# CVEs published 2018-07-10

87 CVEs were published on July 10, 2018: 1 critical, 3 high. Days are UTC.

- [CVE-2017-5704](https://cve.now/CVE-2017-5704.md): Platform sample code firmware included with 4th Gen Intel Core Processor, 5th Gen Intel Core Processor, 6th Gen Intel Core Processor, and 7t (no CVSS, Intel Core Processor)
- [CVE-2018-13866](https://cve.now/CVE-2018-13866.md): An issue was discovered in the HDF HDF5 1.8.20 library. (no CVSS)
- [CVE-2018-13867](https://cve.now/CVE-2018-13867.md): An issue was discovered in the HDF HDF5 1.8.20 library. (no CVSS)
- [CVE-2018-13868](https://cve.now/CVE-2018-13868.md): An issue was discovered in the HDF HDF5 1.8.20 library. (no CVSS)
- [CVE-2018-13869](https://cve.now/CVE-2018-13869.md): An issue was discovered in the HDF HDF5 1.8.20 library. (no CVSS)
- [CVE-2018-13870](https://cve.now/CVE-2018-13870.md): An issue was discovered in the HDF HDF5 1.8.20 library. (no CVSS)
- [CVE-2018-13871](https://cve.now/CVE-2018-13871.md): An issue was discovered in the HDF HDF5 1.8.20 library. (no CVSS)
- [CVE-2018-13872](https://cve.now/CVE-2018-13872.md): An issue was discovered in the HDF HDF5 1.8.20 library. (no CVSS)
- [CVE-2018-13873](https://cve.now/CVE-2018-13873.md): An issue was discovered in the HDF HDF5 1.8.20 library. (no CVSS)
- [CVE-2018-13874](https://cve.now/CVE-2018-13874.md): An issue was discovered in the HDF HDF5 1.8.20 library. (no CVSS)
- [CVE-2018-13875](https://cve.now/CVE-2018-13875.md): An issue was discovered in the HDF HDF5 1.8.20 library. (no CVSS)
- [CVE-2018-13876](https://cve.now/CVE-2018-13876.md): An issue was discovered in the HDF HDF5 1.8.20 library. (no CVSS)
- [CVE-2018-3619](https://cve.now/CVE-2018-3619.md): Information disclosure vulnerability in storage media in systems with Intel Optane memory module with Whole Disk Encryption may allow an att (no CVSS, Intel Optane memory)
- [CVE-2018-3627](https://cve.now/CVE-2018-3627.md): Logic bug in Intel Converged Security Management Engine 11.x may allow an attacker to execute arbitrary code via local privileged access. (no CVSS, Intel Converged Security Management Engine)
- [CVE-2018-3628](https://cve.now/CVE-2018-3628.md): Buffer overflow in HTTP handler in Intel Active Management Technology in Intel Converged Security Manageability Engine Firmware 3.x, 4.x, 5. (no CVSS, Intel Active Management Technology)
- [CVE-2018-3629](https://cve.now/CVE-2018-3629.md): Buffer overflow in event handler in Intel Active Management Technology in Intel Converged Security Manageability Engine Firmware 3.x, 4.x, 5 (no CVSS, Intel Active Management Technology)
- [CVE-2018-3632](https://cve.now/CVE-2018-3632.md): Memory corruption in Intel Active Management Technology in Intel Converged Security Manageability Engine Firmware 6.x / 7.x / 8.x / 9.x / 10 (no CVSS, Intel Active Management Technology)
- [CVE-2018-3652](https://cve.now/CVE-2018-3652.md): Existing UEFI setting restrictions for DCI (Direct Connect Interface) in 5th and 6th generation Intel Xeon Processor E3 Family, Intel Xeon S (no CVSS, Intel Xeon Processor)
- [CVE-2018-3667](https://cve.now/CVE-2018-3667.md): Installation tool IPDT (Intel Processor Diagnostic Tool) 4.1.0.24 sets permissions of installed files incorrectly, allowing for execution of (no CVSS, Intel Processor Diagnostic Tool)
