CVEs published July 3, 2018
113 CVEs were published on July 3, 2018: 1 critical, 2 high.
- Published
- 113
- Critical
- 1
- High
- 2
- Medium
- 28
- Low
- 0
- Unrated
- 82
- Now in CISA KEV
- 0
- Fix available
- 8
Most affected products
- IBM Rational Quality Manager · IBM Rational Collaborative L…
- 16
- Schneider Electric SE U.Motion
- 14
- IBM Rational Collaborative Lifecycle Management · IBM Ratio…
- 12
- Siemens AG SICLOCK TC100, SICLOCK TC400
- 6
- Schneider Electric SE U.motion Builder
- 4
- Schneider Electric SE Pelco Sarix Professional
- 3
- Apache Software Foundation Apache PDFBox · org.apache.pdfbo…
- 1
- Certificate Manager Path Traversal Vulnerability
- 1
- deap
- 1
- deep-extend
- 1
Critical 1
High 2
Medium, low and unrated 110
- CVE-2018-13121RealOne Player 2.0 Build 6.0.11.872 allows remote attackers to cause a denial of service (array out-of-bounds access and application crash)
- CVE-2018-13122onefilecms.php in OneFileCMS through 2017-10-08 might allow attackers to delete arbitrary files via the Delete File(s) screen, as demonstrat
- CVE-2018-13123onefilecms.php in OneFileCMS through 2017-10-08 might allow attackers to read arbitrary files via the i and f parameters, as demonstrated by
- CVE-2017-0912Ubiquiti UCRM versions 2.5.0 to 2.7.7 are vulnerable to Stored Cross-site Scripting.
- CVE-2017-0913Ubiquiti UCRM versions 2.3.0 to 2.7.7 allow an authenticated user to read arbitrary files in the local file system.
- CVE-2017-0919GitLab Community and Enterprise Editions before 10.1.6, 10.2.6, and 10.3.4 are vulnerable to an authorization bypass issue in the GitLab imp
- CVE-2017-0921GitLab Community and Enterprise Editions before 10.1.6, 10.2.6, and 10.3.4 are vulnerable to an unverified password change issue in the Pass
- CVE-2017-0929DNN (aka DotNetNuke) before 9.2.0 suffers from a Server-Side Request Forgery (SSRF) vulnerability in the DnnImageHandler class.DotNetNuke.Core
- CVE-2018-3747The public node module versions <= 1.0.3 allows to embed HTML in file names, which (in certain conditions) might lead to execute malicious Jpublic
- CVE-2018-3748There is a Stored XSS vulnerability in the glance node module versions <= 3.0.5.glance
- CVE-2018-3749The utilities function in all versions < 1.0.1 of the deap node module can be tricked into modifying the prototype of Object when the attackdeap
- CVE-2018-3750The utilities function in all versions <= 0.5.0 of the deep-extend node module can be tricked into modifying the prototype of Object when thdeep-extend
- CVE-2018-3751The utilities function in all versions <= 0.3.0 of the merge-recursive node module can be tricked into modifying the prototype of Object whemerge-recursive
- CVE-2018-3752The utilities function in all versions <= 1.0.0 of the merge-options node module can be tricked into modifying the prototype of Object when merge-options
- CVE-2018-3753The utilities function in all versions <= 1.0.0 of the merge-objects node module can be tricked into modifying the prototype of Object when merge-object
- CVE-2018-3754Node.js third-party module query-mysql versions 0.0.0, 0.0.1, and 0.0.2 are vulnerable to an SQL injection vulnerability due to lack of userquery-mysql
- CVE-2018-7636The URL filtering "continue page" hosted by PAN-OS 8.0.10 and earlier may allow an attacker to inject arbitrary JavaScript or HTML via speci
- CVE-2018-9242The PAN-OS management web interface page in PAN-OS 6.1.20 and earlier, PAN-OS 7.1.16 and earlier, PAN-OS 8.0.9 and earlier may allow an atta
