# CVEs published 2018-07-11

98 CVEs were published on July 11, 2018: 3 critical, 12 high. 1 is now in CISA KEV. Days are UTC.

- [CVE-2016-0708](https://cve.now/CVE-2016-0708.md): Applications deployed to Cloud Foundry, versions v166 through v227, may be vulnerable to a remote disclosure of information, including, but (no CVSS, Cloud Foundry)
- [CVE-2018-11045](https://cve.now/CVE-2018-11045.md): Pivotal Operations Manager, versions 2.1 prior to 2.1.6 and 2.0 prior to 2.0.15 and 1.12 prior to 1.12.22, contains a static Linux Random Nu (no CVSS, Pivotal Operations Manager)
- [CVE-2018-11049](https://cve.now/CVE-2018-11049.md): RSA Identity Governance and Lifecycle Uncontrolled Search Path Vulnerability (no CVSS, Pivotal Operations Manager)
- [CVE-2018-0024](https://cve.now/CVE-2018-0024.md): Junos OS: A privilege escalation vulnerability exists where authenticated users with shell access can become root (CVSS 7.8, Juniper Networks Junos OS)
- [CVE-2018-0025](https://cve.now/CVE-2018-0025.md): Junos OS: SRX Series: Credentials exposed when using HTTP and HTTPS Firewall Pass-through User Authentication (CVSS 6.1, Juniper Networks Junos OS)
- [CVE-2018-0026](https://cve.now/CVE-2018-0026.md): Junos OS: Stateless IP firewall filter rules stop working as expected after reboot or upgrade (CVSS 4.7, Juniper Networks Junos OS)
- [CVE-2018-0027](https://cve.now/CVE-2018-0027.md): Junos OS: Receipt of malformed RSVP packet may lead to RPD denial of service (CVSS 7.5, Juniper Networks Junos OS)
- [CVE-2018-0029](https://cve.now/CVE-2018-0029.md): Junos OS: Kernel crash (vmcore) during broadcast storm after enabling 'monitor traffic interface fxp0' (CVSS 5.7, Juniper Networks Junos OS)
- [CVE-2018-0030](https://cve.now/CVE-2018-0030.md): Junos OS: MPC7/8/9, PTX-FPC3 (FPC-P1, FPC-P2) and PTX1K: Line card may crash upon receipt of specific MPLS packet. (CVSS 7.5, Juniper Networks Junos OS)
- [CVE-2018-0031](https://cve.now/CVE-2018-0031.md): Junos OS: Receipt of specially crafted UDP packets over MPLS may bypass stateless IP firewall rules (CVSS 5.3, Juniper Networks Junos OS)
- [CVE-2018-0032](https://cve.now/CVE-2018-0032.md): Junos OS: RPD crash when receiving a crafted BGP UPDATE (CVSS 7.5, Juniper Networks Junos OS)
- [CVE-2018-0034](https://cve.now/CVE-2018-0034.md): Junos OS: A malicious crafted IPv6 DHCP packet may cause the JDHCPD daemon to core (CVSS 5.3, Juniper Networks Junos OS)
- [CVE-2018-0035](https://cve.now/CVE-2018-0035.md): Junos OS: QFX5200 and QFX10002: Unintended ONIE partition was shipped with certain Junos OS .bin and .iso images (CVSS 4.4, Juniper Networks Junos OS)
- [CVE-2018-0037](https://cve.now/CVE-2018-0037.md): Junos OS: RPD daemon crashes due to receipt of crafted BGP NOTIFICATION messages (CVSS 9.8, Juniper Networks Junos OS)
- [CVE-2018-0038](https://cve.now/CVE-2018-0038.md): Juniper Networks Contrail Service Orchestration releases prior to 3.3.0 have Cassandra service enabled by default with hardcoded credentials (no CVSS)
- [CVE-2018-0039](https://cve.now/CVE-2018-0039.md): Contrail Service Orchestration: Hardcoded credentials for Grafana service (CVSS 6.5, Juniper Networks Contrail Service Orchestration)
- [CVE-2018-0040](https://cve.now/CVE-2018-0040.md): Contrail Service Orchestration: hardcoded cryptographic certificates and keys (CVSS 9.8, Juniper Networks Contrail Service Orchestration)
- [CVE-2018-0041](https://cve.now/CVE-2018-0041.md): Contrail Service Orchestration: Hardcoded credentials for Keystone service. (CVSS 9.8, Juniper Networks Contrail Service Orchestration)
