# CVEs published 2018-07-24

49 CVEs were published on July 24, 2018: 4 critical, 3 high. Days are UTC.

- [CVE-2018-10906](https://cve.now/CVE-2018-10906.md): In fuse before versions 2.9.8 and 3.x before 3.2.5, fusermount is vulnerable to a restriction bypass when SELinux is active. (CVSS 5.3, \[UNKNOWN\] fuse)
- [CVE-2018-11044](https://cve.now/CVE-2018-11044.md): Pivotal Apps Manager included in Pivotal Application Service, versions 2.2.x prior to 2.2.1 and 2.1.x prior to 2.1.8 and 2.0.x prior to 2.0. (no CVSS, Pivotal Application Service)
- [CVE-2018-11047](https://cve.now/CVE-2018-11047.md): Cloud Foundry UAA, versions 4.19 prior to 4.19.2 and 4.12 prior to 4.12.4 and 4.10 prior to 4.10.2 and 4.7 prior to 4.7.6 and 4.5 prior to 4 (no CVSS, Cloud Foundry UAA · org.cloudfoundry.identity:cloudfoundry-…)
- [CVE-2018-11059](https://cve.now/CVE-2018-11059.md): RSA Archer, versions prior to 6.4.0.1, contain a stored cross-site scripting vulnerability. (CVSS 8.2, Dell EMC RSA Archer)
- [CVE-2018-11060](https://cve.now/CVE-2018-11060.md): RSA Archer, versions prior to 6.4.0.1, contain an authorization bypass vulnerability in the REST API. (CVSS 8.8, Dell EMC RSA Archer)
- [CVE-2018-10628](https://cve.now/CVE-2018-10628.md): AVEVA InTouch 2014 R2 SP1 and prior, InTouch 2017, InTouch 2017 Update 1, and InTouch 2017 Update 2 allow an unauthenticated user to send a (no CVSS, AVEVA Software, LLC. InTouch)
- [CVE-2018-10627](https://cve.now/CVE-2018-10627.md): Echelon SmartServer 1 all versions, SmartServer 2 all versions prior to release 4.11.007, i.LON 100 all versions, and i.LON 600 all versions (CVSS 9.8, Echelon SmartServer · Echelon i.LON)
- [CVE-2018-10632](https://cve.now/CVE-2018-10632.md): In Moxa NPort 5210, 5230, and 5232 versions 2.9 build 17030709 and prior, the amount of resources requested by a malicious actor are not res (no CVSS, Moxa NPort 5210, 5230, and)
- [CVE-2018-8851](https://cve.now/CVE-2018-8851.md): Echelon SmartServer 1 all versions, SmartServer 2 all versions prior to release 4.11.007, i.LON 100 all versions, and i.LON 600 all versions (CVSS 9.8, Echelon SmartServer · Echelon i.LON)
- [CVE-2018-8855](https://cve.now/CVE-2018-8855.md): Echelon SmartServer 1 all versions, SmartServer 2 all versions prior to release 4.11.007, i.LON 100 all versions, and i.LON 600 all versions (CVSS 9.8, Echelon SmartServer · Echelon i.LON)
- [CVE-2018-8859](https://cve.now/CVE-2018-8859.md): Echelon SmartServer 1 all versions, SmartServer 2 all versions prior to release 4.11.007, i.LON 100 all versions, and i.LON 600 all versions (CVSS 9.8, Echelon SmartServer · Echelon i.LON)
- [CVE-2018-14582](https://cve.now/CVE-2018-14582.md): index.php?r=admini/admin/create in BageCMS V3.1.3 allows CSRF to add a background administrator account. (no CVSS)
- [CVE-2018-14583](https://cve.now/CVE-2018-14583.md): xyhai.php?s=/Auth/addUser in XYHCMS 3.5 allows CSRF to add a background administrator account. (no CVSS)
- [CVE-2018-14584](https://cve.now/CVE-2018-14584.md): An issue has been discovered in Bento4 1.5.1-624. (no CVSS)
- [CVE-2018-14585](https://cve.now/CVE-2018-14585.md): An issue has been discovered in Bento4 1.5.1-624. (no CVSS)
- [CVE-2018-14586](https://cve.now/CVE-2018-14586.md): An issue has been discovered in Bento4 1.5.1-624. (no CVSS)
- [CVE-2018-14587](https://cve.now/CVE-2018-14587.md): An issue has been discovered in Bento4 1.5.1-624. (no CVSS)
- [CVE-2018-14588](https://cve.now/CVE-2018-14588.md): An issue has been discovered in Bento4 1.5.1-624. (no CVSS)
