# CVEs published 2018-07-02

66 CVEs were published on July 2, 2018: 0 critical, 8 high. 1 is now in CISA KEV. Days are UTC.

- [CVE-2018-13068](https://cve.now/CVE-2018-13068.md): The mintToken function of a smart contract implementation for AzurionToken (AZU), an Ethereum token, has an integer overflow that allows the (no CVSS)
- [CVE-2018-13069](https://cve.now/CVE-2018-13069.md): The mintToken function of a smart contract implementation for DYchain (DYC), an Ethereum token, has an integer overflow that allows the owne (no CVSS)
- [CVE-2018-13070](https://cve.now/CVE-2018-13070.md): The mintToken function of a smart contract implementation for EncryptedToken (ECC), an Ethereum token, has an integer overflow that allows t (no CVSS)
- [CVE-2018-13071](https://cve.now/CVE-2018-13071.md): The mintToken function of a smart contract implementation for CCindex10 (T10), an Ethereum token, has an integer overflow that allows the ow (no CVSS)
- [CVE-2018-13072](https://cve.now/CVE-2018-13072.md): The mintToken function of a smart contract implementation for Coffeecoin (COFFEE), an Ethereum token, has an integer overflow that allows th (no CVSS)
- [CVE-2018-13073](https://cve.now/CVE-2018-13073.md): The mintToken function of a smart contract implementation for ETHEREUMBLACK (ETCBK), an Ethereum token, has an integer overflow that allows (no CVSS)
- [CVE-2018-13074](https://cve.now/CVE-2018-13074.md): The mintToken function of a smart contract implementation for FIBToken (FIB), an Ethereum token, has an integer overflow that allows the own (no CVSS)
- [CVE-2018-13075](https://cve.now/CVE-2018-13075.md): The mintToken function of a smart contract implementation for Carbon Exchange Coin Token (CEC), an Ethereum token, has an integer overflow t (no CVSS)
- [CVE-2018-13076](https://cve.now/CVE-2018-13076.md): The mintToken function of a smart contract implementation for Betcash (BC), an Ethereum token, has an integer overflow that allows the owner (no CVSS)
- [CVE-2018-13077](https://cve.now/CVE-2018-13077.md): The mintToken function of a smart contract implementation for CTB, an Ethereum token, has an integer overflow that allows the owner of the c (no CVSS)
- [CVE-2018-13078](https://cve.now/CVE-2018-13078.md): The mintToken function of a smart contract implementation for Jitech (JTH), an Ethereum token, has an integer overflow that allows the owner (no CVSS)
- [CVE-2018-13079](https://cve.now/CVE-2018-13079.md): The mintToken function of a smart contract implementation for GoodTo (GTO), an Ethereum token, has an integer overflow that allows the owner (no CVSS)
- [CVE-2018-13080](https://cve.now/CVE-2018-13080.md): The mintToken function of a smart contract implementation for Goutex (GTX), an Ethereum token, has an integer overflow that allows the owner (no CVSS)
- [CVE-2018-13081](https://cve.now/CVE-2018-13081.md): The mintToken function of a smart contract implementation for GZS Token (GZS), an Ethereum token, has an integer overflow that allows the ow (no CVSS)
- [CVE-2018-13082](https://cve.now/CVE-2018-13082.md): The mintToken function of a smart contract implementation for MODI Token (MODI), an Ethereum token, has an integer overflow that allows the (no CVSS)
