# CVEs published 2018-07-03

113 CVEs were published on July 3, 2018: 1 critical, 2 high. Days are UTC.

- [CVE-2018-13121](https://cve.now/CVE-2018-13121.md): RealOne Player 2.0 Build 6.0.11.872 allows remote attackers to cause a denial of service (array out-of-bounds access and application crash) (no CVSS)
- [CVE-2018-13122](https://cve.now/CVE-2018-13122.md): onefilecms.php in OneFileCMS through 2017-10-08 might allow attackers to delete arbitrary files via the Delete File(s) screen, as demonstrat (no CVSS)
- [CVE-2018-13123](https://cve.now/CVE-2018-13123.md): onefilecms.php in OneFileCMS through 2017-10-08 might allow attackers to read arbitrary files via the i and f parameters, as demonstrated by (no CVSS)
- [CVE-2017-0912](https://cve.now/CVE-2017-0912.md): Ubiquiti UCRM versions 2.5.0 to 2.7.7 are vulnerable to Stored Cross-site Scripting. (no CVSS)
- [CVE-2017-0913](https://cve.now/CVE-2017-0913.md): Ubiquiti UCRM versions 2.3.0 to 2.7.7 allow an authenticated user to read arbitrary files in the local file system. (no CVSS)
- [CVE-2017-0919](https://cve.now/CVE-2017-0919.md): GitLab Community and Enterprise Editions before 10.1.6, 10.2.6, and 10.3.4 are vulnerable to an authorization bypass issue in the GitLab imp (no CVSS)
- [CVE-2017-0921](https://cve.now/CVE-2017-0921.md): GitLab Community and Enterprise Editions before 10.1.6, 10.2.6, and 10.3.4 are vulnerable to an unverified password change issue in the Pass (no CVSS)
- [CVE-2017-0929](https://cve.now/CVE-2017-0929.md): DNN (aka DotNetNuke) before 9.2.0 suffers from a Server-Side Request Forgery (SSRF) vulnerability in the DnnImageHandler class. (no CVSS, DotNetNuke.Core)
- [CVE-2018-3747](https://cve.now/CVE-2018-3747.md): The public node module versions \<= 1.0.3 allows to embed HTML in file names, which (in certain conditions) might lead to execute malicious J (no CVSS, public)
- [CVE-2018-3748](https://cve.now/CVE-2018-3748.md): There is a Stored XSS vulnerability in the glance node module versions \<= 3.0.5. (no CVSS, glance)
- [CVE-2018-3749](https://cve.now/CVE-2018-3749.md): The utilities function in all versions \< 1.0.1 of the deap node module can be tricked into modifying the prototype of Object when the attack (no CVSS, deap)
- [CVE-2018-3750](https://cve.now/CVE-2018-3750.md): The utilities function in all versions \<= 0.5.0 of the deep-extend node module can be tricked into modifying the prototype of Object when th (no CVSS, deep-extend)
- [CVE-2018-3751](https://cve.now/CVE-2018-3751.md): The utilities function in all versions \<= 0.3.0 of the merge-recursive node module can be tricked into modifying the prototype of Object whe (no CVSS, merge-recursive)
- [CVE-2018-3752](https://cve.now/CVE-2018-3752.md): The utilities function in all versions \<= 1.0.0 of the merge-options node module can be tricked into modifying the prototype of Object when (no CVSS, merge-options)
- [CVE-2018-3753](https://cve.now/CVE-2018-3753.md): The utilities function in all versions \<= 1.0.0 of the merge-objects node module can be tricked into modifying the prototype of Object when (no CVSS, merge-object)
- [CVE-2018-3754](https://cve.now/CVE-2018-3754.md): Node.js third-party module query-mysql versions 0.0.0, 0.0.1, and 0.0.2 are vulnerable to an SQL injection vulnerability due to lack of user (no CVSS, query-mysql)
- [CVE-2018-7636](https://cve.now/CVE-2018-7636.md): The URL filtering "continue page" hosted by PAN-OS 8.0.10 and earlier may allow an attacker to inject arbitrary JavaScript or HTML via speci (no CVSS)
