CVEs published July 11, 2018
98 CVEs were published on July 11, 2018: 3 critical, 12 high. 1 is now in CISA KEV.
- Published
- 98
- Critical
- 3
- High
- 12
- Medium
- 8
- Low
- 0
- Unrated
- 75
- Now in CISA KEV
- 1
- Fix available
- 29
Most affected products
- Juniper Networks Junos OS
- 11
- Microsoft Edge
- 9
- Microsoft Windows
- 7
- Antenna House
- 6
- Microsoft Edge · Microsoft ChakraCore +1
- 5
- Juniper Networks Contrail Service Orchestration
- 3
- Microsoft .NET Framework
- 3
- Microsoft ChakraCore · Microsoft Internet Explorer +2
- 3
- Microsoft Internet Explorer
- 3
- Microsoft SharePoint
- 3
Critical 3
- CVE-2018-0037Junos OS: RPD daemon crashes due to receipt of crafted BGP NOTIFICATION messagesJuniper Networks Junos OS
- CVE-2018-0040Contrail Service Orchestration: hardcoded cryptographic certificates and keysJuniper Networks Contrail Service Orchestration
- CVE-2018-0041Contrail Service Orchestration: Hardcoded credentials for Keystone service.Juniper Networks Contrail Service Orchestration
High 12
- CVE-2018-0024Junos OS: A privilege escalation vulnerability exists where authenticated users with shell access can become rootJuniper Networks Junos OS
- CVE-2018-0027Junos OS: Receipt of malformed RSVP packet may lead to RPD denial of serviceJuniper Networks Junos OS
- CVE-2018-0030Junos OS: MPC7/8/9, PTX-FPC3 (FPC-P1, FPC-P2) and PTX1K: Line card may crash upon receipt of specific MPLS packet.Juniper Networks Junos OS
- CVE-2018-0032Junos OS: RPD crash when receiving a crafted BGP UPDATEJuniper Networks Junos OS
- CVE-2018-3929An exploitable heap corruption exists in the PowerPoint document conversion functionality of the Antenna House Office Server Document ConverAntenna House
- CVE-2018-3930In Antenna House Office Server Document Converter version V6.1 Pro MR2 for Linux64 (6,1,2018,0312), a crafted Microsoft Word (DOC) document Antenna House
- CVE-2018-3931In Antenna House Office Server Document Converter version V6.1 Pro MR2 for Linux64 (6,1,2018,0312), a crafted Microsoft Word (DOC) document Antenna House
- CVE-2018-3932An exploitable stack-based buffer overflow exists in the Microsoft Word document conversion functionality of the Antenna House Office ServerAntenna House
- CVE-2018-3933An exploitable out-of-bounds write exists in the Microsoft Word document conversion functionality of the Antenna House Office Server DocumenAntenna House
- CVE-2018-3936In Antenna House Office Server Document Converter version V6.1 Pro MR2 for Linux64 (6,1,2018,0312), a crafted Microsoft Word (DOC) document Antenna House
- CVE-2017-7467A buffer overflow flaw was found in the way minicom before version 2.7.1 handled VT100 escape sequences.[UNKNOWN] minicom
- CVE-2018-8298A remote code execution vulnerability exists in the way that the ChakraCore scripting engine handles objects in memory, aka "Scripting EnginMicrosoft ChakraCore · Microsoft.ChakraCore
Medium, low and unrated 83
- CVE-2016-0708Applications deployed to Cloud Foundry, versions v166 through v227, may be vulnerable to a remote disclosure of information, including, but Cloud Foundry
- CVE-2018-11045Pivotal Operations Manager, versions 2.1 prior to 2.1.6 and 2.0 prior to 2.0.15 and 1.12 prior to 1.12.22, contains a static Linux Random NuPivotal Operations Manager
- CVE-2018-11049RSA Identity Governance and Lifecycle Uncontrolled Search Path VulnerabilityPivotal Operations Manager
- CVE-2018-0025Junos OS: SRX Series: Credentials exposed when using HTTP and HTTPS Firewall Pass-through User AuthenticationJuniper Networks Junos OS
- CVE-2018-0026Junos OS: Stateless IP firewall filter rules stop working as expected after reboot or upgradeJuniper Networks Junos OS
- CVE-2018-0029Junos OS: Kernel crash (vmcore) during broadcast storm after enabling 'monitor traffic interface fxp0'Juniper Networks Junos OS
- CVE-2018-0031Junos OS: Receipt of specially crafted UDP packets over MPLS may bypass stateless IP firewall rulesJuniper Networks Junos OS
- CVE-2018-0034Junos OS: A malicious crafted IPv6 DHCP packet may cause the JDHCPD daemon to coreJuniper Networks Junos OS
- CVE-2018-0035Junos OS: QFX5200 and QFX10002: Unintended ONIE partition was shipped with certain Junos OS .bin and .iso imagesJuniper Networks Junos OS
- CVE-2018-0038Juniper Networks Contrail Service Orchestration releases prior to 3.3.0 have Cassandra service enabled by default with hardcoded credentials
- CVE-2018-0039Contrail Service Orchestration: Hardcoded credentials for Grafana serviceJuniper Networks Contrail Service Orchestration
- CVE-2018-0042Juniper Networks CSO versions prior to 4.0.0 may log passwords in log files leading to an information disclosure vulnerability.
