CVEs published July 26, 2018
44 CVEs were published on July 26, 2018: 1 critical, 5 high.
- Published
- 44
- Critical
- 1
- High
- 5
- Medium
- 18
- Low
- 4
- Unrated
- 16
- Now in CISA KEV
- 0
- Fix available
- 6
Most affected products
- [UNKNOWN] kernel
- 4
- Apache Software Foundation Apache Kafka · org.apache.kafka:…
- 2
- NEC Platforms Calsos CSDX and CSDJ series products
- 2
- Red Hat Satellite
- 2
- [UNKNOWN] kernel:
- 1
- [UNKNOWN] networkmanager-vpnc
- 1
- [UNKNOWN] rhosp-director
- 1
- ChamaNet MemoCGI
- 1
- Cybozu Garoon
- 1
- DHC Online Shop App for Android
- 1
Critical 1
High 5
- CVE-2017-12150It was found that samba before 4.4.16, 4.5.x before 4.5.14, and 4.6.x before 4.6.8 did not enforce "SMB signing" when certain configuration samba
- CVE-2018-10901A flaw was found in Linux kernel's KVM virtualization subsystem.[UNKNOWN] kernel:
- CVE-2017-2589It was discovered that the hawtio servlet 1.4 uses a single HttpClient instance to proxy requests with a persistent cookie store (cookies arRed Hat hawtio · io.hawt:project
- CVE-2018-10900Network Manager VPNC plugin (aka networkmanager-vpnc) before version 1.2.6 is vulnerable to a privilege escalation attack.[UNKNOWN] networkmanager-vpnc
- CVE-2017-7530In CloudForms Management Engine (cfme) before 5.7.3 and 5.8.x before 5.8.1, it was found that privilege check is missing when invoking arbitRed Hat cfme
Medium, low and unrated 38
- CVE-2018-14607Thomson Reuters UltraTax CS 2017 on Windows, in a client/server configuration, transfers customer records and bank account numbers in cleart
- CVE-2018-14608Thomson Reuters UltraTax CS 2017 on Windows has a password protection option; however, the level of protection might be inconsistent with so
- CVE-2015-9261huft_build in archival/libarchive/decompress_gunzip.c in BusyBox before 1.27.2 misuses a pointer, causing segfaults and an application crash
- CVE-2017-18344The timer_create syscall implementation in kernel/time/posix-timers.c in the Linux kernel before 4.14.8 doesn't properly validate the sigeve
- CVE-2018-9068The IMM2 First Failure Data Capture function collects management module logs and diagnostic information when a hardware error is detected.Lenovo Group System x IMM2 · IBM System x IMM2
- CVE-2018-10876A flaw was found in Linux kernel in the ext4 filesystem code.[UNKNOWN] kernel
- CVE-2018-10878A flaw was found in the Linux kernel's ext4 filesystem.[UNKNOWN] kernel
- CVE-2018-10879A flaw was found in the Linux kernel's ext4 filesystem.[UNKNOWN] kernel
- CVE-2018-10881A flaw was found in the Linux kernel's ext4 filesystem.[UNKNOWN] kernel
- CVE-2017-12167It was found in EAP 7 before 7.0.9 that properties based files of the management and the application realm configuration that contain user tRed Hat EAP-7
- CVE-2017-12171A regression was found in the Red Hat Enterprise Linux 6.9 version of httpd 2.2.15-60, causing comments in the "Allow" and "Deny" configuratRed Hat httpd
- CVE-2017-12175Red Hat Satellite before 6.5 is vulnerable to a XSS in discovery rule when you are entering filter and you use autocomplete functionality.Red Hat Satellite
- CVE-2017-2582It was found that while parsing the SAML messages the StaxParserUtil class of keycloak before 2.5.1 replaces special strings for obtaining aRed Hat keycloak · org.keycloak:keycloak-core
- CVE-2018-0607SQL injection vulnerability in the Notifications application in the Cybozu Garoon 3.5.0 to 4.6.2 allows remote authenticated attackers to exCybozu Garoon
- CVE-2018-0613NEC Platforms Calsos CSDX and CSDJ series products (CSDX 1.37210411 and earlier, CSDX(P) 4.37210411 and earlier, CSDX(D) 3.37210411 and earlNEC Platforms Calsos CSDX and CSDJ series products
- CVE-2018-0614Cross-site scripting vulnerability in NEC Platforms Calsos CSDX and CSDJ series products (CSDX 1.37210411 and earlier, CSDX(P) 4.37210411 anNEC Platforms Calsos CSDX and CSDJ series products