- [CVE-2018-14589](https://cve.now/CVE-2018-14589.md): An issue has been discovered in Bento4 1.5.1-624. (no CVSS)
- [CVE-2018-14590](https://cve.now/CVE-2018-14590.md): An issue has been discovered in Bento4 1.5.1-624. (no CVSS)
- [CVE-2016-5638](https://cve.now/CVE-2016-5638.md): Netgear WNDR4500 running firmware version V1.0.1.40\_1.0.6877 reveals some sensitive information such as 2.4GHz & 5GHz Wireless Network Name (SSID) and Network Key (Password) in clear text (no CVSS, Netgear WNDR4500)
- [CVE-2016-5649](https://cve.now/CVE-2016-5649.md): Netgear DGN2200 and DGND3700 disclose the administrator password (no CVSS, Netgear DGN2200 · Netgear DGND3700)
- [CVE-2017-3180](https://cve.now/CVE-2017-3180.md): Multiple TIBCO Spotfire components fail to sanitize user-supplied inout and are vulnerable to cross-site scripting (no CVSS, TIBCO Silver Fabric Enabler for Spotfire Web Player · TI… +7)
- [CVE-2017-3181](https://cve.now/CVE-2017-3181.md): Multiple TIBCO Spotfire components are vulnerable to multiple unspecified SQL-injection vulnerabilities because it fails to properly sanitize user-supplied input before using it in an SQL query (no CVSS, TIBCO Spotfire Analyst · TIBCO Spotfire Connectors +4)
- [CVE-2017-3182](https://cve.now/CVE-2017-3182.md): On the iOS platform, the ThreatMetrix SDK versions prior to 3.2 fail to validate SSL certificates provided by HTTPS connections, which may allow an attacker to perform a man-in-the-middle (MITM) attack (no CVSS, ThreatMetrix SDK)
- [CVE-2017-3183](https://cve.now/CVE-2017-3183.md): Sage XRT Treasury, version 3, fails to properly restrict database access to authorized users, which may enable any authenticated user to gain full access to privileged database functions (no CVSS, Sage XRT Treasury)
- [CVE-2017-3187](https://cve.now/CVE-2017-3187.md): The dotCMS administration panel, versions 3.7.1 and earlier, are vulnerable to cross-site request forgery (no CVSS, docCMS Administration Panel)
- [CVE-2017-3188](https://cve.now/CVE-2017-3188.md): The dotCMS administration panel, versions 3.7.1 and earlier, "Push Publishing" feature in Enterprise Pro is vulnerable to path traversal (no CVSS, docCMS Administration Panel)
- [CVE-2017-3189](https://cve.now/CVE-2017-3189.md): The dotCMS administration panel, versions 3.7.1 and earlier, "Push Publishing" feature in Enterprise Pro is vulnerable to arbitrary file upload (no CVSS, docCMS Administration Panel)
- [CVE-2017-3209](https://cve.now/CVE-2017-3209.md): The DBPOWER U818A WIFI quadcopter drone provides FTP access over its own local access point, and allows full file permissions to the anonymous user (no CVSS, DBPOWER U818A WiFi Quadcopter Drone)
- [CVE-2017-3210](https://cve.now/CVE-2017-3210.md): Applications developed using the Portrait Display SDK, versions 2.30 through 2.34, default to insecure configurations which allow arbitrary code execution (no CVSS, Portrait Display SDK)
- [CVE-2017-3217](https://cve.now/CVE-2017-3217.md): CalAmp LMU 3030 series OBD-II CDMA and GSM devices has an SMS (text message) interface that can be deployed where no password is configured for this interface by the integrator / reseller (no CVSS, CalAmp LMU 3030 OBD-II)
- [CVE-2017-3223](https://cve.now/CVE-2017-3223.md): Dahua IP camera products using firmware versions prior to V2.400.0000.14.R.20170713 include a version of the Sonia web interface that may be vulnerable to a stack buffer overflow (no CVSS, Dahua IP Camera)