- [CVE-2018-3668](https://cve.now/CVE-2018-3668.md): Unquoted service paths in Intel Processor Diagnostic Tool (IPDT) before version 4.1.0.27 allows a local attacker to potentially execute arbi (no CVSS, Intel Processor Diagnostic Tool)
- [CVE-2018-3682](https://cve.now/CVE-2018-3682.md): BMC Firmware in Intel server boards, compute modules, and systems potentially allow an attacker with administrative privileges to make unaut (no CVSS, Intel Server Boards, Compute Modules and Systems)
- [CVE-2018-3683](https://cve.now/CVE-2018-3683.md): Unquoted service paths in Intel Quartus Prime in versions 15.1 - 18.0 allow a local attacker to potentially execute arbitrary code. (no CVSS, Intel Quartus Prime)
- [CVE-2018-3684](https://cve.now/CVE-2018-3684.md): Unquoted service paths in Intel Quartus II in versions 11.0 - 15.0 allow a local attacker to potentially execute arbitrary code. (no CVSS, Intel Quartus II)
- [CVE-2018-3687](https://cve.now/CVE-2018-3687.md): Unquoted service paths in Intel Quartus II Programmer and Tools in versions 11.0 - 15.0 allow a local attacker to potentially execute arbitr (no CVSS, Intel Quartus II Programmer and Tools)
- [CVE-2018-3688](https://cve.now/CVE-2018-3688.md): Unquoted service paths in Intel Quartus Prime Programmer and Tools in versions 15.1 - 18.0 allow a local attacker to potentially execute arb (no CVSS, Intel Quartus Prime Programmer and Tools)
- [CVE-2018-3693](https://cve.now/CVE-2018-3693.md): Systems with microprocessors utilizing speculative execution and branch prediction may allow unauthorized disclosure of information to an at (no CVSS, Intel Most Modern Operating Systems)
- [CVE-2018-13863](https://cve.now/CVE-2018-13863.md): The MongoDB bson JavaScript module (also known as js-bson) versions 0.5.0 to 1.0.x before 1.0.5 is vulnerable to a Regular Expression Denial (no CVSS, bson)
- [CVE-2018-13865](https://cve.now/CVE-2018-13865.md): An issue was discovered in idreamsoft iCMS 7.0.9. (no CVSS)
- [CVE-2018-10872](https://cve.now/CVE-2018-10872.md): A flaw was found in the way the Linux kernel handled exceptions delivered after a stack switch operation via Mov SS or Pop SS instructions. (CVSS 6.5, Linux kernel)
- [CVE-2018-1116](https://cve.now/CVE-2018-1116.md): A flaw was found in polkit before version 0.116. (CVSS 4.7, \[UNKNOWN\] polkit)
- [CVE-2018-12462](https://cve.now/CVE-2018-12462.md): NetIQ iManager XSS vulnerabilities (CVSS 4.8, NetIQ iManager)
- [CVE-2018-10889](https://cve.now/CVE-2018-10889.md): A flaw was found in moodle before versions 3.5.1, 3.4.4, 3.3.7. (CVSS 4.3, \[UNKNOWN\] moodle · moodle/moodle)
- [CVE-2018-10890](https://cve.now/CVE-2018-10890.md): A flaw was found in moodle before versions 3.5.1, 3.4.4, 3.3.7, 3.1.13. (CVSS 4.3, \[UNKNOWN\] moodle · moodle/moodle)
- [CVE-2018-10891](https://cve.now/CVE-2018-10891.md): A flaw was found in moodle before versions 3.5.1, 3.4.4, 3.3.7, 3.1.13. (CVSS 6.3, \[UNKNOWN\] moodle · moodle/moodle)
- [CVE-2018-12461](https://cve.now/CVE-2018-12461.md): Certificate Revocation Check failure (CVSS 3.5, NetIQ eDirectory)
- [CVE-2018-13843](https://cve.now/CVE-2018-13843.md): An issue has been found in HTSlib 1.8. (no CVSS)
- [CVE-2018-13844](https://cve.now/CVE-2018-13844.md): An issue has been found in HTSlib 1.8. (no CVSS)
- [CVE-2018-13845](https://cve.now/CVE-2018-13845.md): An issue has been found in HTSlib 1.8. (no CVSS)
- [CVE-2018-13846](https://cve.now/CVE-2018-13846.md): An issue has been found in Bento4 1.5.1-624. (no CVSS)