- [CVE-2018-9242](https://cve.now/CVE-2018-9242.md): The PAN-OS management web interface page in PAN-OS 6.1.20 and earlier, PAN-OS 7.1.16 and earlier, PAN-OS 8.0.9 and earlier may allow an atta (no CVSS)
- [CVE-2018-9334](https://cve.now/CVE-2018-9334.md): The PAN-OS management web interface page in PAN-OS 6.1.20 and earlier, PAN-OS 7.1.16 and earlier, PAN-OS 8.0.8 and earlier, and PAN-OS 8.1.0 (no CVSS)
- [CVE-2018-9335](https://cve.now/CVE-2018-9335.md): The PAN-OS session browser in PAN-OS 6.1.20 and earlier, PAN-OS 7.1.16 and earlier, PAN-OS 8.0.9 and earlier, and PAN-OS 8.1.1 and earlier m (no CVSS)
- [CVE-2018-9337](https://cve.now/CVE-2018-9337.md): The PAN-OS web interface administration page in PAN-OS 6.1.20 and earlier, PAN-OS 7.1.17 and earlier, PAN-OS 8.0.10 and earlier, and PAN-OS (no CVSS)
- [CVE-2018-8036](https://cve.now/CVE-2018-8036.md): In Apache PDFBox 1.8.0 to 1.8.14 and 2.0.0RC1 to 2.0.10, a carefully crafted (or fuzzed) file can trigger an infinite loop which leads to an (no CVSS, Apache Software Foundation Apache PDFBox · org.apache.pdfbo…)
- [CVE-2017-1250](https://cve.now/CVE-2017-1250.md): IBM Rational Quality Manager and IBM Rational Collaborative Lifecycle Management 5.0 through 5.0.2 and 6.0 through 6.0.5 are vulnerable to c (CVSS 5.4, IBM Rational Collaborative Lifecycle Management · IBM Ratio…)
- [CVE-2017-1275](https://cve.now/CVE-2017-1275.md): IBM Rational Quality Manager and IBM Rational Collaborative Lifecycle Management 5.0 through 5.0.2 and 6.0 through 6.0.5 are vulnerable to c (CVSS 5.4, IBM Rational Collaborative Lifecycle Management · IBM Ratio…)
- [CVE-2017-1277](https://cve.now/CVE-2017-1277.md): IBM Rational Quality Manager and IBM Rational Collaborative Lifecycle Management 5.0 through 5.0.2 and 6.0 through 6.0.5 are vulnerable to c (CVSS 5.4, IBM Rational Collaborative Lifecycle Management · IBM Ratio…)
- [CVE-2017-1280](https://cve.now/CVE-2017-1280.md): IBM Rational Quality Manager and IBM Rational Collaborative Lifecycle Management 5.0 through 5.0.2 and 6.0 through 6.0.5 are vulnerable to c (CVSS 5.4, IBM Rational Collaborative Lifecycle Management · IBM Ratio…)
- [CVE-2017-1281](https://cve.now/CVE-2017-1281.md): IBM Rational Quality Manager and IBM Rational Collaborative Lifecycle Management 5.0 through 5.0.2 and 6.0 through 6.0.5 are vulnerable to c (CVSS 5.4, IBM Rational Collaborative Lifecycle Management · IBM Ratio…)
- [CVE-2017-1293](https://cve.now/CVE-2017-1293.md): IBM Rational Quality Manager and IBM Rational Collaborative Lifecycle Management 5.0 through 5.0.2 and 6.0 through 6.0.5 are vulnerable to c (CVSS 5.4, IBM Rational Quality Manager · IBM Rational Collaborative L…)
- [CVE-2017-1294](https://cve.now/CVE-2017-1294.md): IBM Rational Quality Manager and IBM Rational Collaborative Lifecycle Management 5.0 through 5.0.2 and 6.0 through 6.0.5 are vulnerable to c (CVSS 5.4, IBM Rational Collaborative Lifecycle Management · IBM Ratio…)
- [CVE-2017-1299](https://cve.now/CVE-2017-1299.md): IBM Rational Quality Manager and IBM Rational Collaborative Lifecycle Management 5.0 through 5.0.2 and 6.0 through 6.0.5 are vulnerable to c (no CVSS)
- [CVE-2017-1306](https://cve.now/CVE-2017-1306.md): IBM Rational Quality Manager and IBM Rational Collaborative Lifecycle Management 5.0 through 5.0.2 and 6.0 through 6.0.5 are vulnerable to c (CVSS 5.4, IBM Rational Quality Manager · IBM Rational Collaborative L…)
- [CVE-2017-1312](https://cve.now/CVE-2017-1312.md): IBM Rational Quality Manager and IBM Rational Collaborative Lifecycle Management 5.0 through 5.0.2 and 6.0 through 6.0.5 are vulnerable to c (CVSS 5.4, IBM Rational Collaborative Lifecycle Management · IBM Ratio…)
