# CVEs published 2018-06-27

31 CVEs were published on June 27, 2018: 2 critical, 1 high. Days are UTC.

- [CVE-2018-1354](https://cve.now/CVE-2018-1354.md): An improper access control vulnerability in Fortinet FortiManager 6.0.0, 5.6.5 and below versions, FortiAnalyzer 6.0.0, 5.6.5 and below vers (no CVSS, Fortinet FortiManager, FortiAnalyzer)
- [CVE-2018-1355](https://cve.now/CVE-2018-1355.md): An open redirect vulnerability in Fortinet FortiManager 6.0.0, 5.6.5 and below versions, FortiAnalyzer 6.0.0, 5.6.5 and below versions allow (no CVSS, Fortinet FortiManager, FortiAnalyzer)
- [CVE-2018-5527](https://cve.now/CVE-2018-5527.md): On BIG-IP 13.1.0-13.1.0.7, a remote attacker using undisclosed methods against virtual servers configured with a Client SSL or Server SSL pr (no CVSS, F5 Networks BIG-IP)
- [CVE-2018-5528](https://cve.now/CVE-2018-5528.md): Under certain conditions, TMM may restart and produce a core file while processing APM data on BIG-IP 13.0.1 or 13.1.0.4-13.1.0.7. (no CVSS, F5 Networks BIG-IP)
- [CVE-2017-16718](https://cve.now/CVE-2017-16718.md): Beckhoff TwinCAT 3 supports communication over ADS. (no CVSS, ICS-CERT Beckhoff TwinCAT)
- [CVE-2017-16726](https://cve.now/CVE-2017-16726.md): Beckhoff TwinCAT supports communication over ADS. (no CVSS, ICS-CERT Beckhoff TwinCAT)
- [CVE-2018-12912](https://cve.now/CVE-2018-12912.md): An issue wan discovered in admin\\controllers\\database.php in HongCMS 3.0.0. (no CVSS)
- [CVE-2018-12913](https://cve.now/CVE-2018-12913.md): In Miniz 2.0.7, tinfl\_decompress in miniz\_tinfl.c has an infinite loop because sym2 and counter can both remain equal to zero. (no CVSS)
- [CVE-2018-12914](https://cve.now/CVE-2018-12914.md): A remote code execution issue was discovered in PublicCMS V4.0.20180210. (no CVSS)
- [CVE-2018-12915](https://cve.now/CVE-2018-12915.md): In libpbc.a in PBC through 2017-03-02, there is a buffer over-read in calc\_hash in map.c. (no CVSS)
- [CVE-2018-12916](https://cve.now/CVE-2018-12916.md): In libpbc.a in PBC through 2017-03-02, there is a Segmentation fault in \_pbcP\_message\_default in proto.c. (no CVSS)
- [CVE-2018-12917](https://cve.now/CVE-2018-12917.md): In libpbc.a in PBC through 2017-03-02, there is a heap-based buffer over-read in \_pbcM\_ip\_new in map.c. (no CVSS)
- [CVE-2018-12918](https://cve.now/CVE-2018-12918.md): In libpbc.a in PBC through 2017-03-02, there is a Segmentation fault in \_pbcB\_register\_fields in bootstrap.c. (no CVSS)
- [CVE-2018-12919](https://cve.now/CVE-2018-12919.md): In CraftedWeb through 2013-09-24, aasp\_includes/pages/notice.php allows XSS via the e parameter. (no CVSS)
- [CVE-2018-1306](https://cve.now/CVE-2018-1306.md): The PortletV3AnnotatedDemo Multipart Portlet war file code provided in Apache Pluto version 3.0.0 could allow a remote attacker to obtain se (no CVSS, Apache Software Foundation Apache Pluto · org.apache.portal…)
- [CVE-2018-1457](https://cve.now/CVE-2018-1457.md): An undisclosed vulnerability in IBM Rational DOORS 9.5.1 through 9.6.1.10 application allows an attacker to gain DOORS administrator privile (CVSS 8.1, IBM Rational DOORS)