- [CVE-2017-3224](https://cve.now/CVE-2017-3224.md): Open Shortest Path First (OSPF) protocol implementations may improperly determine LSA recency in affected Quagga and downstream implementations (SUSE, openSUSE, and Red Hat packages) (no CVSS, Open Shortest Path First (OSPF) Protocol)
- [CVE-2017-3225](https://cve.now/CVE-2017-3225.md): Das U-Boot's AES-CBC encryption feature uses a zero (0) initialization vector that may allow attacks against the underlying cryptographic implementation and allow an attacker to decrypt the data (no CVSS, Das U-Boot)
- [CVE-2017-3226](https://cve.now/CVE-2017-3226.md): Das U-Boot's AES-CBC encryption feature improperly handles an error condition and may allow attacks against the underlying cryptographic implementation and allow an attacker to decrypt the data (no CVSS, Das U-Boot)
- [CVE-2018-5384](https://cve.now/CVE-2018-5384.md): Navarino Infinity web interface up to version 2.2 exposes an unauthenticated script that is prone to blind sql injection (no CVSS, Navarino Infinity)
- [CVE-2018-5385](https://cve.now/CVE-2018-5385.md): Navarino Infinity web interface up to version 2.2 is prone to session fixation attacks (no CVSS, Navarino Infinity)
- [CVE-2018-5386](https://cve.now/CVE-2018-5386.md): Some Navarino Infinity functions placed in the URL can bypass any authentication mechanism leading to an information leak (no CVSS, Navarino Infinity)
- [CVE-2018-5387](https://cve.now/CVE-2018-5387.md): Wizkunde SAMLBase may incorrectly utilize the results of XML DOM traversal and canonicalization APIs in such a way that an attacker may be a (no CVSS, Wizkunde SAMLBase · gogentooss/samlbase)
- [CVE-2018-14579](https://cve.now/CVE-2018-14579.md): GolemCMS through 2008-12-24, if the install/ directory remains active after an installation, allows remote attackers to execute arbitrary PH (no CVSS)
- [CVE-2017-18104](https://cve.now/CVE-2017-18104.md): The Webhooks component of Atlassian Jira before version 7.6.7 and from version 7.7.0 before version 7.11.0 allows remote attackers who are a (no CVSS, Atlassian Jira)
- [CVE-2018-10600](https://cve.now/CVE-2018-10600.md): SEL AcSELerator Architect version 2.2.24.0 and prior allows unsanitized input to be passed to the XML parser, which may allow disclosure and (no CVSS, Schweitzer Engineering Laboratories AcSELerator Architect)
- [CVE-2018-10604](https://cve.now/CVE-2018-10604.md): SEL Compass version 3.0.5.1 and prior allows all users full access to the SEL Compass directory, which may allow modification or overwriting (no CVSS, Schweitzer Engineering Laboratories Compass)
- [CVE-2018-10608](https://cve.now/CVE-2018-10608.md): SEL AcSELerator Architect version 2.2.24.0 and prior can be exploited when the AcSELerator Architect FTP client connects to a malicious FTP (no CVSS, Schweitzer Engineering Laboratories AcSELerator Architect)
- [CVE-2018-10905](https://cve.now/CVE-2018-10905.md): CloudForms Management Engine (cfme) is vulnerable to an improper security setting in the dRuby component of CloudForms. (CVSS 7.8, \[UNKNOWN\] cfme)
- [CVE-2018-13385](https://cve.now/CVE-2018-13385.md): There was an argument injection vulnerability in Sourcetree for macOS via filenames in Mercurial repositories. (no CVSS, Atlassian Sourcetree for macOS)
- [CVE-2018-13386](https://cve.now/CVE-2018-13386.md): There was an argument injection vulnerability in Sourcetree for Windows via filenames in Mercurial repositories. (no CVSS, Atlassian Sourcetree for Windows)
- [CVE-2018-14335](https://cve.now/CVE-2018-14335.md): An issue was discovered in H2 1.4.197. (CVSS 6.5)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2018-07-24
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.