# CVEs published 2018-07-12 34 CVEs were published on July 12, 2018: 1 critical, 1 high. Days are UTC. - [CVE-2018-14015](https://cve.now/CVE-2018-14015.md): The sdb\_set\_internal function in sdb.c in radare2 2.7.0 allows remote attackers to cause a denial of service (invalid read and application c (no CVSS) - [CVE-2018-14016](https://cve.now/CVE-2018-14016.md): The r\_bin\_mdmp\_init\_directory\_entry function in mdmp.c in radare2 2.7.0 allows remote attackers to cause a denial of service (heap-based buf (no CVSS) - [CVE-2018-14017](https://cve.now/CVE-2018-14017.md): The r\_bin\_java\_annotation\_new function in shlr/java/class.c in radare2 2.7.0 allows remote attackers to cause a denial of service (heap-base (no CVSS) - [CVE-2018-14012](https://cve.now/CVE-2018-14012.md): WolfSight CMS 3.2 allows SQL injection via the PATH\_INFO to the default URI. (no CVSS) - [CVE-2018-14014](https://cve.now/CVE-2018-14014.md): In waimai Super Cms 20150505, there is a CSRF vulnerability that can add an admin account via admin.php?m=Member&a=adminadd. (no CVSS) - [CVE-2018-12979](https://cve.now/CVE-2018-12979.md): An issue was discovered on WAGO e!DISPLAY 762-3000 through 762-3003 devices with firmware before FW 02. (no CVSS) - [CVE-2018-12980](https://cve.now/CVE-2018-12980.md): An issue was discovered on WAGO e!DISPLAY 762-3000 through 762-3003 devices with firmware before FW 02. (no CVSS) - [CVE-2018-12981](https://cve.now/CVE-2018-12981.md): An issue was discovered on WAGO e!DISPLAY 762-3000 through 762-3003 devices with firmware before FW 02. (no CVSS) - [CVE-2018-13441](https://cve.now/CVE-2018-13441.md): qh\_help in Nagios Core version 4.4.1 and earlier is prone to a NULL pointer dereference vulnerability, which allows attacker to cause a loca (no CVSS) - [CVE-2018-13457](https://cve.now/CVE-2018-13457.md): qh\_echo in Nagios Core 4.4.1 and earlier is prone to a NULL pointer dereference vulnerability, which allows attackers to cause a local denia (no CVSS) - [CVE-2018-13458](https://cve.now/CVE-2018-13458.md): qh\_core in Nagios Core 4.4.1 and earlier is prone to a NULL pointer dereference vulnerability, which allows attackers to cause a local denia (no CVSS) - [CVE-2018-13796](https://cve.now/CVE-2018-13796.md): An issue was discovered in GNU Mailman before 2.1.28. (no CVSS, mailman) - [CVE-2018-5529](https://cve.now/CVE-2018-5529.md): The svpn component of the F5 BIG-IP APM client prior to version 7.1.7 for Linux and Mac OS X runs as a privileged process and can allow an u (no CVSS, F5 Networks BIG-IP APM client for Linux and Mac OSX) - [CVE-2017-14612](https://cve.now/CVE-2017-14612.md): "Shpock Boot Sale & Classifieds" app before 3.17.0 -- aka shpock-boot-sale-classifieds/id557153158 -- for iOS does not verify X.509 certific (no CVSS) - [CVE-2017-14709](https://cve.now/CVE-2017-14709.md): The komoot GmbH "Komoot - Cycling & Hiking Maps" app before 9.3.2 -- aka komoot-cycling-hiking-maps/id447374873 -- for iOS does not verify X (no CVSS) - [CVE-2017-14710](https://cve.now/CVE-2017-14710.md): The Shein Group Ltd. (no CVSS) - [CVE-2018-12463](https://cve.now/CVE-2018-12463.md): MFSBGN03811 rev.1 - Fortify Software Security Center (SSC), Multiple vulnerabilities (CVSS 7.3, Micro Focus Fortify Software Security Center) - [CVE-2018-14009](https://cve.now/CVE-2018-14009.md): Codiad through 2.8.4 allows Remote Code Execution, a different vulnerability than CVE-2017-11366 and CVE-2017-15689. (no CVSS, codiad/codiad) - [CVE-2018-13836](https://cve.now/CVE-2018-13836.md): An