# CVEs published 2018-06-26

144 CVEs were published on June 26, 2018: 1 critical, 1 high. Days are UTC.

- [CVE-2018-11053](https://cve.now/CVE-2018-11053.md): iSM: Dell EMC iDRAC Service Module Improper File Permission Vulnerability (CVSS 6.6, Dell EMC iDRAC Service Module)
- [CVE-2018-12900](https://cve.now/CVE-2018-12900.md): Heap-based buffer overflow in the cpSeparateBufToContigBuf function in tiffcp.c in LibTIFF 3.9.3, 3.9.4, 3.9.5, 3.9.6, 3.9.7, 4.0.0beta7, 4. (no CVSS)
- [CVE-2018-12902](https://cve.now/CVE-2018-12902.md): In Easy Magazine through 2012-10-26, there is XSS in the search bar of the web site. (no CVSS)
- [CVE-2018-12903](https://cve.now/CVE-2018-12903.md): In CyberArk Endpoint Privilege Manager (formerly Viewfinity) 10.2.1.603, there is persistent XSS via an account name on the create token scr (no CVSS)
- [CVE-2018-3840](https://cve.now/CVE-2018-3840.md): A denial-of-service vulnerability exists in the Pixar Renderman IT Display Service 21.6 (0x67). (CVSS 5.3, Talos Pixar Renderman)
- [CVE-2018-3841](https://cve.now/CVE-2018-3841.md): A denial-of-service vulnerability exists in the Pixar Renderman IT Display Service 21.6 (0x69). (CVSS 5.3, Talos Pixar Renderman)
- [CVE-2018-10594](https://cve.now/CVE-2018-10594.md): Delta Industrial Automation COMMGR from Delta Electronics versions 1.08 and prior with accompanying PLC Simulators (DVPSimulator EH2, EH3, E (no CVSS, ICS-CERT Delta Industrial Automation COMMGR and accompanyin…)
- [CVE-2018-12895](https://cve.now/CVE-2018-12895.md): WordPress through 4.9.6 allows Author users to execute arbitrary code by leveraging directory traversal in the wp-admin/post.php thumb param (no CVSS)
- [CVE-2018-1374](https://cve.now/CVE-2018-1374.md): An IBM WebSphere MQ (Maintenance levels 7.1.0.0 - 7.1.0.9, 7.5.0.0 - 7.5.0.8, 8.0.0.0 - 8.0.0.8, 9.0.0.0 - 9.0.0.2, and 9.0.0 - 9.0.4) clien (CVSS 5.3, IBM WebSphere MQ)
- [CVE-2018-1614](https://cve.now/CVE-2018-1614.md): IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 using malformed SAML responses from the SAML identity provider could allow a remote (CVSS 5.8, IBM WebSphere Application Server)
- [CVE-2018-12711](https://cve.now/CVE-2018-12711.md): An XSS issue was discovered in the language switcher module in Joomla! 1.6.0 through 3.8.8 before 3.8.9. (no CVSS)
- [CVE-2018-12712](https://cve.now/CVE-2018-12712.md): An issue was discovered in Joomla! 2.5.0 through 3.8.8 before 3.8.9. (no CVSS)
- [CVE-2018-3760](https://cve.now/CVE-2018-3760.md): There is an information leak vulnerability in Sprockets. (no CVSS, HackerOne Sprockets · sprockets)
- [CVE-2018-10658](https://cve.now/CVE-2018-10658.md): There was a Memory Corruption issue discovered in multiple models of Axis IP Cameras which causes a denial of service (crash). (no CVSS)
- [CVE-2018-10659](https://cve.now/CVE-2018-10659.md): There was a Memory Corruption issue discovered in multiple models of Axis IP Cameras which allows remote attackers to cause a denial of serv (no CVSS)
- [CVE-2018-10660](https://cve.now/CVE-2018-10660.md): An issue was discovered in multiple models of Axis IP Cameras. (no CVSS)
- [CVE-2018-10661](https://cve.now/CVE-2018-10661.md): An issue was discovered in multiple models of Axis IP Cameras. (no CVSS)
- [CVE-2018-10662](https://cve.now/CVE-2018-10662.md): An issue was discovered in multiple models of Axis IP Cameras. (no CVSS)
- [CVE-2018-10663](https://cve.now/CVE-2018-10663.md): An issue was discovered in multiple models of Axis IP Cameras. (no CVSS)
- [CVE-2018-10664](https://cve.now/CVE-2018-10664.md): An issue was discovered in the httpd process in multiple models of Axis IP Cameras. (no CVSS)
- [CVE-2018-1072](https://cve.now/CVE-2018-1072.md): ovirt-engine before version ovirt 4.2.2 is vulnerable to an information exposure through log files. (CVSS 5.0, \[UNKNOWN\] ovirt-engine-setup)
