# CVEs published 2018-06-29

37 CVEs were published on June 29, 2018: 2 critical, 0 high. Days are UTC.

- [CVE-2018-10860](https://cve.now/CVE-2018-10860.md): perl-archive-zip is vulnerable to a directory traversal in Archive::Zip. (CVSS 5.4, \[UNKNOWN\] perl-archive-zip)
- [CVE-2018-13021](https://cve.now/CVE-2018-13021.md): An issue was discovered in HongCMS 3.0.0. (no CVSS)
- [CVE-2018-13024](https://cve.now/CVE-2018-13024.md): Metinfo v6.0.0 allows remote attackers to write code into a .php file, and execute that code, via the module parameter to admin/column/save. (no CVSS)
- [CVE-2018-13025](https://cve.now/CVE-2018-13025.md): protected/apps/admin/controller/photoController.php in YXcms 1.4.7 allows remote attackers to delete arbitrary files via the index.php?r=adm (no CVSS)
- [CVE-2018-12464](https://cve.now/CVE-2018-12464.md): Unauthenticated SQL injection in Micro Focus Secure Messaging Gateway (CVSS 10.0, Micro Focus Secure Messaging Gateway)
- [CVE-2018-12465](https://cve.now/CVE-2018-12465.md): Remote Code Execution in Micro Focus Secure Messaging Gateway (CVSS 9.1, Micro Focus Secure Messaging Gateway)
- [CVE-2018-13011](https://cve.now/CVE-2018-13011.md): An issue was discovered in gpmf-parser 1.1.2. (no CVSS)
- [CVE-2018-13012](https://cve.now/CVE-2018-13012.md): Download of code with improper integrity check in snsupd.exe and upd.exe in SAFE'N'SEC SoftControl/SafenSoft SysWatch, SoftControl/SafenSoft (no CVSS)
- [CVE-2018-13013](https://cve.now/CVE-2018-13013.md): Improper check of unusual conditions when launching msiexec.exe in safensec.com (SysWatch service) in SAFE'N'SEC SoftControl/SafenSoft SysWa (no CVSS)
- [CVE-2018-13014](https://cve.now/CVE-2018-13014.md): Storing password in recoverable format in safensec.com (SysWatch service) in SAFE'N'SEC SoftControl/SafenSoft SysWatch, SoftControl/SafenSof (no CVSS)
- [CVE-2018-8901](https://cve.now/CVE-2018-8901.md): An issue was discovered in Ivanti Avalanche for all versions between 5.3 and 6.2. (no CVSS)
- [CVE-2018-8902](https://cve.now/CVE-2018-8902.md): An issue was discovered in Ivanti Avalanche for all versions between 5.3 and 6.2. (no CVSS)
- [CVE-2018-13000](https://cve.now/CVE-2018-13000.md): An XSS issue was discovered in Advanced Electron Forum (AEF) v1.0.9. (no CVSS)
- [CVE-2018-13001](https://cve.now/CVE-2018-13001.md): An XSS issue was discovered in Sandoba CP:Shop v2016.1. (no CVSS)
- [CVE-2018-13002](https://cve.now/CVE-2018-13002.md): An XSS issue was discovered in Inhaltsprojekte in Weblication CMS Core & Grid v12.6.24. (no CVSS)
- [CVE-2018-13003](https://cve.now/CVE-2018-13003.md): An issue was discovered in OpenTSDB 2.3.0. (no CVSS, net.opentsdb:opentsdb)
- [CVE-2018-13005](https://cve.now/CVE-2018-13005.md): An issue was discovered in MP4Box in GPAC 0.7.1. (no CVSS)
- [CVE-2018-13006](https://cve.now/CVE-2018-13006.md): An issue was discovered in MP4Box in GPAC 0.7.1. (no CVSS)
- [CVE-2018-13007](https://cve.now/CVE-2018-13007.md): An issue was discovered in gpmf-parser 1.1.2. (no CVSS)
- [CVE-2018-13008](https://cve.now/CVE-2018-13008.md): An issue was discovered in gpmf-parser 1.1.2. (no CVSS)
