CVEs published July 24, 2018
49 CVEs were published on July 24, 2018: 4 critical, 3 high.
- Published
- 49
- Critical
- 4
- High
- 3
- Medium
- 2
- Low
- 0
- Unrated
- 40
- Now in CISA KEV
- 0
- Fix available
- 13
Most affected products
- Echelon SmartServer · Echelon i.LON
- 4
- docCMS Administration Panel
- 3
- Navarino Infinity
- 3
- Das U-Boot
- 2
- Dell EMC RSA Archer
- 2
- Schweitzer Engineering Laboratories AcSELerator Architect
- 2
- [UNKNOWN] cfme
- 1
- [UNKNOWN] fuse
- 1
- Atlassian Jira
- 1
- Atlassian Sourcetree for macOS
- 1
Critical 4
- CVE-2018-10627Echelon SmartServer 1 all versions, SmartServer 2 all versions prior to release 4.11.007, i.LON 100 all versions, and i.LON 600 all versionsEchelon SmartServer · Echelon i.LON
- CVE-2018-8851Echelon SmartServer 1 all versions, SmartServer 2 all versions prior to release 4.11.007, i.LON 100 all versions, and i.LON 600 all versionsEchelon SmartServer · Echelon i.LON
- CVE-2018-8855Echelon SmartServer 1 all versions, SmartServer 2 all versions prior to release 4.11.007, i.LON 100 all versions, and i.LON 600 all versionsEchelon SmartServer · Echelon i.LON
- CVE-2018-8859Echelon SmartServer 1 all versions, SmartServer 2 all versions prior to release 4.11.007, i.LON 100 all versions, and i.LON 600 all versionsEchelon SmartServer · Echelon i.LON
High 3
- CVE-2018-11059RSA Archer, versions prior to 6.4.0.1, contain a stored cross-site scripting vulnerability.Dell EMC RSA Archer
- CVE-2018-11060RSA Archer, versions prior to 6.4.0.1, contain an authorization bypass vulnerability in the REST API.Dell EMC RSA Archer
- CVE-2018-10905CloudForms Management Engine (cfme) is vulnerable to an improper security setting in the dRuby component of CloudForms.[UNKNOWN] cfme
Medium, low and unrated 42
- CVE-2018-10906In fuse before versions 2.9.8 and 3.x before 3.2.5, fusermount is vulnerable to a restriction bypass when SELinux is active.[UNKNOWN] fuse
- CVE-2018-11044Pivotal Apps Manager included in Pivotal Application Service, versions 2.2.x prior to 2.2.1 and 2.1.x prior to 2.1.8 and 2.0.x prior to 2.0.Pivotal Application Service
- CVE-2018-11047Cloud Foundry UAA, versions 4.19 prior to 4.19.2 and 4.12 prior to 4.12.4 and 4.10 prior to 4.10.2 and 4.7 prior to 4.7.6 and 4.5 prior to 4Cloud Foundry UAA · org.cloudfoundry.identity:cloudfoundry-…
- CVE-2018-10628AVEVA InTouch 2014 R2 SP1 and prior, InTouch 2017, InTouch 2017 Update 1, and InTouch 2017 Update 2 allow an unauthenticated user to send a AVEVA Software, LLC. InTouch
- CVE-2018-10632In Moxa NPort 5210, 5230, and 5232 versions 2.9 build 17030709 and prior, the amount of resources requested by a malicious actor are not resMoxa NPort 5210, 5230, and
- CVE-2018-14582index.php?r=admini/admin/create in BageCMS V3.1.3 allows CSRF to add a background administrator account.
- CVE-2018-14583xyhai.php?s=/Auth/addUser in XYHCMS 3.5 allows CSRF to add a background administrator account.
- CVE-2018-14584An issue has been discovered in Bento4 1.5.1-624.
- CVE-2018-14585An issue has been discovered in Bento4 1.5.1-624.
- CVE-2018-14586An issue has been discovered in Bento4 1.5.1-624.
- CVE-2018-14587An issue has been discovered in Bento4 1.5.1-624.
- CVE-2018-14588An issue has been discovered in Bento4 1.5.1-624.
- CVE-2018-14589An issue has been discovered in Bento4 1.5.1-624.
- CVE-2018-14590An issue has been discovered in Bento4 1.5.1-624.
