CVEs published August 1, 2018
79 CVEs were published on August 1, 2018: 2 critical, 11 high.
- Published
- 79
- Critical
- 2
- High
- 11
- Medium
- 21
- Low
- 6
- Unrated
- 39
- Now in CISA KEV
- 0
- Fix available
- 24
Most affected products
- The Curl Project curl
- 6
- Computerinsel Photoline
- 3
- Intel Saffron MemoryBase
- 3
- Intel Smart Sound Technology
- 3
- Cisco Small Business 300 Series Managed Switches unknown
- 2
- de.tracetronic.jenkins.plugins:ecutest
- 2
- Foxit
- 2
- opensuse openbuildservice
- 2
- The Foreman Project foreman
- 2
- The Jasper Project jasper
- 2
Critical 2
High 11
- CVE-2018-3924An exploitable use-after-free vulnerability exists in the JavaScript engine of Foxit Software's Foxit PDF Reader version 9.1.5096.Foxit
- CVE-2018-3939An exploitable use-after-free vulnerability exists in the JavaScript engine of Foxit Software's PDF Reader, version 9.1.0.5096.Foxit
- CVE-2018-3847Multiple exploitable buffer overflow vulnerabilities exist in image parsing functionality of the CFITSIO library version 3.42.NASA CFITSIO
- CVE-2018-8034The host name verification when using TLS with the WebSocket client was missing.Apache Software Foundation Apache Tomcat · org.apache.tomca…
- CVE-2018-10897A directory traversal issue was found in reposync, a part of yum-utils, where reposync fails to sanitize paths in remote repository configurThe RPM Project yum-utils:
- CVE-2018-1595IBM Spectrum Symphony and Platform Symphony 7.1.2 and 7.2.0.2 could allow an authenticated user to execute arbitrary commands due to impropeIBM Spectrum Symphony
- CVE-2016-8654A heap-buffer overflow vulnerability was found in QMFB code in JPC codec caused by buffer being allocated with too small size.The Jasper Project jasper
- CVE-2018-3921A memory corruption vulnerability exists in the PSD-parsing functionality of Computerinsel Photoline 20.54.Computerinsel Photoline
- CVE-2018-3922A memory corruption vulnerability exists in the ANI-parsing functionality of Computerinsel Photoline 20.54.Computerinsel Photoline
- CVE-2018-3923A memory corruption vulnerability exists in the PCX-parsing functionality of Computerinsel Photoline 20.54.Computerinsel Photoline
- CVE-2016-8648It was found that the Karaf container used by Red Hat JBoss Fuse 6.x, and Red Hat JBoss A-MQ 6.x, deserializes objects passed to MBeans via Apache Software Foundation Karaf
Medium, low and unrated 66
- CVE-2015-9262_XcursorThemeInherits in library.c in libXcursor before 1.1.15 allows remote attackers to cause denial of service or potentially code execut
- CVE-2018-10624Johnson Controls Metasys and BCPro Generation of Error Message Containing Sensitive InformationJohnson Controls Metasys System · Johnson Controls BCPro
- CVE-2018-0391A vulnerability in the password change function of Cisco Prime Collaboration Provisioning could allow an authenticated, remote attacker to cCisco Prime Collaboration Provisioning unknown
- CVE-2018-0397A vulnerability in Cisco AMP for Endpoints Mac Connector Software installed on Apple macOS 10.12 could allow an unauthenticated, remote attaCisco AMP for Endpoints Mac Connector unknown
- CVE-2018-0406A vulnerability in the web-based management interface of Cisco Web Security Appliance (WSA) could allow an unauthenticated, remote attacker Cisco Web Security Appliance unknown
- CVE-2018-0407A vulnerability in the web-based management interface of Cisco Small Business 300 Series (Sx300) Managed Switches could allow an authenticatCisco Small Business 300 Series Managed Switches unknown
- CVE-2018-0408A vulnerability in the web-based management interface of Cisco Small Business 300 Series (Sx300) Managed Switches could allow an authenticatCisco Small Business 300 Series Managed Switches unknown
- CVE-2018-0411A vulnerability in the web-based management interface of Cisco Unified Communications Manager could allow an unauthenticated, remote attackeCisco Unified Communications Manager unknown
- CVE-2018-0413A vulnerability in the web-based management interface of Cisco Identity Services Engine (ISE) could allow an unauthenticated, remote attackeCisco Identity Services Engine unknown
- CVE-2018-14777An issue was discovered in DataLife Engine (DLE) through 13.0.
