CVEs published June 29, 2018
37 CVEs were published on June 29, 2018: 2 critical, 0 high.
- Published
- 37
- Critical
- 2
- High
- 0
- Medium
- 1
- Low
- 0
- Unrated
- 34
- Now in CISA KEV
- 0
- Fix available
- 2
Most affected products
- net.opentsdb:opentsdb
- 3
- Micro Focus Secure Messaging Gateway
- 2
- [UNKNOWN] perl-archive-zip
- 1
Critical 2
Medium, low and unrated 35
- CVE-2018-10860perl-archive-zip is vulnerable to a directory traversal in Archive::Zip.[UNKNOWN] perl-archive-zip
- CVE-2018-13021An issue was discovered in HongCMS 3.0.0.
- CVE-2018-13024Metinfo v6.0.0 allows remote attackers to write code into a .php file, and execute that code, via the module parameter to admin/column/save.
- CVE-2018-13025protected/apps/admin/controller/photoController.php in YXcms 1.4.7 allows remote attackers to delete arbitrary files via the index.php?r=adm
- CVE-2018-13011An issue was discovered in gpmf-parser 1.1.2.
- CVE-2018-13012Download of code with improper integrity check in snsupd.exe and upd.exe in SAFE'N'SEC SoftControl/SafenSoft SysWatch, SoftControl/SafenSoft
- CVE-2018-13013Improper check of unusual conditions when launching msiexec.exe in safensec.com (SysWatch service) in SAFE'N'SEC SoftControl/SafenSoft SysWa
- CVE-2018-13014Storing password in recoverable format in safensec.com (SysWatch service) in SAFE'N'SEC SoftControl/SafenSoft SysWatch, SoftControl/SafenSof
- CVE-2018-8901An issue was discovered in Ivanti Avalanche for all versions between 5.3 and 6.2.
- CVE-2018-8902An issue was discovered in Ivanti Avalanche for all versions between 5.3 and 6.2.
- CVE-2018-13000An XSS issue was discovered in Advanced Electron Forum (AEF) v1.0.9.
- CVE-2018-13001An XSS issue was discovered in Sandoba CP:Shop v2016.1.
- CVE-2018-13002An XSS issue was discovered in Inhaltsprojekte in Weblication CMS Core & Grid v12.6.24.
- CVE-2018-13003An issue was discovered in OpenTSDB 2.3.0.net.opentsdb:opentsdb
- CVE-2018-13005An issue was discovered in MP4Box in GPAC 0.7.1.
- CVE-2018-13006An issue was discovered in MP4Box in GPAC 0.7.1.
- CVE-2018-13007An issue was discovered in gpmf-parser 1.1.2.
- CVE-2018-13008An issue was discovered in gpmf-parser 1.1.2.
- CVE-2018-13009An issue was discovered in gpmf-parser 1.1.2.
- CVE-2018-13010WSTMall v1.9.1_170316 has CSRF via the index.php?m=Admin&c=Users&a=edit URI to add a user account.
- CVE-2018-12992An issue was discovered CMS MaeloStore V.1.5.0.
- CVE-2018-12993onefilecms.php in OneFileCMS through 2012-04-14 might allow attackers to conduct brute-force attacks via the onefilecms_username and onefile
- CVE-2018-12994onefilecms.php in OneFileCMS through 2012-04-14 might allow attackers to execute arbitrary PHP code via a .php filename on the New File scre
- CVE-2018-12995onefilecms.php in OneFileCMS through 2012-04-14 might allow attackers to execute arbitrary PHP code via a .php filename on the Upload screen
- CVE-2018-12996A reflected Cross-site scripting (XSS) vulnerability in Zoho ManageEngine Applications Manager before 13 (Build 13800) allows remote attacke
- CVE-2018-12997Incorrect Access Control in FailOverHelperServlet in Zoho ManageEngine Netflow Analyzer before build 123137, Network Configuration Manager b
- CVE-2018-12998A reflected Cross-site scripting (XSS) vulnerability in Zoho ManageEngine Netflow Analyzer before build 123137, Network Configuration Manage
- CVE-2018-12999Incorrect Access Control in AgentTrayIconServlet in Zoho ManageEngine Desktop Central 10.0.255 allows attackers to delete certain files on t
- CVE-2018-12971EasyCMS 1.3 has CSRF via the index.php?s=/admin/user/delAll URI to delete users.
- CVE-2018-12972An issue was discovered in OpenTSDB 2.3.0.net.opentsdb:opentsdb
- CVE-2018-12973An issue was discovered in OpenTSDB 2.3.0.net.opentsdb:opentsdb
- CVE-2018-12982Invalid memory read in the PoDoFo::PdfVariant::DelayedLoad() function in PdfVariant.h in PoDoFo 0.9.6-rc1 allows remote attackers to have de
- CVE-2018-12983A stack-based buffer over-read in the PdfEncryptMD5Base::ComputeEncryptionKey() function in PdfEncrypt.cpp in PoDoFo 0.9.6-rc1 could be leve
- CVE-2018-12984Hycus CMS 1.0.4 allows Authentication Bypass via "'=' 'OR'" credentials.
- CVE-2018-12988GreenCMS 2.3.0603 has an arbitrary file download vulnerability via an index.php?m=admin&c=media&a=downfile URI.