- [CVE-2018-13083](https://cve.now/CVE-2018-13083.md): The mintToken function of a smart contract implementation for Plaza Token (PLAZA), an Ethereum token, has an integer overflow that allows th (no CVSS)
- [CVE-2018-13084](https://cve.now/CVE-2018-13084.md): The mintToken function of a smart contract implementation for Good Time Coin (GTY), an Ethereum token, has an integer overflow that allows t (no CVSS)
- [CVE-2018-13085](https://cve.now/CVE-2018-13085.md): The mintToken function of a smart contract implementation for FreeCoin (FREE), an Ethereum token, has an integer overflow that allows the ow (no CVSS)
- [CVE-2018-13086](https://cve.now/CVE-2018-13086.md): The mintToken function of a smart contract implementation for IADOWR Coin (IAD), an Ethereum token, has an integer overflow that allows the (no CVSS)
- [CVE-2018-13087](https://cve.now/CVE-2018-13087.md): The mintToken function of a smart contract implementation for Coinstar (CSTR), an Ethereum token, has an integer overflow that allows the ow (no CVSS)
- [CVE-2018-13088](https://cve.now/CVE-2018-13088.md): The mintToken function of a smart contract implementation for Futures Pease (FP), an Ethereum token, has an integer overflow that allows the (no CVSS)
- [CVE-2018-13089](https://cve.now/CVE-2018-13089.md): The mintToken function of a smart contract implementation for Universal Coin (UCOIN), an Ethereum token, has an integer overflow that allows (no CVSS)
- [CVE-2018-13090](https://cve.now/CVE-2018-13090.md): The mintToken function of a smart contract implementation for YiTongCoin (YTC), an Ethereum token, has an integer overflow that allows the o (no CVSS)
- [CVE-2018-13091](https://cve.now/CVE-2018-13091.md): The mintToken function of a smart contract implementation for sumocoin (SUMO), an Ethereum token, has an integer overflow that allows the ow (no CVSS)
- [CVE-2018-13092](https://cve.now/CVE-2018-13092.md): The mintToken function of a smart contract implementation for Reimburse Token (REIM), an Ethereum token, has an integer overflow that allows (no CVSS)
- [CVE-2017-2615](https://cve.now/CVE-2017-2615.md): Quick emulator (QEMU) built with the Cirrus CLGD 54xx VGA emulator support is vulnerable to an out-of-bounds access issue. (CVSS 5.5, qemu display)
- [CVE-2018-10596](https://cve.now/CVE-2018-10596.md): Medtronic 2090 Carelink Programmer Improper Restriction of Communication Channel to Intended Endpoints (CVSS 7.1, Medtronic 2090 CareLink Programmer · Medtronic 29901 Encore…)
- [CVE-2018-1080](https://cve.now/CVE-2018-1080.md): Dogtag PKI, through version 10.6.1, has a vulnerability in AAclAuthz.java that, under certain configurations, causes the application of ACL (CVSS 7.5, \[UNKNOWN\] pki-core)
- [CVE-2018-10855](https://cve.now/CVE-2018-10855.md): Ansible 2.5 prior to 2.5.5, and 2.4 prior to 2.4.5, do not honor the no\_log task flag for failed tasks. (CVSS 5.9, \[UNKNOWN\] ansible · ansible)
- [CVE-2018-10856](https://cve.now/CVE-2018-10856.md): It has been discovered that podman before version 0.6.1 does not drop capabilities when executing a container as a non-root user. (CVSS 5.3, \[UNKNOWN\] podman · github.com/containers/podman +3)
- [CVE-2018-1113](https://cve.now/CVE-2018-1113.md): setup before version 2.11.4-1.fc28 in Fedora and Red Hat Enterprise Linux added /sbin/nologin and /usr/sbin/nologin to /etc/shells. (CVSS 4.8, \[UNKNOWN\] setup)
