# CVEs published 2018-07-25

33 CVEs were published on July 25, 2018: 0 critical, 0 high. Days are UTC.

- [CVE-2018-13988](https://cve.now/CVE-2018-13988.md): Poppler through 0.62 contains an out of bounds read vulnerability due to an incorrect memory access that is not mapped in its memory space, (no CVSS)
- [CVE-2018-14083](https://cve.now/CVE-2018-14083.md): LICA miniCMTS E8K(u/i/...) devices allow remote attackers to obtain sensitive information via a direct POST request for the inc/user.ini fil (no CVSS)
- [CVE-2018-14430](https://cve.now/CVE-2018-14430.md): The Mondula Multi Step Form plugin through 1.2.5 for WordPress allows XSS via the fw\_data \[id\]\[1\], fw\_data \[id\]\[2\], fw\_data \[id\]\[3\], fw\_data (no CVSS)
- [CVE-2018-14493](https://cve.now/CVE-2018-14493.md): Cross-site scripting (XSS) vulnerability in the Groups Page in Open-Audit Community 2.2.6 allows remote attackers to inject arbitrary web sc (no CVSS)
- [CVE-2018-8090](https://cve.now/CVE-2018-8090.md): Quick Heal Total Security 64 bit 17.00 (QHTS64.exe), (QHTSFT64.exe) - Version 10.0.1.38; Quick Heal Total Security 32 bit 17.00 (QHTS32.exe) (no CVSS)
- [CVE-2018-1002200](https://cve.now/CVE-2018-1002200.md): plexus-archiver before 3.6.0 is vulnerable to directory traversal, allowing attackers to write to arbitrary files via a ../ (dot dot slash) (no CVSS, Codehaus plexus-archiver · org.codehaus.plexus:plexus-archi…)
- [CVE-2018-1002201](https://cve.now/CVE-2018-1002201.md): zt-zip before 1.13 is vulnerable to directory traversal, allowing attackers to write to arbitrary files via a ../ (dot dot slash) in a Zip a (no CVSS, zeroturnaround zt-zip · org.zeroturnaround:zt-zip)
- [CVE-2018-1002202](https://cve.now/CVE-2018-1002202.md): zip4j before 1.3.3 is vulnerable to directory traversal, allowing attackers to write to arbitrary files via a ../ (dot dot slash) in a Zip a (no CVSS, zip4j · net.lingala.zip4j:zip4j)
- [CVE-2018-1002203](https://cve.now/CVE-2018-1002203.md): unzipper npm library before 0.8.13 is vulnerable to directory traversal, allowing attackers to write to arbitrary files via a ../ (dot dot s (no CVSS, node.js unzipper · unzipper)
- [CVE-2018-1002204](https://cve.now/CVE-2018-1002204.md): adm-zip npm library before 0.4.9 is vulnerable to directory traversal, allowing attackers to write to arbitrary files via a ../ (dot dot sla (no CVSS, node.js adm-zip · adm-zip)
- [CVE-2018-1002205](https://cve.now/CVE-2018-1002205.md): DotNetZip.Semvered before 1.11.0 is vulnerable to directory traversal, allowing attackers to write to arbitrary files via a ../ (dot dot sla (CVSS 5.5, DotNetZip.Semvered · DotNetZip)
- [CVE-2018-1002206](https://cve.now/CVE-2018-1002206.md): SharpCompress before 0.21.0 is vulnerable to directory traversal, allowing attackers to write to arbitrary files via a ../ (dot dot slash) i (no CVSS, SharpCompress)
- [CVE-2018-1002207](https://cve.now/CVE-2018-1002207.md): mholt/archiver golang package before e4ef56d48eb029648b0e895bb0b6a393ef0829c3 is vulnerable to directory traversal, allowing attackers to wr (no CVSS, golang archiver · github.com/mholt/archiver)
- [CVE-2018-1002208](https://cve.now/CVE-2018-1002208.md): SharpZipLib before 1.0 RC1 is vulnerable to directory traversal, allowing attackers to write to arbitrary files via a ../ (dot dot slash) in (no CVSS, SharpZipLib)
- [CVE-2018-1002209](https://cve.now/CVE-2018-1002209.md): QuaZIP before 0.7.6 is vulnerable to directory traversal, allowing attackers to write to arbitrary files via a ../ (dot dot slash) in a Zip (no CVSS, quazip)
- [CVE-2018-5240](https://cve.now/CVE-2018-5240.md): The Inventory Plugin for Symantec Management Agent prior to 7.6 POST HF7, 8.0 POST HF6, or 8.1 RU7 may be susceptible to a privilege escalat (no CVSS, Inventory Plugin for Symantec Management Agent)
