CVEs published July 10, 2018
87 CVEs were published on July 10, 2018: 1 critical, 3 high.
- Published
- 87
- Critical
- 1
- High
- 3
- Medium
- 19
- Low
- 1
- Unrated
- 63
- Now in CISA KEV
- 0
- Fix available
- 12
Most affected products
- IBM Rational Quality Manager
- 8
- [UNKNOWN] moodle · moodle/moodle
- 3
- IBM DB2 for Linux, UNIX and Windows
- 3
- IBM Rational Team Concert
- 3
- Intel Active Management Technology
- 3
- Red Hat ceph
- 3
- SAP Internet Graphics Server
- 3
- Intel Processor Diagnostic Tool
- 2
- libgit2
- 2
- [UNKNOWN] polkit
- 1
Critical 1
High 3
- CVE-2018-1458IBM DB2 for Linux, UNIX and Windows (includes DB2 Connect Server) 9.7, 10,1, 10.5 and 11.1 could allow a local user to execute arbitrary codIBM DB2 for Linux, UNIX and Windows
- CVE-2018-1487IBM DB2 for Linux, UNIX and Windows (includes DB2 Connect Server) 9.7, 10.1, 10.5 and 11.1 binaries load shared libraries from an untrusted IBM DB2 for Linux, UNIX and Windows
- CVE-2018-1566IBM DB2 for Linux, UNIX and Windows (includes DB2 Connect Server) 9.7, 10.1, 10.5, and 11.1 could allow a local user to execute arbitrary coIBM DB2 for Linux, UNIX and Windows
Medium, low and unrated 83
- CVE-2017-5704Platform sample code firmware included with 4th Gen Intel Core Processor, 5th Gen Intel Core Processor, 6th Gen Intel Core Processor, and 7tIntel Core Processor
- CVE-2018-13866An issue was discovered in the HDF HDF5 1.8.20 library.
- CVE-2018-13867An issue was discovered in the HDF HDF5 1.8.20 library.
- CVE-2018-13868An issue was discovered in the HDF HDF5 1.8.20 library.
- CVE-2018-13869An issue was discovered in the HDF HDF5 1.8.20 library.
- CVE-2018-13870An issue was discovered in the HDF HDF5 1.8.20 library.
- CVE-2018-13871An issue was discovered in the HDF HDF5 1.8.20 library.
- CVE-2018-13872An issue was discovered in the HDF HDF5 1.8.20 library.
- CVE-2018-13873An issue was discovered in the HDF HDF5 1.8.20 library.
- CVE-2018-13874An issue was discovered in the HDF HDF5 1.8.20 library.
- CVE-2018-13875An issue was discovered in the HDF HDF5 1.8.20 library.
- CVE-2018-13876An issue was discovered in the HDF HDF5 1.8.20 library.
- CVE-2018-3619Information disclosure vulnerability in storage media in systems with Intel Optane memory module with Whole Disk Encryption may allow an attIntel Optane memory
- CVE-2018-3627Logic bug in Intel Converged Security Management Engine 11.x may allow an attacker to execute arbitrary code via local privileged access.Intel Converged Security Management Engine
- CVE-2018-3628Buffer overflow in HTTP handler in Intel Active Management Technology in Intel Converged Security Manageability Engine Firmware 3.x, 4.x, 5.Intel Active Management Technology
- CVE-2018-3629Buffer overflow in event handler in Intel Active Management Technology in Intel Converged Security Manageability Engine Firmware 3.x, 4.x, 5Intel Active Management Technology
- CVE-2018-3632Memory corruption in Intel Active Management Technology in Intel Converged Security Manageability Engine Firmware 6.x / 7.x / 8.x / 9.x / 10Intel Active Management Technology
- CVE-2018-3652Existing UEFI setting restrictions for DCI (Direct Connect Interface) in 5th and 6th generation Intel Xeon Processor E3 Family, Intel Xeon SIntel Xeon Processor
- CVE-2018-3667Installation tool IPDT (Intel Processor Diagnostic Tool) 4.1.0.24 sets permissions of installed files incorrectly, allowing for execution ofIntel Processor Diagnostic Tool
- CVE-2018-3668Unquoted service paths in Intel Processor Diagnostic Tool (IPDT) before version 4.1.0.27 allows a local attacker to potentially execute arbiIntel Processor Diagnostic Tool
- CVE-2018-3682BMC Firmware in Intel server boards, compute modules, and systems potentially allow an attacker with administrative privileges to make unautIntel Server Boards, Compute Modules and Systems
- CVE-2018-3683Unquoted service paths in Intel Quartus Prime in versions 15.1 - 18.0 allow a local attacker to potentially execute arbitrary code.Intel Quartus Prime
- CVE-2018-3684Unquoted service paths in Intel Quartus II in versions 11.0 - 15.0 allow a local attacker to potentially execute arbitrary code.Intel Quartus II
- CVE-2018-3687Unquoted service paths in Intel Quartus II Programmer and Tools in versions 11.0 - 15.0 allow a local attacker to potentially execute arbitrIntel Quartus II Programmer and Tools
- CVE-2018-3688Unquoted service paths in Intel Quartus Prime Programmer and Tools in versions 15.1 - 18.0 allow a local attacker to potentially execute arbIntel Quartus Prime Programmer and Tools
- CVE-2018-3693Systems with microprocessors utilizing speculative execution and branch prediction may allow unauthorized disclosure of information to an atIntel Most Modern Operating Systems
- CVE-2018-13863The MongoDB bson JavaScript module (also known as js-bson) versions 0.5.0 to 1.0.x before 1.0.5 is vulnerable to a Regular Expression Denialbson
- CVE-2018-13865An issue was discovered in idreamsoft iCMS 7.0.9.