- CVE-2018-10231Cross-site scripting (XSS) vulnerability in TOPdesk before 8.05.017 (June 2018 version) and before 5.7.SR9 allows remote attackers to inject
- CVE-2018-10232Cross-site request forgery (CSRF) vulnerability in TOPdesk before 8.05.017 (June 2018 version) and before 5.7.SR9 allows remote attackers to
- CVE-2018-10633Universal Robots Robot Controllers Version CB 3.1, SW Version 3.4.5-100 utilizes hard-coded credentials that may allow an attacker to reset Universal Robots Robot Controller
- CVE-2018-10635In Universal Robots Robot Controllers Version CB 3.1, SW Version 3.4.5-100, ports 30001/TCP to 30003/TCP listen for arbitrary URScript code Universal Robots Robot Controllers
- CVE-2013-0589IBM iNotes before 8.5.3 Fix Pack 6 and 9.x before 9.0.1 allows remote attackers to bypass the remote image filtering mechanism and obtain se
- CVE-2013-0592Cross-site scripting (XSS) vulnerability in IBM iNotes before 8.5.3 Fix Pack 6 and 9.x before 9.0.1 allows remote attackers to inject arbitr
- CVE-2013-0594Open redirect vulnerability in IBM iNotes before 8.5.3 Fix Pack 6 and 9.x before 9.0.1 allows remote attackers to redirect users to arbitrar
- CVE-2013-2951IBM WebSphere Portal 7.0.0.x and 8.0.0.x write passwords to a trace file when tracing is enabled for the Selfcare Portlet (Profile Managemen
- CVE-2013-2972IBM WebSphere Cast Iron 6.3 allows remote attackers to bypass intended access restrictions via unspecified vectors.
- CVE-2017-16709Crestron Airmedia AM-100 devices with firmware before 1.6.0 and AM-101 devices with firmware before 2.7.0 allows remote authenticated admini
- CVE-2017-16710Cross-site scripting (XSS) vulnerability in Crestron Airmedia AM-100 devices with firmware before 1.6.0 and AM-101 devices with firmware bef
- CVE-2018-10197There is a time-based blind SQL injection vulnerability in the Access Manager component before 9.18.040 and 10.x before 10.18.040 in ELO ELO
- CVE-2018-11529VideoLAN VLC media player 2.2.x is prone to a use after free vulnerability which an attacker can leverage to execute arbitrary code via craf
- CVE-2018-13989Grundig Smart Inter@ctive TV 3.0 devices allow CSRF attacks via a POST request to TCP port 8085 containing a predictable ID value, as demons
- CVE-2016-9604It was discovered in the Linux kernel before 4.11-rc8 that root can gain direct access to an internal keyring, such as '.dns_resolver' in RHkernel security
- CVE-2018-0500Curl_smtp_escape_eob in lib/smtp.c in curl 7.54.1 to and including curl 7.60.0 has a heap-based buffer overflow that might be exploitable bycurl before
- CVE-2018-8007Apache CouchDB administrative users can configure the database server via HTTP(S).Apache Software Foundation Apache CouchDB
- CVE-2018-13878An XSS issue was discovered in packages/rocketchat-mentions/Mentions.js in Rocket.Chat before 0.65.
- CVE-2018-13879A reflected XSS issue was discovered in the registration form in Rocket.Chat before 0.66.