- [CVE-2018-11447](https://cve.now/CVE-2018-11447.md): A vulnerability has been identified in SCALANCE M875 (All versions). (no CVSS, Siemens AG SCALANCE M875)
- [CVE-2018-11448](https://cve.now/CVE-2018-11448.md): A vulnerability has been identified in SCALANCE M875 (All versions). (no CVSS, Siemens AG SCALANCE M875)
- [CVE-2018-11449](https://cve.now/CVE-2018-11449.md): A vulnerability has been identified in SCALANCE M875 (All versions). (no CVSS, Siemens AG SCALANCE M875)
- [CVE-2018-4845](https://cve.now/CVE-2018-4845.md): A vulnerability has been identified in RAPIDLab 1200 systems / RAPIDPoint 400 systems / RAPIDPoint 500 systems (All versions\_without\_ use of (no CVSS, Siemens AG RAPIDLab 1200 systems / RAPIDPoint 400 systems /…)
- [CVE-2018-4846](https://cve.now/CVE-2018-4846.md): A vulnerability has been identified in RAPIDLab 1200 systems / RAPIDPoint 400 systems / RAPIDPoint 500 systems (All versions\_without\_ use of (no CVSS, Siemens AG RAPIDLab 1200 systems RAPIDPoint 400 systems RAP…)
- [CVE-2018-4859](https://cve.now/CVE-2018-4859.md): A vulnerability has been identified in SCALANCE M875 (All versions). (no CVSS, Siemens AG SCALANCE M875)
- [CVE-2018-4860](https://cve.now/CVE-2018-4860.md): A vulnerability has been identified in SCALANCE M875 (All versions). (no CVSS, Siemens AG SCALANCE M875)
- [CVE-2018-4861](https://cve.now/CVE-2018-4861.md): A vulnerability has been identified in SCALANCE M875 (All versions). (no CVSS, Siemens AG SCALANCE M875)
- [CVE-2017-7658](https://cve.now/CVE-2017-7658.md): In Eclipse Jetty Server, versions 9.2.x and older, 9.3.x (all non HTTP/1.x configurations), and 9.4.x (all HTTP/1.x configurations), when pr (no CVSS, The Eclipse Foundation Eclipse Jetty · org.eclipse.jetty:je…)
- [CVE-2018-1000600](https://cve.now/CVE-2018-1000600.md): A exposure of sensitive information vulnerability exists in Jenkins GitHub Plugin 1.29.1 and earlier in GitHubTokenCredentialsCreator.java t (no CVSS, com.coravy.hudson.plugins.github:github)
- [CVE-2018-1000601](https://cve.now/CVE-2018-1000601.md): A arbitrary file read vulnerability exists in Jenkins SSH Credentials Plugin 1.13 and earlier in BasicSSHUserPrivateKey.java that allows att (no CVSS, org.jenkins-ci.plugins:ssh-credentials · org.jenkins-ci.plu…)
- [CVE-2018-1000602](https://cve.now/CVE-2018-1000602.md): A session fixation vulnerability exists in Jenkins SAML Plugin 1.0.6 and earlier in SamlSecurityRealm.java that allows unauthorized attacker (no CVSS, org.jenkins-ci.plugins:saml)
- [CVE-2018-1000603](https://cve.now/CVE-2018-1000603.md): A exposure of sensitive information vulnerability exists in Jenkins Openstack Cloud Plugin 2.35 and earlier in BootSource.java, InstancesToR (no CVSS, org.jenkins-ci.plugins:openstack-cloud)
- [CVE-2018-1000604](https://cve.now/CVE-2018-1000604.md): A persisted cross-site scripting vulnerability exists in Jenkins Badge Plugin 1.4 and earlier in BadgeSummaryAction.java, HtmlBadgeAction.ja (no CVSS, org.jenkins-ci.plugins:badge)
- [CVE-2018-1000605](https://cve.now/CVE-2018-1000605.md): A man in the middle vulnerability exists in Jenkins CollabNet Plugin 2.0.4 and earlier in CollabNetApp.java, CollabNetPlugin.java, CNFormFie (no CVSS, org.jenkins-ci.plugins:collabnet)
- [CVE-2018-1000606](https://cve.now/CVE-2018-1000606.md): A server-side request forgery vulnerability exists in Jenkins URLTrigger Plugin 0.41 and earlier in URLTrigger.java that allows attackers wi (no CVSS, org.jenkins-ci.plugins:urltrigger)
- [CVE-2018-1000607](https://cve.now/CVE-2018-1000607.md): A arbitrary file write vulnerability exists in Jenkins Fortify CloudScan Plugin 1.5.1 and earlier in ArchiveUtil.java that allows attackers (no CVSS, org.jenkins-ci.plugins:fortify-cloudscan-jenkins-plugin)
- [CVE-2018-1000608](https://cve.now/CVE-2018-1000608.md): A exposure of sensitive information vulnerability exists in Jenkins z/OS Connector Plugin 1.2.6.1 and earlier in SCLMSCM.java that allows an (no CVSS, org.jenkins-ci.plugins:zos-connector)
