CVEs published July 16, 2018
44 CVEs were published on July 16, 2018: 0 critical, 1 high.
- Published
- 44
- Critical
- 0
- High
- 1
- Medium
- 6
- Low
- 0
- Unrated
- 37
- Now in CISA KEV
- 0
- Fix available
- 3
Most affected products
- QNAP Q'center Virtual Appliance
- 5
- [UNKNOWN] git-annex
- 2
- Cisco Firepower unknown
- 2
- Cisco FireSIGHT unknown
- 2
- ClamAV before 0.100.1 unknown
- 2
- [UNKNOWN] atomic-openshift
- 1
- [UNKNOWN] curl
- 1
- [UNKNOWN] infinispan · org.infinispan:infinispan-server-core
- 1
- [UNKNOWN] pdns
- 1
- Atlassian Jira
- 1
High 1
Medium, low and unrated 43
- CVE-2017-15137The OpenShift image import whitelist failed to enforce restrictions correctly when running commands such as "oc tag", for example.[UNKNOWN] atomic-openshift
- CVE-2017-17541A Cross-site Scripting (XSS) vulnerability in Fortinet FortiManager 6.0.0, 5.6.4 and below versions, FortiAnalyzer 6.0.0, 5.6.4 and below veFortinet FortiManager, FortiAnalyzer
- CVE-2018-10840Linux kernel is vulnerable to a heap-based buffer overflow in the fs/ext4/xattr.c:ext4_xattr_set_entry() function.kernel heap-based buffer overflow in fs/ext4/xattr.c
- CVE-2018-10857git-annex is vulnerable to a private data exposure and exfiltration attack.[UNKNOWN] git-annex
- CVE-2018-12584The ConnectionBase::preparseNewBytes function in resip/stack/ConnectionBase.cxx in reSIProcate through 1.10.2 allows remote attackers to cau
- CVE-2018-13832Multiple Persistent cross-site scripting (XSS) issues in the Techotronic all-in-one-favicon (aka All In One Favicon) plugin 4.6 for WordPres
- CVE-2018-10859git-annex is vulnerable to an Information Exposure when decrypting files.[UNKNOWN] git-annex
- CVE-2018-14324The demo feature in Oracle GlassFish Open Source Edition 5.0 has TCP port 7676 open by default with a password of admin for the admin accoun
- CVE-2018-0341A vulnerability in the web-based UI of Cisco IP Phone 6800, 7800, and 8800 Series with Multiplatform Firmware before 11.2(1) could allow an Cisco IP Phone 6800, 7800, and 8800 unknown
- CVE-2018-0360ClamAV before 0.100.1 has an HWP integer overflow with a resultant infinite loop via a crafted Hangul Word Processor file.ClamAV before 0.100.1 unknown
- CVE-2018-0361ClamAV before 0.100.1 lacks a PDF object length check, resulting in an unreasonably long time to parse a relatively small file.ClamAV before 0.100.1 unknown
- CVE-2018-0366A vulnerability in the web-based management interface of Cisco Web Security Appliance (WSA) could allow an unauthenticated, remote attacker Cisco Web Security Appliance unknown
- CVE-2018-0368A vulnerability in Cisco Digital Network Architecture (DNA) Center could allow an authenticated, local attacker to access sensitive informatCisco Digital Network Architecture Center unknown
- CVE-2018-0369A vulnerability in the reassembly logic for fragmented IPv4 packets of Cisco StarOS running on virtual platforms could allow an unauthenticaCisco StarOS unknown
- CVE-2018-0370A vulnerability in the detection engine of Cisco Firepower System Software could allow an unauthenticated, remote attacker to cause one of tCisco Firepower unknown
- CVE-2018-0383A vulnerability in the detection engine of Cisco FireSIGHT System Software could allow an unauthenticated, remote attacker to bypass a file Cisco FireSIGHT unknown
- CVE-2018-0384A vulnerability in the detection engine of Cisco FireSIGHT System Software could allow an unauthenticated, remote attacker to bypass a URL-bCisco FireSIGHT unknown
- CVE-2018-0385A vulnerability in the detection engine parsing of Security Socket Layer (SSL) protocol packets for Cisco Firepower System Software could alCisco Firepower unknown
