# CVEs published 2018-07-23

61 CVEs were published on July 23, 2018: 0 critical, 2 high. Days are UTC.

- [CVE-2018-14573](https://cve.now/CVE-2018-14573.md): A Local File Inclusion (LFI) vulnerability exists in the Web Interface API of TightRope Media Carousel Digital Signage before 7.3.5. (no CVSS)
- [CVE-2018-10912](https://cve.now/CVE-2018-10912.md): keycloak before version 4.0.0.final is vulnerable to a infinite loop in session replacement. (CVSS 4.4, \[UNKNOWN\] keycloak · org.keycloak:keycloak-core)
- [CVE-2018-8031](https://cve.now/CVE-2018-8031.md): The Apache TomEE console (tomee-webapp) has a XSS vulnerability which could allow javascript to be executed if the user is given a malicious (no CVSS, Apache Software Foundation Apache TomEE · org.apache.tomee:…)
- [CVE-2018-11451](https://cve.now/CVE-2018-11451.md): A vulnerability has been identified in Firmware variant IEC 61850 for EN100 Ethernet module (All versions \< V4.33), Firmware variant PROFINE (no CVSS, Siemens AG Firmware variant IEC 61850 for EN100 Ethernet… +5)
- [CVE-2018-11452](https://cve.now/CVE-2018-11452.md): A vulnerability has been identified in Firmware variant IEC 61850 for EN100 Ethernet module (All versions \< V4.33), Firmware variant PROFINE (no CVSS, Siemens AG Firmware variant IEC 61850 for EN100 Ethernet… +3)
- [CVE-2016-10728](https://cve.now/CVE-2016-10728.md): An issue was discovered in Suricata before 3.1.2. (no CVSS)
- [CVE-2018-14328](https://cve.now/CVE-2018-14328.md): Brynamics "Online Trade - Online trading and cryptocurrency investment system" allows remote attackers to obtain sensitive information via a (no CVSS)
- [CVE-2018-14568](https://cve.now/CVE-2018-14568.md): Suricata before 4.0.5 stops TCP stream inspection upon a TCP RST from a server. (no CVSS)
- [CVE-2018-14570](https://cve.now/CVE-2018-14570.md): A file upload vulnerability in application/shop/controller/member.php in Niushop B2B2C Multi-business basic version V1.11 allows any remote (no CVSS)
- [CVE-2018-1999001](https://cve.now/CVE-2018-1999001.md): A unauthorized modification of configuration vulnerability exists in Jenkins 2.132 and earlier, 2.121.1 and earlier in User.java that allows (no CVSS, org.jenkins-ci.main:jenkins-core)
- [CVE-2018-1999002](https://cve.now/CVE-2018-1999002.md): A arbitrary file read vulnerability exists in Jenkins 2.132 and earlier, 2.121.1 and earlier in the Stapler web framework's org/kohsuke/stap (no CVSS, org.jenkins-ci.main:jenkins-core)
- [CVE-2018-1999003](https://cve.now/CVE-2018-1999003.md): A Improper authorization vulnerability exists in Jenkins 2.132 and earlier, 2.121.1 and earlier in Queue.java that allows attackers with Ove (no CVSS, org.jenkins-ci.main:jenkins-core)
- [CVE-2018-1999004](https://cve.now/CVE-2018-1999004.md): A Improper authorization vulnerability exists in Jenkins 2.132 and earlier, 2.121.1 and earlier in SlaveComputer.java that allows attackers (no CVSS, org.jenkins-ci.main:jenkins-core)
- [CVE-2018-1999005](https://cve.now/CVE-2018-1999005.md): A cross-site scripting vulnerability exists in Jenkins 2.132 and earlier, 2.121.1 and earlier in BuildTimelineWidget.java, BuildTimelineWidg (no CVSS, org.jenkins-ci.main:jenkins-core)
- [CVE-2018-1999006](https://cve.now/CVE-2018-1999006.md): A exposure of sensitive information vulnerability exists in Jenkins 2.132 and earlier, 2.121.1 and earlier in Plugin.java that allows attack (no CVSS, org.jenkins-ci.main:jenkins-core)
- [CVE-2018-1999007](https://cve.now/CVE-2018-1999007.md): A cross-site scripting vulnerability exists in Jenkins 2.132 and earlier, 2.121.1 and earlier in the Stapler web framework's org/kohsuke/sta (no CVSS, org.jenkins-ci.main:jenkins-core · org.kohsuke.stapler:stap…)
- [CVE-2018-11756](https://cve.now/CVE-2018-11756.md): In PHP Runtime for Apache OpenWhisk, a Docker action inheriting one of the Docker tags openwhisk/action-php-v7.2:1.0.0 or openwhisk/action-p (no CVSS, Apache Software Foundation PHP Runtime for Apache OpenWhisk)