- [CVE-2018-1000609](https://cve.now/CVE-2018-1000609.md): A exposure of sensitive information vulnerability exists in Jenkins Configuration as Code Plugin 0.7-alpha and earlier in ConfigurationAsCod (no CVSS, io.jenkins:configuration-as-code)
- [CVE-2018-1000610](https://cve.now/CVE-2018-1000610.md): A exposure of sensitive information vulnerability exists in Jenkins Configuration as Code Plugin 0.7-alpha and earlier in DataBoundConfigura (no CVSS, io.jenkins:configuration-as-code)
- [CVE-2018-6667](https://cve.now/CVE-2018-6667.md): McAfee Web Gateway - Authentication Bypass vulnerability (CVSS 10.0, McAfee Web Gateway)
- [CVE-2017-7657](https://cve.now/CVE-2017-7657.md): In Eclipse Jetty, versions 9.2.x and older, 9.3.x (all configurations), and 9.4.x (non-default configuration with RFC2616 compliance enabled (no CVSS, The Eclipse Foundation Eclipse Jetty · org.eclipse.jetty:je…)
- [CVE-2018-1000205](https://cve.now/CVE-2018-1000205.md): U-Boot contains a CWE-20: Improper Input Validation vulnerability in Verified boot signature validation that can result in Bypass verified b (no CVSS)
- [CVE-2018-1000500](https://cve.now/CVE-2018-1000500.md): Busybox contains a Missing SSL certificate validation vulnerability in The "busybox wget" applet that can result in arbitrary code execution (CVSS 6.5)
- [CVE-2018-1000501](https://cve.now/CVE-2018-1000501.md): Instant Update CMS contains a Password Reset Vulnerability vulnerability in /iu-application/controllers/administration/auth.php that can res (no CVSS)
- [CVE-2018-1000502](https://cve.now/CVE-2018-1000502.md): MyBB Group MyBB contains a File Inclusion vulnerability in Admin panel (Tools and Maintenance -\> Task Manager -\> Add New Task) that can resu (no CVSS)
- [CVE-2018-1000503](https://cve.now/CVE-2018-1000503.md): MyBB Group MyBB contains a Incorrect Access Control vulnerability in Private forums that can result in Users can view posts from private for (no CVSS)
- [CVE-2018-1000504](https://cve.now/CVE-2018-1000504.md): Redirection version 2.7.3 contains a ACE via file inclusion vulnerability in Pass-through mode that can result in allows admins to execute a (no CVSS)
- [CVE-2018-1000505](https://cve.now/CVE-2018-1000505.md): Tooltipy (tooltips for WP) version 5 contains a Cross ite Request Forgery (CSRF) vulnerability in Settings page that can result in could all (no CVSS)
- [CVE-2018-1000506](https://cve.now/CVE-2018-1000506.md): Metronet Tag Manager version 1.2.7 contains a Cross ite Request Forgery (CSRF) vulnerability in Settings page /wp-admin/options-general.php? (no CVSS)
- [CVE-2018-1000507](https://cve.now/CVE-2018-1000507.md): WP User Groups version 2.0.0 contains a Cross ite Request Forgery (CSRF) vulnerability in Settings page that can result in allows anybody to (no CVSS)
- [CVE-2018-1000508](https://cve.now/CVE-2018-1000508.md): WP ULike version 2.8.1, 3.1 contains a Cross Site Scripting (XSS) vulnerability in Settings screen that can result in allows unauthorised us (no CVSS)
- [CVE-2018-1000509](https://cve.now/CVE-2018-1000509.md): Redirection version 2.7.1 contains a Serialisation vulnerability possibly allowing ACE vulnerability in Settings page AJAX that can result i (no CVSS)
- [CVE-2018-1000510](https://cve.now/CVE-2018-1000510.md): WP Image Zoom version 1.23 contains a Incorrect Access Control vulnerability in AJAX settings that can result in allows anybody to cause den (no CVSS)
- [CVE-2018-1000511](https://cve.now/CVE-2018-1000511.md): WP ULike version 2.8.1, 3.1 contains a Incorrect Access Control vulnerability in AJAX that can result in allows anybody to delete any row in (no CVSS)
- [CVE-2018-1000512](https://cve.now/CVE-2018-1000512.md): Tooltipy Tooltipy (tooltips for WP) version 5 contains a Cross Site Scripting (XSS) vulnerability in Glossary shortcode that can result in c (no CVSS)