- CVE-2018-10872A flaw was found in the way the Linux kernel handled exceptions delivered after a stack switch operation via Mov SS or Pop SS instructions.Linux kernel
- CVE-2018-1116A flaw was found in polkit before version 0.116.[UNKNOWN] polkit
- CVE-2018-12462NetIQ iManager XSS vulnerabilitiesNetIQ iManager
- CVE-2018-10889A flaw was found in moodle before versions 3.5.1, 3.4.4, 3.3.7.[UNKNOWN] moodle · moodle/moodle
- CVE-2018-10890A flaw was found in moodle before versions 3.5.1, 3.4.4, 3.3.7, 3.1.13.[UNKNOWN] moodle · moodle/moodle
- CVE-2018-10891A flaw was found in moodle before versions 3.5.1, 3.4.4, 3.3.7, 3.1.13.[UNKNOWN] moodle · moodle/moodle
- CVE-2018-12461Certificate Revocation Check failureNetIQ eDirectory
- CVE-2018-13843An issue has been found in HTSlib 1.8.
- CVE-2018-13844An issue has been found in HTSlib 1.8.
- CVE-2018-13845An issue has been found in HTSlib 1.8.
- CVE-2018-13846An issue has been found in Bento4 1.5.1-624.
- CVE-2018-13847An issue has been found in Bento4 1.5.1-624.
- CVE-2018-13848An issue has been found in Bento4 1.5.1-624.
- CVE-2018-13849edit_requests.php in yTakkar Instagram-clone through 2018-04-23 has XSS via an onmouseover payload because of an inadequate XSS protection m
- CVE-2018-13850The "Firebase Cloud Messaging (FCM) + Advance Admin Panel" component supporting Firebase Push Notification on iOS (through 2017-10-26) allow
- CVE-2018-2427SAP BusinessObjects Business Intelligence Suite, versions 4.10 and 4.20, and SAP Crystal Reports (version for Visual Studio .NET, Version 20SAP BusinessObjects Business Intelligence Suite · SAP Cryst…
- CVE-2018-2431SAP BusinessObjects Business Intelligence Suite, versions 4.10 and 4.20, does not sufficiently encode user controlled inputs, resulting in CSAP BusinessObjects Business Intelligence Suite
- CVE-2018-2432SAP BusinessObjects Business Intelligence (BI Launchpad and Central Management Console) versions 4.10, 4.20 and 4.30 allow an attacker to inSAP BusinessObjects Business Intelligence
- CVE-2018-2433SAP Gateway (SAP KERNEL 32 NUC, SAP KERNEL 32 Unicode, SAP KERNEL 64 NUC, SAP KERNEL 64 Unicode 7.21, 7.21EXT, 7.22 and 7.22EXT; SAP KERNEL SAP Gateway
- CVE-2018-2434A content spoofing vulnerability in the following components allows to render html pages containing arbitrary plain text content, which mighSAP NetWeaver · SAP UI Implementation for Decoupled Inno… +1
- CVE-2018-2435SAP NetWeaver Enterprise Portal from 7.0 to 7.02, 7.11, 7.20, 7.30, 7.31, 7.40, 7.50, does not sufficiently encode user controlled inputs, rSAP NetWeaver Enterprise Portal
- CVE-2018-2436Executing transaction WRCK in SAP R/3 Enterprise Retail (EHP6) does not perform necessary authorization checks for an authenticated user, reSAP R/3 Enterprise Retail
- CVE-2018-2437The SAP Internet Graphics Service (IGS), 7.20, 7.20EXT, 7.45, 7.49, 7.53, allows an attacker to externally trigger IGS command executions whSAP Internet Graphics Server
- CVE-2018-2438The SAP Internet Graphics Server (IGS), 7.20, 7.20EXT, 7.45, 7.49, 7.53, has several denial-of-service vulnerabilities that allow an attackeSAP Internet Graphics Server
- CVE-2018-2439The SAP Internet Graphics Server (IGS), 7.20, 7.20EXT, 7.45, 7.49, 7.53, has insufficient request validation (for example, where the requestSAP Internet Graphics Server
- CVE-2018-2440Under certain circumstances SAP Dynamic Authorization Management (DAM) by NextLabs (Java Policy Controller versions 7.7 and 8.5) exposes senSAP Dynamic Authorization Management (DAM) by NextLabs
- CVE-2018-1331In Apache Storm 0.10.0 through 0.10.2, 1.0.0 through 1.0.6, 1.1.0 through 1.1.2, and 1.2.0 through 1.2.1, an attacker with access to a securApache Software Foundation Apache Storm · org.apache.storm:…
- CVE-2017-1729IBM Rational Quality Manager 5.0 through 5.0.2 and 6.0 through 6.0.5 are vulnerable to cross-site scripting.IBM Rational Quality Manager