- CVE-2018-0617Directory traversal vulnerability in ChamaNet MemoCGI v2.1800 to v2.2200 allows remote attackers to read arbitrary files via unspecified vecChamaNet MemoCGI
- CVE-2018-0618Cross-site scripting vulnerability in Mailman 2.1.26 and earlier allows remote authenticated attackers to inject arbitrary web script or HTMGNU Mailman Mailman
- CVE-2018-0619Untrusted search path vulnerability in the installer of Glarysoft Glary Utilities (Glary Utilities 5.99 and earlier and Glary Utilities Pro Glarysoft Installer of Glary Utilities
- CVE-2018-0620Untrusted search path vulnerability in LOGICOOL Game Software versions before 8.87.116 allows an attacker to gain privileges via a Trojan hoLogicool Co the installer of LOGICOOL Game Software
- CVE-2018-0621Untrusted search path vulnerability in LOGICOOL CONNECTION UTILITY SOFTWARE versions before 2.30.9 allows an attacker to gain privileges viathe installer of LOGICOOL CONNECTION UTILITY SOFTWARE
- CVE-2018-0622The DHC Online Shop App for Android version 3.2.0 and earlier does not verify X.509 certificates from SSL servers, which allows man-in-the-mDHC Online Shop App for Android
- CVE-2017-12163An information leak flaw was found in the way SMB1 protocol was implemented by Samba before 4.4.16, 4.5.x before 4.5.14, and 4.6.x before 4.Samba
- CVE-2017-12164A flaw was discovered in gdm 3.24.1 where gdm greeter was no longer setting the ran_once boolean during autologin.GNOME gdm
- CVE-2017-7509An input validation error was found in Red Hat Certificate System's handling of client provided certificates before 8.1.20-1.Red Hat Certificate System
- CVE-2017-7538A cross-site scripting (XSS) flaw was found in how an organization name is displayed in Satellite 5, before 5.8.Red Hat Satellite
- CVE-2017-7545It was discovered that the XmlUtils class in jbpmmigration 6.5 performed expansion of external parameter entities while parsing XML files.KIE jbpm-designer · org.jbpm.jbpm5:jbpmmigration
- CVE-2017-7558A kernel data leak due to an out-of-bound read was found in the Linux kernel in inet_diag_msg_sctp{,l}addr_fill() and sctp_get_sctp_info() fLinux kernel
- CVE-2017-7562An authentication bypass flaw was found in the way krb5's certauth interface before 1.16.1 handled the validation of client certificates.MIT krb5
- CVE-2016-8647An input validation vulnerability was found in Ansible's mysql_user module before 2.2.1.0, which may fail to correctly change a password in Red Hat Ansible · ansible
- CVE-2017-12610In Apache Kafka 0.10.0.0 to 0.10.2.1 and 0.11.0.0 to 0.11.0.1, authenticated Kafka clients may use impersonation via a manually crafted protApache Software Foundation Apache Kafka · org.apache.kafka:…
- CVE-2017-2664CloudForms Management Engine (cfme) before 5.7.3 and 5.8.x before 5.8.1 lacks RBAC controls on certain methods in the rails application portRed Hat CloudForms
- CVE-2017-7539An assertion-failure flaw was found in Qemu before 2.10.1, in the Network Block Device (NBD) server's initial connection negotiation, where Qemu
- CVE-2017-7543A race-condition flaw was discovered in openstack-neutron before 7.2.0-12.1, 8.x before 8.3.0-11.1, 9.x before 9.3.1-2.1, and 10.x before 10Red Hat openstack-neutron · neutron
- CVE-2018-1288In Apache Kafka 0.9.0.0 to 0.9.0.1, 0.10.0.0 to 0.10.2.1, 0.11.0.0 to 0.11.0.2, and 1.0.0, authenticated Kafka users may perform action reseApache Software Foundation Apache Kafka · org.apache.kafka:…
- CVE-2017-7526libgcrypt before version 1.7.8 is vulnerable to a cache side-channel attack resulting into a complete break of RSA-1024 while using the leftGnuPG libgcrypt
- CVE-2017-7535foreman before version 1.16.0 is vulnerable to a stored XSS in organizations/locations assignment to hosts.foreman
- CVE-2017-7537It was found that a mock CMC authentication plugin with a hardcoded secret was accidentally enabled by default in the pki-core package beforDogtag PKI pki-core