- [CVE-2018-0042](https://cve.now/CVE-2018-0042.md): Juniper Networks CSO versions prior to 4.0.0 may log passwords in log files leading to an information disclosure vulnerability. (no CVSS)
- [CVE-2018-10231](https://cve.now/CVE-2018-10231.md): Cross-site scripting (XSS) vulnerability in TOPdesk before 8.05.017 (June 2018 version) and before 5.7.SR9 allows remote attackers to inject (no CVSS)
- [CVE-2018-10232](https://cve.now/CVE-2018-10232.md): Cross-site request forgery (CSRF) vulnerability in TOPdesk before 8.05.017 (June 2018 version) and before 5.7.SR9 allows remote attackers to (no CVSS)
- [CVE-2018-10633](https://cve.now/CVE-2018-10633.md): Universal Robots Robot Controllers Version CB 3.1, SW Version 3.4.5-100 utilizes hard-coded credentials that may allow an attacker to reset (no CVSS, Universal Robots Robot Controller)
- [CVE-2018-10635](https://cve.now/CVE-2018-10635.md): In Universal Robots Robot Controllers Version CB 3.1, SW Version 3.4.5-100, ports 30001/TCP to 30003/TCP listen for arbitrary URScript code (no CVSS, Universal Robots Robot Controllers)
- [CVE-2013-0589](https://cve.now/CVE-2013-0589.md): IBM iNotes before 8.5.3 Fix Pack 6 and 9.x before 9.0.1 allows remote attackers to bypass the remote image filtering mechanism and obtain se (no CVSS)
- [CVE-2013-0592](https://cve.now/CVE-2013-0592.md): Cross-site scripting (XSS) vulnerability in IBM iNotes before 8.5.3 Fix Pack 6 and 9.x before 9.0.1 allows remote attackers to inject arbitr (no CVSS)
- [CVE-2013-0594](https://cve.now/CVE-2013-0594.md): Open redirect vulnerability in IBM iNotes before 8.5.3 Fix Pack 6 and 9.x before 9.0.1 allows remote attackers to redirect users to arbitrar (no CVSS)
- [CVE-2013-2951](https://cve.now/CVE-2013-2951.md): IBM WebSphere Portal 7.0.0.x and 8.0.0.x write passwords to a trace file when tracing is enabled for the Selfcare Portlet (Profile Managemen (no CVSS)
- [CVE-2013-2972](https://cve.now/CVE-2013-2972.md): IBM WebSphere Cast Iron 6.3 allows remote attackers to bypass intended access restrictions via unspecified vectors. (no CVSS)
- [CVE-2017-16709](https://cve.now/CVE-2017-16709.md): Crestron Airmedia AM-100 devices with firmware before 1.6.0 and AM-101 devices with firmware before 2.7.0 allows remote authenticated admini (no CVSS)
- [CVE-2017-16710](https://cve.now/CVE-2017-16710.md): Cross-site scripting (XSS) vulnerability in Crestron Airmedia AM-100 devices with firmware before 1.6.0 and AM-101 devices with firmware bef (no CVSS)
- [CVE-2018-10197](https://cve.now/CVE-2018-10197.md): There is a time-based blind SQL injection vulnerability in the Access Manager component before 9.18.040 and 10.x before 10.18.040 in ELO ELO (no CVSS)
- [CVE-2018-11529](https://cve.now/CVE-2018-11529.md): VideoLAN VLC media player 2.2.x is prone to a use after free vulnerability which an attacker can leverage to execute arbitrary code via craf (no CVSS)
- [CVE-2018-13989](https://cve.now/CVE-2018-13989.md): Grundig Smart Inter@ctive TV 3.0 devices allow CSRF attacks via a POST request to TCP port 8085 containing a predictable ID value, as demons (no CVSS)
- [CVE-2018-3929](https://cve.now/CVE-2018-3929.md): An exploitable heap corruption exists in the PowerPoint document conversion functionality of the Antenna House Office Server Document Conver (CVSS 8.8, Antenna House)
- [CVE-2018-3930](https://cve.now/CVE-2018-3930.md): In Antenna House Office Server Document Converter version V6.1 Pro MR2 for Linux64 (6,1,2018,0312), a crafted Microsoft Word (DOC) document (CVSS 8.8, Antenna House)