- [CVE-2018-8868](https://cve.now/CVE-2018-8868.md): Medtronic MyCareLink Patient Monitor Exposed Dangerous Method or Function (CVSS 6.2, Medtronic 24950 MyCareLink Monitor · Medtronic 24952 MyCare…)
- [CVE-2018-8870](https://cve.now/CVE-2018-8870.md): Medtronic MyCareLink Patient Monitor Use of Hard-coded Password (CVSS 6.4, Medtronic 24950 MyCareLink Monitor · Medtronic 24952 MyCare…)
- [CVE-2018-10843](https://cve.now/CVE-2018-10843.md): source-to-image component of Openshift Container Platform before versions atomic-openshift 3.7.53, atomic-openshift 3.9.31 is vulnerable to (CVSS 8.5, \[UNKNOWN\] source-to-image)
- [CVE-2018-1212](https://cve.now/CVE-2018-1212.md): Authenticated remote code execution in iDRAC 6 (CVSS 8.8, Dell EMC iDRAC6)
- [CVE-2018-12426](https://cve.now/CVE-2018-12426.md): The WP Live Chat Support Pro plugin before 8.0.07 for WordPress is vulnerable to unauthenticated Remote Code Execution due to client-side va (no CVSS)
- [CVE-2018-1243](https://cve.now/CVE-2018-1243.md): iDRAC6/iDRAC7/iDRAC8 - Weak CGI session ID vulnerability (CVSS 7.5, Dell EMC iDRAC6 · Dell EMC iDRAC7 +1)
- [CVE-2018-1244](https://cve.now/CVE-2018-1244.md): iDRAC7/iDRAC8/iDrac9 contains a command injection vulnerability in the SNMP agent. (CVSS 8.8, Dell EMC iDRAC7 · Dell EMC iDRAC8 +1)
- [CVE-2018-1249](https://cve.now/CVE-2018-1249.md): iDRAC9 versions prior to 3.21.21.21 did not enforce the use of TLS/SSL for a connection to iDRAC web server for certain URLs (CVSS 6.5, Dell EMC iDRAC9)
- [CVE-2018-12891](https://cve.now/CVE-2018-12891.md): An issue was discovered in Xen through 4.10.x. (no CVSS)
- [CVE-2018-12892](https://cve.now/CVE-2018-12892.md): An issue was discovered in Xen 4.7 through 4.10.x. (no CVSS)
- [CVE-2018-12893](https://cve.now/CVE-2018-12893.md): An issue was discovered in Xen through 4.10.x. (no CVSS)
- [CVE-2018-12896](https://cve.now/CVE-2018-12896.md): An issue was discovered in the Linux kernel through 4.17.3. (no CVSS)
- [CVE-2018-13066](https://cve.now/CVE-2018-13066.md): There is a memory leak in util/parser.c in libming 0.4.8, which will lead to a denial of service via parseSWF\_DEFINEBUTTON2, parseSWF\_DEFINE (no CVSS)
- [CVE-2018-13067](https://cve.now/CVE-2018-13067.md): /upload/catalog/controller/account/password.php in OpenCart through 3.0.2.0 has CSRF via the index.php?route=account/password URI to change (no CVSS, opencart/opencart)
- [CVE-2018-10075](https://cve.now/CVE-2018-10075.md): Cross-site scripting (XSS) vulnerability in Zoho ManageEngine EventLog Analyzer 11.12 allows remote attackers to inject arbitrary web script (no CVSS)
- [CVE-2018-10076](https://cve.now/CVE-2018-10076.md): An issue was discovered in Zoho ManageEngine EventLog Analyzer 11.12. (no CVSS)
- [CVE-2018-12499](https://cve.now/CVE-2018-12499.md): The Motorola MBP853 firmware does not correctly validate server certificates. (no CVSS)
- [CVE-2018-12528](https://cve.now/CVE-2018-12528.md): An issue was discovered on Intex N150 devices. (no CVSS)
- [CVE-2018-12529](https://cve.now/CVE-2018-12529.md): An issue was discovered on Intex N150 devices. (no CVSS)
- [CVE-2018-12574](https://cve.now/CVE-2018-12574.md): CSRF exists for all actions in the web interface on TP-Link TL-WR841N v13 00000001 0.9.1 4.16 v0001.0 Build 180119 Rel.65243n devices. (no CVSS)