- CVE-2018-9334The PAN-OS management web interface page in PAN-OS 6.1.20 and earlier, PAN-OS 7.1.16 and earlier, PAN-OS 8.0.8 and earlier, and PAN-OS 8.1.0
- CVE-2018-9335The PAN-OS session browser in PAN-OS 6.1.20 and earlier, PAN-OS 7.1.16 and earlier, PAN-OS 8.0.9 and earlier, and PAN-OS 8.1.1 and earlier m
- CVE-2018-9337The PAN-OS web interface administration page in PAN-OS 6.1.20 and earlier, PAN-OS 7.1.17 and earlier, PAN-OS 8.0.10 and earlier, and PAN-OS
- CVE-2018-8036In Apache PDFBox 1.8.0 to 1.8.14 and 2.0.0RC1 to 2.0.10, a carefully crafted (or fuzzed) file can trigger an infinite loop which leads to anApache Software Foundation Apache PDFBox · org.apache.pdfbo…
- CVE-2017-1250IBM Rational Quality Manager and IBM Rational Collaborative Lifecycle Management 5.0 through 5.0.2 and 6.0 through 6.0.5 are vulnerable to cIBM Rational Collaborative Lifecycle Management · IBM Ratio…
- CVE-2017-1275IBM Rational Quality Manager and IBM Rational Collaborative Lifecycle Management 5.0 through 5.0.2 and 6.0 through 6.0.5 are vulnerable to cIBM Rational Collaborative Lifecycle Management · IBM Ratio…
- CVE-2017-1277IBM Rational Quality Manager and IBM Rational Collaborative Lifecycle Management 5.0 through 5.0.2 and 6.0 through 6.0.5 are vulnerable to cIBM Rational Collaborative Lifecycle Management · IBM Ratio…
- CVE-2017-1280IBM Rational Quality Manager and IBM Rational Collaborative Lifecycle Management 5.0 through 5.0.2 and 6.0 through 6.0.5 are vulnerable to cIBM Rational Collaborative Lifecycle Management · IBM Ratio…
- CVE-2017-1281IBM Rational Quality Manager and IBM Rational Collaborative Lifecycle Management 5.0 through 5.0.2 and 6.0 through 6.0.5 are vulnerable to cIBM Rational Collaborative Lifecycle Management · IBM Ratio…
- CVE-2017-1293IBM Rational Quality Manager and IBM Rational Collaborative Lifecycle Management 5.0 through 5.0.2 and 6.0 through 6.0.5 are vulnerable to cIBM Rational Quality Manager · IBM Rational Collaborative L…
- CVE-2017-1294IBM Rational Quality Manager and IBM Rational Collaborative Lifecycle Management 5.0 through 5.0.2 and 6.0 through 6.0.5 are vulnerable to cIBM Rational Collaborative Lifecycle Management · IBM Ratio…
- CVE-2017-1299IBM Rational Quality Manager and IBM Rational Collaborative Lifecycle Management 5.0 through 5.0.2 and 6.0 through 6.0.5 are vulnerable to c
- CVE-2017-1306IBM Rational Quality Manager and IBM Rational Collaborative Lifecycle Management 5.0 through 5.0.2 and 6.0 through 6.0.5 are vulnerable to cIBM Rational Quality Manager · IBM Rational Collaborative L…
- CVE-2017-1312IBM Rational Quality Manager and IBM Rational Collaborative Lifecycle Management 5.0 through 5.0.2 and 6.0 through 6.0.5 are vulnerable to cIBM Rational Collaborative Lifecycle Management · IBM Ratio…
- CVE-2017-1313IBM Rational Quality Manager and IBM Rational Collaborative Lifecycle Management 5.0 through 5.0.2 and 6.0 through 6.0.5 are vulnerable to cIBM Rational Collaborative Lifecycle Management · IBM Ratio…
- CVE-2017-1314IBM Rational Quality Manager and IBM Rational Collaborative Lifecycle Management 5.0 through 5.0.2 and 6.0 through 6.0.5 are vulnerable to cIBM Rational Quality Manager · IBM Rational Collaborative L…
- CVE-2017-1315IBM Rational Quality Manager and IBM Rational Collaborative Lifecycle Management 5.0 through 5.0.2 and 6.0 through 6.0.5 are vulnerable to cIBM Rational Collaborative Lifecycle Management · IBM Ratio…
