# CVEs published 2018-07-15

12 CVEs were published on July 15, 2018: 0 critical, 0 high. Days are UTC.

- [CVE-2018-14072](https://cve.now/CVE-2018-14072.md): libsixel 1.8.1 has a memory leak in sixel\_decoder\_decode in decoder.c, image\_buffer\_resize in fromsixel.c, and sixel\_decode\_raw in fromsixel (no CVSS)
- [CVE-2018-14073](https://cve.now/CVE-2018-14073.md): libsixel 1.8.1 has a memory leak in sixel\_allocator\_new in allocator.c. (no CVSS)
- [CVE-2018-14068](https://cve.now/CVE-2018-14068.md): An issue was discovered in SRCMS V2.3.1. (no CVSS)
- [CVE-2018-14069](https://cve.now/CVE-2018-14069.md): An issue was discovered in SRCMS V2.3.1. (no CVSS)
- [CVE-2018-14066](https://cve.now/CVE-2018-14066.md): The content://wappush content provider in com.android.provider.telephony, as found in some custom ROMs for Android phones, allows SQL inject (no CVSS)
- [CVE-2018-14063](https://cve.now/CVE-2018-14063.md): The increaseApproval function of a smart contract implementation for Tracto (TRCT), an Ethereum ERC20 token, has an integer overflow. (no CVSS)
- [CVE-2018-14064](https://cve.now/CVE-2018-14064.md): The uc-http service 1.0.0 on VelotiSmart WiFi B-380 camera devices allows Directory Traversal, as demonstrated by /../../etc/passwd on TCP p (no CVSS)
- [CVE-2018-14065](https://cve.now/CVE-2018-14065.md): XMLReader.php in PHPOffice Common before 0.2.9 allows XXE. (no CVSS, phpoffice/common)
- [CVE-2018-14010](https://cve.now/CVE-2018-14010.md): OS command injection in the guest Wi-Fi settings feature in /cgi-bin/luci on Xiaomi R3P before 2.14.5, R3C before 2.12.15, R3 before 2.22.15 (no CVSS)
- [CVE-2018-14060](https://cve.now/CVE-2018-14060.md): OS command injection in the AP mode settings feature in /cgi-bin/luci /api/misystem/set\_router\_wifiap on Xiaomi R3D before 2.26.4 devices al (no CVSS)
- [CVE-2018-14055](https://cve.now/CVE-2018-14055.md): ZNC before 1.7.1-rc1 does not properly validate untrusted lines coming from the network, allowing a non-admin user to escalate his privilege (no CVSS)
- [CVE-2018-14056](https://cve.now/CVE-2018-14056.md): ZNC before 1.7.1-rc1 is prone to a path traversal flaw via ../ in a web skin name to access files outside of the intended skins directories. (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2018-07-15
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.