- CVE-2016-5638Netgear WNDR4500 running firmware version V1.0.1.40_1.0.6877 reveals some sensitive information such as 2.4GHz & 5GHz Wireless Network Name (SSID) and Network Key (Password) in clear textNetgear WNDR4500
- CVE-2016-5649Netgear DGN2200 and DGND3700 disclose the administrator passwordNetgear DGN2200 · Netgear DGND3700
- CVE-2017-3180Multiple TIBCO Spotfire components fail to sanitize user-supplied inout and are vulnerable to cross-site scriptingTIBCO Silver Fabric Enabler for Spotfire Web Player · TI… +7
- CVE-2017-3181Multiple TIBCO Spotfire components are vulnerable to multiple unspecified SQL-injection vulnerabilities because it fails to properly sanitize user-supplied input before using it in an SQL queryTIBCO Spotfire Analyst · TIBCO Spotfire Connectors +4
- CVE-2017-3182On the iOS platform, the ThreatMetrix SDK versions prior to 3.2 fail to validate SSL certificates provided by HTTPS connections, which may allow an attacker to perform a man-in-the-middle (MITM) attackThreatMetrix SDK
- CVE-2017-3183Sage XRT Treasury, version 3, fails to properly restrict database access to authorized users, which may enable any authenticated user to gain full access to privileged database functionsSage XRT Treasury
- CVE-2017-3187The dotCMS administration panel, versions 3.7.1 and earlier, are vulnerable to cross-site request forgerydocCMS Administration Panel
- CVE-2017-3188The dotCMS administration panel, versions 3.7.1 and earlier, "Push Publishing" feature in Enterprise Pro is vulnerable to path traversaldocCMS Administration Panel
- CVE-2017-3189The dotCMS administration panel, versions 3.7.1 and earlier, "Push Publishing" feature in Enterprise Pro is vulnerable to arbitrary file uploaddocCMS Administration Panel
- CVE-2017-3209The DBPOWER U818A WIFI quadcopter drone provides FTP access over its own local access point, and allows full file permissions to the anonymous userDBPOWER U818A WiFi Quadcopter Drone
- CVE-2017-3210Applications developed using the Portrait Display SDK, versions 2.30 through 2.34, default to insecure configurations which allow arbitrary code executionPortrait Display SDK
- CVE-2017-3217CalAmp LMU 3030 series OBD-II CDMA and GSM devices has an SMS (text message) interface that can be deployed where no password is configured for this interface by the integrator / resellerCalAmp LMU 3030 OBD-II
- CVE-2017-3223Dahua IP camera products using firmware versions prior to V2.400.0000.14.R.20170713 include a version of the Sonia web interface that may be vulnerable to a stack buffer overflowDahua IP Camera
- CVE-2017-3224Open Shortest Path First (OSPF) protocol implementations may improperly determine LSA recency in affected Quagga and downstream implementations (SUSE, openSUSE, and Red Hat packages)Open Shortest Path First (OSPF) Protocol
- CVE-2017-3225Das U-Boot's AES-CBC encryption feature uses a zero (0) initialization vector that may allow attacks against the underlying cryptographic implementation and allow an attacker to decrypt the dataDas U-Boot
- CVE-2017-3226Das U-Boot's AES-CBC encryption feature improperly handles an error condition and may allow attacks against the underlying cryptographic implementation and allow an attacker to decrypt the dataDas U-Boot
- CVE-2018-5384Navarino Infinity web interface up to version 2.2 exposes an unauthenticated script that is prone to blind sql injectionNavarino Infinity
- CVE-2018-5385Navarino Infinity web interface up to version 2.2 is prone to session fixation attacksNavarino Infinity
- CVE-2018-5386Some Navarino Infinity functions placed in the URL can bypass any authentication mechanism leading to an information leakNavarino Infinity
- CVE-2018-5387Wizkunde SAMLBase may incorrectly utilize the results of XML DOM traversal and canonicalization APIs in such a way that an attacker may be aWizkunde SAMLBase · gogentooss/samlbase
- CVE-2018-14579GolemCMS through 2008-12-24, if the install/ directory remains active after an installation, allows remote attackers to execute arbitrary PH
- CVE-2017-18104The Webhooks component of Atlassian Jira before version 7.6.7 and from version 7.7.0 before version 7.11.0 allows remote attackers who are aAtlassian Jira
- CVE-2018-10600SEL AcSELerator Architect version 2.2.24.0 and prior allows unsanitized input to be passed to the XML parser, which may allow disclosure andSchweitzer Engineering Laboratories AcSELerator Architect
- CVE-2018-10604SEL Compass version 3.0.5.1 and prior allows all users full access to the SEL Compass directory, which may allow modification or overwritingSchweitzer Engineering Laboratories Compass
- CVE-2018-10608SEL AcSELerator Architect version 2.2.24.0 and prior can be exploited when the AcSELerator Architect FTP client connects to a malicious FTP Schweitzer Engineering Laboratories AcSELerator Architect
- CVE-2018-13385There was an argument injection vulnerability in Sourcetree for macOS via filenames in Mercurial repositories.Atlassian Sourcetree for macOS
- CVE-2018-13386There was an argument injection vulnerability in Sourcetree for Windows via filenames in Mercurial repositories.Atlassian Sourcetree for Windows
- CVE-2018-14335An issue was discovered in H2 1.4.197.