- CVE-2017-1316IBM Rational Quality Manager and IBM Rational Collaborative Lifecycle Management 5.0 through 5.0.2 and 6.0 through 6.0.5 are vulnerable to cIBM Rational Collaborative Lifecycle Management · IBM Ratio…
- CVE-2017-1317IBM Rational Quality Manager and IBM Rational Collaborative Lifecycle Management 5.0 through 5.0.2 and 6.0 through 6.0.5 are vulnerable to cIBM Rational Quality Manager · IBM Rational Collaborative L…
- CVE-2017-1561IBM Rational Quality Manager and IBM Rational Collaborative Lifecycle Management 5.0 through 5.0.2 and 6.0 through 6.0.5 are vulnerable to cIBM Rational Quality Manager · IBM Rational Collaborative L…
- CVE-2017-1562IBM Rational Quality Manager and IBM Rational Collaborative Lifecycle Management 5.0 through 5.0.2 and 6.0 through 6.0.5 are vulnerable to cIBM Rational Quality Manager · IBM Rational Collaborative L…
- CVE-2017-1564IBM Rational Quality Manager and IBM Rational Collaborative Lifecycle Management 5.0 through 5.0.2 and 6.0 through 6.0.5 are vulnerable to cIBM Rational Quality Manager · IBM Rational Collaborative L…
- CVE-2017-1565IBM Rational Quality Manager and IBM Rational Collaborative Lifecycle Management 5.0 through 5.0.2 and 6.0 through 6.0.5 are vulnerable to cIBM Rational Quality Manager · IBM Rational Collaborative L…
- CVE-2017-1568IBM Rational Quality Manager and IBM Rational Collaborative Lifecycle Management 5.0 through 5.0.2 and 6.0 through 6.0.5 are vulnerable to cIBM Rational Quality Manager · IBM Rational Collaborative L…
- CVE-2017-1592IBM Rational Quality Manager and IBM Rational Collaborative Lifecycle Management 5.0 through 5.0.2 and 6.0 through 6.0.5 are vulnerable to cIBM Rational Quality Manager · IBM Rational Collaborative L…
- CVE-2017-1608IBM Rational Quality Manager and IBM Rational Collaborative Lifecycle Management 5.0 through 5.0.2 and 6.0 through 6.0.5 are vulnerable to cIBM Rational Quality Manager · IBM Rational Collaborative L…
- CVE-2017-1621IBM Rational Quality Manager and IBM Rational Collaborative Lifecycle Management 5.0 through 5.0.2 and 6.0 through 6.0.5 are vulnerable to cIBM Rational Quality Manager · IBM Rational Collaborative L…
- CVE-2017-1651IBM Rational Quality Manager and IBM Rational Collaborative Lifecycle Management 5.0 through 5.0.2 and 6.0 through 6.0.5 are vulnerable to cIBM Rational Quality Manager · IBM Rational Collaborative L…
- CVE-2017-1652IBM Rational Quality Manager and IBM Rational Collaborative Lifecycle Management 5.0 through 5.0.2 and 6.0 through 6.0.5 are vulnerable to cIBM Rational Quality Manager · IBM Rational Collaborative L…
- CVE-2017-1690IBM Rational Quality Manager and IBM Rational Collaborative Lifecycle Management 5.0 through 5.0.2 and 6.0 through 6.0.5 are vulnerable to cIBM Rational Collaborative Lifecycle Management · IBM Ratio…
- CVE-2017-1691IBM Rational Quality Manager and IBM Rational Collaborative Lifecycle Management 5.0 through 5.0.2 and 6.0 through 6.0.5 are vulnerable to cIBM Rational Quality Manager · IBM Rational Collaborative L…
- CVE-2017-1715IBM Rational Quality Manager and IBM Rational Collaborative Lifecycle Management 5.0 through 5.0.2 and 6.0 through 6.0.5 are vulnerable to cIBM Rational Collaborative Lifecycle Management · IBM Ratio…
- CVE-2017-1717IBM Rational Quality Manager and IBM Rational Collaborative Lifecycle Management 5.0 through 5.0.2 and 6.0 through 6.0.5 are vulnerable to cIBM Rational Quality Manager · IBM Rational Collaborative L…
- CVE-2018-13116/user/del.php in zzcms 8.3 allows SQL injection via the tablename parameter after leveraging use of the zzcms_ask table.