- [CVE-2018-1000513](https://cve.now/CVE-2018-1000513.md): LimeSurvey version 3.0.0-beta.3+17110 contains a Cross Site Scripting (XSS) vulnerability in Boxes that can result in JS code execution agai (no CVSS)
- [CVE-2018-1000514](https://cve.now/CVE-2018-1000514.md): LimeSurvey version 3.0.0-beta.3+17110 contains a Cross ite Request Forgery (CSRF) vulnerability in Boxes that can result in CSRF admins to d (no CVSS)
- [CVE-2018-1000515](https://cve.now/CVE-2018-1000515.md): ventrian News-Articles version NewsArticles.00.09.11 contains a XML External Entity (XXE) vulnerability in News-Articles/API/MetaWebLog/Hand (no CVSS)
- [CVE-2018-1000516](https://cve.now/CVE-2018-1000516.md): The Galaxy Project Galaxy version v14.10 contains a CWE-79: Improper Neutralization of Input During Web Page Generation vulnerability in Man (no CVSS, galaxy-app)
- [CVE-2018-1000517](https://cve.now/CVE-2018-1000517.md): BusyBox project BusyBox wget version prior to commit 8e2174e9bd836e53c8b9c6e00d1bc6e2a718686e contains a Buffer Overflow vulnerability in Bu (CVSS 8.0)
- [CVE-2018-1000518](https://cve.now/CVE-2018-1000518.md): aaugustin websockets version 4 contains a CWE-409: Improper Handling of Highly Compressed Data (Data Amplification) vulnerability in Servers (no CVSS, websockets)
- [CVE-2018-1000519](https://cve.now/CVE-2018-1000519.md): aio-libs aiohttp-session contains a Session Fixation vulnerability in load\_session function for RedisStorage (see: https://github.com/aio-li (no CVSS, aiohttp-session)
- [CVE-2018-1000520](https://cve.now/CVE-2018-1000520.md): ARM mbedTLS version 2.7.0 and earlier contains a Ciphersuite Allows Incorrectly Signed Certificates vulnerability in mbedtls\_ssl\_get\_verify\_ (no CVSS)
- [CVE-2018-1000521](https://cve.now/CVE-2018-1000521.md): BigTree-CMS contains a Cross Site Scripting (XSS) vulnerability in /users/create that can result in The low-privileged users can use this vu (no CVSS)
- [CVE-2018-1000523](https://cve.now/CVE-2018-1000523.md): topydo contains a CWE-20: Improper Input Validation vulnerability in ListFormatParser::parse, file topydo/lib/ListFormat.py line 292 as of d (no CVSS, topydo)
- [CVE-2018-1000524](https://cve.now/CVE-2018-1000524.md): miniSphere version 5.2.9 and earlier contains a Integer Overflow vulnerability in layer\_resize() function in map\_engine.c that can result in (no CVSS)
- [CVE-2018-1000525](https://cve.now/CVE-2018-1000525.md): openpsa contains a PHP Object Injection vulnerability in Form data passed as GET request variables that can result in Possible information d (no CVSS)
- [CVE-2018-1000526](https://cve.now/CVE-2018-1000526.md): Openpsa contains a XML Injection vulnerability in RSS file upload feature that can result in Remote denial of service. (no CVSS)
- [CVE-2018-1000527](https://cve.now/CVE-2018-1000527.md): Froxlor version \<= 0.9.39.5 contains a PHP Object Injection vulnerability in Domain name form that can result in Possible information disclo (no CVSS, froxlor/froxlor)
- [CVE-2018-1000528](https://cve.now/CVE-2018-1000528.md): GONICUS GOsa version before commit 56070d6289d47ba3f5918885954dcceb75606001 contains a Cross Site Scripting (XSS) vulnerability in change pa (no CVSS)
- [CVE-2018-1000529](https://cve.now/CVE-2018-1000529.md): Grails Fields plugin version 2.2.7 contains a Cross Site Scripting (XSS) vulnerability in Using the display tag that can result in XSS . (no CVSS, org.grails.plugins:fields · org.grails:grails-core)
- [CVE-2018-1000531](https://cve.now/CVE-2018-1000531.md): inversoft prime-jwt version prior to commit abb0d479389a2509f939452a6767dc424bb5e6ba contains a CWE-20 vulnerability in JWTDecoder.decode th (no CVSS)
- [CVE-2018-1000532](https://cve.now/CVE-2018-1000532.md): beep version 1.3 and up contains a External Control of File Name or Path vulnerability in --device option that can result in Local unprivile (no CVSS)