- [CVE-2018-1507](https://cve.now/CVE-2018-1507.md): IBM DOORS Next Generation (DNG/RRC) 6.0.5 is vulnerable to cross-site scripting. (CVSS 5.4, IBM Rational DOORS Next Generation)
- [CVE-2018-1543](https://cve.now/CVE-2018-1543.md): IBM WebSphere MQ 8.0 and 9.0 could allow a remote attacker to obtain sensitive information, caused by the failure to properly validate the S (CVSS 5.9, IBM MQ)
- [CVE-2018-1553](https://cve.now/CVE-2018-1553.md): IBM WebSphere Application Server Liberty prior to 18.0.0.2 could allow a remote attacker to obtain sensitive information, caused by mishandl (CVSS 5.3, IBM WebSphere Application Server Liberty)
- [CVE-2018-12536](https://cve.now/CVE-2018-12536.md): In Eclipse Jetty Server, all 9.x versions, on webapps deployed using default Error Handling, when an intentionally bad query arrives that do (no CVSS, The Eclipse Foundation Eclipse Jetty · org.eclipse.jetty:je…)
- [CVE-2017-7465](https://cve.now/CVE-2017-7465.md): It was found that the JAXP implementation used in JBoss EAP 7.0 for XSLT processing is vulnerable to code injection. (CVSS 9.0, \[UNKNOWN\] jboss)
- [CVE-2018-12908](https://cve.now/CVE-2018-12908.md): Brynamics "Online Trade - Online trading and cryptocurrency investment system" allows remote attackers to obtain sensitive information via a (no CVSS)
- [CVE-2018-12909](https://cve.now/CVE-2018-12909.md): Webgrind 1.5 relies on user input to display a file, which lets anyone view files from the local filesystem (that the webserver user has acc (no CVSS)
- [CVE-2018-5435](https://cve.now/CVE-2018-5435.md): TIBCO Spotfire Product Family Remote Code Execution Vulnerability (CVSS 9.6, TIBCO Software TIBCO Spotfire Analyst · TIBCO Software T… +2)
- [CVE-2018-5436](https://cve.now/CVE-2018-5436.md): TIBCO Spotfire Server information disclosure vulnerabilities (CVSS 6.5, TIBCO Software TIBCO Spotfire Analytics Platform for AWS Ma…)
- [CVE-2018-5437](https://cve.now/CVE-2018-5437.md): TIBCO Spotfire Product Family Information Disclosure Vulnerability (CVSS 6.8, TIBCO Software TIBCO Spotfire Analyst · TIBCO Software T… +2)
- [CVE-2018-8025](https://cve.now/CVE-2018-8025.md): CVE-2018-8025 describes an issue in Apache HBase that affects the optional "Thrift 1" API server when running over HTTP. (no CVSS, Apache Software Foundation Apache HBase · org.apache.hbase:…)
- [CVE-2018-12905](https://cve.now/CVE-2018-12905.md): joyplus-cms 1.6.0 has XSS in admin\_player.php, related to manager/index.php "system manage" and "add" actions. (no CVSS)
- [CVE-2018-12907](https://cve.now/CVE-2018-12907.md): In Rclone 1.42, use of "rclone sync" to migrate data between two Google Cloud Storage buckets might allow attackers to trigger the transmiss (no CVSS)
- [CVE-2017-18342](https://cve.now/CVE-2017-18342.md): In PyYAML before 5.1, the yaml.load() API could execute arbitrary code if used with untrusted data. (no CVSS, pyyaml)
- [CVE-2018-12904](https://cve.now/CVE-2018-12904.md): In arch/x86/kvm/vmx.c in the Linux kernel before 4.17.2, when nested virtualization is used, local attackers could cause L1 KVM guests to VM (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2018-06-27
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.