- CVE-2018-5239Norton App Lock prior to v1.3.0.332 can be susceptible to a bypass exploit.Symantec Norton App Lock
- CVE-2018-0706Exposure of Private Information in QNAP Q'center Virtual Appliance version 1.7.1063 and earlier could allow authenticated users to access seQNAP Q'center Virtual Appliance
- CVE-2018-0707Command injection vulnerability in change password of QNAP Q'center Virtual Appliance version 1.7.1063 and earlier could allow authenticatedQNAP Q'center Virtual Appliance
- CVE-2018-0708Command injection vulnerability in networking of QNAP Q'center Virtual Appliance version 1.7.1063 and earlier could allow authenticated userQNAP Q'center Virtual Appliance
- CVE-2018-0709Command injection vulnerability in date of QNAP Q'center Virtual Appliance version 1.7.1063 and earlier could allow authenticated users to rQNAP Q'center Virtual Appliance
- CVE-2018-0710Command injection vulnerability in SSH of QNAP Q'center Virtual Appliance version 1.7.1063 and earlier could allow authenticated users to ruQNAP Q'center Virtual Appliance
- CVE-2013-0522The Notes Client Single Logon feature in IBM Notes 8.0, 8.0.1, 8.0.2, 8.5, 8.5.1, 8.5.2, 8.5.3, and 9.0 on Windows allows local users to dis
- CVE-2014-2079X File Explorer (aka xfe) might allow local users to bypass intended access restrictions and gain access to arbitrary files by leveraging fa
- CVE-2018-11716An issue was discovered in Zoho ManageEngine Desktop Central before 100230.
- CVE-2018-11717An issue was discovered in Zoho ManageEngine Desktop Central before 100251.
- CVE-2018-13980The websites that were built from Zeta Producer Desktop CMS before 14.2.1 are vulnerable to unauthenticated file disclosure if the plugin "f
- CVE-2018-13981The websites that were built from Zeta Producer Desktop CMS before 14.2.1 are vulnerable to unauthenticated remote code execution due to a d
- CVE-2017-2638It was found that the REST API in Infinispan before version 9.0.0 did not properly enforce auth constraints.[UNKNOWN] infinispan · org.infinispan:infinispan-server-core
- CVE-2017-7468In curl and libcurl 7.52.0 to and including 7.53.1, libcurl would attempt to resume a TLS session even if the client certificate had changed[UNKNOWN] curl
- CVE-2018-13387The IncomingMailServers resource in Atlassian JIRA Server before version 7.6.7, from version 7.7.0 before version 7.7.5, from version 7.8.0 Atlassian Jira
- CVE-2018-14071The Geo Mashup plugin before 1.10.4 for WordPress has insufficient sanitization of post editor and other user input.
- CVE-2018-5229The NotificationRepresentationFactoryImpl class in Atlassian Universal Plugin Manager before version 2.22.9 allows remote attackers to injecAtlassian Universal Plugin Manager
- CVE-2018-14084An issue was discovered in a smart contract implementation for MKCB, an Ethereum token.
- CVE-2018-14085An issue was discovered in a smart contract implementation for UserWallet 0x0a7bca9FB7AfF26c6ED8029BB6f0F5D291587c42, an Ethereum token.
- CVE-2018-14086An issue was discovered in a smart contract implementation for SingaporeCoinOrigin (SCO), an Ethereum token.
- CVE-2018-14087An issue was discovered in a smart contract implementation for EUC (EUC), an Ethereum token.
- CVE-2018-14088An issue was discovered in a smart contract implementation for STeX White List (STE(WL)), an Ethereum token.
- CVE-2018-14089An issue was discovered in a smart contract implementation for Virgo_ZodiacToken, an Ethereum token.
- CVE-2018-14325In MP4v2 2.0.0, there is an integer underflow (with resultant memory corruption) when parsing MP4Atom in mp4atom.cpp.
- CVE-2018-14326In MP4v2 2.0.0, there is an integer overflow (with resultant memory corruption) when resizing MP4Array for the ftyp atom in mp4array.h.