- [CVE-2018-13847](https://cve.now/CVE-2018-13847.md): An issue has been found in Bento4 1.5.1-624. (no CVSS)
- [CVE-2018-13848](https://cve.now/CVE-2018-13848.md): An issue has been found in Bento4 1.5.1-624. (no CVSS)
- [CVE-2018-13849](https://cve.now/CVE-2018-13849.md): edit\_requests.php in yTakkar Instagram-clone through 2018-04-23 has XSS via an onmouseover payload because of an inadequate XSS protection m (no CVSS)
- [CVE-2018-13850](https://cve.now/CVE-2018-13850.md): The "Firebase Cloud Messaging (FCM) + Advance Admin Panel" component supporting Firebase Push Notification on iOS (through 2017-10-26) allow (no CVSS)
- [CVE-2018-2427](https://cve.now/CVE-2018-2427.md): SAP BusinessObjects Business Intelligence Suite, versions 4.10 and 4.20, and SAP Crystal Reports (version for Visual Studio .NET, Version 20 (no CVSS, SAP BusinessObjects Business Intelligence Suite · SAP Cryst…)
- [CVE-2018-2431](https://cve.now/CVE-2018-2431.md): SAP BusinessObjects Business Intelligence Suite, versions 4.10 and 4.20, does not sufficiently encode user controlled inputs, resulting in C (no CVSS, SAP BusinessObjects Business Intelligence Suite)
- [CVE-2018-2432](https://cve.now/CVE-2018-2432.md): SAP BusinessObjects Business Intelligence (BI Launchpad and Central Management Console) versions 4.10, 4.20 and 4.30 allow an attacker to in (no CVSS, SAP BusinessObjects Business Intelligence)
- [CVE-2018-2433](https://cve.now/CVE-2018-2433.md): SAP Gateway (SAP KERNEL 32 NUC, SAP KERNEL 32 Unicode, SAP KERNEL 64 NUC, SAP KERNEL 64 Unicode 7.21, 7.21EXT, 7.22 and 7.22EXT; SAP KERNEL (no CVSS, SAP Gateway)
- [CVE-2018-2434](https://cve.now/CVE-2018-2434.md): A content spoofing vulnerability in the following components allows to render html pages containing arbitrary plain text content, which migh (no CVSS, SAP NetWeaver · SAP UI Implementation for Decoupled Inno… +1)
- [CVE-2018-2435](https://cve.now/CVE-2018-2435.md): SAP NetWeaver Enterprise Portal from 7.0 to 7.02, 7.11, 7.20, 7.30, 7.31, 7.40, 7.50, does not sufficiently encode user controlled inputs, r (no CVSS, SAP NetWeaver Enterprise Portal)
- [CVE-2018-2436](https://cve.now/CVE-2018-2436.md): Executing transaction WRCK in SAP R/3 Enterprise Retail (EHP6) does not perform necessary authorization checks for an authenticated user, re (no CVSS, SAP R/3 Enterprise Retail)
- [CVE-2018-2437](https://cve.now/CVE-2018-2437.md): The SAP Internet Graphics Service (IGS), 7.20, 7.20EXT, 7.45, 7.49, 7.53, allows an attacker to externally trigger IGS command executions wh (no CVSS, SAP Internet Graphics Server)
- [CVE-2018-2438](https://cve.now/CVE-2018-2438.md): The SAP Internet Graphics Server (IGS), 7.20, 7.20EXT, 7.45, 7.49, 7.53, has several denial-of-service vulnerabilities that allow an attacke (no CVSS, SAP Internet Graphics Server)
- [CVE-2018-2439](https://cve.now/CVE-2018-2439.md): The SAP Internet Graphics Server (IGS), 7.20, 7.20EXT, 7.45, 7.49, 7.53, has insufficient request validation (for example, where the request (no CVSS, SAP Internet Graphics Server)
- [CVE-2018-2440](https://cve.now/CVE-2018-2440.md): Under certain circumstances SAP Dynamic Authorization Management (DAM) by NextLabs (Java Policy Controller versions 7.7 and 8.5) exposes sen (no CVSS, SAP Dynamic Authorization Management (DAM) by NextLabs)
