CVEs published July 23, 2018
61 CVEs were published on July 23, 2018: 0 critical, 2 high.
- Published
- 61
- Critical
- 0
- High
- 2
- Medium
- 3
- Low
- 1
- Unrated
- 55
- Now in CISA KEV
- 0
- Fix available
- 15
Most affected products
- org.jenkins-ci.main:jenkins-core
- 6
- aubio
- 3
- McAfee Web Gateway
- 2
- [UNKNOWN] keycloak · org.keycloak:keycloak-core
- 1
- Apache Software Foundation Apache TomEE · org.apache.tomee:…
- 1
- Apache Software Foundation Docker Skeleton Runtime for Apac…
- 1
- Apache Software Foundation PHP Runtime for Apache OpenWhisk
- 1
- gleez/cms
- 1
- IBM Sterling B2B Integrator
- 1
- IBM WebSphere MQ
- 1
High 2
Medium, low and unrated 59
- CVE-2018-14573A Local File Inclusion (LFI) vulnerability exists in the Web Interface API of TightRope Media Carousel Digital Signage before 7.3.5.
- CVE-2018-10912keycloak before version 4.0.0.final is vulnerable to a infinite loop in session replacement.[UNKNOWN] keycloak · org.keycloak:keycloak-core
- CVE-2018-8031The Apache TomEE console (tomee-webapp) has a XSS vulnerability which could allow javascript to be executed if the user is given a maliciousApache Software Foundation Apache TomEE · org.apache.tomee:…
- CVE-2018-11451A vulnerability has been identified in Firmware variant IEC 61850 for EN100 Ethernet module (All versions < V4.33), Firmware variant PROFINESiemens AG Firmware variant IEC 61850 for EN100 Ethernet… +5
- CVE-2018-11452A vulnerability has been identified in Firmware variant IEC 61850 for EN100 Ethernet module (All versions < V4.33), Firmware variant PROFINESiemens AG Firmware variant IEC 61850 for EN100 Ethernet… +3
- CVE-2016-10728An issue was discovered in Suricata before 3.1.2.
- CVE-2018-14328Brynamics "Online Trade - Online trading and cryptocurrency investment system" allows remote attackers to obtain sensitive information via a
- CVE-2018-14568Suricata before 4.0.5 stops TCP stream inspection upon a TCP RST from a server.
- CVE-2018-14570A file upload vulnerability in application/shop/controller/member.php in Niushop B2B2C Multi-business basic version V1.11 allows any remote
- CVE-2018-1999001A unauthorized modification of configuration vulnerability exists in Jenkins 2.132 and earlier, 2.121.1 and earlier in User.java that allowsorg.jenkins-ci.main:jenkins-core
- CVE-2018-1999002A arbitrary file read vulnerability exists in Jenkins 2.132 and earlier, 2.121.1 and earlier in the Stapler web framework's org/kohsuke/staporg.jenkins-ci.main:jenkins-core
- CVE-2018-1999003A Improper authorization vulnerability exists in Jenkins 2.132 and earlier, 2.121.1 and earlier in Queue.java that allows attackers with Oveorg.jenkins-ci.main:jenkins-core
- CVE-2018-1999004A Improper authorization vulnerability exists in Jenkins 2.132 and earlier, 2.121.1 and earlier in SlaveComputer.java that allows attackers org.jenkins-ci.main:jenkins-core
- CVE-2018-1999005A cross-site scripting vulnerability exists in Jenkins 2.132 and earlier, 2.121.1 and earlier in BuildTimelineWidget.java, BuildTimelineWidgorg.jenkins-ci.main:jenkins-core
- CVE-2018-1999006A exposure of sensitive information vulnerability exists in Jenkins 2.132 and earlier, 2.121.1 and earlier in Plugin.java that allows attackorg.jenkins-ci.main:jenkins-core
- CVE-2018-1999007A cross-site scripting vulnerability exists in Jenkins 2.132 and earlier, 2.121.1 and earlier in the Stapler web framework's org/kohsuke/staorg.jenkins-ci.main:jenkins-core · org.kohsuke.stapler:stap…
- CVE-2018-11756In PHP Runtime for Apache OpenWhisk, a Docker action inheriting one of the Docker tags openwhisk/action-php-v7.2:1.0.0 or openwhisk/action-pApache Software Foundation PHP Runtime for Apache OpenWhisk
- CVE-2018-11757In Docker Skeleton Runtime for Apache OpenWhisk, a Docker action inheriting the Docker tag openwhisk/dockerskeleton:1.3.0 (or earlier) may aApache Software Foundation Docker Skeleton Runtime for Apac…
- CVE-2018-1999022PEAR HTML_QuickForm version 3.2.14 contains an eval injection (CWE-95) vulnerability in HTML_QuickForm's getSubmitValue method, HTML_QuickFo
- CVE-2018-1999023The Battle for Wesnoth Project version 1.7.0 through 1.14.3 contains a Code Injection vulnerability in the Lua scripting engine that can res
- CVE-2018-1999024MathJax version prior to version 2.7.4 contains a Cross Site Scripting (XSS) vulnerability in the \unicode{} macro that can result in Potentmathjax
- CVE-2018-1999008October CMS version prior to build 437 contains a Cross Site Scripting (XSS) vulnerability in the Media module and create folder functionali
- CVE-2018-1999009October CMS version prior to Build 437 contains a Local File Inclusion vulnerability in modules/system/traits/ViewMaker.php#244 (makeFileConoctober/october