- [CVE-2017-1313](https://cve.now/CVE-2017-1313.md): IBM Rational Quality Manager and IBM Rational Collaborative Lifecycle Management 5.0 through 5.0.2 and 6.0 through 6.0.5 are vulnerable to c (CVSS 5.4, IBM Rational Collaborative Lifecycle Management · IBM Ratio…)
- [CVE-2017-1314](https://cve.now/CVE-2017-1314.md): IBM Rational Quality Manager and IBM Rational Collaborative Lifecycle Management 5.0 through 5.0.2 and 6.0 through 6.0.5 are vulnerable to c (CVSS 5.4, IBM Rational Quality Manager · IBM Rational Collaborative L…)
- [CVE-2017-1315](https://cve.now/CVE-2017-1315.md): IBM Rational Quality Manager and IBM Rational Collaborative Lifecycle Management 5.0 through 5.0.2 and 6.0 through 6.0.5 are vulnerable to c (CVSS 5.4, IBM Rational Collaborative Lifecycle Management · IBM Ratio…)
- [CVE-2017-1316](https://cve.now/CVE-2017-1316.md): IBM Rational Quality Manager and IBM Rational Collaborative Lifecycle Management 5.0 through 5.0.2 and 6.0 through 6.0.5 are vulnerable to c (CVSS 5.4, IBM Rational Collaborative Lifecycle Management · IBM Ratio…)
- [CVE-2017-1317](https://cve.now/CVE-2017-1317.md): IBM Rational Quality Manager and IBM Rational Collaborative Lifecycle Management 5.0 through 5.0.2 and 6.0 through 6.0.5 are vulnerable to c (CVSS 5.4, IBM Rational Quality Manager · IBM Rational Collaborative L…)
- [CVE-2017-1561](https://cve.now/CVE-2017-1561.md): IBM Rational Quality Manager and IBM Rational Collaborative Lifecycle Management 5.0 through 5.0.2 and 6.0 through 6.0.5 are vulnerable to c (CVSS 5.4, IBM Rational Quality Manager · IBM Rational Collaborative L…)
- [CVE-2017-1562](https://cve.now/CVE-2017-1562.md): IBM Rational Quality Manager and IBM Rational Collaborative Lifecycle Management 5.0 through 5.0.2 and 6.0 through 6.0.5 are vulnerable to c (CVSS 5.4, IBM Rational Quality Manager · IBM Rational Collaborative L…)
- [CVE-2017-1564](https://cve.now/CVE-2017-1564.md): IBM Rational Quality Manager and IBM Rational Collaborative Lifecycle Management 5.0 through 5.0.2 and 6.0 through 6.0.5 are vulnerable to c (CVSS 5.4, IBM Rational Quality Manager · IBM Rational Collaborative L…)
- [CVE-2017-1565](https://cve.now/CVE-2017-1565.md): IBM Rational Quality Manager and IBM Rational Collaborative Lifecycle Management 5.0 through 5.0.2 and 6.0 through 6.0.5 are vulnerable to c (CVSS 5.4, IBM Rational Quality Manager · IBM Rational Collaborative L…)
- [CVE-2017-1568](https://cve.now/CVE-2017-1568.md): IBM Rational Quality Manager and IBM Rational Collaborative Lifecycle Management 5.0 through 5.0.2 and 6.0 through 6.0.5 are vulnerable to c (CVSS 5.4, IBM Rational Quality Manager · IBM Rational Collaborative L…)
- [CVE-2017-1592](https://cve.now/CVE-2017-1592.md): IBM Rational Quality Manager and IBM Rational Collaborative Lifecycle Management 5.0 through 5.0.2 and 6.0 through 6.0.5 are vulnerable to c (CVSS 5.4, IBM Rational Quality Manager · IBM Rational Collaborative L…)
- [CVE-2017-1608](https://cve.now/CVE-2017-1608.md): IBM Rational Quality Manager and IBM Rational Collaborative Lifecycle Management 5.0 through 5.0.2 and 6.0 through 6.0.5 are vulnerable to c (CVSS 5.4, IBM Rational Quality Manager · IBM Rational Collaborative L…)
- [CVE-2017-1621](https://cve.now/CVE-2017-1621.md): IBM Rational Quality Manager and IBM Rational Collaborative Lifecycle Management 5.0 through 5.0.2 and 6.0 through 6.0.5 are vulnerable to c (CVSS 5.4, IBM Rational Quality Manager · IBM Rational Collaborative L…)