- CVE-2018-0949A security feature bypass vulnerability exists when Microsoft Internet Explorer improperly handles requests involving UNC resources, aka "InMicrosoft Internet Explorer
- CVE-2018-8125A remote code execution vulnerability exists when Microsoft Edge improperly accesses objects in memory, aka "Microsoft Edge Memory CorruptioMicrosoft Edge
- CVE-2018-8171A Security Feature Bypass vulnerability exists in ASP.NET when the number of incorrect login attempts is not validated, aka "ASP.NET SecuritMicrosoft ASP.NET · Microsoft.AspNetCore.Identity
- CVE-2018-8172A remote code execution vulnerability exists in Visual Studio software when the software does not check the source markup of a file for an uMicrosoft Visual Studio · Microsoft Expression Blend
- CVE-2018-8202An elevation of privilege vulnerability exists in .NET Framework which could allow an attacker to elevate their privilege level, aka ".NET FMicrosoft .NET Framework
- CVE-2018-8206A denial of service vulnerability exists when Windows improperly handles File Transfer Protocol (FTP) connections, aka "Windows FTP Server DMicrosoft Windows
- CVE-2018-8222A security feature bypass vulnerability exists in Device Guard that could allow an attacker to inject malicious code into a Windows PowerSheMicrosoft Windows Server · Microsoft Windows
- CVE-2018-8232A Tampering vulnerability exists when Microsoft Macro Assembler improperly validates code, aka "Microsoft Macro Assembler Tampering VulnerabMicrosoft Visual Studio
- CVE-2018-8238A security feature bypass vulnerability exists when Skype for Business or Lync do not properly parse UNC path links shared via messages, akaMicrosoft Skype · Microsoft Lync
- CVE-2018-8242A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Internet Explorer, aka "ScripMicrosoft Internet Explorer
- CVE-2018-8260A Remote Code Execution vulnerability exists in .NET software when the software fails to check the source markup of a file, aka ".NET FramewMicrosoft .NET Framework
- CVE-2018-8262A remote code execution vulnerability exists when Microsoft Edge improperly accesses objects in memory, aka "Microsoft Edge Memory CorruptioMicrosoft Edge
- CVE-2018-8274A remote code execution vulnerability exists when Microsoft Edge improperly accesses objects in memory, aka "Microsoft Edge Memory CorruptioMicrosoft Edge
- CVE-2018-8275A remote code execution vulnerability exists when Microsoft Edge improperly accesses objects in memory, aka "Microsoft Edge Memory CorruptioMicrosoft Edge · Microsoft ChakraCore
- CVE-2018-8276A security feature bypass vulnerability exists in the Microsoft Chakra scripting engine that allows Control Flow Guard (CFG) to be bypassed,Microsoft Edge · Microsoft ChakraCore +1
- CVE-2018-8278A spoofing vulnerability exists when Microsoft Edge improperly handles specific HTML content, aka "Microsoft Edge Spoofing Vulnerability." TMicrosoft Edge
- CVE-2018-8279A remote code execution vulnerability exists when Microsoft Edge improperly accesses objects in memory, aka "Microsoft Edge Memory CorruptioMicrosoft Edge · Microsoft ChakraCore
- CVE-2018-8280A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka "CMicrosoft Edge · Microsoft ChakraCore +1
- CVE-2018-8281A remote code execution vulnerability exists in Microsoft Office software when the software fails to properly handle objects in memory, aka Microsoft Excel Viewer · Microsoft PowerPoint Viewer +1
- CVE-2018-8282An elevation of privilege vulnerability exists in Windows when the Windows kernel-mode driver fails to properly handle objects in memory, akMicrosoft Windows
- CVE-2018-8283A remote code execution vulnerability exists in the way that the ChakraCore scripting engine handles objects in memory, aka "Scripting EnginMicrosoft ChakraCore · Microsoft.ChakraCore
- CVE-2018-8284A remote code execution vulnerability exists when the Microsoft .NET Framework fails to validate input properly, aka ".NET Framework Remote Microsoft .NET Framework
- CVE-2018-8286A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka "CMicrosoft Edge · Microsoft ChakraCore +1
- CVE-2018-8287A remote code execution vulnerability exists in the way the scripting engine handles objects in memory in Microsoft browsers, aka "ScriptingMicrosoft ChakraCore · Microsoft Internet Explorer +2
- CVE-2018-8288A remote code execution vulnerability exists in the way the scripting engine handles objects in memory in Microsoft browsers, aka "ScriptingMicrosoft ChakraCore · Microsoft Internet Explorer +2
- CVE-2018-8289An information disclosure vulnerability exists when Microsoft Edge improperly handles objects in memory, aka "Microsoft Edge Information DisMicrosoft Edge
