# CVEs published 2018-06-28

20 CVEs were published on June 28, 2018: 0 critical, 0 high. Days are UTC.

- [CVE-2018-8016](https://cve.now/CVE-2018-8016.md): The default configuration in Apache Cassandra 3.8 through 3.11.1 binds an unauthenticated JMX/RMI interface to all network interfaces, which (no CVSS, Apache Software Foundation Apache Cassandra · org.apache.ca…)
- [CVE-2018-1351](https://cve.now/CVE-2018-1351.md): A Cross-site Scripting (XSS) vulnerability in Fortinet FortiManager 6.0.0, 5.6.6 and below versions allows attacker to execute HTML/javascri (no CVSS, Fortinet FortiManager)
- [CVE-2017-16859](https://cve.now/CVE-2017-16859.md): The review attachment resource in Atlassian Fisheye and Crucible before version 4.3.2, from version 4.4.0 before 4.4.3 and before version 4. (no CVSS, Atlassian Fisheye and Crucible)
- [CVE-2018-11510](https://cve.now/CVE-2018-11510.md): The ASUSTOR ADM 3.1.0.RFQ3 NAS portal suffers from an unauthenticated remote code execution vulnerability in the portal/apis/aggrecate\_js.cg (no CVSS)
- [CVE-2018-12589](https://cve.now/CVE-2018-12589.md): Polaris Office 2017 8.1 allows attackers to execute arbitrary code via a Trojan horse puiframeworkproresenu.dll file in the current working (no CVSS)
- [CVE-2018-12928](https://cve.now/CVE-2018-12928.md): In the Linux kernel 4.15.0, a NULL pointer dereference was discovered in hfs\_ext\_read\_extent in hfs.ko. (no CVSS)
- [CVE-2018-12929](https://cve.now/CVE-2018-12929.md): ntfs\_read\_locked\_inode in the ntfs.ko filesystem driver in the Linux kernel 4.15.0 allows attackers to trigger a use-after-free read and pos (no CVSS)
- [CVE-2018-12930](https://cve.now/CVE-2018-12930.md): ntfs\_end\_buffer\_async\_read in the ntfs.ko filesystem driver in the Linux kernel 4.15.0 allows attackers to trigger a stack-based out-of-boun (no CVSS)
- [CVE-2018-12931](https://cve.now/CVE-2018-12931.md): ntfs\_attr\_find in the ntfs.ko filesystem driver in the Linux kernel 4.15.0 allows attackers to trigger a stack-based out-of-bounds write and (no CVSS)
- [CVE-2018-12932](https://cve.now/CVE-2018-12932.md): PlayEnhMetaFileRecord in enhmetafile.c in Wine 3.7 allows attackers to cause a denial of service (heap-based buffer overflow) or possibly ha (no CVSS)
- [CVE-2018-12933](https://cve.now/CVE-2018-12933.md): PlayEnhMetaFileRecord in enhmetafile.c in Wine 3.7 allows attackers to cause a denial of service (out-of-bounds write) or possibly have unsp (no CVSS)
- [CVE-2018-12934](https://cve.now/CVE-2018-12934.md): remember\_Ktype in cplus-dem.c in GNU libiberty, as distributed in GNU Binutils 2.30, allows attackers to trigger excessive memory consumptio (no CVSS)
- [CVE-2018-12920](https://cve.now/CVE-2018-12920.md): Brickstream 2300 devices allow remote attackers to obtain potentially sensitive information via a direct request for the basic.html#ipsettin (no CVSS)
- [CVE-2018-12921](https://cve.now/CVE-2018-12921.md): Electro Industries GaugeTech Nexus devices allow remote attackers to obtain potentially sensitive information via a direct request for the m (no CVSS)
- [CVE-2018-12922](https://cve.now/CVE-2018-12922.md): Emerson Liebert IntelliSlot Web Card devices allow remote attackers to reconfigure access control via the config/configUser.htm or config/co (no CVSS)
- [CVE-2018-12923](https://cve.now/CVE-2018-12923.md): BWS Systems HA-Bridge devices allow remote attackers to obtain potentially sensitive information via a direct request for the #!/system URI. (no CVSS)
- [CVE-2018-12924](https://cve.now/CVE-2018-12924.md): Sollae Serial-Ethernet-Module and Remote-I/O-Device-Server devices have a default password of sollae for the TELNET service. (no CVSS)
- [CVE-2018-12925](https://cve.now/CVE-2018-12925.md): Baseon Lantronix MSS devices do not require a password for TELNET access. (no CVSS)
- [CVE-2018-12926](https://cve.now/CVE-2018-12926.md): Pharos Controls devices allow remote attackers to obtain potentially sensitive information via a direct request for the default/index.lsp or (no CVSS)
- [CVE-2018-12927](https://cve.now/CVE-2018-12927.md): Northern Electric & Power (NEP) inverter devices allow remote attackers to obtain potentially sensitive information via a direct request for (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2018-06-28
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.