# CVEs published 2018-07-16

44 CVEs were published on July 16, 2018: 0 critical, 1 high. Days are UTC.

- [CVE-2017-15137](https://cve.now/CVE-2017-15137.md): The OpenShift image import whitelist failed to enforce restrictions correctly when running commands such as "oc tag", for example. (CVSS 4.3, \[UNKNOWN\] atomic-openshift)
- [CVE-2017-17541](https://cve.now/CVE-2017-17541.md): A Cross-site Scripting (XSS) vulnerability in Fortinet FortiManager 6.0.0, 5.6.4 and below versions, FortiAnalyzer 6.0.0, 5.6.4 and below ve (no CVSS, Fortinet FortiManager, FortiAnalyzer)
- [CVE-2018-1046](https://cve.now/CVE-2018-1046.md): pdns before version 4.1.2 is vulnerable to a buffer overflow in dnsreplay. (CVSS 7.0, \[UNKNOWN\] pdns)
- [CVE-2018-10840](https://cve.now/CVE-2018-10840.md): Linux kernel is vulnerable to a heap-based buffer overflow in the fs/ext4/xattr.c:ext4\_xattr\_set\_entry() function. (CVSS 5.2, kernel heap-based buffer overflow in fs/ext4/xattr.c)
- [CVE-2018-10857](https://cve.now/CVE-2018-10857.md): git-annex is vulnerable to a private data exposure and exfiltration attack. (CVSS 5.9, \[UNKNOWN\] git-annex)
- [CVE-2018-12584](https://cve.now/CVE-2018-12584.md): The ConnectionBase::preparseNewBytes function in resip/stack/ConnectionBase.cxx in reSIProcate through 1.10.2 allows remote attackers to cau (no CVSS)
- [CVE-2018-13832](https://cve.now/CVE-2018-13832.md): Multiple Persistent cross-site scripting (XSS) issues in the Techotronic all-in-one-favicon (aka All In One Favicon) plugin 4.6 for WordPres (no CVSS)
- [CVE-2018-10859](https://cve.now/CVE-2018-10859.md): git-annex is vulnerable to an Information Exposure when decrypting files. (CVSS 5.9, \[UNKNOWN\] git-annex)
- [CVE-2018-14324](https://cve.now/CVE-2018-14324.md): The demo feature in Oracle GlassFish Open Source Edition 5.0 has TCP port 7676 open by default with a password of admin for the admin accoun (no CVSS)
- [CVE-2018-0341](https://cve.now/CVE-2018-0341.md): A vulnerability in the web-based UI of Cisco IP Phone 6800, 7800, and 8800 Series with Multiplatform Firmware before 11.2(1) could allow an (no CVSS, Cisco IP Phone 6800, 7800, and 8800 unknown)
- [CVE-2018-0360](https://cve.now/CVE-2018-0360.md): ClamAV before 0.100.1 has an HWP integer overflow with a resultant infinite loop via a crafted Hangul Word Processor file. (no CVSS, ClamAV before 0.100.1 unknown)
- [CVE-2018-0361](https://cve.now/CVE-2018-0361.md): ClamAV before 0.100.1 lacks a PDF object length check, resulting in an unreasonably long time to parse a relatively small file. (no CVSS, ClamAV before 0.100.1 unknown)
- [CVE-2018-0366](https://cve.now/CVE-2018-0366.md): A vulnerability in the web-based management interface of Cisco Web Security Appliance (WSA) could allow an unauthenticated, remote attacker (no CVSS, Cisco Web Security Appliance unknown)
- [CVE-2018-0368](https://cve.now/CVE-2018-0368.md): A vulnerability in Cisco Digital Network Architecture (DNA) Center could allow an authenticated, local attacker to access sensitive informat (no CVSS, Cisco Digital Network Architecture Center unknown)
- [CVE-2018-0369](https://cve.now/CVE-2018-0369.md): A vulnerability in the reassembly logic for fragmented IPv4 packets of Cisco StarOS running on virtual platforms could allow an unauthentica (no CVSS, Cisco StarOS unknown)
- [CVE-2018-0370](https://cve.now/CVE-2018-0370.md): A vulnerability in the detection engine of Cisco Firepower System Software could allow an unauthenticated, remote attacker to cause one of t (no CVSS, Cisco Firepower unknown)
- [CVE-2018-0383](https://cve.now/CVE-2018-0383.md): A vulnerability in the detection engine of Cisco FireSIGHT System Software could allow an unauthenticated, remote attacker to bypass a file (no CVSS, Cisco FireSIGHT unknown)
- [CVE-2018-0384](https://cve.now/CVE-2018-0384.md): A vulnerability in the detection engine of Cisco FireSIGHT System Software could allow an unauthenticated, remote attacker to bypass a URL-b (no CVSS, Cisco FireSIGHT unknown)
- [CVE-2018-0385](https://cve.now/CVE-2018-0385.md): A vulnerability in the detection engine parsing of Security Socket Layer (SSL) protocol packets for Cisco Firepower System Software could al (no CVSS, Cisco Firepower unknown)
- [CVE-2018-5239](https://cve.now/CVE-2018-5239.md): Norton App Lock prior to v1.3.0.332 can be susceptible to a bypass exploit. (no CVSS, Symantec Norton App Lock)
- [CVE-2018-0706](https://cve.now/CVE-2018-0706.md): Exposure of Private Information in QNAP Q'center Virtual Appliance version 1.7.1063 and earlier could allow authenticated users to access se (no CVSS, QNAP Q'center Virtual Appliance)