- [CVE-2018-1000533](https://cve.now/CVE-2018-1000533.md): klaussilveira GitList version \<= 0.6 contains a Passing incorrectly sanitized input to system function vulnerability in \`searchTree\` functio (no CVSS)
- [CVE-2018-1000534](https://cve.now/CVE-2018-1000534.md): Joplin version prior to 1.0.90 contains a XSS evolving into code execution due to enabled nodeIntegration for that particular BrowserWindow (no CVSS, joplin)
- [CVE-2018-1000535](https://cve.now/CVE-2018-1000535.md): lms version \<= LMS\_011123 contains a Local File Disclosure vulnerability in File reading functionality in LMS module that can result in Poss (no CVSS)
- [CVE-2018-1000536](https://cve.now/CVE-2018-1000536.md): Medis version 0.6.1 and earlier contains a XSS vulnerability evolving into code execution due to enabled nodeIntegration for the renderer pr (no CVSS)
- [CVE-2018-1000537](https://cve.now/CVE-2018-1000537.md): Marlin Firmware Marlin version 1.1.x and earlier contains a Buffer Overflow vulnerability in cardreader.cpp (Depending on branch/version) th (no CVSS)
- [CVE-2018-1000538](https://cve.now/CVE-2018-1000538.md): Minio Inc. (no CVSS)
- [CVE-2018-1000539](https://cve.now/CVE-2018-1000539.md): Nov json-jwt version \>= 0.5.0 && \< 1.9.4 contains a CWE-347: Improper Verification of Cryptographic Signature vulnerability in Decryption of (no CVSS, json-jwt)
- [CVE-2018-1000540](https://cve.now/CVE-2018-1000540.md): LoboEvolution version \< 9b75694cedfa4825d4a2330abf2719d470c654cd contains a XML External Entity (XXE) vulnerability in XML Parsing when view (no CVSS)
- [CVE-2018-1000542](https://cve.now/CVE-2018-1000542.md): netbeans-mmd-plugin version \<= 1.4.3 contains a XML External Entity (XXE) vulnerability in MMD file import that can result in Possible infor (no CVSS)
- [CVE-2018-1000543](https://cve.now/CVE-2018-1000543.md): Akiee version 0.0.3 contains a XSS leading to code execution due to the use of node integration vulnerability in "Details" of a task is not (no CVSS)
- [CVE-2018-1000544](https://cve.now/CVE-2018-1000544.md): rubyzip gem rubyzip version 1.2.1 and earlier contains a Directory Traversal vulnerability in Zip::File component that can result in write a (no CVSS, rubyzip)
- [CVE-2018-1000546](https://cve.now/CVE-2018-1000546.md): Triplea version \<= 1.9.0.0.10291 contains a XML External Entity (XXE) vulnerability in Importing game data that can result in Possible infor (no CVSS)
- [CVE-2018-1000547](https://cve.now/CVE-2018-1000547.md): coreBOS version 7.0 and earlier contains a Incorrect Access Control vulnerability in Module: Contacts that can result in The error allows yo (no CVSS)
- [CVE-2018-1000548](https://cve.now/CVE-2018-1000548.md): Umlet version \< 14.3 contains a XML External Entity (XXE) vulnerability in File parsing that can result in disclosure of confidential data, (no CVSS)
- [CVE-2018-1000549](https://cve.now/CVE-2018-1000549.md): Wekan version 1.04.0 contains a Email / Username Enumeration vulnerability in Register' and 'Forgot your password?' pages that can result in (no CVSS)
- [CVE-2018-1000550](https://cve.now/CVE-2018-1000550.md): The Sympa Community Sympa version prior to version 6.2.32 contains a Directory Traversal vulnerability in wwsympa.fcgi template editing func (no CVSS)
- [CVE-2018-1000551](https://cve.now/CVE-2018-1000551.md): Trovebox version \<= 4.0.0-rc6 contains a PHP Type juggling vulnerability in album view component that can result in Authentication bypass. (no CVSS)
- [CVE-2018-1000552](https://cve.now/CVE-2018-1000552.md): Trovebox version \<= 4.0.0-rc6 contains a SQL Injection vulnerability in album component that can result in SQL code injection. (no CVSS)
- [CVE-2018-1000553](https://cve.now/CVE-2018-1000553.md): Trovebox version \<= 4.0.0-rc6 contains a Server-Side request forgery vulnerability in webhook component that can result in read or update in (no CVSS)
