual Studio Community
- CVE-2018-0597Untrusted search path vulnerability in the installer of Visual Studio Code allows an attacker to gain privileges via a Trojan horse DLL in aMicrosoft The installer of Visual Studio Code
- CVE-2018-0599Untrusted search path vulnerability in the installer of Visual C++ Redistributable allows an attacker to gain privileges via a Trojan horse Microsoft The installer of Visual C++ Redistributable
- CVE-2018-0600Untrusted search path vulnerability in the installer of PlayMemories Home for Windows ver.5.5.01 and earlier allows an attacker to gain privSony the installer of PlayMemories Home for Windows
- CVE-2018-0601Untrusted search path vulnerability in axpdfium v0.01 allows an attacker to gain privileges via a Trojan horse DLL in an unspecified directoYasutaka ATARASHI axpdfium
- CVE-2018-0602Cross-site scripting vulnerability in Email Subscribers & Newsletters versions prior to 3.5.0 allows remote attackers to inject arbitrary weicegram Email Subscribers & Newsletters
- CVE-2018-0603Cross-site scripting vulnerability in Site Reviews versions prior to 2.15.3 allows remote attackers to inject arbitrary web script or HTML vGemini Labs Site Reviews
- CVE-2018-0604Pixelpost v1.7.3 and earlier allows remote code execution via unspecified vectors.Pixelpost.org Pixelpost
- CVE-2018-0605Cross-site scripting vulnerability in Pixelpost v1.7.3 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecPixelpost.org Pixelpost
- CVE-2018-0606SQL injection vulnerability in the Pixelpost v1.7.3 and earlier allows remote authenticated attackers to execute arbitrary SQL commands via Pixelpost.org Pixelpost
- CVE-2018-0608Buffer overflow in H2O version 2.2.4 and earlier allows remote attackers to execute arbitrary code or cause a denial of service (DoS) via unKazuho Oku H2O
- CVE-2018-0609Untrusted search path vulnerability in LINE for Windows versions before 5.8.0 allows an attacker to gain privileges via a Trojan horse DLL i
- CVE-2018-0610Local file inclusion vulnerability in Zenphoto 1.4.14 and earlier allows a remote attacker with an administrative privilege to execute arbitZenphoto
- CVE-2018-0611The ANA App for iOS version 4.0.22 and earlier does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackersALL NIPPON AIRWAYS CO. ANA App for iOS
- CVE-2018-0612Cross-site scripting vulnerability in 5000 trillion yen converter v1.0.6 allows remote attackers to inject arbitrary web script or HTML via Owen 5000 trillion yen converter
- CVE-2018-1000204Linux Kernel version 3.18 to 4.16 incorrectly handles an SG_IO ioctl on /dev/sg0 with dxfer_direction=SG_DXFER_FROM_DEV and an empty 6-byte
- CVE-2018-10852The UNIX pipe which sudo uses to contact SSSD and read the available sudo rules from SSSD has too wide permissions, which means that anyone [UNKNOWN] sssd
- CVE-2018-12889An issue was discovered in CCN-lite 2.0.1.
- CVE-2018-12884In Octopus Deploy 3.0 onwards (before 2018.6.7), an authenticated user with incorrect permissions may be able to create Accounts under the I
- CVE-2018-12882exif_read_from_impl in ext/exif/exif.c in PHP 7.2.x through 7.2.7 allows attackers to trigger a use-after-free (in exif_read_from_file) beca
- CVE-2018-0598Untrusted search path vulnerability in Self-extracting archive files created by IExpress bundled with Microsoft Windows allows an attacker tSelf-extracting archive files created by IExpress bundled w…