- CVE-2018-1999010FFmpeg before commit cced03dd667a5df6df8fd40d8de0bff477ee02e8 contains multiple out of array access vulnerabilities in the mms protocol that
- CVE-2018-1999011FFmpeg before commit 2b46ebdbff1d8dec7a3d8ea280a612b91a582869 contains a Buffer Overflow vulnerability in asf_o format demuxer that can resu
- CVE-2018-1999012FFmpeg before commit 9807d3976be0e92e4ece3b4b1701be894cd7c2e1 contains a CWE-835: Infinite loop vulnerability in pva format demuxer that can
- CVE-2018-1999013FFmpeg before commit a7e032a277452366771951e29fd0bf2bd5c029f0 contains a use-after-free vulnerability in the realmedia demuxer that can resu
- CVE-2018-1999014FFmpeg before commit bab0716c7f4793ec42e05a5aa7e80d82a0dd4e75 contains an out of array access vulnerability in MXF format demuxer that can r
- CVE-2018-1999015FFmpeg before commit 5aba5b89d0b1d73164d3b81764828bb8b20ff32a contains an out of array read vulnerability in ASF_F format demuxer that can r
- CVE-2018-1999016Pydio version 8.2.0 and earlier contains a Cross Site Scripting (XSS) vulnerability in ./core/vendor/meenie/javascript-packer/example-inline
- CVE-2018-1999017Pydio version 8.2.0 and earlier contains a Server-Side Request Forgery (SSRF) vulnerability in plugins/action.updater/UpgradeManager.php Lin
- CVE-2018-1999018Pydio version 8.2.1 and prior contains an Unvalidated user input leading to Remote Code Execution (RCE) vulnerability in plugins/action.anti
- CVE-2018-1999019Chamilo LMS version 11.x contains an Unserialization vulnerability in the "hash" GET parameter for the api endpoint located at /webservices/
- CVE-2018-1999020Open Networking Foundation (ONF) ONOS version 1.13.2 and earlier version contains a Directory Traversal vulnerability in core/common/src/mai
- CVE-2018-1999021Gleezcms Gleez Cms version 1.3.0 contains a Cross Site Scripting (XSS) vulnerability in Profile page that can result in Inject arbitrary webgleez/cms
- CVE-2018-14562An issue was discovered in libthulac.so in THULAC through 2018-02-25.
- CVE-2018-14563An issue was discovered in libthulac.so in THULAC through 2018-02-25.
- CVE-2018-14564An issue was discovered in libthulac.so in THULAC through 2018-02-25.
- CVE-2018-14565An issue was discovered in libthulac.so in THULAC through 2018-02-25.
- CVE-2018-1503IBM WebSphere MQ 7.5, 8.0, and 9.0 could allow a remotely authenticated attacker to to send invalid or malformed headers that could cause meIBM WebSphere MQ
- CVE-2018-1513IBM Sterling B2B Integrator Standard Edition 5.2.0 through 5.2.6 is vulnerable to cross-site scripting.IBM Sterling B2B Integrator
- CVE-2018-6678McAfee Web Gateway (MWG) - Configuration/Environment manipulation vulnerabilityMcAfee Web Gateway
- CVE-2018-14512An XSS vulnerability was discovered in WUZHI CMS 4.1.0.
- CVE-2018-14513An XSS vulnerability was discovered in WUZHI CMS 4.1.0.
- CVE-2018-14514An SSRF vulnerability was discovered in idreamsoft iCMS V7.0.9 that allows attackers to read sensitive files, access an intranet, or possibl
- CVE-2018-14515A SQL injection was discovered in WUZHI CMS 4.1.0 that allows remote attackers to inject a malicious SQL statement via the index.php?m=promo
- CVE-2018-14517SeaCMS 6.61 has two XSS issues in the admin_config.php file via certain form fields.
- CVE-2018-14521An issue was discovered in aubio 0.4.6.aubio
- CVE-2018-14522An issue was discovered in aubio 0.4.6.aubio
- CVE-2018-14523An issue was discovered in aubio 0.4.6.aubio
- CVE-2018-14524dwg_decode_eed in decode.c in GNU LibreDWG before 0.6 leads to a double free (in dwg_free_eed in free.c) because it does not properly manage
- CVE-2018-14527Feedback.asp in Xiao5uCompany 1.7 has XSS because the XSS protection mechanism in Safe.asp is insufficient (for example, it considers SCRIPT
- CVE-2018-14531An issue was discovered in Bento4 1.5.1-624.
- CVE-2018-14532An issue was discovered in Bento4 1.5.1-624.
- CVE-2018-14543There exists one NULL pointer dereference vulnerability in AP4_JsonInspector::AddField in Ap4Atom.cpp in Bento4 1.5.1-624, which can allow a
- CVE-2018-14544There exists one invalid memory read bug in AP4_SampleDescription::GetFormat() in Ap4SampleDescription.h in Bento4 1.5.1-624, which can allo
- CVE-2018-14545There exists one invalid memory read bug in AP4_SampleDescription::GetType() in Ap4SampleDescription.h in Bento4 1.5.1-624, which can allow
- CVE-2018-14549An issue has been found in libwav through 2017-04-20.
- CVE-2018-14551The ReadMATImageV4 function in coders/mat.c in ImageMagick 7.0.8-7 uses an uninitialized variable, leading to memory corruption.