- CVE-2018-11634Plaintext Storage of Passwords in the administrative console in Dialogic PowerMedia XMS before 3.5 SU2 allows local users to access the web
- CVE-2018-11635Use of a Hard-coded Cryptographic Key used to protect cookie session data in /var/www/xms/application/config/config.php in the administrativ
- CVE-2018-11636Cross-site request forgery (CSRF) vulnerability in the administrative console in Dialogic PowerMedia XMS through 3.5 allows remote attackers
- CVE-2018-11637Information leakage vulnerability in the administrative console in Dialogic PowerMedia XMS through 3.5 allows remote attackers to read arbit
- CVE-2018-11638Unrestricted Upload of a File with a Dangerous Type in the administrative console in Dialogic PowerMedia XMS through 3.5 allows remote authe
- CVE-2018-11639Plaintext Storage of Passwords within Cookies in /var/www/xms/application/controllers/verifyLogin.php in the administrative console in Dialo
- CVE-2018-11640XML External Entity (XXE) vulnerability in the web service in Dialogic PowerMedia XMS before 3.5 SU2 allows remote attackers to read arbitra
- CVE-2018-11641Use of Hard-coded Credentials in /var/www/xms/application/controllers/gatherLogs.php in the administrative console in Dialogic PowerMedia XM
- CVE-2018-11642Incorrect Permission Assignment on the /var/www/xms/cleanzip.sh shell script run periodically in Dialogic PowerMedia XMS through 3.5 allows
- CVE-2018-11643SQL injection vulnerability in the administrative console in Dialogic PowerMedia XMS through 3.5 allows remote authenticated users to execut
- CVE-2018-13112get_l2len in common/get.c in Tcpreplay 4.3.0 beta1 allows remote attackers to cause a denial of service (heap-based buffer over-read and app
- CVE-2018-11316The UPnP HTTP server on Sonos wireless speaker products allow unauthorized access via a DNS rebinding attack.
- CVE-2018-13102AnyDesk before "12.06.2018 - 4.1.3" on Windows 7 SP1 has a DLL preloading vulnerability.
- CVE-2018-13106ClipperCMS 1.3.3 has stored XSS via the "Tools -> Configuration" screen of the manager/ URI.
- CVE-2018-7635Whale Browser before 1.0.41.8 displays no URL information but only a title of a web page on the browser's address bar when visiting a blank
- CVE-2018-4851A vulnerability has been identified in SICLOCK TC100 (All versions) and SICLOCK TC400 (All versions).Siemens AG SICLOCK TC100, SICLOCK TC400
- CVE-2018-4852A vulnerability has been identified in SICLOCK TC100 (All versions) and SICLOCK TC400 (All versions).Siemens AG SICLOCK TC100, SICLOCK TC400
- CVE-2018-4853A vulnerability has been identified in SICLOCK TC100 (All versions) and SICLOCK TC400 (All versions).Siemens AG SICLOCK TC100, SICLOCK TC400
- CVE-2018-4854A vulnerability has been identified in SICLOCK TC100 (All versions) and SICLOCK TC400 (All versions).Siemens AG SICLOCK TC100, SICLOCK TC400
- CVE-2018-4855A vulnerability has been identified in SICLOCK TC100 (All versions) and SICLOCK TC400 (All versions).Siemens AG SICLOCK TC100, SICLOCK TC400
- CVE-2018-4856A vulnerability has been identified in SICLOCK TC100 (All versions) and SICLOCK TC400 (All versions).Siemens AG SICLOCK TC100, SICLOCK TC400
- CVE-2018-7763The vulnerability exists within css.inc.php in Schneider Electric U.motion Builder software versions prior to v1.3.4.Schneider Electric SE U.Motion
- CVE-2018-7764The vulnerability exists within runscript.php applet in Schneider Electric U.motion Builder software versions prior to v1.3.4.Schneider Electric SE U.Motion
- CVE-2018-7765The vulnerability exists within processing of track_import_export.php in Schneider Electric U.motion Builder software versions prior to v1.3Schneider Electric SE U.Motion
- CVE-2018-7766The vulnerability exists within processing of track_getdata.php in Schneider Electric U.motion Builder software versions prior to v1.3.4.Schneider Electric SE U.Motion
- CVE-2018-7767The vulnerability exists within processing of editobject.php in Schneider Electric U.motion Builder software versions prior to v1.3.4.Schneider Electric SE U.Motion
- CVE-2018-7768The vulnerability exists within processing of loadtemplate.php in Schneider Electric U.motion Builder software versions prior to v1.3.4.Schneider Electric SE U.Motion
- CVE-2018-7769The vulnerability exists within processing of xmlserver.php in Schneider Electric U.motion Builder software versions prior to v1.3.4.Schneider Electric SE U.Motion
- CVE-2018-7770The vulnerability exists within processing of sendmail.php in Schneider Electric U.motion Builder software versions prior to v1.3.4.Schneider Electric SE U.Motion
