CVEs published July 19, 2018
56 CVEs were published on July 19, 2018: 1 critical, 8 high. 1 is now in CISA KEV.
- Published
- 56
- Critical
- 1
- High
- 8
- Medium
- 8
- Low
- 0
- Unrated
- 39
- Now in CISA KEV
- 1
- Fix available
- 5
Most affected products
- ACD Systems Canvas Draw
- 6
- F5 Networks BIG-IP
- 4
- IBM Rational Software Architect Design Manager · IBM Ration…
- 3
- [UNKNOWN] ansible · ansible
- 1
- [UNKNOWN] nss
- 1
- [UNKNOWN] openstack-keystone · keystone
- 1
- [UNKNOWN] redhat-certification
- 1
- Apache Software Foundation Apache Ignite · org.apache.ignit…
- 1
- AVEVA Software InduSoft Web Studio · AVEVA Software InTouch…
- 1
- Drupal core · drupal/core +1
- 1
Critical 1
High 8
- CVE-2018-10869redhat-certification does not properly restrict files that can be download through the /download page.[UNKNOWN] redhat-certification
- CVE-2018-3857An exploitable heap overflow exists in the TIFF parsing functionality of Canvas Draw version 4.0.0.ACD Systems Canvas Draw
- CVE-2018-3858An exploitable heap overflow exists in the TIFF parsing functionality of Canvas Draw version 4.0.0.ACD Systems Canvas Draw
- CVE-2018-3859An exploitable out-of-bounds write exists in the TIFF parsing functionality of Canvas Draw version 4.0.0.ACD Systems Canvas Draw
- CVE-2018-3860An exploitable out-of-bounds write exists in the TIFF parsing functionality of Canvas Draw version 4.0.0.ACD Systems Canvas Draw
- CVE-2018-3870An exploitable out-of-bounds write exists in the PCX parsing functionality of Canvas Draw version 4.0.0.ACD Systems Canvas Draw
- CVE-2018-3871An exploitable out-of-bounds write exists in the PCX parsing functionality of Canvas Draw version 4.0.0.ACD Systems Canvas Draw
- CVE-2018-7602Drupal core - Highly critical - Remote Code Execution - SA-CORE-2018-004Drupal core · drupal/core +1
Medium, low and unrated 47
- CVE-2018-12959The approveAndCall function of a smart contract implementation for Aditus (ADI), an Ethereum ERC20 token, allows attackers to steal assets (
- CVE-2018-14336TP-Link WR840N devices allow remote attackers to cause a denial of service (connectivity loss) via a series of packets with random MAC addre
- CVE-2018-10620AVEVA InduSoft Web Studio v8.1 and v8.1SP1, and InTouch Machine Edition v2017 8.1 and v2017 8.1 SP1 a remote user could send a carefully craAVEVA Software InduSoft Web Studio · AVEVA Software InTouch…
- CVE-2018-14423Division-by-zero vulnerabilities in the functions pi_next_pcrl, pi_next_cprl, and pi_next_rpcl in lib/openjp3d/pi.c in OpenJPEG through 2.3.
- CVE-2018-9062BIOS Modules Unprotected by Intel Boot Guard Vulnerable to Physical AttackLenovo Group some Lenovo ThinkPads
- CVE-2018-14415An issue was discovered in idreamsoft iCMS before 7.0.10.
- CVE-2018-14418In Msvod Cms v10, SQL Injection exists via an images/lists?cid= URI.
- CVE-2018-14419MetInfo 6.0.0 allows XSS via a modified name of the navigation bar on the home page.
- CVE-2018-14420MetInfo 6.0.0 allows a CSRF attack to add a user account via a doaddsave action to admin/index.php, as demonstrated by an admin/index.php?an
- CVE-2018-14421SeaCMS v6.61 allows Remote Code execution by placing PHP code in a movie picture address (aka v_pic) to /admin/admin_video.php (aka /bac
- CVE-2018-14422blog/index.php in SansCMS 0.7 has XSS via the q parameter.
- CVE-2018-8018In Apache Ignite before 2.4.8 and 2.5.x before 2.5.3, the serialization mechanism does not have a list of classes allowed for serialization/Apache Software Foundation Apache Ignite · org.apache.ignit…
- CVE-2014-0243Check_MK through 1.2.5i2p1 allows local users to read arbitrary files via a symlink attack to a file in /var/lib/check_mk_agent/job.
- CVE-2014-2302The installer script in webEdition CMS before 6.2.7-s1 and 6.3.x before 6.3.8-s1 allows remote attackers to conduct PHP Object Injection att
- CVE-2018-14332An issue was discovered in Clementine Music Player 1.3.1.
