# CVEs published 2018-07-26

44 CVEs were published on July 26, 2018: 1 critical, 5 high. Days are UTC.

- [CVE-2018-14607](https://cve.now/CVE-2018-14607.md): Thomson Reuters UltraTax CS 2017 on Windows, in a client/server configuration, transfers customer records and bank account numbers in cleart (no CVSS)
- [CVE-2018-14608](https://cve.now/CVE-2018-14608.md): Thomson Reuters UltraTax CS 2017 on Windows has a password protection option; however, the level of protection might be inconsistent with so (no CVSS)
- [CVE-2015-9261](https://cve.now/CVE-2015-9261.md): huft\_build in archival/libarchive/decompress\_gunzip.c in BusyBox before 1.27.2 misuses a pointer, causing segfaults and an application crash (no CVSS)
- [CVE-2017-18344](https://cve.now/CVE-2017-18344.md): The timer\_create syscall implementation in kernel/time/posix-timers.c in the Linux kernel before 4.14.8 doesn't properly validate the sigeve (no CVSS)
- [CVE-2018-9068](https://cve.now/CVE-2018-9068.md): The IMM2 First Failure Data Capture function collects management module logs and diagnostic information when a hardware error is detected. (no CVSS, Lenovo Group System x IMM2 · IBM System x IMM2)
- [CVE-2017-12150](https://cve.now/CVE-2017-12150.md): It was found that samba before 4.4.16, 4.5.x before 4.5.14, and 4.6.x before 4.6.8 did not enforce "SMB signing" when certain configuration (CVSS 7.4, samba)
- [CVE-2018-10876](https://cve.now/CVE-2018-10876.md): A flaw was found in Linux kernel in the ext4 filesystem code. (CVSS 5.0, \[UNKNOWN\] kernel)
- [CVE-2018-10878](https://cve.now/CVE-2018-10878.md): A flaw was found in the Linux kernel's ext4 filesystem. (CVSS 4.8, \[UNKNOWN\] kernel)
- [CVE-2018-10879](https://cve.now/CVE-2018-10879.md): A flaw was found in the Linux kernel's ext4 filesystem. (CVSS 4.2, \[UNKNOWN\] kernel)
- [CVE-2018-10881](https://cve.now/CVE-2018-10881.md): A flaw was found in the Linux kernel's ext4 filesystem. (CVSS 4.2, \[UNKNOWN\] kernel)
- [CVE-2017-12167](https://cve.now/CVE-2017-12167.md): It was found in EAP 7 before 7.0.9 that properties based files of the management and the application realm configuration that contain user t (CVSS 5.5, Red Hat EAP-7)
- [CVE-2017-12171](https://cve.now/CVE-2017-12171.md): A regression was found in the Red Hat Enterprise Linux 6.9 version of httpd 2.2.15-60, causing comments in the "Allow" and "Deny" configurat (CVSS 6.5, Red Hat httpd)
- [CVE-2017-12175](https://cve.now/CVE-2017-12175.md): Red Hat Satellite before 6.5 is vulnerable to a XSS in discovery rule when you are entering filter and you use autocomplete functionality. (CVSS 3.5, Red Hat Satellite)
- [CVE-2017-2582](https://cve.now/CVE-2017-2582.md): It was found that while parsing the SAML messages the StaxParserUtil class of keycloak before 2.5.1 replaces special strings for obtaining a (CVSS 6.5, Red Hat keycloak · org.keycloak:keycloak-core)
- [CVE-2018-0607](https://cve.now/CVE-2018-0607.md): SQL injection vulnerability in the Notifications application in the Cybozu Garoon 3.5.0 to 4.6.2 allows remote authenticated attackers to ex (no CVSS, Cybozu Garoon)
- [CVE-2018-0613](https://cve.now/CVE-2018-0613.md): NEC Platforms Calsos CSDX and CSDJ series products (CSDX 1.37210411 and earlier, CSDX(P) 4.37210411 and earlier, CSDX(D) 3.37210411 and earl (no CVSS, NEC Platforms Calsos CSDX and CSDJ series products)