- [CVE-2018-1000554](https://cve.now/CVE-2018-1000554.md): Trovebox version \<= 4.0.0-rc6 contains a Unsafe password reset token generation vulnerability in user component that can result in Password (no CVSS)
- [CVE-2018-1000556](https://cve.now/CVE-2018-1000556.md): WordPress version 4.8 + contains a Cross Site Scripting (XSS) vulnerability in plugins.php or core wordpress on delete function that can res (no CVSS)
- [CVE-2018-1000557](https://cve.now/CVE-2018-1000557.md): OCS Inventory OCS Inventory NG version ocsreports 2.4 contains a Cross Site Scripting (XSS) vulnerability in login form and search functiona (no CVSS)
- [CVE-2018-1000558](https://cve.now/CVE-2018-1000558.md): OCS Inventory NG ocsreports 2.4 and ocsreports 2.3.1 version 2.4 and 2.3.1 contains a SQL Injection vulnerability in web search that can res (no CVSS)
- [CVE-2018-1000559](https://cve.now/CVE-2018-1000559.md): qutebrowser version introduced in v0.11.0 (1179ee7a937fb31414d77d9970bac21095358449) contains a Cross Site Scripting (XSS) vulnerability in (no CVSS, qutebrowser)
- [CVE-2017-7656](https://cve.now/CVE-2017-7656.md): In Eclipse Jetty, versions 9.2.x and older, 9.3.x (all configurations), and 9.4.x (non-default configuration with RFC2616 compliance enabled (no CVSS, The Eclipse Foundation Eclipse Jetty · org.eclipse.jetty:je…)
- [CVE-2018-0526](https://cve.now/CVE-2018-0526.md): Cybozu Office 10.0.0 to 10.7.0 allow remote attackers to display an image located in an external server via unspecified vectors. (no CVSS)
- [CVE-2018-0527](https://cve.now/CVE-2018-0527.md): Cross-site scripting vulnerability in Cybozu Office 10.0.0 to 10.7.0 allows remote attackers to inject arbitrary web script or HTML via unsp (no CVSS, Cybozu Office)
- [CVE-2018-0528](https://cve.now/CVE-2018-0528.md): Cybozu Office 10.0.0 to 10.7.0 allows authenticated attackers to bypass authentication to view the schedules that are not permitted to acces (no CVSS, Cybozu Office)
- [CVE-2018-0529](https://cve.now/CVE-2018-0529.md): Cybozu Office 10.0.0 to 10.7.0 allows remote attackers to cause a denial of service via unspecified vectors. (no CVSS, Cybozu Office)
- [CVE-2018-0557](https://cve.now/CVE-2018-0557.md): Stored cross-site scripting vulnerability in Cybozu Mailwise 5.0.0 to 5.4.1 allows remote attackers to inject arbitrary web script or HTML ' (no CVSS, Cybozu Mailwise)
- [CVE-2018-0558](https://cve.now/CVE-2018-0558.md): Reflected cross-site scripting vulnerability in Cybozu Mailwise 5.0.0 to 5.4.1 allows remote attackers to inject arbitrary web script or HTM (no CVSS, Cybozu Mailwise)
- [CVE-2018-0559](https://cve.now/CVE-2018-0559.md): Cross-site scripting vulnerability in Cybozu Mailwise 5.0.0 to 5.4.1 allows remote attackers to inject arbitrary web script or HTML 'Address (no CVSS, Cybozu Mailwise)
- [CVE-2018-0563](https://cve.now/CVE-2018-0563.md): Untrusted search path vulnerability in the installer of FLET'S VIRUS CLEAR Easy Setup & Application Tool ver.13.0 and earlier versions and F (no CVSS, NIPPON TELEGRAPH AND TELEPHONE EAST the installer of FLET'S…)
- [CVE-2018-0565](https://cve.now/CVE-2018-0565.md): Cross-site scripting vulnerability in Cybozu Office 10.0.0 to 10.8.0 allows remote attackers to inject arbitrary web script or HTML via unsp (no CVSS, Cybozu Office)
- [CVE-2018-0566](https://cve.now/CVE-2018-0566.md): Cybozu Office 10.0.0 to 10.8.0 allows authenticated attackers to bypass authentication to obtain the schedules without access privilege via (no CVSS, Cybozu Office)
- [CVE-2018-0567](https://cve.now/CVE-2018-0567.md): Cybozu Office 10.0.0 to 10.8.0 allows authenticated attackers to bypass access restriction to access and write non-public data via unspecifi (no CVSS, Cybozu Office)
