CVEs published July 13, 2018
86 CVEs were published on July 13, 2018: 1 critical, 1 high.
- Published
- 86
- Critical
- 1
- High
- 1
- Medium
- 3
- Low
- 1
- Unrated
- 80
- Now in CISA KEV
- 0
- Fix available
- 16
Most affected products
- IEEE Standard
- 7
- iTrack Easy
- 5
- PHP FormMail Generator
- 5
- Hughes Satellite Modem HN7740S · Hughes Satellite Modem… +1
- 4
- ManageEngine Applications Manager
- 3
- Accellion FTP Server
- 2
- ASUS RP-AC52 Access Point
- 2
- bootstrap · org.webjars:bootstrap +3
- 2
- IBM Security Identity Governance and Intelligence
- 2
- Microsoft Windows SecureConnector agent
- 2
Critical 1
High 1
Medium, low and unrated 84
- CVE-2013-0570The Fibre Channel over Ethernet (FCoE) feature in IBM System Networking and Blade Network Technology (BNT) switches running IBM Networking O
- CVE-2016-6542The MAC address/device tracking ID of an iTrack Easy can be obtained within range of the deviceiTrack Easy
- CVE-2016-6543A captured MAC/device ID of an iTrack Easy can be registered under multiple user accounts allowing access to getgps GPS dataiTrack Easy
- CVE-2016-6544iTrack Easy's getgps data can be modified without authenticationiTrack Easy
- CVE-2016-6545iTrack Easy does not use session cookies to maintain sessions and POSTs the users password over HTTPS for each requestiTrack Easy
- CVE-2016-6546iTrack Easy mobile application stores the user password in base-64 encoding/cleartextiTrack Easy
- CVE-2016-6547Zizai Tech Nut stores the account password in cleartextZizai Technology Tech Nut Mobile Application
- CVE-2016-6548Zizai Tech Nut mobile application makes requests using HTTP, which includes the users session tokenZizai Technology Tech Nut Mobile Application
- CVE-2016-6549Zizai Tech Nut allows for unauthenticated Bluetooth pairingZizai Technology Tech Nut
- CVE-2016-6551Intellian Satellite TV antennas t-Series and v-Series, firmware version 1.07, uses default credentialsIntellian Satellite TV Antennas
- CVE-2016-6552Green Packet DX-350 uses default credentialsGreen Packet WiFi Access Point
- CVE-2016-6553Nuuo NT-4040 Titan, firmware NT-4040_01.07.0000.0015_1120, uses default credentialsNuuo NT-4040 Titan
- CVE-2016-6554Synology NAS servers DS107, DS116, and DS213, use default credentialsSynology NAS server DS107 · Synology NAS server DS116 +1
- CVE-2016-6557The ASUS RP-AC52 access point, firmware version 1.0.1.1s and possibly earlier, is vulnerable to cross-site request forgeryASUS RP-AC52 Access Point
- CVE-2016-6558The ASUS RP-AC52 access point, firmware version 1.0.1.1s and possibly earlier, is vulnerable to command injectionASUS RP-AC52 Access Point
- CVE-2016-6559The BSD libc library's link_ntoa() function may be vulnerable to a classic buffer overflowBSD libc library
- CVE-2016-6562ShoreTel Mobility Client for iOS and Android, version 9.1.3.109 and earlier, fails to properly validate SSL certificates provided by HTTPS connectionsShoreTel Mobility Client iOS · ShoreTel Mobility Client And…
- CVE-2016-6563D-Link DIR routers contain a stack-based buffer overflow in the HNAP Login actionD-Link DIR-823 · D-Link DIR-822 +7
- CVE-2016-6564Ragentek Android software contains an over-the-air update mechanism that communicates over an unencrypted channel, which can allow a remote attacker to execute arbitrary code with root privilegesRagentek Android software
- CVE-2016-6565The Imagely NextGen Gallery plugin for Wordpress prior to version 2.1.57 may execute code from an uploaded malicious fileImagely NextGen Gallery plugin
- CVE-2016-6566The Sungard eTRAKiT3 software version 3.2.1.17 may be vulnerable to SQL injection which may allow a remote unauthenticated attacker to run a subset of SQL commands against the back-end databaseSungard eTRAKiT3
- CVE-2016-6567SHDesigns' Resident Download Manager (as well as the Ethernet Download Manager) does not authenticate firmware downloads before executing code and deploying them to devicesSHDesigns Resident Download Manager · SHDesigns Ethernet Do…
- CVE-2016-6578CodeLathe FileCloud, version 13.0.0.32841 and earlier, is vulnerable to cross-site request forgery (CSRF)CodeLathe FileCloud
- CVE-2016-9482PHP FormMail Generator generates PHP code for standard web forms, and the code generated is vulnerable to authentication bypassPHP FormMail Generator
- CVE-2016-9483PHP FormMail Generator generates PHP code for standard web forms, and the code generated is vulnerable to unsafe deserialization of untrusted dataPHP FormMail Generator
- CVE-2016-9484PHP FormMail Generator generates PHP code for standard web forms, and the code generated does not properly validate user input folder directories and is vulnerable to path traversalPHP FormMail Generator
- CVE-2016-9485On Windows endpoints, the SecureConnector agent is vulnerable to privilege escalation whereby an authenticated unprivileged user can obtain administrator privileges on the endpoint because it fails to set any permissions on downloaded file objectsMicrosoft Windows SecureConnector agent