- [CVE-2017-10934](https://cve.now/CVE-2017-10934.md): All versions prior to V5.09.02.02T4 of the ZTE ZXIPTV-EPG product use the Java RMI service in which the servers use the Apache Commons Colle (no CVSS, ZTE ZXIPTV-EPG)
- [CVE-2017-10935](https://cve.now/CVE-2017-10935.md): All versions prior to ZSRV2 V3.00.40 of the ZTE ZXR10 1800-2S products allow remote authenticated users to bypass the original password auth (no CVSS, ZTE ZXR10 1800-2S)
- [CVE-2017-10936](https://cve.now/CVE-2017-10936.md): SQL injection vulnerability in all versions prior to V4.01.01 of the ZTE ZXCDN-SNS product allows remote attackers to execute arbitrary SQL (no CVSS, ZTE ZXCDN-SNS)
- [CVE-2017-10937](https://cve.now/CVE-2017-10937.md): SQL injection vulnerability in all versions prior to V2.01.05.09 of the ZTE ZXIPTV-UCM product allows remote attackers to execute arbitrary (no CVSS, ZTE ZXIPTV-UCM)
- [CVE-2018-5530](https://cve.now/CVE-2018-5530.md): F5 BIG-IP 13.0.0-13.1.0.5, 12.1.0-12.1.3.5, or 11.6.0-11.6.3.1 virtual servers with HTTP/2 profiles enabled are vulnerable to "HPACK Bomb". (no CVSS, F5 Networks BIG-IP)
- [CVE-2018-5531](https://cve.now/CVE-2018-5531.md): Through undisclosed methods, on F5 BIG-IP 13.0.0-13.1.0.7, 12.1.0-12.1.3.5, 11.6.0-11.6.3.1, or 11.2.1-11.5.6, adjacent network attackers ca (no CVSS, F5 Networks BIG-IP)
- [CVE-2018-5536](https://cve.now/CVE-2018-5536.md): A remote attacker via undisclosed measures, may be able to exploit an F5 BIG-IP APM 13.0.0-13.1.0.7 or 12.1.0-12.1.3.5 virtual server config (no CVSS, F5 Networks BIG-IP)
- [CVE-2018-5537](https://cve.now/CVE-2018-5537.md): A remote attacker may be able to disrupt services on F5 BIG-IP 13.0.0-13.1.0.5, 12.1.0-12.1.3.5, 11.6.0-11.6.3.1, or 11.2.1-11.5.6 if the TM (no CVSS, F5 Networks BIG-IP)
- [CVE-2018-5538](https://cve.now/CVE-2018-5538.md): On F5 BIG-IP DNS 13.1.0-13.1.0.7, 12.1.3-12.1.3.5, DNS Express / DNS Zones accept NOTIFY messages on the management interface from source IP (no CVSS, F5 Networks BIG-IP)
- [CVE-2018-5539](https://cve.now/CVE-2018-5539.md): Under certain conditions, on F5 BIG-IP ASM 13.0.0-13.1.0.7, 12.1.0-12.1.3.5, 11.6.0-11.6.3.1, 11.5.1-11.5.6, or 11.2.1, when processing CSRF (no CVSS, F5 Networks BIG-IP)
- [CVE-2018-5541](https://cve.now/CVE-2018-5541.md): When F5 BIG-IP ASM 13.0.0-13.1.0.1, 12.1.0-12.1.3.5, 11.6.0-11.6.3.1, or 11.5.1-11.5.6 is processing HTTP requests, an unusually large numbe (no CVSS, F5 Networks BIG-IP)
- [CVE-2018-5542](https://cve.now/CVE-2018-5542.md): F5 BIG-IP 13.0.0-13.0.1, 12.1.0-12.1.3.6, or 11.2.1-11.6.3.2 HTTPS health monitors do not validate the identity of the monitored server. (no CVSS, F5 Networks BIG-IP)
- [CVE-2018-10880](https://cve.now/CVE-2018-10880.md): Linux kernel is vulnerable to a stack-out-of-bounds write in the ext4 filesystem code when mounting and writing to a crafted ext4 image in e (CVSS 5.5, \[UNKNOWN\] kernel)
- [CVE-2018-11491](https://cve.now/CVE-2018-11491.md): ASUS HG100 devices with firmware before 1.05.12 allow unauthenticated access, leading to remote command execution. (no CVSS)
- [CVE-2018-6971](https://cve.now/CVE-2018-6971.md): VMware Horizon View Agents (7.x.x before 7.5.1) contain a local information disclosure vulnerability due to insecure logging of credentials (no CVSS, VMware Horizon View Agent)
- [CVE-2018-6972](https://cve.now/CVE-2018-6972.md): VMware ESXi (6.7 before ESXi670-201806401-BG, 6.5 before ESXi650-201806401-BG, 6.0 before ESXi600-201806401-BG and 5.5 before ESXi550-201806 (no CVSS, VMware ESXi · VMware Workstation +1)
- [CVE-2018-14596](https://cve.now/CVE-2018-14596.md): wancms 1.0 through 5.0 allows remote attackers to cause a denial of service (resource consumption) via a checkcode (aka verification code) U (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2018-07-25
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.