CVEs published June 27, 2018
31 CVEs were published on June 27, 2018: 2 critical, 1 high.
- Published
- 31
- Critical
- 2
- High
- 1
- Medium
- 5
- Low
- 0
- Unrated
- 23
- Now in CISA KEV
- 0
- Fix available
- 4
Most affected products
- F5 Networks BIG-IP
- 2
- Fortinet FortiManager, FortiAnalyzer
- 2
- ICS-CERT Beckhoff TwinCAT
- 2
- TIBCO Software TIBCO Spotfire Analyst · TIBCO Software T… +2
- 2
- [UNKNOWN] jboss
- 1
- Apache Software Foundation Apache HBase · org.apache.hbase:…
- 1
- Apache Software Foundation Apache Pluto · org.apache.portal…
- 1
- IBM MQ
- 1
- IBM Rational DOORS
- 1
- IBM Rational DOORS Next Generation
- 1
Critical 2
High 1
Medium, low and unrated 28
- CVE-2018-1354An improper access control vulnerability in Fortinet FortiManager 6.0.0, 5.6.5 and below versions, FortiAnalyzer 6.0.0, 5.6.5 and below versFortinet FortiManager, FortiAnalyzer
- CVE-2018-1355An open redirect vulnerability in Fortinet FortiManager 6.0.0, 5.6.5 and below versions, FortiAnalyzer 6.0.0, 5.6.5 and below versions allowFortinet FortiManager, FortiAnalyzer
- CVE-2018-5527On BIG-IP 13.1.0-13.1.0.7, a remote attacker using undisclosed methods against virtual servers configured with a Client SSL or Server SSL prF5 Networks BIG-IP
- CVE-2018-5528Under certain conditions, TMM may restart and produce a core file while processing APM data on BIG-IP 13.0.1 or 13.1.0.4-13.1.0.7.F5 Networks BIG-IP
- CVE-2017-16718Beckhoff TwinCAT 3 supports communication over ADS.ICS-CERT Beckhoff TwinCAT
- CVE-2017-16726Beckhoff TwinCAT supports communication over ADS.ICS-CERT Beckhoff TwinCAT
- CVE-2018-12912An issue wan discovered in admin\controllers\database.php in HongCMS 3.0.0.
- CVE-2018-12913In Miniz 2.0.7, tinfl_decompress in miniz_tinfl.c has an infinite loop because sym2 and counter can both remain equal to zero.
- CVE-2018-12914A remote code execution issue was discovered in PublicCMS V4.0.20180210.
- CVE-2018-12915In libpbc.a in PBC through 2017-03-02, there is a buffer over-read in calc_hash in map.c.
- CVE-2018-12916In libpbc.a in PBC through 2017-03-02, there is a Segmentation fault in _pbcP_message_default in proto.c.
- CVE-2018-12917In libpbc.a in PBC through 2017-03-02, there is a heap-based buffer over-read in _pbcM_ip_new in map.c.
- CVE-2018-12918In libpbc.a in PBC through 2017-03-02, there is a Segmentation fault in _pbcB_register_fields in bootstrap.c.
- CVE-2018-12919In CraftedWeb through 2013-09-24, aasp_includes/pages/notice.php allows XSS via the e parameter.
- CVE-2018-1306The PortletV3AnnotatedDemo Multipart Portlet war file code provided in Apache Pluto version 3.0.0 could allow a remote attacker to obtain seApache Software Foundation Apache Pluto · org.apache.portal…
- CVE-2018-1507IBM DOORS Next Generation (DNG/RRC) 6.0.5 is vulnerable to cross-site scripting.IBM Rational DOORS Next Generation
- CVE-2018-1543IBM WebSphere MQ 8.0 and 9.0 could allow a remote attacker to obtain sensitive information, caused by the failure to properly validate the SIBM MQ
- CVE-2018-1553IBM WebSphere Application Server Liberty prior to 18.0.0.2 could allow a remote attacker to obtain sensitive information, caused by mishandlIBM WebSphere Application Server Liberty
- CVE-2018-12536In Eclipse Jetty Server, all 9.x versions, on webapps deployed using default Error Handling, when an intentionally bad query arrives that doThe Eclipse Foundation Eclipse Jetty · org.eclipse.jetty:je…
- CVE-2018-12908Brynamics "Online Trade - Online trading and cryptocurrency investment system" allows remote attackers to obtain sensitive information via a
- CVE-2018-12909Webgrind 1.5 relies on user input to display a file, which lets anyone view files from the local filesystem (that the webserver user has acc
- CVE-2018-5436TIBCO Spotfire Server information disclosure vulnerabilitiesTIBCO Software TIBCO Spotfire Analytics Platform for AWS Ma…
- CVE-2018-5437TIBCO Spotfire Product Family Information Disclosure VulnerabilityTIBCO Software TIBCO Spotfire Analyst · TIBCO Software T… +2
- CVE-2018-8025CVE-2018-8025 describes an issue in Apache HBase that affects the optional "Thrift 1" API server when running over HTTP.Apache Software Foundation Apache HBase · org.apache.hbase:…
- CVE-2018-12905joyplus-cms 1.6.0 has XSS in admin_player.php, related to manager/index.php "system manage" and "add" actions.
- CVE-2018-12907In Rclone 1.42, use of "rclone sync" to migrate data between two Google Cloud Storage buckets might allow attackers to trigger the transmiss
- CVE-2017-18342In PyYAML before 5.1, the yaml.load() API could execute arbitrary code if used with untrusted data.pyyaml
- CVE-2018-12904In arch/x86/kvm/vmx.c in the Linux kernel before 4.17.2, when nested virtualization is used, local attackers could cause L1 KVM guests to VM