- [CVE-2018-1331](https://cve.now/CVE-2018-1331.md): In Apache Storm 0.10.0 through 0.10.2, 1.0.0 through 1.0.6, 1.1.0 through 1.1.2, and 1.2.0 through 1.2.1, an attacker with access to a secur (no CVSS, Apache Software Foundation Apache Storm · org.apache.storm:…)
- [CVE-2017-1729](https://cve.now/CVE-2017-1729.md): IBM Rational Quality Manager 5.0 through 5.0.2 and 6.0 through 6.0.5 are vulnerable to cross-site scripting. (CVSS 5.4, IBM Rational Quality Manager)
- [CVE-2017-1738](https://cve.now/CVE-2017-1738.md): IBM Rational Quality Manager 5.0 through 5.0.2 and 6.0 through 6.0.5 contains an undisclosed vulnerability that would allow an authenticated (CVSS 6.3, IBM Rational Quality Manager)
- [CVE-2017-1791](https://cve.now/CVE-2017-1791.md): IBM Rational Quality Manager 5.0 through 5.0.2 and 6.0 through 6.0.5 are vulnerable to cross-site scripting. (CVSS 5.4, IBM Rational Quality Manager)
- [CVE-2017-1792](https://cve.now/CVE-2017-1792.md): IBM Rational Quality Manager 5.0 through 5.0.2 and 6.0 through 6.0.5 are vulnerable to cross-site scripting. (CVSS 5.4, IBM Rational Quality Manager)
- [CVE-2017-1793](https://cve.now/CVE-2017-1793.md): IBM Rational Quality Manager 5.0 through 5.0.2 and 6.0 through 6.0.5 are vulnerable to cross-site scripting. (CVSS 5.4, IBM Rational Quality Manager)
- [CVE-2018-1396](https://cve.now/CVE-2018-1396.md): IBM Rational Quality Manager 5.0 through 5.0.2 and 6.0 through 6.0.5 are vulnerable to cross-site scripting. (CVSS 5.4, IBM Rational Quality Manager)
- [CVE-2018-1423](https://cve.now/CVE-2018-1423.md): IBM Jazz Foundation products could disclose sensitive information to an authenticated attacker that could be used in further attacks against (CVSS 4.3, IBM Rational Collaborative Lifecycle Management · IBM Ra… +5)
- [CVE-2018-1458](https://cve.now/CVE-2018-1458.md): IBM DB2 for Linux, UNIX and Windows (includes DB2 Connect Server) 9.7, 10,1, 10.5 and 11.1 could allow a local user to execute arbitrary cod (CVSS 7.4, IBM DB2 for Linux, UNIX and Windows)
- [CVE-2018-1487](https://cve.now/CVE-2018-1487.md): IBM DB2 for Linux, UNIX and Windows (includes DB2 Connect Server) 9.7, 10.1, 10.5 and 11.1 binaries load shared libraries from an untrusted (CVSS 8.4, IBM DB2 for Linux, UNIX and Windows)
- [CVE-2018-1492](https://cve.now/CVE-2018-1492.md): IBM Jazz Foundation products could allow a user with physical access to the system to log in as another user due to the server's failure to (CVSS 4.3, IBM Rational Engineering Lifecycle Manager · IBM Rationa… +5)
- [CVE-2018-1523](https://cve.now/CVE-2018-1523.md): IBM Rational Quality Manager 5.0 through 5.0.2 and 6.0 through 6.0.5 are vulnerable to cross-site scripting. (CVSS 5.4, IBM Rational Quality Manager)
- [CVE-2018-1549](https://cve.now/CVE-2018-1549.md): IBM Rational Quality Manager 5.0 through 5.0.2 and 6.0 through 6.0.5 are vulnerable to HTTP response splitting attacks. (CVSS 5.4, IBM Rational Quality Manager)
- [CVE-2018-1566](https://cve.now/CVE-2018-1566.md): IBM DB2 for Linux, UNIX and Windows (includes DB2 Connect Server) 9.7, 10.1, 10.5, and 11.1 could allow a local user to execute arbitrary co (CVSS 8.4, IBM DB2 for Linux, UNIX and Windows)
- [CVE-2018-5553](https://cve.now/CVE-2018-5553.md): Crestron DGE-100 Console Command Injection (FIXED) (CVSS 9.8, Crestron DGE-100 · Crestron TS-1542-C +1)
- [CVE-2018-10943](https://cve.now/CVE-2018-10943.md): An issue was discovered on Barco ClickShare CSE-200 and CS-100 Base Units with firmware before 1.6.0.3. (no CVSS)