- [CVE-2017-1651](https://cve.now/CVE-2017-1651.md): IBM Rational Quality Manager and IBM Rational Collaborative Lifecycle Management 5.0 through 5.0.2 and 6.0 through 6.0.5 are vulnerable to c (CVSS 5.4, IBM Rational Quality Manager · IBM Rational Collaborative L…)
- [CVE-2017-1652](https://cve.now/CVE-2017-1652.md): IBM Rational Quality Manager and IBM Rational Collaborative Lifecycle Management 5.0 through 5.0.2 and 6.0 through 6.0.5 are vulnerable to c (CVSS 5.4, IBM Rational Quality Manager · IBM Rational Collaborative L…)
- [CVE-2017-1690](https://cve.now/CVE-2017-1690.md): IBM Rational Quality Manager and IBM Rational Collaborative Lifecycle Management 5.0 through 5.0.2 and 6.0 through 6.0.5 are vulnerable to c (CVSS 5.4, IBM Rational Collaborative Lifecycle Management · IBM Ratio…)
- [CVE-2017-1691](https://cve.now/CVE-2017-1691.md): IBM Rational Quality Manager and IBM Rational Collaborative Lifecycle Management 5.0 through 5.0.2 and 6.0 through 6.0.5 are vulnerable to c (CVSS 5.4, IBM Rational Quality Manager · IBM Rational Collaborative L…)
- [CVE-2017-1715](https://cve.now/CVE-2017-1715.md): IBM Rational Quality Manager and IBM Rational Collaborative Lifecycle Management 5.0 through 5.0.2 and 6.0 through 6.0.5 are vulnerable to c (CVSS 5.4, IBM Rational Collaborative Lifecycle Management · IBM Ratio…)
- [CVE-2017-1717](https://cve.now/CVE-2017-1717.md): IBM Rational Quality Manager and IBM Rational Collaborative Lifecycle Management 5.0 through 5.0.2 and 6.0 through 6.0.5 are vulnerable to c (CVSS 5.4, IBM Rational Quality Manager · IBM Rational Collaborative L…)
- [CVE-2018-13116](https://cve.now/CVE-2018-13116.md): /user/del.php in zzcms 8.3 allows SQL injection via the tablename parameter after leveraging use of the zzcms\_ask table. (no CVSS)
- [CVE-2018-11051](https://cve.now/CVE-2018-11051.md): RSA Certificate Manager Path Traversal Vulnerability (CVSS 7.5, Certificate Manager Path Traversal Vulnerability)
- [CVE-2018-11052](https://cve.now/CVE-2018-11052.md): Dell EMC ECS S3 Authentication Bypass Vulnerability (CVSS 9.8, Dell EMC ECS)
- [CVE-2018-11634](https://cve.now/CVE-2018-11634.md): Plaintext Storage of Passwords in the administrative console in Dialogic PowerMedia XMS before 3.5 SU2 allows local users to access the web (no CVSS)
- [CVE-2018-11635](https://cve.now/CVE-2018-11635.md): Use of a Hard-coded Cryptographic Key used to protect cookie session data in /var/www/xms/application/config/config.php in the administrativ (no CVSS)
- [CVE-2018-11636](https://cve.now/CVE-2018-11636.md): Cross-site request forgery (CSRF) vulnerability in the administrative console in Dialogic PowerMedia XMS through 3.5 allows remote attackers (no CVSS)
- [CVE-2018-11637](https://cve.now/CVE-2018-11637.md): Information leakage vulnerability in the administrative console in Dialogic PowerMedia XMS through 3.5 allows remote attackers to read arbit (no CVSS)
- [CVE-2018-11638](https://cve.now/CVE-2018-11638.md): Unrestricted Upload of a File with a Dangerous Type in the administrative console in Dialogic PowerMedia XMS through 3.5 allows remote authe (no CVSS)
- [CVE-2018-11639](https://cve.now/CVE-2018-11639.md): Plaintext Storage of Passwords within Cookies in /var/www/xms/application/controllers/verifyLogin.php in the administrative console in Dialo (no CVSS)
- [CVE-2018-11640](https://cve.now/CVE-2018-11640.md): XML External Entity (XXE) vulnerability in the web service in Dialogic PowerMedia XMS before 3.5 SU2 allows remote attackers to read arbitra (no CVSS)