- [CVE-2018-11757](https://cve.now/CVE-2018-11757.md): In Docker Skeleton Runtime for Apache OpenWhisk, a Docker action inheriting the Docker tag openwhisk/dockerskeleton:1.3.0 (or earlier) may a (no CVSS, Apache Software Foundation Docker Skeleton Runtime for Apac…)
- [CVE-2018-1999022](https://cve.now/CVE-2018-1999022.md): PEAR HTML\_QuickForm version 3.2.14 contains an eval injection (CWE-95) vulnerability in HTML\_QuickForm's getSubmitValue method, HTML\_QuickFo (no CVSS)
- [CVE-2018-1999023](https://cve.now/CVE-2018-1999023.md): The Battle for Wesnoth Project version 1.7.0 through 1.14.3 contains a Code Injection vulnerability in the Lua scripting engine that can res (no CVSS)
- [CVE-2018-1999024](https://cve.now/CVE-2018-1999024.md): MathJax version prior to version 2.7.4 contains a Cross Site Scripting (XSS) vulnerability in the \\unicode{} macro that can result in Potent (no CVSS, mathjax)
- [CVE-2018-1999008](https://cve.now/CVE-2018-1999008.md): October CMS version prior to build 437 contains a Cross Site Scripting (XSS) vulnerability in the Media module and create folder functionali (no CVSS)
- [CVE-2018-1999009](https://cve.now/CVE-2018-1999009.md): October CMS version prior to Build 437 contains a Local File Inclusion vulnerability in modules/system/traits/ViewMaker.php#244 (makeFileCon (no CVSS, october/october)
- [CVE-2018-1999010](https://cve.now/CVE-2018-1999010.md): FFmpeg before commit cced03dd667a5df6df8fd40d8de0bff477ee02e8 contains multiple out of array access vulnerabilities in the mms protocol that (no CVSS)
- [CVE-2018-1999011](https://cve.now/CVE-2018-1999011.md): FFmpeg before commit 2b46ebdbff1d8dec7a3d8ea280a612b91a582869 contains a Buffer Overflow vulnerability in asf\_o format demuxer that can resu (no CVSS)
- [CVE-2018-1999012](https://cve.now/CVE-2018-1999012.md): FFmpeg before commit 9807d3976be0e92e4ece3b4b1701be894cd7c2e1 contains a CWE-835: Infinite loop vulnerability in pva format demuxer that can (no CVSS)
- [CVE-2018-1999013](https://cve.now/CVE-2018-1999013.md): FFmpeg before commit a7e032a277452366771951e29fd0bf2bd5c029f0 contains a use-after-free vulnerability in the realmedia demuxer that can resu (no CVSS)
- [CVE-2018-1999014](https://cve.now/CVE-2018-1999014.md): FFmpeg before commit bab0716c7f4793ec42e05a5aa7e80d82a0dd4e75 contains an out of array access vulnerability in MXF format demuxer that can r (no CVSS)
- [CVE-2018-1999015](https://cve.now/CVE-2018-1999015.md): FFmpeg before commit 5aba5b89d0b1d73164d3b81764828bb8b20ff32a contains an out of array read vulnerability in ASF\_F format demuxer that can r (no CVSS)
- [CVE-2018-1999016](https://cve.now/CVE-2018-1999016.md): Pydio version 8.2.0 and earlier contains a Cross Site Scripting (XSS) vulnerability in ./core/vendor/meenie/javascript-packer/example-inline (no CVSS)
- [CVE-2018-1999017](https://cve.now/CVE-2018-1999017.md): Pydio version 8.2.0 and earlier contains a Server-Side Request Forgery (SSRF) vulnerability in plugins/action.updater/UpgradeManager.php Lin (no CVSS)
- [CVE-2018-1999018](https://cve.now/CVE-2018-1999018.md): Pydio version 8.2.1 and prior contains an Unvalidated user input leading to Remote Code Execution (RCE) vulnerability in plugins/action.anti (no CVSS)
- [CVE-2018-1999019](https://cve.now/CVE-2018-1999019.md): Chamilo LMS version 11.x contains an Unserialization vulnerability in the "hash" GET parameter for the api endpoint located at /webservices/ (no CVSS)
- [CVE-2018-1999020](https://cve.now/CVE-2018-1999020.md): Open Networking Foundation (ONF) ONOS version 1.13.2 and earlier version contains a Directory Traversal vulnerability in core/common/src/mai (no CVSS)
- [CVE-2018-1999021](https://cve.now/CVE-2018-1999021.md): Gleezcms Gleez Cms version 1.3.0 contains a Cross Site Scripting (XSS) vulnerability in Profile page that can result in Inject arbitrary web (no CVSS, gleez/cms)
- [CVE-2018-6683](https://cve.now/CVE-2018-6683.md): - Data Loss Prevention (DLP) for Windows - Exploiting Incorrectly Configured Access Control Security Levels vulnerability (CVSS 7.2, McAfee Data Loss Prevention (DLP) for Windows)