- [CVE-2018-13009](https://cve.now/CVE-2018-13009.md): An issue was discovered in gpmf-parser 1.1.2. (no CVSS)
- [CVE-2018-13010](https://cve.now/CVE-2018-13010.md): WSTMall v1.9.1\_170316 has CSRF via the index.php?m=Admin&c=Users&a=edit URI to add a user account. (no CVSS)
- [CVE-2018-12992](https://cve.now/CVE-2018-12992.md): An issue was discovered CMS MaeloStore V.1.5.0. (no CVSS)
- [CVE-2018-12993](https://cve.now/CVE-2018-12993.md): onefilecms.php in OneFileCMS through 2012-04-14 might allow attackers to conduct brute-force attacks via the onefilecms\_username and onefile (no CVSS)
- [CVE-2018-12994](https://cve.now/CVE-2018-12994.md): onefilecms.php in OneFileCMS through 2012-04-14 might allow attackers to execute arbitrary PHP code via a .php filename on the New File scre (no CVSS)
- [CVE-2018-12995](https://cve.now/CVE-2018-12995.md): onefilecms.php in OneFileCMS through 2012-04-14 might allow attackers to execute arbitrary PHP code via a .php filename on the Upload screen (no CVSS)
- [CVE-2018-12996](https://cve.now/CVE-2018-12996.md): A reflected Cross-site scripting (XSS) vulnerability in Zoho ManageEngine Applications Manager before 13 (Build 13800) allows remote attacke (no CVSS)
- [CVE-2018-12997](https://cve.now/CVE-2018-12997.md): Incorrect Access Control in FailOverHelperServlet in Zoho ManageEngine Netflow Analyzer before build 123137, Network Configuration Manager b (no CVSS)
- [CVE-2018-12998](https://cve.now/CVE-2018-12998.md): A reflected Cross-site scripting (XSS) vulnerability in Zoho ManageEngine Netflow Analyzer before build 123137, Network Configuration Manage (no CVSS)
- [CVE-2018-12999](https://cve.now/CVE-2018-12999.md): Incorrect Access Control in AgentTrayIconServlet in Zoho ManageEngine Desktop Central 10.0.255 allows attackers to delete certain files on t (no CVSS)
- [CVE-2018-12971](https://cve.now/CVE-2018-12971.md): EasyCMS 1.3 has CSRF via the index.php?s=/admin/user/delAll URI to delete users. (no CVSS)
- [CVE-2018-12972](https://cve.now/CVE-2018-12972.md): An issue was discovered in OpenTSDB 2.3.0. (no CVSS, net.opentsdb:opentsdb)
- [CVE-2018-12973](https://cve.now/CVE-2018-12973.md): An issue was discovered in OpenTSDB 2.3.0. (no CVSS, net.opentsdb:opentsdb)
- [CVE-2018-12982](https://cve.now/CVE-2018-12982.md): Invalid memory read in the PoDoFo::PdfVariant::DelayedLoad() function in PdfVariant.h in PoDoFo 0.9.6-rc1 allows remote attackers to have de (no CVSS)
- [CVE-2018-12983](https://cve.now/CVE-2018-12983.md): A stack-based buffer over-read in the PdfEncryptMD5Base::ComputeEncryptionKey() function in PdfEncrypt.cpp in PoDoFo 0.9.6-rc1 could be leve (no CVSS)
- [CVE-2018-12984](https://cve.now/CVE-2018-12984.md): Hycus CMS 1.0.4 allows Authentication Bypass via "'=' 'OR'" credentials. (no CVSS)
- [CVE-2018-12988](https://cve.now/CVE-2018-12988.md): GreenCMS 2.3.0603 has an arbitrary file download vulnerability via an index.php?m=admin&c=media&a=downfile URI. (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2018-06-29
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.