- [CVE-2018-11641](https://cve.now/CVE-2018-11641.md): Use of Hard-coded Credentials in /var/www/xms/application/controllers/gatherLogs.php in the administrative console in Dialogic PowerMedia XM (no CVSS)
- [CVE-2018-11642](https://cve.now/CVE-2018-11642.md): Incorrect Permission Assignment on the /var/www/xms/cleanzip.sh shell script run periodically in Dialogic PowerMedia XMS through 3.5 allows (no CVSS)
- [CVE-2018-11643](https://cve.now/CVE-2018-11643.md): SQL injection vulnerability in the administrative console in Dialogic PowerMedia XMS through 3.5 allows remote authenticated users to execut (no CVSS)
- [CVE-2018-13112](https://cve.now/CVE-2018-13112.md): get\_l2len in common/get.c in Tcpreplay 4.3.0 beta1 allows remote attackers to cause a denial of service (heap-based buffer over-read and app (no CVSS)
- [CVE-2018-11316](https://cve.now/CVE-2018-11316.md): The UPnP HTTP server on Sonos wireless speaker products allow unauthorized access via a DNS rebinding attack. (no CVSS)
- [CVE-2018-13102](https://cve.now/CVE-2018-13102.md): AnyDesk before "12.06.2018 - 4.1.3" on Windows 7 SP1 has a DLL preloading vulnerability. (no CVSS)
- [CVE-2018-13106](https://cve.now/CVE-2018-13106.md): ClipperCMS 1.3.3 has stored XSS via the "Tools -\> Configuration" screen of the manager/ URI. (no CVSS)
- [CVE-2018-7635](https://cve.now/CVE-2018-7635.md): Whale Browser before 1.0.41.8 displays no URL information but only a title of a web page on the browser's address bar when visiting a blank (no CVSS)
- [CVE-2018-4851](https://cve.now/CVE-2018-4851.md): A vulnerability has been identified in SICLOCK TC100 (All versions) and SICLOCK TC400 (All versions). (no CVSS, Siemens AG SICLOCK TC100, SICLOCK TC400)
- [CVE-2018-4852](https://cve.now/CVE-2018-4852.md): A vulnerability has been identified in SICLOCK TC100 (All versions) and SICLOCK TC400 (All versions). (no CVSS, Siemens AG SICLOCK TC100, SICLOCK TC400)
- [CVE-2018-4853](https://cve.now/CVE-2018-4853.md): A vulnerability has been identified in SICLOCK TC100 (All versions) and SICLOCK TC400 (All versions). (no CVSS, Siemens AG SICLOCK TC100, SICLOCK TC400)
- [CVE-2018-4854](https://cve.now/CVE-2018-4854.md): A vulnerability has been identified in SICLOCK TC100 (All versions) and SICLOCK TC400 (All versions). (no CVSS, Siemens AG SICLOCK TC100, SICLOCK TC400)
- [CVE-2018-4855](https://cve.now/CVE-2018-4855.md): A vulnerability has been identified in SICLOCK TC100 (All versions) and SICLOCK TC400 (All versions). (no CVSS, Siemens AG SICLOCK TC100, SICLOCK TC400)
- [CVE-2018-4856](https://cve.now/CVE-2018-4856.md): A vulnerability has been identified in SICLOCK TC100 (All versions) and SICLOCK TC400 (All versions). (no CVSS, Siemens AG SICLOCK TC100, SICLOCK TC400)
- [CVE-2018-7763](https://cve.now/CVE-2018-7763.md): The vulnerability exists within css.inc.php in Schneider Electric U.motion Builder software versions prior to v1.3.4. (no CVSS, Schneider Electric SE U.Motion)
- [CVE-2018-7764](https://cve.now/CVE-2018-7764.md): The vulnerability exists within runscript.php applet in Schneider Electric U.motion Builder software versions prior to v1.3.4. (no CVSS, Schneider Electric SE U.Motion)
- [CVE-2018-7765](https://cve.now/CVE-2018-7765.md): The vulnerability exists within processing of track\_import\_export.php in Schneider Electric U.motion Builder software versions prior to v1.3 (no CVSS, Schneider Electric SE U.Motion)
- [CVE-2018-7766](https://cve.now/CVE-2018-7766.md): The vulnerability exists within processing of track\_getdata.php in Schneider Electric U.motion Builder software versions prior to v1.3.4. (no CVSS, Schneider Electric SE U.Motion)