- CVE-2016-9486On Windows endpoints, the SecureConnector agent is vulnerable to privilege escalation whereby an authenticated unprivileged user can obtain administrator privileges on the endpoint because files are created in a folder with incorrect privilegesMicrosoft Windows SecureConnector agent
- CVE-2016-9487EpubCheck 4.0.1 is vulnerable to external XML entity processing attacksEpubCheck
- CVE-2016-9489ManageEngine Applications Manager 12 and 13 is vulnerable to privilege escalation and authentication bypassManageEngine Applications Manager
- CVE-2016-9491ManageEngine Applications Manager 12 and 13 is vulnerable to privilege escalation due to improper restriction of an XML external entityManageEngine Applications Manager
- CVE-2016-9492PHP forms generated using the PHP FormMail Generator are vulnerable to unrestricted upload of dangerous file typesPHP FormMail Generator
- CVE-2016-9493PHP forms generated using the PHP FormMail Generator are vulnerable to stored cross-site scriptingPHP FormMail Generator
- CVE-2016-9494Hughes high-performance broadband satellite modems, models HN7740S DW7000 HN7000S/SM, are potentially vulnerable to improper input validation, potentially leading to denial of serviceHughes Satellite Modem HN7740S · Hughes Satellite Modem… +1
- CVE-2016-9495Hughes high-performance broadband satellite modems, models HN7740S DW7000 HN7000S/SM, uses hard coded credentialsHughes Satellite Modem HN7740S · Hughes Satellite Modem… +1
- CVE-2016-9496Hughes high-performance broadband satellite modems, models HN7740S DW7000 HN7000S/SM, lacks authentication to access certain pagesHughes Satellite Modem HN7740S · Hughes Satellite Modem… +1
- CVE-2016-9497Hughes high-performance broadband satellite modems, models HN7740S DW7000 HN7000S/SM, is vulnerable to an authentication bypass using an alternate path or channelHughes Satellite Modem HN7740S · Hughes Satellite Modem… +1
- CVE-2016-9498ManageEngine Applications Manager 12 and 13, allows unserialization of unsafe Java objectsManageEngine Applications Manager
- CVE-2016-9499The Accellion FTP server prior to version FTA_9_12_220 is vulnerable to cross-site scripting.Accellion FTP Server
- CVE-2016-9500The Accellion FTP server prior to version FTA_9_12_220 is vulnerable to informaiton exposureAccellion FTP Server
- CVE-2017-13091The P1735 IEEE standard describes flawed methods for encrypting electronic-design intellectual property (IP), including improperly specified padding in CBC mode allows use of an EDA tool as a decryption oracleIEEE Standard
- CVE-2017-13092The P1735 IEEE standard describes flawed methods for encrypting electronic-design intellectual property (IP), including improperly specified HDL syntax allows use of an EDA tool as a decryption oracleIEEE Standard
- CVE-2017-13093The P1735 IEEE standard describes flawed methods for encrypting electronic-design intellectual property (IP), including modification of encrypted IP cyphertext to insert hardware trojansIEEE Standard
- CVE-2017-13094The P1735 IEEE standard describes flawed methods for encrypting electronic-design intellectual property (IP), including modification of the encryption key and insertion of hardware trojans in any IPIEEE Standard
- CVE-2017-13095The P1735 IEEE standard describes flawed methods for encrypting electronic-design intellectual property (IP), including modification of a license-deny response to a license grantIEEE Standard
- CVE-2017-13096The P1735 IEEE standard describes flawed methods for encrypting electronic-design intellectual property (IP), including modification of Rights Block to remove or relax access controlIEEE Standard
- CVE-2017-13097The P1735 IEEE standard describes flawed methods for encrypting electronic-design intellectual property (IP), including modification of Rights Block to remove or relax license requirementIEEE Standard
- CVE-2018-10631Medtronic N'Vision Clinician Programmer Protection Mechanism FailureMedtronic 8840 N’Vision Clinician Programmer · Medtronic 88…
- CVE-2018-8847Eaton 9000X DriveA versions 2.0.29 and prior has a stack-based buffer overflow vulnerability, which may allow remote code execution.ICS-CERT Eaton 9000X Drive
- CVE-2018-1000206JFrog Artifactory version since 5.11 contains a Cross ite Request Forgery (CSRF) vulnerability in UI rest endpoints that can result in Class
- CVE-2018-1000207MODX Revolution version <=2.6.4 contains a Incorrect Access Control vulnerability in Filtering user parameters before passing them into phptmodx/revolution
- CVE-2018-1000208MODX Revolution version <=2.6.4 contains a Directory Traversal vulnerability in /core/model/modx/modmanagerrequest.class.php that can result
- CVE-2018-1000209Sensu, Inc.