- [CVE-2018-13833](https://cve.now/CVE-2018-13833.md): An issue was discovered in cmft through 2017-09-24. (no CVSS)
- [CVE-2018-1407](https://cve.now/CVE-2018-1407.md): IBM Rational Team Concert 5.0 through 5.0.2 and 6.0 through 6.0.5 are vulnerable to cross-site scripting. (CVSS 5.4, IBM Rational Team Concert)
- [CVE-2018-1408](https://cve.now/CVE-2018-1408.md): IBM Rational Team Concert 5.0 through 5.0.2 and 6.0 through 6.0.5 are vulnerable to cross-site scripting. (CVSS 5.4, IBM Rational Team Concert)
- [CVE-2018-1521](https://cve.now/CVE-2018-1521.md): IBM Rational Team Concert 5.0 through 5.0.2 and 6.0 through 6.0.5 are vulnerable to cross-site scripting. (CVSS 5.4, IBM Rational Team Concert)
- [CVE-2018-10861](https://cve.now/CVE-2018-10861.md): A flaw was found in the way ceph mon handles user requests. (no CVSS, Red Hat ceph)
- [CVE-2018-10887](https://cve.now/CVE-2018-10887.md): A flaw was found in libgit2 before version 0.27.3. (no CVSS, libgit2)
- [CVE-2018-10888](https://cve.now/CVE-2018-10888.md): A flaw was found in libgit2 before version 0.27.3. (no CVSS, libgit2)
- [CVE-2018-1128](https://cve.now/CVE-2018-1128.md): It was found that cephx authentication protocol did not verify ceph clients correctly and was vulnerable to replay attack. (no CVSS, Red Hat ceph)
- [CVE-2018-1129](https://cve.now/CVE-2018-1129.md): A flaw was found in the way signature calculation was handled by cephx authentication protocol. (no CVSS, Red Hat ceph)
- [CVE-2018-13818](https://cve.now/CVE-2018-13818.md): Twig before 2.4.4 allows Server-Side Template Injection (SSTI) via the search search\_key parameter. (no CVSS)
- [CVE-2018-9853](https://cve.now/CVE-2018-9853.md): Insecure access control in freeSSHd version 1.3.1 allows attackers to obtain the privileges of the freesshd.exe process by leveraging the ab (no CVSS)
- [CVE-2018-1337](https://cve.now/CVE-2018-1337.md): In Apache Directory LDAP API before 1.0.2, a bug in the way the SSL Filter was setup made it possible for another thread to use the connecti (no CVSS, Apache Software Foundation Apache Directory · org.apache.di…)
- [CVE-2018-13388](https://cve.now/CVE-2018-13388.md): The review attachment resource in Atlassian Fisheye and Crucible before version 4.5.3 allows remote attackers to inject arbitrary HTML or Ja (no CVSS, Atlassian Fisheye and Crucible)
- [CVE-2018-13389](https://cve.now/CVE-2018-13389.md): The attachment resource in Atlassian Confluence before version 6.6.1 allows remote attackers to spoof web content in the Mozilla Firefox Bro (no CVSS, Atlassian Confluence)
- [CVE-2018-13797](https://cve.now/CVE-2018-13797.md): The macaddress module before 0.2.9 for Node.js is prone to an arbitrary command injection flaw, due to allowing unsanitized input to an exec (no CVSS, macaddress)
- [CVE-2016-10726](https://cve.now/CVE-2016-10726.md): The XMLUI feature in DSpace before 3.6, 4.x before 4.5, and 5.x before 5.5 allows directory traversal via the themes/ path in an attack with (no CVSS, org.dspace:dspace-xmlui)
- [CVE-2018-12230](https://cve.now/CVE-2018-12230.md): An wrong logical check identified in the transferFrom function of a smart contract implementation for RemiCoin (RMC), an Ethereum ERC20 toke (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2018-07-10
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.