- [CVE-2018-3931](https://cve.now/CVE-2018-3931.md): In Antenna House Office Server Document Converter version V6.1 Pro MR2 for Linux64 (6,1,2018,0312), a crafted Microsoft Word (DOC) document (CVSS 8.8, Antenna House)
- [CVE-2018-3932](https://cve.now/CVE-2018-3932.md): An exploitable stack-based buffer overflow exists in the Microsoft Word document conversion functionality of the Antenna House Office Server (CVSS 8.8, Antenna House)
- [CVE-2018-3933](https://cve.now/CVE-2018-3933.md): An exploitable out-of-bounds write exists in the Microsoft Word document conversion functionality of the Antenna House Office Server Documen (CVSS 8.8, Antenna House)
- [CVE-2018-3936](https://cve.now/CVE-2018-3936.md): In Antenna House Office Server Document Converter version V6.1 Pro MR2 for Linux64 (6,1,2018,0312), a crafted Microsoft Word (DOC) document (CVSS 8.8, Antenna House)
- [CVE-2016-9604](https://cve.now/CVE-2016-9604.md): It was discovered in the Linux kernel before 4.11-rc8 that root can gain direct access to an internal keyring, such as '.dns\_resolver' in RH (CVSS 4.4, kernel security)
- [CVE-2017-7467](https://cve.now/CVE-2017-7467.md): A buffer overflow flaw was found in the way minicom before version 2.7.1 handled VT100 escape sequences. (CVSS 7.0, \[UNKNOWN\] minicom)
- [CVE-2018-0500](https://cve.now/CVE-2018-0500.md): Curl\_smtp\_escape\_eob in lib/smtp.c in curl 7.54.1 to and including curl 7.60.0 has a heap-based buffer overflow that might be exploitable by (no CVSS, curl before)
- [CVE-2018-8007](https://cve.now/CVE-2018-8007.md): Apache CouchDB administrative users can configure the database server via HTTP(S). (no CVSS, Apache Software Foundation Apache CouchDB)
- [CVE-2018-13878](https://cve.now/CVE-2018-13878.md): An XSS issue was discovered in packages/rocketchat-mentions/Mentions.js in Rocket.Chat before 0.65. (no CVSS)
- [CVE-2018-13879](https://cve.now/CVE-2018-13879.md): A reflected XSS issue was discovered in the registration form in Rocket.Chat before 0.66. (no CVSS)
- [CVE-2018-0949](https://cve.now/CVE-2018-0949.md): A security feature bypass vulnerability exists when Microsoft Internet Explorer improperly handles requests involving UNC resources, aka "In (no CVSS, Microsoft Internet Explorer)
- [CVE-2018-8125](https://cve.now/CVE-2018-8125.md): A remote code execution vulnerability exists when Microsoft Edge improperly accesses objects in memory, aka "Microsoft Edge Memory Corruptio (no CVSS, Microsoft Edge)
- [CVE-2018-8171](https://cve.now/CVE-2018-8171.md): A Security Feature Bypass vulnerability exists in ASP.NET when the number of incorrect login attempts is not validated, aka "ASP.NET Securit (no CVSS, Microsoft ASP.NET · Microsoft.AspNetCore.Identity)
- [CVE-2018-8172](https://cve.now/CVE-2018-8172.md): A remote code execution vulnerability exists in Visual Studio software when the software does not check the source markup of a file for an u (no CVSS, Microsoft Visual Studio · Microsoft Expression Blend)
- [CVE-2018-8202](https://cve.now/CVE-2018-8202.md): An elevation of privilege vulnerability exists in .NET Framework which could allow an attacker to elevate their privilege level, aka ".NET F (no CVSS, Microsoft .NET Framework)
- [CVE-2018-8206](https://cve.now/CVE-2018-8206.md): A denial of service vulnerability exists when Windows improperly handles File Transfer Protocol (FTP) connections, aka "Windows FTP Server D (no CVSS, Microsoft Windows)