- [CVE-2018-0707](https://cve.now/CVE-2018-0707.md): Command injection vulnerability in change password of QNAP Q'center Virtual Appliance version 1.7.1063 and earlier could allow authenticated (no CVSS, QNAP Q'center Virtual Appliance)
- [CVE-2018-0708](https://cve.now/CVE-2018-0708.md): Command injection vulnerability in networking of QNAP Q'center Virtual Appliance version 1.7.1063 and earlier could allow authenticated user (no CVSS, QNAP Q'center Virtual Appliance)
- [CVE-2018-0709](https://cve.now/CVE-2018-0709.md): Command injection vulnerability in date of QNAP Q'center Virtual Appliance version 1.7.1063 and earlier could allow authenticated users to r (no CVSS, QNAP Q'center Virtual Appliance)
- [CVE-2018-0710](https://cve.now/CVE-2018-0710.md): Command injection vulnerability in SSH of QNAP Q'center Virtual Appliance version 1.7.1063 and earlier could allow authenticated users to ru (no CVSS, QNAP Q'center Virtual Appliance)
- [CVE-2013-0522](https://cve.now/CVE-2013-0522.md): The Notes Client Single Logon feature in IBM Notes 8.0, 8.0.1, 8.0.2, 8.5, 8.5.1, 8.5.2, 8.5.3, and 9.0 on Windows allows local users to dis (no CVSS)
- [CVE-2014-2079](https://cve.now/CVE-2014-2079.md): X File Explorer (aka xfe) might allow local users to bypass intended access restrictions and gain access to arbitrary files by leveraging fa (no CVSS)
- [CVE-2018-11716](https://cve.now/CVE-2018-11716.md): An issue was discovered in Zoho ManageEngine Desktop Central before 100230. (no CVSS)
- [CVE-2018-11717](https://cve.now/CVE-2018-11717.md): An issue was discovered in Zoho ManageEngine Desktop Central before 100251. (no CVSS)
- [CVE-2018-13980](https://cve.now/CVE-2018-13980.md): The websites that were built from Zeta Producer Desktop CMS before 14.2.1 are vulnerable to unauthenticated file disclosure if the plugin "f (no CVSS)
- [CVE-2018-13981](https://cve.now/CVE-2018-13981.md): The websites that were built from Zeta Producer Desktop CMS before 14.2.1 are vulnerable to unauthenticated remote code execution due to a d (no CVSS)
- [CVE-2017-2638](https://cve.now/CVE-2017-2638.md): It was found that the REST API in Infinispan before version 9.0.0 did not properly enforce auth constraints. (CVSS 6.5, \[UNKNOWN\] infinispan · org.infinispan:infinispan-server-core)
- [CVE-2017-7468](https://cve.now/CVE-2017-7468.md): In curl and libcurl 7.52.0 to and including 7.53.1, libcurl would attempt to resume a TLS session even if the client certificate had changed (CVSS 4.8, \[UNKNOWN\] curl)
- [CVE-2018-13387](https://cve.now/CVE-2018-13387.md): The IncomingMailServers resource in Atlassian JIRA Server before version 7.6.7, from version 7.7.0 before version 7.7.5, from version 7.8.0 (no CVSS, Atlassian Jira)
- [CVE-2018-14071](https://cve.now/CVE-2018-14071.md): The Geo Mashup plugin before 1.10.4 for WordPress has insufficient sanitization of post editor and other user input. (no CVSS)
- [CVE-2018-5229](https://cve.now/CVE-2018-5229.md): The NotificationRepresentationFactoryImpl class in Atlassian Universal Plugin Manager before version 2.22.9 allows remote attackers to injec (no CVSS, Atlassian Universal Plugin Manager)
- [CVE-2018-14084](https://cve.now/CVE-2018-14084.md): An issue was discovered in a smart contract implementation for MKCB, an Ethereum token. (no CVSS)
- [CVE-2018-14085](https://cve.now/CVE-2018-14085.md): An issue was discovered in a smart contract implementation for UserWallet 0x0a7bca9FB7AfF26c6ED8029BB6f0F5D291587c42, an Ethereum token. (no CVSS)
- [CVE-2018-14086](https://cve.now/CVE-2018-14086.md): An issue was discovered in a smart contract implementation for SingaporeCoinOrigin (SCO), an Ethereum token. (no CVSS)
- [CVE-2018-14087](https://cve.now/CVE-2018-14087.md): An issue was discovered in a smart contract implementation for EUC (EUC), an Ethereum token. (no CVSS)
- [CVE-2018-14088](https://cve.now/CVE-2018-14088.md): An issue was discovered in a smart contract implementation for STeX White List (STE(WL)), an Ethereum token. (no CVSS)
- [CVE-2018-14089](https://cve.now/CVE-2018-14089.md): An issue was discovered in a smart contract implementation for Virgo\_ZodiacToken, an Ethereum token. (no CVSS)
- [CVE-2018-14325](https://cve.now/CVE-2018-14325.md): In MP4v2 2.0.0, there is an integer underflow (with resultant memory corruption) when parsing MP4Atom in mp4atom.cpp. (no CVSS)
- [CVE-2018-14326](https://cve.now/CVE-2018-14326.md): In MP4v2 2.0.0, there is an integer overflow (with resultant memory corruption) when resizing MP4Array for the ftyp atom in mp4array.h. (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2018-07-16
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.