integer overflow vulnerability exists in the function multiTransfer of Rocket Coin (XRC), an Ethereum token smart contract. (no CVSS) - [CVE-2018-14001](https://cve.now/CVE-2018-14001.md): An integer overflow vulnerability exists in the function batchTransfer of SHARKTECH (SKT), an Ethereum token smart contract. (no CVSS) - [CVE-2018-14002](https://cve.now/CVE-2018-14002.md): An integer overflow vulnerability exists in the function distribute of MP3 Coin (MP3), an Ethereum token smart contract. (no CVSS) - [CVE-2018-14003](https://cve.now/CVE-2018-14003.md): An integer overflow vulnerability exists in the function batchTransfer of WeMediaChain (WMC), an Ethereum token smart contract. (no CVSS) - [CVE-2018-14004](https://cve.now/CVE-2018-14004.md): An integer overflow vulnerability exists in the function transfer\_tokens\_after\_ICO of GlobeCoin (GLB), an Ethereum token smart contract. (no CVSS) - [CVE-2018-14005](https://cve.now/CVE-2018-14005.md): An integer overflow vulnerability exists in the function transferAny of Malaysia coins (Xmc), an Ethereum token smart contract. (no CVSS) - [CVE-2018-14006](https://cve.now/CVE-2018-14006.md): An integer overflow vulnerability exists in the function multipleTransfer of Neo Genesis Token (NGT), an Ethereum token smart contract. (no CVSS) - [CVE-2017-18155](https://cve.now/CVE-2017-18155.md): While playing HEVC content using HD DMB in Snapdragon Automobile and Snapdragon Mobile in version MSM8996AU, SD 450, SD 625, SD 820, SD 820A (no CVSS, Qualcomm Snapdragon Automobile, Snapdragon Mobile) - [CVE-2018-12540](https://cve.now/CVE-2018-12540.md): In version from 3.0.0 to 3.5.2 of Eclipse Vert.x, the CSRFHandler do not assert that the XSRF Cookie matches the returned XSRF header/form p (no CVSS, The Eclipse Foundation Eclipse Vert.x · io.vertx:vertx-web) - [CVE-2018-1334](https://cve.now/CVE-2018-1334.md): In Apache Spark 1.0.0 to 2.1.2, 2.2.0 to 2.2.1, and 2.3.0, when using PySpark or SparkR, it's possible for a different local user to connect (no CVSS, Apache Software Foundation Apache Spark · pyspark +2) - [CVE-2018-8024](https://cve.now/CVE-2018-8024.md): In Apache Spark 2.1.0 to 2.1.2, 2.2.0 to 2.2.1, and 2.3.0, it's possible for a malicious user to construct a URL pointing to a Spark cluster (no CVSS, Apache Software Foundation Apache Spark · org.apache.spa… +1) - [CVE-2018-10895](https://cve.now/CVE-2018-10895.md): qutebrowser before version 1.4.1 is vulnerable to a cross-site request forgery flaw that allows websites to access 'qute://\*' URLs. (CVSS 9.3, qutebrowser cross-site request forgery flaw allows sites to…) - [CVE-2018-13996](https://cve.now/CVE-2018-13996.md): Genann through 2018-07-08 has a stack-based buffer over-read in genann\_train in genann.c. (no CVSS) - [CVE-2018-13997](https://cve.now/CVE-2018-13997.md): Genann through 2018-07-08 has a SEGV in genann\_run in genann.c. (no CVSS) - [CVE-2018-13998](https://cve.now/CVE-2018-13998.md): ClipperCMS 1.3.3 has stored XSS via the Full Name field of (1) Security -\> Manager Users or (2) Security -\> Web Users. (no CVSS) - [CVE-2018-13999](https://cve.now/CVE-2018-13999.md): Catfish CMS v4.7.9 allows XSS via the admin/Index/write.html editorValue parameter (aka an article posted by an administrator). (no CVSS) --- Source: cve.now, built and run by Sazabi (AI-native observability and security) Page: https://cve.now/daily/2018-07-12 Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.