- [CVE-2018-12575](https://cve.now/CVE-2018-12575.md): On TP-Link TL-WR841N v13 00000001 0.9.1 4.16 v0001.0 Build 171019 Rel.55346n devices, all actions in the web interface are affected by bypas (no CVSS)
- [CVE-2018-12576](https://cve.now/CVE-2018-12576.md): TP-Link TL-WR841N v13 00000001 0.9.1 4.16 v0001.0 Build 180119 Rel.65243n devices allow clickjacking. (no CVSS)
- [CVE-2018-12577](https://cve.now/CVE-2018-12577.md): The Ping and Traceroute features on TP-Link TL-WR841N v13 00000001 0.9.1 4.16 v0001.0 Build 180119 Rel.65243n devices allow authenticated bl (no CVSS)
- [CVE-2018-9276](https://cve.now/CVE-2018-9276.md): An issue was discovered in PRTG Network Monitor before 18.2.39. (CVSS 7.2, KEV)
- [CVE-2018-13056](https://cve.now/CVE-2018-13056.md): An issue was discovered on zzcms 8.3. (no CVSS)
- [CVE-2018-13054](https://cve.now/CVE-2018-13054.md): An issue was discovered in Cinnamon 1.9.2 through 3.8.6. (no CVSS)
- [CVE-2017-17175](https://cve.now/CVE-2017-17175.md): Short Message Service (SMS) module of Mate 9 Pro Huawei smart phones with the versions before LON-AL00B 8.0.0.354(C00) has a Denial of Servi (no CVSS, Huawei Technologies Co. Mate 9 Pro)
- [CVE-2017-17316](https://cve.now/CVE-2017-17316.md): Huawei DP300 V500R002C00; RP200 V500R002C00; V600R006C00; TE30 V100R001C10; V500R002C00; V600R006C00; TE40 V500R002C00; V600R006C00; TE50 V5 (no CVSS, Huawei Technologies Co. DP300; RP200; TE30; TE40; TE50; TE60)
- [CVE-2017-17317](https://cve.now/CVE-2017-17317.md): Common Open Policy Service Protocol (COPS) module in Huawei USG6300 V100R001C10; V100R001C20; V100R001C30; V500R001C00; V500R001C20; V500R00 (no CVSS, Huawei Technologies Co. DP300; IPS Module; NGFW Module; RP2…)
- [CVE-2018-10874](https://cve.now/CVE-2018-10874.md): In ansible it was found that inventory variables are loaded from current working directory when running ad-hoc command which are under attac (CVSS 7.8, \[UNKNOWN\] ansible · ansible)
- [CVE-2018-8039](https://cve.now/CVE-2018-8039.md): It is possible to configure Apache CXF to use the com.sun.net.ssl implementation via 'System.setProperty("java.protocol.handler.pkgs", "com. (no CVSS, Apache Software Foundation Apache CXF · org.apache.cxf:c… +1)
- [CVE-2018-0499](https://cve.now/CVE-2018-0499.md): A cross-site scripting vulnerability in queryparser/termgenerator\_internal.cc in Xapian xapian-core before 1.4.6 exists due to incomplete HT (no CVSS, Xapian xapian-core before · xapian-core)
- [CVE-2018-13053](https://cve.now/CVE-2018-13053.md): The alarm\_timer\_nsleep function in kernel/time/alarmtimer.c in the Linux kernel through 4.17.3 has an integer overflow via a large relative (no CVSS)
- [CVE-2018-13049](https://cve.now/CVE-2018-13049.md): The constructSQL function in inc/search.class.php in GLPI 9.2.x through 9.3.0 allows SQL Injection, as demonstrated by triggering a crafted (no CVSS)
- [CVE-2018-13050](https://cve.now/CVE-2018-13050.md): A SQL Injection vulnerability exists in Zoho ManageEngine Applications Manager 13.x before build 13800 via the j\_username parameter in a /j\_ (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2018-07-02
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.