- CVE-2018-7771The vulnerability exists within processing of editscript.php in Schneider Electric U.motion Builder software versions prior to v1.3.4.Schneider Electric SE U.Motion
- CVE-2018-7772The vulnerability exists within processing of applets which are exposed on the web service in Schneider Electric U.motion Builder software vSchneider Electric SE U.Motion
- CVE-2018-7773The vulnerability exists within processing of nfcserver.php in Schneider Electric U.motion Builder software versions prior to v1.3.4.Schneider Electric SE U.Motion
- CVE-2018-7774The vulnerability exists within processing of localize.php in Schneider Electric U.motion Builder software versions prior to v1.3.4.Schneider Electric SE U.Motion
- CVE-2018-7776The vulnerability exists within error.php in Schneider Electric U.motion Builder software versions prior to v1.3.4.Schneider Electric SE U.Motion
- CVE-2018-7777The vulnerability is due to insufficient handling of update_file request parameter on update_module.php in Schneider Electric U.motion BuildSchneider Electric SE U.Motion
- CVE-2018-7778In Schneider Electric Evlink Charging Station versions prior to v3.2.0-12_v1, the Web Interface has an issue that may allow a remote attackeSchneider Electric SE Evlink Charging Station
- CVE-2018-7779In Schneider Electric Wiser for KNX V2.1.0 and prior, homeLYnk V2.0.1 and prior; and spaceLYnk V2.1.0 and prior, weak and unprotected FTP acSchneider Electric SE Wiser for KNX
- CVE-2018-7780In Schneider Electric Pelco Sarix Professional 1st generation cameras with firmware versions prior to 3.29.69, a buffer overflow vulnerabiliSchneider Electric SE Pelco Sarix Professional
- CVE-2018-7781In Schneider Electric Pelco Sarix Professional 1st generation cameras with firmware versions prior to 3.29.69, by sending a specially crafteSchneider Electric SE Pelco Sarix Professional
- CVE-2018-7782In Schneider Electric Pelco Sarix Professional 1st generation cameras with firmware versions prior to 3.29.69, authenticated users can view Schneider Electric SE Pelco Sarix Professional
- CVE-2018-7783Schneider Electric SoMachine Basic prior to v1.6 SP1 suffers from an XML External Entity (XXE) vulnerability using the DTD parameter entitieSchneider Electric SE SoMachine Basic
- CVE-2018-7784In Schneider Electric U.motion Builder software versions prior to v1.3.4, this exploit occurs when the submitted data of an input string is Schneider Electric SE U.motion Builder
- CVE-2018-7785In Schneider Electric U.motion Builder software versions prior to v1.3.4, a remote command injection allows authentication bypass.Schneider Electric SE U.motion Builder
- CVE-2018-7786In Schneider Electric U.motion Builder software versions prior to v1.3.4, a cross site scripting (XSS) vulnerability exists which could alloSchneider Electric SE U.motion Builder
- CVE-2018-7787In Schneider Electric U.motion Builder software versions prior to v1.3.4, this vulnerability is due to improper validation of input of conteSchneider Electric SE U.motion Builder
- CVE-2018-12255An XSS issue was discovered in InvoicePlane 1.5.10 via the "Quote PDF Password(Optional)" field.
- CVE-2018-13065ModSecurity 3.0.0 has XSS via an onerror attribute of an IMG element.
- CVE-2018-13101KioskSimpleService.exe in RedSwimmer KioskSimple 1.4.7.0 suffers from a privilege escalation vulnerability in the WCF endpoint.
- CVE-2018-13093An issue was discovered in fs/xfs/xfs_icache.c in the Linux kernel through 4.17.3.
- CVE-2018-13094An issue was discovered in fs/xfs/libxfs/xfs_attr_leaf.c in the Linux kernel through 4.17.3.
- CVE-2018-13095An issue was discovered in fs/xfs/libxfs/xfs_inode_buf.c in the Linux kernel through 4.17.3.
- CVE-2018-13096An issue was discovered in fs/f2fs/super.c in the Linux kernel through 4.14.
- CVE-2018-13097An issue was discovered in fs/f2fs/super.c in the Linux kernel through 4.17.3.
- CVE-2018-13098An issue was discovered in fs/f2fs/inode.c in the Linux kernel through 4.17.3.
- CVE-2018-13099An issue was discovered in fs/f2fs/inline.c in the Linux kernel through 4.4.
- CVE-2018-13100An issue was discovered in fs/f2fs/super.c in the Linux kernel through 4.17.3, which does not properly validate secs_per_zone in a corrupted
- CVE-2018-11314The External Control API in Roku and Roku TV products allow unauthorized access via a DNS Rebind attack.
- CVE-2018-13113The transfer and transferFrom functions of a smart contract implementation for Easy Trading Token (ETT), an Ethereum token, have an integer