- [CVE-2018-8222](https://cve.now/CVE-2018-8222.md): A security feature bypass vulnerability exists in Device Guard that could allow an attacker to inject malicious code into a Windows PowerShe (no CVSS, Microsoft Windows Server · Microsoft Windows)
- [CVE-2018-8232](https://cve.now/CVE-2018-8232.md): A Tampering vulnerability exists when Microsoft Macro Assembler improperly validates code, aka "Microsoft Macro Assembler Tampering Vulnerab (no CVSS, Microsoft Visual Studio)
- [CVE-2018-8238](https://cve.now/CVE-2018-8238.md): A security feature bypass vulnerability exists when Skype for Business or Lync do not properly parse UNC path links shared via messages, aka (no CVSS, Microsoft Skype · Microsoft Lync)
- [CVE-2018-8242](https://cve.now/CVE-2018-8242.md): A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Internet Explorer, aka "Scrip (no CVSS, Microsoft Internet Explorer)
- [CVE-2018-8260](https://cve.now/CVE-2018-8260.md): A Remote Code Execution vulnerability exists in .NET software when the software fails to check the source markup of a file, aka ".NET Framew (no CVSS, Microsoft .NET Framework)
- [CVE-2018-8262](https://cve.now/CVE-2018-8262.md): A remote code execution vulnerability exists when Microsoft Edge improperly accesses objects in memory, aka "Microsoft Edge Memory Corruptio (no CVSS, Microsoft Edge)
- [CVE-2018-8274](https://cve.now/CVE-2018-8274.md): A remote code execution vulnerability exists when Microsoft Edge improperly accesses objects in memory, aka "Microsoft Edge Memory Corruptio (no CVSS, Microsoft Edge)
- [CVE-2018-8275](https://cve.now/CVE-2018-8275.md): A remote code execution vulnerability exists when Microsoft Edge improperly accesses objects in memory, aka "Microsoft Edge Memory Corruptio (no CVSS, Microsoft Edge · Microsoft ChakraCore)
- [CVE-2018-8276](https://cve.now/CVE-2018-8276.md): A security feature bypass vulnerability exists in the Microsoft Chakra scripting engine that allows Control Flow Guard (CFG) to be bypassed, (no CVSS, Microsoft Edge · Microsoft ChakraCore +1)
- [CVE-2018-8278](https://cve.now/CVE-2018-8278.md): A spoofing vulnerability exists when Microsoft Edge improperly handles specific HTML content, aka "Microsoft Edge Spoofing Vulnerability." T (no CVSS, Microsoft Edge)
- [CVE-2018-8279](https://cve.now/CVE-2018-8279.md): A remote code execution vulnerability exists when Microsoft Edge improperly accesses objects in memory, aka "Microsoft Edge Memory Corruptio (no CVSS, Microsoft Edge · Microsoft ChakraCore)
- [CVE-2018-8280](https://cve.now/CVE-2018-8280.md): A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka "C (no CVSS, Microsoft Edge · Microsoft ChakraCore +1)
- [CVE-2018-8281](https://cve.now/CVE-2018-8281.md): A remote code execution vulnerability exists in Microsoft Office software when the software fails to properly handle objects in memory, aka (no CVSS, Microsoft Excel Viewer · Microsoft PowerPoint Viewer +1)
- [CVE-2018-8282](https://cve.now/CVE-2018-8282.md): An elevation of privilege vulnerability exists in Windows when the Windows kernel-mode driver fails to properly handle objects in memory, ak (no CVSS, Microsoft Windows)
- [CVE-2018-8283](https://cve.now/CVE-2018-8283.md): A remote code execution vulnerability exists in the way that the ChakraCore scripting engine handles objects in memory, aka "Scripting Engin (no CVSS, Microsoft ChakraCore · Microsoft.ChakraCore)
- [CVE-2018-8284](https://cve.now/CVE-2018-8284.md): A remote code execution vulnerability exists when the Microsoft .NET Framework fails to validate input properly, aka ".NET Framework Remote (no CVSS, Microsoft .NET Framework)