- CVE-2018-1000210YamlDotNet version 4.3.2 and earlier contains a Insecure Direct Object Reference vulnerability in The default behavior of Deserializer.DeserYamlDotNet · YamlDotNet.Signed
- CVE-2018-1000211Doorkeeper version 4.2.0 and later contains a Incorrect Access Control vulnerability in Token revocation API's authorized method that can redoorkeeper
- CVE-2018-10018The GDASPAMLib.AntiSpam ActiveX control ASK\GDASpam.dll in G DATA Total Security 25.4.0.3 has a buffer overflow via a long IsBlackListed arg
- CVE-2018-10098In MicroWorld eScan Internet Security Suite (ISS) for Business 14.0.1400.2029, the driver econceal.sys allows a non-privileged user to send
- CVE-2018-1255Reflected Cross-Site Scripting VulnerabilityRSA Identity Governance and Lifecycle
- CVE-2018-7535An issue was discovered in TotalAV v4.1.7.
- CVE-2017-1367IBM Security Identity Governance and Intelligence Virtual Appliance 5.2 through 5.2.3.2 stores sensitive information in URL parameters.IBM Security Identity Governance and Intelligence
- CVE-2017-1395IBM Security Identity Governance and Intelligence Virtual Appliance 5.2 through 5.2.3.2 could allow a remote attacker to obtain sensitive inIBM Security Identity Governance and Intelligence
- CVE-2018-14047An issue has been found in PNGwriter 0.7.0.
- CVE-2018-14048An issue has been found in libpng 1.6.34.
- CVE-2018-14049An issue has been found in libwav through 2017-04-20.
- CVE-2018-14050An issue has been found in libwav through 2017-04-20.
- CVE-2018-14051The function wav_read in libwav.c in libwav through 2017-04-20 has an infinite loop.
- CVE-2018-14052An issue has been found in libwav through 2017-04-20.
- CVE-2018-9067The Lenovo Help Android app versions earlier than 6.1.2.0327 had insufficient access control for some functions which, if exploited, could hLenovo Group Lenovo Help Android application
- CVE-2018-9070For the Lenovo Smart Assistant Android app versions earlier than 12.1.82, an attacker with physical access to the smart speaker can, by presLenovo Group Lenovo Smart Assistant
- CVE-2018-14044The RateTransposer::setChannels function in RateTransposer.cpp in libSoundTouch.a in Olli Parviainen SoundTouch 2.0 allows remote attackers
- CVE-2018-14045The FIRFilter::evaluateFilterMulti function in FIRFilter.cpp in libSoundTouch.a in Olli Parviainen SoundTouch 2.0 allows remote attackers to
- CVE-2018-14046Exiv2 0.26 has a heap-based buffer over-read in WebPImage::decodeChunks in webpimage.cpp.
- CVE-2018-14040In Bootstrap before 4.1.2, XSS is possible in the collapse data-parent attribute.bootstrap · org.webjars:bootstrap +3
- CVE-2018-14041In Bootstrap before 4.1.2, XSS is possible in the data-target property of scrollspy.bootstrap · typo3/cms-core +4
- CVE-2018-14042In Bootstrap before 4.1.2, XSS is possible in the data-container property of tooltip.bootstrap · org.webjars:bootstrap +3
- CVE-2018-14043mstdlib (aka the M Standard Library for C) 1.2.0 has incorrect file access control in situations where M_fs_perms_can_access attempts to del
- CVE-2018-6969VMware Tools (10.x and prior before 10.3.0) contains an out-of-bounds read vulnerability in HGFS.VMware Tools
- CVE-2018-14036Directory Traversal with ../ sequences occurs in AccountsService before 0.6.50 because of an insufficient path check in user_change_icon_fil
- CVE-2018-14029CSRF vulnerability in admin/user/edit in Creatiwity wityCMS 0.6.2 allows an attacker to take over a user account, as demonstrated by modifyi
- CVE-2018-14031An issue was discovered in the HDF HDF5 1.8.20 library.
- CVE-2018-14033An issue was discovered in the HDF HDF5 1.8.20 library.
- CVE-2018-14034An issue was discovered in the HDF HDF5 1.8.20 library.
- CVE-2018-14035An issue was discovered in the HDF HDF5 1.8.20 library.
- CVE-2018-14054A double free exists in the MP4StringProperty class in mp4property.cpp in MP4v2 2.0.0.