- [CVE-2018-0614](https://cve.now/CVE-2018-0614.md): Cross-site scripting vulnerability in NEC Platforms Calsos CSDX and CSDJ series products (CSDX 1.37210411 and earlier, CSDX(P) 4.37210411 an (no CVSS, NEC Platforms Calsos CSDX and CSDJ series products)
- [CVE-2018-0617](https://cve.now/CVE-2018-0617.md): Directory traversal vulnerability in ChamaNet MemoCGI v2.1800 to v2.2200 allows remote attackers to read arbitrary files via unspecified vec (no CVSS, ChamaNet MemoCGI)
- [CVE-2018-0618](https://cve.now/CVE-2018-0618.md): Cross-site scripting vulnerability in Mailman 2.1.26 and earlier allows remote authenticated attackers to inject arbitrary web script or HTM (no CVSS, GNU Mailman Mailman)
- [CVE-2018-0619](https://cve.now/CVE-2018-0619.md): Untrusted search path vulnerability in the installer of Glarysoft Glary Utilities (Glary Utilities 5.99 and earlier and Glary Utilities Pro (no CVSS, Glarysoft Installer of Glary Utilities)
- [CVE-2018-0620](https://cve.now/CVE-2018-0620.md): Untrusted search path vulnerability in LOGICOOL Game Software versions before 8.87.116 allows an attacker to gain privileges via a Trojan ho (no CVSS, Logicool Co the installer of LOGICOOL Game Software)
- [CVE-2018-0621](https://cve.now/CVE-2018-0621.md): Untrusted search path vulnerability in LOGICOOL CONNECTION UTILITY SOFTWARE versions before 2.30.9 allows an attacker to gain privileges via (no CVSS, the installer of LOGICOOL CONNECTION UTILITY SOFTWARE)
- [CVE-2018-0622](https://cve.now/CVE-2018-0622.md): The DHC Online Shop App for Android version 3.2.0 and earlier does not verify X.509 certificates from SSL servers, which allows man-in-the-m (no CVSS, DHC Online Shop App for Android)
- [CVE-2018-10901](https://cve.now/CVE-2018-10901.md): A flaw was found in Linux kernel's KVM virtualization subsystem. (CVSS 7.8, \[UNKNOWN\] kernel:)
- [CVE-2017-12163](https://cve.now/CVE-2017-12163.md): An information leak flaw was found in the way SMB1 protocol was implemented by Samba before 4.4.16, 4.5.x before 4.5.14, and 4.6.x before 4. (CVSS 4.1, Samba)
- [CVE-2017-12164](https://cve.now/CVE-2017-12164.md): A flaw was discovered in gdm 3.24.1 where gdm greeter was no longer setting the ran\_once boolean during autologin. (CVSS 4.1, GNOME gdm)
- [CVE-2017-7509](https://cve.now/CVE-2017-7509.md): An input validation error was found in Red Hat Certificate System's handling of client provided certificates before 8.1.20-1. (CVSS 3.5, Red Hat Certificate System)
- [CVE-2017-2589](https://cve.now/CVE-2017-2589.md): It was discovered that the hawtio servlet 1.4 uses a single HttpClient instance to proxy requests with a persistent cookie store (cookies ar (CVSS 8.7, Red Hat hawtio · io.hawt:project)
- [CVE-2017-7538](https://cve.now/CVE-2017-7538.md): A cross-site scripting (XSS) flaw was found in how an organization name is displayed in Satellite 5, before 5.8. (CVSS 3.5, Red Hat Satellite)
- [CVE-2017-7545](https://cve.now/CVE-2017-7545.md): It was discovered that the XmlUtils class in jbpmmigration 6.5 performed expansion of external parameter entities while parsing XML files. (CVSS 6.5, KIE jbpm-designer · org.jbpm.jbpm5:jbpmmigration)