- [CVE-2018-8286](https://cve.now/CVE-2018-8286.md): A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka "C (no CVSS, Microsoft Edge · Microsoft ChakraCore +1)
- [CVE-2018-8287](https://cve.now/CVE-2018-8287.md): A remote code execution vulnerability exists in the way the scripting engine handles objects in memory in Microsoft browsers, aka "Scripting (no CVSS, Microsoft ChakraCore · Microsoft Internet Explorer +2)
- [CVE-2018-8288](https://cve.now/CVE-2018-8288.md): A remote code execution vulnerability exists in the way the scripting engine handles objects in memory in Microsoft browsers, aka "Scripting (no CVSS, Microsoft ChakraCore · Microsoft Internet Explorer +2)
- [CVE-2018-8289](https://cve.now/CVE-2018-8289.md): An information disclosure vulnerability exists when Microsoft Edge improperly handles objects in memory, aka "Microsoft Edge Information Dis (no CVSS, Microsoft Edge)
- [CVE-2018-8290](https://cve.now/CVE-2018-8290.md): A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka "C (no CVSS, Microsoft Edge · Microsoft ChakraCore +1)
- [CVE-2018-8291](https://cve.now/CVE-2018-8291.md): A remote code execution vulnerability exists in the way the scripting engine handles objects in memory in Microsoft browsers, aka "Scripting (no CVSS, Microsoft ChakraCore · Microsoft Internet Explorer +2)
- [CVE-2018-8294](https://cve.now/CVE-2018-8294.md): A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka "C (no CVSS, Microsoft Edge · Microsoft ChakraCore +1)
- [CVE-2018-8296](https://cve.now/CVE-2018-8296.md): A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Internet Explorer, aka "Scrip (no CVSS, Microsoft Internet Explorer)
- [CVE-2018-8297](https://cve.now/CVE-2018-8297.md): An information disclosure vulnerability exists when Microsoft Edge improperly handles objects in memory, aka "Microsoft Edge Information Dis (no CVSS, Microsoft Edge)
- [CVE-2018-8298](https://cve.now/CVE-2018-8298.md): A remote code execution vulnerability exists in the way that the ChakraCore scripting engine handles objects in memory, aka "Scripting Engin (CVSS 7.5, KEV, Microsoft ChakraCore · Microsoft.ChakraCore)
- [CVE-2018-8299](https://cve.now/CVE-2018-8299.md): An elevation of privilege vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request t (no CVSS, Microsoft SharePoint)
- [CVE-2018-8300](https://cve.now/CVE-2018-8300.md): A remote code execution vulnerability exists in Microsoft SharePoint when the software fails to check the source markup of an application pa (no CVSS, Microsoft SharePoint)
- [CVE-2018-8301](https://cve.now/CVE-2018-8301.md): A remote code execution vulnerability exists when Microsoft Edge improperly accesses objects in memory, aka "Microsoft Edge Memory Corruptio (no CVSS, Microsoft Edge)
- [CVE-2018-8304](https://cve.now/CVE-2018-8304.md): A denial of service vulnerability exists in Windows Domain Name System (DNS) DNSAPI.dll when it fails to properly handle DNS responses, aka (no CVSS, Microsoft Windows)
- [CVE-2018-8305](https://cve.now/CVE-2018-8305.md): An information disclosure vulnerability exists in Windows Mail Client when a message is opened, aka "Windows Mail Client Information Disclos (no CVSS, Microsoft Mail, Calendar, and People in Windows 8.1 App Sto…)
- [CVE-2018-8306](https://cve.now/CVE-2018-8306.md): A command injection vulnerability exists in the Microsoft Wireless Display Adapter (MWDA) when the Microsoft Wireless Display Adapter does n (no CVSS, Microsoft Wireless Display Adapter V2 Software)