- CVE-2018-8290A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka "CMicrosoft Edge · Microsoft ChakraCore +1
- CVE-2018-8291A remote code execution vulnerability exists in the way the scripting engine handles objects in memory in Microsoft browsers, aka "ScriptingMicrosoft ChakraCore · Microsoft Internet Explorer +2
- CVE-2018-8294A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka "CMicrosoft Edge · Microsoft ChakraCore +1
- CVE-2018-8296A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Internet Explorer, aka "ScripMicrosoft Internet Explorer
- CVE-2018-8297An information disclosure vulnerability exists when Microsoft Edge improperly handles objects in memory, aka "Microsoft Edge Information DisMicrosoft Edge
- CVE-2018-8299An elevation of privilege vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request tMicrosoft SharePoint
- CVE-2018-8300A remote code execution vulnerability exists in Microsoft SharePoint when the software fails to check the source markup of an application paMicrosoft SharePoint
- CVE-2018-8301A remote code execution vulnerability exists when Microsoft Edge improperly accesses objects in memory, aka "Microsoft Edge Memory CorruptioMicrosoft Edge
- CVE-2018-8304A denial of service vulnerability exists in Windows Domain Name System (DNS) DNSAPI.dll when it fails to properly handle DNS responses, aka Microsoft Windows
- CVE-2018-8305An information disclosure vulnerability exists in Windows Mail Client when a message is opened, aka "Windows Mail Client Information DisclosMicrosoft Mail, Calendar, and People in Windows 8.1 App Sto…
- CVE-2018-8306A command injection vulnerability exists in the Microsoft Wireless Display Adapter (MWDA) when the Microsoft Wireless Display Adapter does nMicrosoft Wireless Display Adapter V2 Software
- CVE-2018-8307A security feature bypass vulnerability exists when Microsoft WordPad improperly handles embedded OLE objects, aka "WordPad Security FeatureMicrosoft Windows
- CVE-2018-8308An elevation of privilege vulnerability exists when the Windows kernel fails to properly handle objects in memory, aka "Windows Kernel ElevaMicrosoft Windows
- CVE-2018-8309A denial of service vulnerability exists when Windows improperly handles objects in memory, aka "Windows Denial of Service Vulnerability." TMicrosoft Windows
- CVE-2018-8310A tampering vulnerability exists when Microsoft Outlook does not properly handle specific attachment types when rendering HTML emails, aka "Microsoft Word · Microsoft Office
- CVE-2018-8311A remote code execution vulnerability exists when Skype for Business and Microsoft Lync clients fail to properly sanitize specially crafted Microsoft Skype · Microsoft Lync
- CVE-2018-8312A remote code execution vulnerability exists when Microsoft Access fails to properly handle objects in memory, aka "Microsoft Access Remote Microsoft Access · Microsoft Office
- CVE-2018-8313An elevation of privilege vulnerability exists in the way that the Windows Kernel API enforces permissions, aka "Windows Elevation of PrivilMicrosoft Windows Server 2012 R2 · Microsoft Windows RT +2
- CVE-2018-8314An elevation of privilege vulnerability exists when Windows fails a check, allowing a sandbox escape, aka "Windows Elevation of Privilege VuMicrosoft Windows
- CVE-2018-8319A Security Feature Bypass vulnerability exists in MSR JavaScript Cryptography Library that is caused by incorrect arithmetic computations, aMicrosoft Research JavaScript Cryptography Library · msrcry…
- CVE-2018-8323An elevation of privilege vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request tMicrosoft SharePoint
- CVE-2018-8324An information disclosure vulnerability exists when Microsoft Edge improperly handles objects in memory, aka "Microsoft Edge Information DisMicrosoft Edge
- CVE-2018-8325An information disclosure vulnerability exists when Microsoft Edge improperly handles objects in memory, aka "Microsoft Edge Information DisMicrosoft Edge
- CVE-2018-8326A cross-site-scripting (XSS) vulnerability exists when an open source customization for Microsoft Active Directory Federation Services (AD FMicrosoft Web Customizations
- CVE-2018-8327A remote code execution vulnerability exists in PowerShell Editor Services, aka "PowerShell Editor Services Remote Code Execution VulnerabilMicrosoft PowerShell Editor · Microsoft PowerShell Extension
- CVE-2018-8356A security feature bypass vulnerability exists when Microsoft .NET Framework components do not correctly validate certificates, aka ".NET FrMicrosoft .NET Framework · Microsoft .NET Core +7