- [CVE-2017-7558](https://cve.now/CVE-2017-7558.md): A kernel data leak due to an out-of-bound read was found in the Linux kernel in inet\_diag\_msg\_sctp{,l}addr\_fill() and sctp\_get\_sctp\_info() f (CVSS 5.1, Linux kernel)
- [CVE-2017-7562](https://cve.now/CVE-2017-7562.md): An authentication bypass flaw was found in the way krb5's certauth interface before 1.16.1 handled the validation of client certificates. (CVSS 6.5, MIT krb5)
- [CVE-2018-10900](https://cve.now/CVE-2018-10900.md): Network Manager VPNC plugin (aka networkmanager-vpnc) before version 1.2.6 is vulnerable to a privilege escalation attack. (CVSS 8.8, \[UNKNOWN\] networkmanager-vpnc)
- [CVE-2016-8647](https://cve.now/CVE-2016-8647.md): An input validation vulnerability was found in Ansible's mysql\_user module before 2.2.1.0, which may fail to correctly change a password in (CVSS 2.2, Red Hat Ansible · ansible)
- [CVE-2017-12610](https://cve.now/CVE-2017-12610.md): In Apache Kafka 0.10.0.0 to 0.10.2.1 and 0.11.0.0 to 0.11.0.1, authenticated Kafka clients may use impersonation via a manually crafted prot (no CVSS, Apache Software Foundation Apache Kafka · org.apache.kafka:…)
- [CVE-2017-2664](https://cve.now/CVE-2017-2664.md): CloudForms Management Engine (cfme) before 5.7.3 and 5.8.x before 5.8.1 lacks RBAC controls on certain methods in the rails application port (CVSS 6.5, Red Hat CloudForms)
- [CVE-2017-7539](https://cve.now/CVE-2017-7539.md): An assertion-failure flaw was found in Qemu before 2.10.1, in the Network Block Device (NBD) server's initial connection negotiation, where (CVSS 5.3, Qemu)
- [CVE-2017-7543](https://cve.now/CVE-2017-7543.md): A race-condition flaw was discovered in openstack-neutron before 7.2.0-12.1, 8.x before 8.3.0-11.1, 9.x before 9.3.1-2.1, and 10.x before 10 (CVSS 5.3, Red Hat openstack-neutron · neutron)
- [CVE-2018-1288](https://cve.now/CVE-2018-1288.md): In Apache Kafka 0.9.0.0 to 0.9.0.1, 0.10.0.0 to 0.10.2.1, 0.11.0.0 to 0.11.0.2, and 1.0.0, authenticated Kafka users may perform action rese (no CVSS, Apache Software Foundation Apache Kafka · org.apache.kafka:…)
- [CVE-2017-7526](https://cve.now/CVE-2017-7526.md): libgcrypt before version 1.7.8 is vulnerable to a cache side-channel attack resulting into a complete break of RSA-1024 while using the left (CVSS 6.1, GnuPG libgcrypt)
- [CVE-2017-7530](https://cve.now/CVE-2017-7530.md): In CloudForms Management Engine (cfme) before 5.7.3 and 5.8.x before 5.8.1, it was found that privilege check is missing when invoking arbit (CVSS 8.8, Red Hat cfme)
- [CVE-2017-7535](https://cve.now/CVE-2017-7535.md): foreman before version 1.16.0 is vulnerable to a stored XSS in organizations/locations assignment to hosts. (CVSS 6.1, foreman)
- [CVE-2017-7537](https://cve.now/CVE-2017-7537.md): It was found that a mock CMC authentication plugin with a hardcoded secret was accidentally enabled by default in the pki-core package befor (CVSS 5.9, Dogtag PKI pki-core)
- [CVE-2017-2637](https://cve.now/CVE-2017-2637.md): A design flaw issue was found in the Red Hat OpenStack Platform director use of TripleO to enable libvirtd based live-migration. (CVSS 9.9, \[UNKNOWN\] rhosp-director)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2018-07-26
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.