- [CVE-2018-0569](https://cve.now/CVE-2018-0569.md): baserCMS (baserCMS 4.1.0.1 and earlier versions, baserCMS 3.0.15 and earlier versions) allows remote authenticated attackers to execute arbi (no CVSS, baserCMS Users Community baserCMS · baserproject/basercms)
- [CVE-2018-0570](https://cve.now/CVE-2018-0570.md): Cross-site scripting vulnerability in baserCMS (baserCMS 4.1.0.1 and earlier versions, baserCMS 3.0.15 and earlier versions) allows remote a (no CVSS, baserCMS Users Community baserCMS · baserproject/basercms)
- [CVE-2018-0571](https://cve.now/CVE-2018-0571.md): baserCMS (baserCMS 4.1.0.1 and earlier versions, baserCMS 3.0.15 and earlier versions) allows remote attackers with a site operator privileg (no CVSS, baserCMS Users Community baserCMS · baserproject/basercms)
- [CVE-2018-0572](https://cve.now/CVE-2018-0572.md): baserCMS (baserCMS 4.1.0.1 and earlier versions, baserCMS 3.0.15 and earlier versions) allows remote authenticated attackers to bypass acces (no CVSS, baserCMS Users Community baserCMS · baserproject/basercms)
- [CVE-2018-0573](https://cve.now/CVE-2018-0573.md): baserCMS (baserCMS 4.1.0.1 and earlier versions, baserCMS 3.0.15 and earlier versions) allows remote attackers to bypass access restriction (no CVSS, baserCMS Users Community baserCMS · baserproject/basercms)
- [CVE-2018-0574](https://cve.now/CVE-2018-0574.md): Cross-site scripting vulnerability in baserCMS (baserCMS 4.1.0.1 and earlier versions, baserCMS 3.0.15 and earlier versions) allows remote a (no CVSS, baserCMS Users Community baserCMS · baserproject/basercms)
- [CVE-2018-0575](https://cve.now/CVE-2018-0575.md): baserCMS (baserCMS 4.1.0.1 and earlier versions, baserCMS 3.0.15 and earlier versions) allows remote attackers to bypass access restriction (no CVSS, baserCMS Users Community baserCMS · baserproject/basercms)
- [CVE-2018-0584](https://cve.now/CVE-2018-0584.md): IIJ SmartKey App for Android version 2.1.0 and earlier allows remote attackers to bypass authentication \[effect\_of\_bypassing\_authentication\] (no CVSS, Internet Initiative Japan IIJ SmartKey App for Android)
- [CVE-2018-0592](https://cve.now/CVE-2018-0592.md): Untrusted search path vulnerability in Microsoft OneDrive allows an attacker to gain privileges via a Trojan horse DLL in an unspecified dir (no CVSS, Microsoft OneDrive)
- [CVE-2018-0593](https://cve.now/CVE-2018-0593.md): Untrusted search path vulnerability in the installer of Microsoft OneDrive allows an attacker to gain privileges via a Trojan horse DLL in a (no CVSS, The installer of Microsoft OneDrive)
- [CVE-2018-0594](https://cve.now/CVE-2018-0594.md): Untrusted search path vulnerability in Skype for Windows allows an attacker to gain privileges via a Trojan horse DLL in an unspecified dire (no CVSS, Microsoft Skype for Windows)
- [CVE-2018-0595](https://cve.now/CVE-2018-0595.md): Untrusted search path vulnerability in the installer of Skype for Windows allows an attacker to gain privileges via a Trojan horse DLL in an (no CVSS, Microsoft The installer of Skype for Windows)
- [CVE-2018-0596](https://cve.now/CVE-2018-0596.md): Untrusted search path vulnerability in the installer of Visual Studio Community allows an attacker to gain privileges via a Trojan horse DLL (no CVSS, Microsoft The installer of Visual Studio Community)
- [CVE-2018-0597](https://cve.now/CVE-2018-0597.md): Untrusted search path vulnerability in the installer of Visual Studio Code allows an attacker to gain privileges via a Trojan horse DLL in a (no CVSS, Microsoft The installer of Visual Studio Code)
- [CVE-2018-0599](https://cve.now/CVE-2018-0599.md): Untrusted search path vulnerability in the installer of Visual C++ Redistributable allows an attacker to gain privileges via a Trojan horse (no CVSS, Microsoft The installer of Visual C++ Redistributable)
- [CVE-2018-0600](https://cve.now/CVE-2018-0600.md): Untrusted search path vulnerability in the installer of PlayMemories Home for Windows ver.5.5.01 and earlier allows an attacker to gain priv (no CVSS, Sony the installer of PlayMemories Home for Windows)