- [CVE-2018-8307](https://cve.now/CVE-2018-8307.md): A security feature bypass vulnerability exists when Microsoft WordPad improperly handles embedded OLE objects, aka "WordPad Security Feature (no CVSS, Microsoft Windows)
- [CVE-2018-8308](https://cve.now/CVE-2018-8308.md): An elevation of privilege vulnerability exists when the Windows kernel fails to properly handle objects in memory, aka "Windows Kernel Eleva (no CVSS, Microsoft Windows)
- [CVE-2018-8309](https://cve.now/CVE-2018-8309.md): A denial of service vulnerability exists when Windows improperly handles objects in memory, aka "Windows Denial of Service Vulnerability." T (no CVSS, Microsoft Windows)
- [CVE-2018-8310](https://cve.now/CVE-2018-8310.md): A tampering vulnerability exists when Microsoft Outlook does not properly handle specific attachment types when rendering HTML emails, aka " (no CVSS, Microsoft Word · Microsoft Office)
- [CVE-2018-8311](https://cve.now/CVE-2018-8311.md): A remote code execution vulnerability exists when Skype for Business and Microsoft Lync clients fail to properly sanitize specially crafted (no CVSS, Microsoft Skype · Microsoft Lync)
- [CVE-2018-8312](https://cve.now/CVE-2018-8312.md): A remote code execution vulnerability exists when Microsoft Access fails to properly handle objects in memory, aka "Microsoft Access Remote (no CVSS, Microsoft Access · Microsoft Office)
- [CVE-2018-8313](https://cve.now/CVE-2018-8313.md): An elevation of privilege vulnerability exists in the way that the Windows Kernel API enforces permissions, aka "Windows Elevation of Privil (no CVSS, Microsoft Windows Server 2012 R2 · Microsoft Windows RT +2)
- [CVE-2018-8314](https://cve.now/CVE-2018-8314.md): An elevation of privilege vulnerability exists when Windows fails a check, allowing a sandbox escape, aka "Windows Elevation of Privilege Vu (no CVSS, Microsoft Windows)
- [CVE-2018-8319](https://cve.now/CVE-2018-8319.md): A Security Feature Bypass vulnerability exists in MSR JavaScript Cryptography Library that is caused by incorrect arithmetic computations, a (no CVSS, Microsoft Research JavaScript Cryptography Library · msrcry…)
- [CVE-2018-8323](https://cve.now/CVE-2018-8323.md): An elevation of privilege vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request t (no CVSS, Microsoft SharePoint)
- [CVE-2018-8324](https://cve.now/CVE-2018-8324.md): An information disclosure vulnerability exists when Microsoft Edge improperly handles objects in memory, aka "Microsoft Edge Information Dis (no CVSS, Microsoft Edge)
- [CVE-2018-8325](https://cve.now/CVE-2018-8325.md): An information disclosure vulnerability exists when Microsoft Edge improperly handles objects in memory, aka "Microsoft Edge Information Dis (no CVSS, Microsoft Edge)
- [CVE-2018-8326](https://cve.now/CVE-2018-8326.md): A cross-site-scripting (XSS) vulnerability exists when an open source customization for Microsoft Active Directory Federation Services (AD F (no CVSS, Microsoft Web Customizations)
- [CVE-2018-8327](https://cve.now/CVE-2018-8327.md): A remote code execution vulnerability exists in PowerShell Editor Services, aka "PowerShell Editor Services Remote Code Execution Vulnerabil (no CVSS, Microsoft PowerShell Editor · Microsoft PowerShell Extension)
- [CVE-2018-8356](https://cve.now/CVE-2018-8356.md): A security feature bypass vulnerability exists when Microsoft .NET Framework components do not correctly validate certificates, aka ".NET Fr (no CVSS, Microsoft .NET Framework · Microsoft .NET Core +7)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2018-07-11
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.