- CVE-2017-1738IBM Rational Quality Manager 5.0 through 5.0.2 and 6.0 through 6.0.5 contains an undisclosed vulnerability that would allow an authenticatedIBM Rational Quality Manager
- CVE-2017-1791IBM Rational Quality Manager 5.0 through 5.0.2 and 6.0 through 6.0.5 are vulnerable to cross-site scripting.IBM Rational Quality Manager
- CVE-2017-1792IBM Rational Quality Manager 5.0 through 5.0.2 and 6.0 through 6.0.5 are vulnerable to cross-site scripting.IBM Rational Quality Manager
- CVE-2017-1793IBM Rational Quality Manager 5.0 through 5.0.2 and 6.0 through 6.0.5 are vulnerable to cross-site scripting.IBM Rational Quality Manager
- CVE-2018-1396IBM Rational Quality Manager 5.0 through 5.0.2 and 6.0 through 6.0.5 are vulnerable to cross-site scripting.IBM Rational Quality Manager
- CVE-2018-1423IBM Jazz Foundation products could disclose sensitive information to an authenticated attacker that could be used in further attacks againstIBM Rational Collaborative Lifecycle Management · IBM Ra… +5
- CVE-2018-1492IBM Jazz Foundation products could allow a user with physical access to the system to log in as another user due to the server's failure to IBM Rational Engineering Lifecycle Manager · IBM Rationa… +5
- CVE-2018-1523IBM Rational Quality Manager 5.0 through 5.0.2 and 6.0 through 6.0.5 are vulnerable to cross-site scripting.IBM Rational Quality Manager
- CVE-2018-1549IBM Rational Quality Manager 5.0 through 5.0.2 and 6.0 through 6.0.5 are vulnerable to HTTP response splitting attacks.IBM Rational Quality Manager
- CVE-2018-10943An issue was discovered on Barco ClickShare CSE-200 and CS-100 Base Units with firmware before 1.6.0.3.
- CVE-2018-13833An issue was discovered in cmft through 2017-09-24.
- CVE-2018-1407IBM Rational Team Concert 5.0 through 5.0.2 and 6.0 through 6.0.5 are vulnerable to cross-site scripting.IBM Rational Team Concert
- CVE-2018-1408IBM Rational Team Concert 5.0 through 5.0.2 and 6.0 through 6.0.5 are vulnerable to cross-site scripting.IBM Rational Team Concert
- CVE-2018-1521IBM Rational Team Concert 5.0 through 5.0.2 and 6.0 through 6.0.5 are vulnerable to cross-site scripting.IBM Rational Team Concert
- CVE-2018-10861A flaw was found in the way ceph mon handles user requests.Red Hat ceph
- CVE-2018-10887A flaw was found in libgit2 before version 0.27.3.libgit2
- CVE-2018-10888A flaw was found in libgit2 before version 0.27.3.libgit2
- CVE-2018-1128It was found that cephx authentication protocol did not verify ceph clients correctly and was vulnerable to replay attack.Red Hat ceph
- CVE-2018-1129A flaw was found in the way signature calculation was handled by cephx authentication protocol.Red Hat ceph
- CVE-2018-13818Twig before 2.4.4 allows Server-Side Template Injection (SSTI) via the search search_key parameter.
- CVE-2018-9853Insecure access control in freeSSHd version 1.3.1 allows attackers to obtain the privileges of the freesshd.exe process by leveraging the ab
- CVE-2018-1337In Apache Directory LDAP API before 1.0.2, a bug in the way the SSL Filter was setup made it possible for another thread to use the connectiApache Software Foundation Apache Directory · org.apache.di…
- CVE-2018-13388The review attachment resource in Atlassian Fisheye and Crucible before version 4.5.3 allows remote attackers to inject arbitrary HTML or JaAtlassian Fisheye and Crucible
- CVE-2018-13389The attachment resource in Atlassian Confluence before version 6.6.1 allows remote attackers to spoof web content in the Mozilla Firefox BroAtlassian Confluence
- CVE-2018-13797The macaddress module before 0.2.9 for Node.js is prone to an arbitrary command injection flaw, due to allowing unsanitized input to an execmacaddress
- CVE-2016-10726The XMLUI feature in DSpace before 3.6, 4.x before 4.5, and 5.x before 5.5 allows directory traversal via the themes/ path in an attack withorg.dspace:dspace-xmlui
- CVE-2018-12230An wrong logical check identified in the transferFrom function of a smart contract implementation for RemiCoin (RMC), an Ethereum ERC20 toke