CVEs published July 25, 2018
33 CVEs were published on July 25, 2018: 0 critical, 0 high.
- Published
- 33
- Critical
- 0
- High
- 0
- Medium
- 2
- Low
- 0
- Unrated
- 31
- Now in CISA KEV
- 0
- Fix available
- 10
Most affected products
- F5 Networks BIG-IP
- 8
- [UNKNOWN] kernel
- 1
- Codehaus plexus-archiver · org.codehaus.plexus:plexus-archi…
- 1
- DotNetZip.Semvered · DotNetZip
- 1
- golang archiver · github.com/mholt/archiver
- 1
- Inventory Plugin for Symantec Management Agent
- 1
- node.js adm-zip · adm-zip
- 1
- node.js unzipper · unzipper
- 1
- quazip
- 1
- SharpCompress
- 1
Medium, low and unrated 33
- CVE-2018-13988Poppler through 0.62 contains an out of bounds read vulnerability due to an incorrect memory access that is not mapped in its memory space,
- CVE-2018-14083LICA miniCMTS E8K(u/i/...) devices allow remote attackers to obtain sensitive information via a direct POST request for the inc/user.ini fil
- CVE-2018-14430The Mondula Multi Step Form plugin through 1.2.5 for WordPress allows XSS via the fw_data [id][1], fw_data [id][2], fw_data [id][3], fw_data
- CVE-2018-14493Cross-site scripting (XSS) vulnerability in the Groups Page in Open-Audit Community 2.2.6 allows remote attackers to inject arbitrary web sc
- CVE-2018-8090Quick Heal Total Security 64 bit 17.00 (QHTS64.exe), (QHTSFT64.exe) - Version 10.0.1.38; Quick Heal Total Security 32 bit 17.00 (QHTS32.exe)
- CVE-2018-1002200plexus-archiver before 3.6.0 is vulnerable to directory traversal, allowing attackers to write to arbitrary files via a ../ (dot dot slash) Codehaus plexus-archiver · org.codehaus.plexus:plexus-archi…
- CVE-2018-1002201zt-zip before 1.13 is vulnerable to directory traversal, allowing attackers to write to arbitrary files via a ../ (dot dot slash) in a Zip azeroturnaround zt-zip · org.zeroturnaround:zt-zip
- CVE-2018-1002202zip4j before 1.3.3 is vulnerable to directory traversal, allowing attackers to write to arbitrary files via a ../ (dot dot slash) in a Zip azip4j · net.lingala.zip4j:zip4j
- CVE-2018-1002203unzipper npm library before 0.8.13 is vulnerable to directory traversal, allowing attackers to write to arbitrary files via a ../ (dot dot snode.js unzipper · unzipper
- CVE-2018-1002204adm-zip npm library before 0.4.9 is vulnerable to directory traversal, allowing attackers to write to arbitrary files via a ../ (dot dot slanode.js adm-zip · adm-zip
- CVE-2018-1002205DotNetZip.Semvered before 1.11.0 is vulnerable to directory traversal, allowing attackers to write to arbitrary files via a ../ (dot dot slaDotNetZip.Semvered · DotNetZip
- CVE-2018-1002206SharpCompress before 0.21.0 is vulnerable to directory traversal, allowing attackers to write to arbitrary files via a ../ (dot dot slash) iSharpCompress
- CVE-2018-1002207mholt/archiver golang package before e4ef56d48eb029648b0e895bb0b6a393ef0829c3 is vulnerable to directory traversal, allowing attackers to wrgolang archiver · github.com/mholt/archiver
- CVE-2018-1002208SharpZipLib before 1.0 RC1 is vulnerable to directory traversal, allowing attackers to write to arbitrary files via a ../ (dot dot slash) inSharpZipLib