- [CVE-2018-7767](https://cve.now/CVE-2018-7767.md): The vulnerability exists within processing of editobject.php in Schneider Electric U.motion Builder software versions prior to v1.3.4. (no CVSS, Schneider Electric SE U.Motion)
- [CVE-2018-7768](https://cve.now/CVE-2018-7768.md): The vulnerability exists within processing of loadtemplate.php in Schneider Electric U.motion Builder software versions prior to v1.3.4. (no CVSS, Schneider Electric SE U.Motion)
- [CVE-2018-7769](https://cve.now/CVE-2018-7769.md): The vulnerability exists within processing of xmlserver.php in Schneider Electric U.motion Builder software versions prior to v1.3.4. (no CVSS, Schneider Electric SE U.Motion)
- [CVE-2018-7770](https://cve.now/CVE-2018-7770.md): The vulnerability exists within processing of sendmail.php in Schneider Electric U.motion Builder software versions prior to v1.3.4. (no CVSS, Schneider Electric SE U.Motion)
- [CVE-2018-7771](https://cve.now/CVE-2018-7771.md): The vulnerability exists within processing of editscript.php in Schneider Electric U.motion Builder software versions prior to v1.3.4. (no CVSS, Schneider Electric SE U.Motion)
- [CVE-2018-7772](https://cve.now/CVE-2018-7772.md): The vulnerability exists within processing of applets which are exposed on the web service in Schneider Electric U.motion Builder software v (no CVSS, Schneider Electric SE U.Motion)
- [CVE-2018-7773](https://cve.now/CVE-2018-7773.md): The vulnerability exists within processing of nfcserver.php in Schneider Electric U.motion Builder software versions prior to v1.3.4. (no CVSS, Schneider Electric SE U.Motion)
- [CVE-2018-7774](https://cve.now/CVE-2018-7774.md): The vulnerability exists within processing of localize.php in Schneider Electric U.motion Builder software versions prior to v1.3.4. (no CVSS, Schneider Electric SE U.Motion)
- [CVE-2018-7776](https://cve.now/CVE-2018-7776.md): The vulnerability exists within error.php in Schneider Electric U.motion Builder software versions prior to v1.3.4. (no CVSS, Schneider Electric SE U.Motion)
- [CVE-2018-7777](https://cve.now/CVE-2018-7777.md): The vulnerability is due to insufficient handling of update\_file request parameter on update\_module.php in Schneider Electric U.motion Build (no CVSS, Schneider Electric SE U.Motion)
- [CVE-2018-7778](https://cve.now/CVE-2018-7778.md): In Schneider Electric Evlink Charging Station versions prior to v3.2.0-12\_v1, the Web Interface has an issue that may allow a remote attacke (no CVSS, Schneider Electric SE Evlink Charging Station)
- [CVE-2018-7779](https://cve.now/CVE-2018-7779.md): In Schneider Electric Wiser for KNX V2.1.0 and prior, homeLYnk V2.0.1 and prior; and spaceLYnk V2.1.0 and prior, weak and unprotected FTP ac (no CVSS, Schneider Electric SE Wiser for KNX)
- [CVE-2018-7780](https://cve.now/CVE-2018-7780.md): In Schneider Electric Pelco Sarix Professional 1st generation cameras with firmware versions prior to 3.29.69, a buffer overflow vulnerabili (no CVSS, Schneider Electric SE Pelco Sarix Professional)
- [CVE-2018-7781](https://cve.now/CVE-2018-7781.md): In Schneider Electric Pelco Sarix Professional 1st generation cameras with firmware versions prior to 3.29.69, by sending a specially crafte (no CVSS, Schneider Electric SE Pelco Sarix Professional)
- [CVE-2018-7782](https://cve.now/CVE-2018-7782.md): In Schneider Electric Pelco Sarix Professional 1st generation cameras with firmware versions prior to 3.29.69, authenticated users can view (no CVSS, Schneider Electric SE Pelco Sarix Professional)