- [CVE-2018-0601](https://cve.now/CVE-2018-0601.md): Untrusted search path vulnerability in axpdfium v0.01 allows an attacker to gain privileges via a Trojan horse DLL in an unspecified directo (no CVSS, Yasutaka ATARASHI axpdfium)
- [CVE-2018-0602](https://cve.now/CVE-2018-0602.md): Cross-site scripting vulnerability in Email Subscribers & Newsletters versions prior to 3.5.0 allows remote attackers to inject arbitrary we (no CVSS, icegram Email Subscribers & Newsletters)
- [CVE-2018-0603](https://cve.now/CVE-2018-0603.md): Cross-site scripting vulnerability in Site Reviews versions prior to 2.15.3 allows remote attackers to inject arbitrary web script or HTML v (no CVSS, Gemini Labs Site Reviews)
- [CVE-2018-0604](https://cve.now/CVE-2018-0604.md): Pixelpost v1.7.3 and earlier allows remote code execution via unspecified vectors. (no CVSS, Pixelpost.org Pixelpost)
- [CVE-2018-0605](https://cve.now/CVE-2018-0605.md): Cross-site scripting vulnerability in Pixelpost v1.7.3 and earlier allows remote attackers to inject arbitrary web script or HTML via unspec (no CVSS, Pixelpost.org Pixelpost)
- [CVE-2018-0606](https://cve.now/CVE-2018-0606.md): SQL injection vulnerability in the Pixelpost v1.7.3 and earlier allows remote authenticated attackers to execute arbitrary SQL commands via (no CVSS, Pixelpost.org Pixelpost)
- [CVE-2018-0608](https://cve.now/CVE-2018-0608.md): Buffer overflow in H2O version 2.2.4 and earlier allows remote attackers to execute arbitrary code or cause a denial of service (DoS) via un (no CVSS, Kazuho Oku H2O)
- [CVE-2018-0609](https://cve.now/CVE-2018-0609.md): Untrusted search path vulnerability in LINE for Windows versions before 5.8.0 allows an attacker to gain privileges via a Trojan horse DLL i (no CVSS)
- [CVE-2018-0610](https://cve.now/CVE-2018-0610.md): Local file inclusion vulnerability in Zenphoto 1.4.14 and earlier allows a remote attacker with an administrative privilege to execute arbit (no CVSS, Zenphoto)
- [CVE-2018-0611](https://cve.now/CVE-2018-0611.md): The ANA App for iOS version 4.0.22 and earlier does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers (no CVSS, ALL NIPPON AIRWAYS CO. ANA App for iOS)
- [CVE-2018-0612](https://cve.now/CVE-2018-0612.md): Cross-site scripting vulnerability in 5000 trillion yen converter v1.0.6 allows remote attackers to inject arbitrary web script or HTML via (no CVSS, Owen 5000 trillion yen converter)
- [CVE-2018-1000204](https://cve.now/CVE-2018-1000204.md): Linux Kernel version 3.18 to 4.16 incorrectly handles an SG\_IO ioctl on /dev/sg0 with dxfer\_direction=SG\_DXFER\_FROM\_DEV and an empty 6-byte (no CVSS)
- [CVE-2018-10852](https://cve.now/CVE-2018-10852.md): The UNIX pipe which sudo uses to contact SSSD and read the available sudo rules from SSSD has too wide permissions, which means that anyone (CVSS 3.8, \[UNKNOWN\] sssd)
- [CVE-2018-12889](https://cve.now/CVE-2018-12889.md): An issue was discovered in CCN-lite 2.0.1. (no CVSS)
- [CVE-2018-12884](https://cve.now/CVE-2018-12884.md): In Octopus Deploy 3.0 onwards (before 2018.6.7), an authenticated user with incorrect permissions may be able to create Accounts under the I (no CVSS)
- [CVE-2018-12882](https://cve.now/CVE-2018-12882.md): exif\_read\_from\_impl in ext/exif/exif.c in PHP 7.2.x through 7.2.7 allows attackers to trigger a use-after-free (in exif\_read\_from\_file) beca (no CVSS)
- [CVE-2018-0598](https://cve.now/CVE-2018-0598.md): Untrusted search path vulnerability in Self-extracting archive files created by IExpress bundled with Microsoft Windows allows an attacker t (no CVSS, Self-extracting archive files created by IExpress bundled w…)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2018-06-26
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.