- CVE-2018-1529IBM Rational DOORS Next Generation 5.0 through 5.0.2, 6.0 through 6.0.5 and IBM Rational Requirements Composer 5.0 through 5.0.2 are vulnera
- CVE-2018-1535IBM Rational Rhapsody Design Manager 5.0 through 5.0.2 and 6.0 through 6.0.5 and IBM Rational Software Architect Design Manager 5.0 through IBM Rational Rhapsody Design Manager · IBM Rational Softwar…
- CVE-2018-1536IBM Rational Rhapsody Design Manager 5.0 through 5.0.2 and 6.0 through 6.0.5 and IBM Rational Software Architect Design Manager 5.0 through IBM Rational Software Architect Design Manager · IBM Ration…
- CVE-2018-1585IBM Rational Rhapsody Design Manager 5.0 through 5.0.2 and 6.0 through 6.0.5 and IBM Rational Software Architect Design Manager 5.0 through IBM Rational Software Architect Design Manager · IBM Ration…
- CVE-2018-1587IBM Rational Rhapsody Design Manager 5.0 through 5.0.2 and 6.0 through 6.0.5 and IBM Rational Software Architect Design Manager 5.0 through IBM Rational Software Architect Design Manager · IBM Ration…
- CVE-2018-5532On F5 BIG-IP 13.0.0, 12.1.0-12.1.2, 11.6.0-11.6.3.1, or 11.2.1-11.5.6 a domain name cached within the DNS Cache of TMM may continue to be reF5 Networks BIG-IP
- CVE-2018-5533Under certain conditions on F5 BIG-IP 13.0.0, 12.1.0-12.1.2, 11.6.0-11.6.3.1, or 11.5.0-11.5.6, TMM may core while processing SSL forward prF5 Networks BIG-IP
- CVE-2018-5534Under certain conditions on F5 BIG-IP 13.1.0-13.1.0.5, 13.0.0, 12.1.0-12.1.3.1, 11.6.0-11.6.3.1, or 11.5.0-11.5.6, TMM may core while procesF5 Networks BIG-IP
- CVE-2018-5535On F5 BIG-IP 14.0.0, 13.0.0-13.1.0, 12.1.0-12.1.3, or 11.5.1-11.6.3 specifically crafted HTTP responses, when processed by a Virtual Server F5 Networks BIG-IP
- CVE-2018-5540On F5 BIG-IP 13.0.0-13.0.1, 12.1.0-12.1.3.3, 11.6.0-11.6.3.1, or 11.5.1-11.5.6, Enterprise Manager 3.1.1, BIG-IQ Centralized Management 5.0.F5 Networks BIG-IP · F5 Networks Enterprise Manager +3
- CVE-2016-9574nss before version 3.30 is vulnerable to a remote denial of service during the session handshake when using SessionTicket extension and ECDH[UNKNOWN] nss
- CVE-2017-2673An authorization-check flaw was discovered in federation configurations of the OpenStack Identity service (keystone).[UNKNOWN] openstack-keystone · keystone
- CVE-2017-7481Ansible before versions 2.3.1.0 and 2.4.0.0 fails to properly mark lookup-plugin results as unsafe.[UNKNOWN] ansible · ansible
- CVE-2018-12911WebKitGTK+ 2.20.3 has an off-by-one error, with a resultant out-of-bounds write, in the get_simple_globs functions in ThirdParty/xdgmime/src
- CVE-2018-14404A NULL pointer dereference vulnerability exists in the xpath.c:xmlXPathCompOpEval() function of libxml2 through 2.9.8 when parsing an invalinokogiri
- CVE-2018-14394libavformat/movenc.c in FFmpeg before 4.0.2 allows attackers to cause a denial of service (application crash caused by a divide-by-zero erro
- CVE-2018-14395libavformat/movenc.c in FFmpeg 3.2 and 4.0.2 allows attackers to cause a denial of service (application crash caused by a divide-by-zero err
- CVE-2018-14399libs\classes\attachment.class.php in PHPCMS 9.6.0 allows remote attackers to upload and execute arbitrary PHP code via a .txt?.php#.jpg URI
- CVE-2018-14401CopyData in AxmlParser.c in AXML Parser through 2018-01-04 has an out-of-bounds read.
- CVE-2018-14402axmldec 1.2.0 has an out-of-bounds write in the jitana::axml_parser::parse_start_namespace function in lib/jitana/util/axml_parser.cpp.
- CVE-2018-14339In Wireshark 2.6.0 to 2.6.1, 2.4.0 to 2.4.7, and 2.2.0 to 2.2.15, the MMSE dissector could go into an infinite loop.
- CVE-2018-14340In Wireshark 2.6.0 to 2.6.1, 2.4.0 to 2.4.7, and 2.2.0 to 2.2.15, dissectors that support zlib decompression could crash.
- CVE-2018-14341In Wireshark 2.6.0 to 2.6.1, 2.4.0 to 2.4.7, and 2.2.0 to 2.2.15, the DICOM dissector could go into a large or infinite loop.
- CVE-2018-14342In Wireshark 2.6.0 to 2.6.1, 2.4.0 to 2.4.7, and 2.2.0 to 2.2.15, the BGP protocol dissector could go into a large loop.
- CVE-2018-14343In Wireshark 2.6.0 to 2.6.1, 2.4.0 to 2.4.7, and 2.2.0 to 2.2.15, the ASN.1 BER dissector could crash.
- CVE-2018-14344In Wireshark 2.6.0 to 2.6.1, 2.4.0 to 2.4.7, and 2.2.0 to 2.2.15, the ISMP dissector could crash.
- CVE-2018-14367In Wireshark 2.6.0 to 2.6.1 and 2.4.0 to 2.4.7, the CoAP protocol dissector could crash.
- CVE-2018-14368In Wireshark 2.6.0 to 2.6.1, 2.4.0 to 2.4.7, and 2.2.0 to 2.2.15, the Bazaar protocol dissector could go into an infinite loop.
- CVE-2018-14369In Wireshark 2.6.0 to 2.6.1, 2.4.0 to 2.4.7, and 2.2.0 to 2.2.15, the HTTP2 dissector could crash.
- CVE-2018-14370In Wireshark 2.6.0 to 2.6.1 and 2.4.0 to 2.4.7, the IEEE 802.11 protocol dissector could crash.
- CVE-2018-14392The New Threads plugin before 1.2 for MyBB has XSS.
- CVE-2018-14403MP4NameFirstMatches in mp4util.cpp in MP4v2 2.0.0 mishandles substrings of atom names, leading to use of an inappropriate data type for asso