- [CVE-2018-7783](https://cve.now/CVE-2018-7783.md): Schneider Electric SoMachine Basic prior to v1.6 SP1 suffers from an XML External Entity (XXE) vulnerability using the DTD parameter entitie (no CVSS, Schneider Electric SE SoMachine Basic)
- [CVE-2018-7784](https://cve.now/CVE-2018-7784.md): In Schneider Electric U.motion Builder software versions prior to v1.3.4, this exploit occurs when the submitted data of an input string is (no CVSS, Schneider Electric SE U.motion Builder)
- [CVE-2018-7785](https://cve.now/CVE-2018-7785.md): In Schneider Electric U.motion Builder software versions prior to v1.3.4, a remote command injection allows authentication bypass. (no CVSS, Schneider Electric SE U.motion Builder)
- [CVE-2018-7786](https://cve.now/CVE-2018-7786.md): In Schneider Electric U.motion Builder software versions prior to v1.3.4, a cross site scripting (XSS) vulnerability exists which could allo (no CVSS, Schneider Electric SE U.motion Builder)
- [CVE-2018-7787](https://cve.now/CVE-2018-7787.md): In Schneider Electric U.motion Builder software versions prior to v1.3.4, this vulnerability is due to improper validation of input of conte (no CVSS, Schneider Electric SE U.motion Builder)
- [CVE-2018-11746](https://cve.now/CVE-2018-11746.md): Puppet Discovery can leak authentication information (CVSS 8.6, Puppet Discovery)
- [CVE-2018-12255](https://cve.now/CVE-2018-12255.md): An XSS issue was discovered in InvoicePlane 1.5.10 via the "Quote PDF Password(Optional)" field. (no CVSS)
- [CVE-2018-13065](https://cve.now/CVE-2018-13065.md): ModSecurity 3.0.0 has XSS via an onerror attribute of an IMG element. (no CVSS)
- [CVE-2018-13101](https://cve.now/CVE-2018-13101.md): KioskSimpleService.exe in RedSwimmer KioskSimple 1.4.7.0 suffers from a privilege escalation vulnerability in the WCF endpoint. (no CVSS)
- [CVE-2018-13093](https://cve.now/CVE-2018-13093.md): An issue was discovered in fs/xfs/xfs\_icache.c in the Linux kernel through 4.17.3. (no CVSS)
- [CVE-2018-13094](https://cve.now/CVE-2018-13094.md): An issue was discovered in fs/xfs/libxfs/xfs\_attr\_leaf.c in the Linux kernel through 4.17.3. (no CVSS)
- [CVE-2018-13095](https://cve.now/CVE-2018-13095.md): An issue was discovered in fs/xfs/libxfs/xfs\_inode\_buf.c in the Linux kernel through 4.17.3. (no CVSS)
- [CVE-2018-13096](https://cve.now/CVE-2018-13096.md): An issue was discovered in fs/f2fs/super.c in the Linux kernel through 4.14. (no CVSS)
- [CVE-2018-13097](https://cve.now/CVE-2018-13097.md): An issue was discovered in fs/f2fs/super.c in the Linux kernel through 4.17.3. (no CVSS)
- [CVE-2018-13098](https://cve.now/CVE-2018-13098.md): An issue was discovered in fs/f2fs/inode.c in the Linux kernel through 4.17.3. (no CVSS)
- [CVE-2018-13099](https://cve.now/CVE-2018-13099.md): An issue was discovered in fs/f2fs/inline.c in the Linux kernel through 4.4. (no CVSS)
- [CVE-2018-13100](https://cve.now/CVE-2018-13100.md): An issue was discovered in fs/f2fs/super.c in the Linux kernel through 4.17.3, which does not properly validate secs\_per\_zone in a corrupted (no CVSS)
- [CVE-2018-11314](https://cve.now/CVE-2018-11314.md): The External Control API in Roku and Roku TV products allow unauthorized access via a DNS Rebind attack. (no CVSS)
- [CVE-2018-13113](https://cve.now/CVE-2018-13113.md): The transfer and transferFrom functions of a smart contract implementation for Easy Trading Token (ETT), an Ethereum token, have an integer (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2018-07-03
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.