- CVE-2018-1002209QuaZIP before 0.7.6 is vulnerable to directory traversal, allowing attackers to write to arbitrary files via a ../ (dot dot slash) in a Zip quazip
- CVE-2018-5240The Inventory Plugin for Symantec Management Agent prior to 7.6 POST HF7, 8.0 POST HF6, or 8.1 RU7 may be susceptible to a privilege escalatInventory Plugin for Symantec Management Agent
- CVE-2017-10934All versions prior to V5.09.02.02T4 of the ZTE ZXIPTV-EPG product use the Java RMI service in which the servers use the Apache Commons ColleZTE ZXIPTV-EPG
- CVE-2017-10935All versions prior to ZSRV2 V3.00.40 of the ZTE ZXR10 1800-2S products allow remote authenticated users to bypass the original password authZTE ZXR10 1800-2S
- CVE-2017-10936SQL injection vulnerability in all versions prior to V4.01.01 of the ZTE ZXCDN-SNS product allows remote attackers to execute arbitrary SQL ZTE ZXCDN-SNS
- CVE-2017-10937SQL injection vulnerability in all versions prior to V2.01.05.09 of the ZTE ZXIPTV-UCM product allows remote attackers to execute arbitrary ZTE ZXIPTV-UCM
- CVE-2018-5530F5 BIG-IP 13.0.0-13.1.0.5, 12.1.0-12.1.3.5, or 11.6.0-11.6.3.1 virtual servers with HTTP/2 profiles enabled are vulnerable to "HPACK Bomb".F5 Networks BIG-IP
- CVE-2018-5531Through undisclosed methods, on F5 BIG-IP 13.0.0-13.1.0.7, 12.1.0-12.1.3.5, 11.6.0-11.6.3.1, or 11.2.1-11.5.6, adjacent network attackers caF5 Networks BIG-IP
- CVE-2018-5536A remote attacker via undisclosed measures, may be able to exploit an F5 BIG-IP APM 13.0.0-13.1.0.7 or 12.1.0-12.1.3.5 virtual server configF5 Networks BIG-IP
- CVE-2018-5537A remote attacker may be able to disrupt services on F5 BIG-IP 13.0.0-13.1.0.5, 12.1.0-12.1.3.5, 11.6.0-11.6.3.1, or 11.2.1-11.5.6 if the TMF5 Networks BIG-IP
- CVE-2018-5538On F5 BIG-IP DNS 13.1.0-13.1.0.7, 12.1.3-12.1.3.5, DNS Express / DNS Zones accept NOTIFY messages on the management interface from source IPF5 Networks BIG-IP
- CVE-2018-5539Under certain conditions, on F5 BIG-IP ASM 13.0.0-13.1.0.7, 12.1.0-12.1.3.5, 11.6.0-11.6.3.1, 11.5.1-11.5.6, or 11.2.1, when processing CSRFF5 Networks BIG-IP
- CVE-2018-5541When F5 BIG-IP ASM 13.0.0-13.1.0.1, 12.1.0-12.1.3.5, 11.6.0-11.6.3.1, or 11.5.1-11.5.6 is processing HTTP requests, an unusually large numbeF5 Networks BIG-IP
- CVE-2018-5542F5 BIG-IP 13.0.0-13.0.1, 12.1.0-12.1.3.6, or 11.2.1-11.6.3.2 HTTPS health monitors do not validate the identity of the monitored server.F5 Networks BIG-IP
- CVE-2018-10880Linux kernel is vulnerable to a stack-out-of-bounds write in the ext4 filesystem code when mounting and writing to a crafted ext4 image in e[UNKNOWN] kernel
- CVE-2018-11491ASUS HG100 devices with firmware before 1.05.12 allow unauthenticated access, leading to remote command execution.
- CVE-2018-6971VMware Horizon View Agents (7.x.x before 7.5.1) contain a local information disclosure vulnerability due to insecure logging of credentials VMware Horizon View Agent
- CVE-2018-6972VMware ESXi (6.7 before ESXi670-201806401-BG, 6.5 before ESXi650-201806401-BG, 6.0 before ESXi600-201806401-BG and 5.5 before ESXi550-201806VMware ESXi · VMware Workstation +1
- CVE-2018-14596wancms 1.0 through 5.0 allows remote attackers to cause a denial of service (resource consumption) via a checkcode (aka verification code) U