- [CVE-2018-14562](https://cve.now/CVE-2018-14562.md): An issue was discovered in libthulac.so in THULAC through 2018-02-25. (no CVSS)
- [CVE-2018-14563](https://cve.now/CVE-2018-14563.md): An issue was discovered in libthulac.so in THULAC through 2018-02-25. (no CVSS)
- [CVE-2018-14564](https://cve.now/CVE-2018-14564.md): An issue was discovered in libthulac.so in THULAC through 2018-02-25. (no CVSS)
- [CVE-2018-14565](https://cve.now/CVE-2018-14565.md): An issue was discovered in libthulac.so in THULAC through 2018-02-25. (no CVSS)
- [CVE-2018-1503](https://cve.now/CVE-2018-1503.md): IBM WebSphere MQ 7.5, 8.0, and 9.0 could allow a remotely authenticated attacker to to send invalid or malformed headers that could cause me (CVSS 4.3, IBM WebSphere MQ)
- [CVE-2018-1513](https://cve.now/CVE-2018-1513.md): IBM Sterling B2B Integrator Standard Edition 5.2.0 through 5.2.6 is vulnerable to cross-site scripting. (CVSS 5.4, IBM Sterling B2B Integrator)
- [CVE-2018-6677](https://cve.now/CVE-2018-6677.md): McAfee Web Gateway (MWG) - Directory Traversal vulnerability (CVSS 7.6, McAfee Web Gateway)
- [CVE-2018-6678](https://cve.now/CVE-2018-6678.md): McAfee Web Gateway (MWG) - Configuration/Environment manipulation vulnerability (CVSS 3.4, McAfee Web Gateway)
- [CVE-2018-14512](https://cve.now/CVE-2018-14512.md): An XSS vulnerability was discovered in WUZHI CMS 4.1.0. (no CVSS)
- [CVE-2018-14513](https://cve.now/CVE-2018-14513.md): An XSS vulnerability was discovered in WUZHI CMS 4.1.0. (no CVSS)
- [CVE-2018-14514](https://cve.now/CVE-2018-14514.md): An SSRF vulnerability was discovered in idreamsoft iCMS V7.0.9 that allows attackers to read sensitive files, access an intranet, or possibl (no CVSS)
- [CVE-2018-14515](https://cve.now/CVE-2018-14515.md): A SQL injection was discovered in WUZHI CMS 4.1.0 that allows remote attackers to inject a malicious SQL statement via the index.php?m=promo (no CVSS)
- [CVE-2018-14517](https://cve.now/CVE-2018-14517.md): SeaCMS 6.61 has two XSS issues in the admin\_config.php file via certain form fields. (no CVSS)
- [CVE-2018-14521](https://cve.now/CVE-2018-14521.md): An issue was discovered in aubio 0.4.6. (no CVSS, aubio)
- [CVE-2018-14522](https://cve.now/CVE-2018-14522.md): An issue was discovered in aubio 0.4.6. (no CVSS, aubio)
- [CVE-2018-14523](https://cve.now/CVE-2018-14523.md): An issue was discovered in aubio 0.4.6. (no CVSS, aubio)
- [CVE-2018-14524](https://cve.now/CVE-2018-14524.md): dwg\_decode\_eed in decode.c in GNU LibreDWG before 0.6 leads to a double free (in dwg\_free\_eed in free.c) because it does not properly manage (no CVSS)
- [CVE-2018-14527](https://cve.now/CVE-2018-14527.md): Feedback.asp in Xiao5uCompany 1.7 has XSS because the XSS protection mechanism in Safe.asp is insufficient (for example, it considers SCRIPT (no CVSS)
- [CVE-2018-14531](https://cve.now/CVE-2018-14531.md): An issue was discovered in Bento4 1.5.1-624. (no CVSS)
- [CVE-2018-14532](https://cve.now/CVE-2018-14532.md): An issue was discovered in Bento4 1.5.1-624. (no CVSS)
- [CVE-2018-14543](https://cve.now/CVE-2018-14543.md): There exists one NULL pointer dereference vulnerability in AP4\_JsonInspector::AddField in Ap4Atom.cpp in Bento4 1.5.1-624, which can allow a (no CVSS)
- [CVE-2018-14544](https://cve.now/CVE-2018-14544.md): There exists one invalid memory read bug in AP4\_SampleDescription::GetFormat() in Ap4SampleDescription.h in Bento4 1.5.1-624, which can allo (no CVSS)
- [CVE-2018-14545](https://cve.now/CVE-2018-14545.md): There exists one invalid memory read bug in AP4\_SampleDescription::GetType() in Ap4SampleDescription.h in Bento4 1.5.1-624, which can allow (no CVSS)
- [CVE-2018-14549](https://cve.now/CVE-2018-14549.md): An issue has been found in libwav through 2017-04-20. (no CVSS)
- [CVE-2018-14551](https://cve.now/CVE-2018-14551.md): The ReadMATImageV4 function in coders/mat.c in ImageMagick 7.0.8-7 uses an uninitialized variable, leading to memory corruption. (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2018-07-23
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.