- CVE-2016-8640A SQL injection vulnerability in pycsw all versions before 2.0.2, 1.10.5 and 1.8.6 that leads to read and extract of any data from any tablehttps://github.com/geopython pycsw · pycsw
- CVE-2018-10618Davolink DVW-3200N all version prior to Version 1.00.06.Davolink DVW-3200N
- CVE-2016-8609It was found that the keycloak before 2.3.0 did not implement authentication flow correctly.Red Hat keycloak · org.keycloak:keycloak-core
- CVE-2016-9583An out-of-bounds heap read vulnerability was found in the jpc_pi_nextpcrl() function of jasper before 2.0.6 when processing crafted input.The Jasper Project jasper
- CVE-2018-10894It was found that SAML authentication in Keycloak 3.4.3.Final incorrectly authenticated expired certificates.Red Hat keycloak · org.keycloak:keycloak-saml-adapter-co… +1
- CVE-2018-10896The default cloud-init configuration, in cloud-init 0.6.2 and newer, included "ssh_deletekeys: 0", disabling cloud-init's deletion of ssh hoCanonical cloud-init
- CVE-2016-8651An input validation flaw was found in the way OpenShift 3 handles requests for images.Red Hat OpenShift Enterprise
- CVE-2016-9572A NULL pointer dereference flaw was found in the way openjpeg 2.1.2 decoded certain input images.The OpenJPEG Project openjpeg
- CVE-2016-9579A flaw was found in the way Ceph Object Gateway would process cross-origin HTTP requests if the CORS policy was set to allow origin on a bucRed Hat ceph
- CVE-2016-9580An integer overflow vulnerability was found in tiftoimage function in openjpeg 2.1.2, resulting in heap buffer overflow.The OpenJPEG Project openjpeg2
- CVE-2017-5692Out-of-bounds read condition in older versions of some Intel Graphics Driver for Windows code branches allows local users to perform a deniaMobile, Desktop, Server, Workstation, and Embedded processo…
- CVE-2018-12466openbuildservice allowed deleting packages via project linksopensuse openbuildservice
- CVE-2018-12467delete package via link exploit in open buildserviceopensuse openbuildservice
- CVE-2018-3650Insufficient Input Validation in Bleach module in INTEL Distribution for Python versions prior to IDP 2018 Update 2 allows unprivileged userIntel Distribution for Python
- CVE-2018-3662Escalation of privilege in Intel Saffron MemoryBase before version 11.4 potentially allows an authorized user of the Saffron application to Intel Saffron MemoryBase
- CVE-2018-3663Escalation of privilege in Intel Saffron MemoryBase before 11.4 allows an authenticated user access to privileged information.Intel Saffron MemoryBase
- CVE-2018-3666Driver module in Intel Smart Sound Technology before version 9.21.00.3541 potentially allows a local attacker to execute arbitrary code as aIntel Smart Sound Technology
- CVE-2018-3670Driver module in Intel Smart Sound Technology before version 9.21.00.3541 potentially allows a local attacker to execute arbitrary code as aIntel Smart Sound Technology
- CVE-2018-3671Escalation of privilege in Intel Saffron admin application before 11.4 allows an authenticated user to access unauthorized information.Intel Saffron MemoryBase
- CVE-2018-3672Driver module in Intel Smart Sound Technology before version 9.21.00.3541 potentially allows a local attacker to execute arbitrary code as aIntel Smart Sound Technology
- CVE-2016-8608JBoss BRMS 6 and BPM Suite 6 are vulnerable to a stored XSS via business process editor.Red Hat BRMS
- CVE-2016-8641A privilege escalation vulnerability was found in nagios 4.2.x that occurs in daemon-init.in when creating necessary files and insecurely chNagios Enterprises nagios
- CVE-2016-8653It was found that the JMX endpoint of Red Hat JBoss Fuse 6, and Red Hat A-MQ 6 deserializes the credentials passed to it.Red Hat Fuse
- CVE-2016-9581An infinite loop vulnerability in tiftoimage that results in heap buffer overflow in convert_32s_C1P1 was found in openjpeg 2.1.2.The OpenJPEG Project openjpeg2
- CVE-2018-10916It has been discovered that lftp up to and including version 4.8.3 does not properly sanitize remote file names, leading to a loss of integr[UNKNOWN] lftp
- CVE-2016-8635It was found that Diffie Hellman Client key exchange handling in NSS 3.21.x was vulnerable to small subgroup confinement attack.Mozilla nss
- CVE-2016-8637A local information disclosure issue was found in dracut before 045 when generating initramfs images with world-readable permissions when 'eThe Dracut Project dracut
- CVE-2016-8639It was found that foreman before 1.13.0 is vulnerable to a stored XSS via an organization or location name.The Foreman Project foreman
- CVE-2018-1999025A man in the middle vulnerability exists in Jenkins TraceTronic ECU-TEST Plugin 2.3 and earlier in ATXPublisher.java, ATXValidator.java thatde.tracetronic.jenkins.plugins:ecutest
- CVE-2018-1999026A server-side request forgery vulnerability exists in Jenkins TraceTronic ECU-TEST Plugin 2.3 and earlier in ATXPublisher.java that allows ade.tracetronic.jenkins.plugins:ecutest
- CVE-2018-1999027An exposure of sensitive information vulnerability exists in Jenkins SaltStack Plugin 3.1.6 and earlier in SaltAPIBuilder.java, SaltAPIStep.org.jenkins-ci.plugins:saltstack
- CVE-2018-1999028An exposure of sensitive information vulnerability exists in Jenkins Accurev Plugin 0.7.16 and earlier in AccurevSCM.java that allows attackorg.jenkins-ci.plugins:accurev
- CVE-2018-1999029A cross-site scripting vulnerability exists in Jenkins Shelve Project Plugin 1.5 and earlier in ShelveProjectAction/index.jelly, ShelvedProjorg.jenkins-ci.plugins:shelve-project-plugin
- CVE-2018-1999030An exposure of sensitive information vulnerability exists in Jenkins Maven Artifact ChoiceListProvider (Nexus) Plugin 1.3.1 and earlier in Aorg.jenkins-ci.plugins:maven-artifact-choicelistprovider
- CVE-2018-1999031An exposure of sensitive information vulnerability exists in Jenkins meliora-testlab Plugin 1.14 and earlier in TestlabNotifier.java that alorg.jenkins-ci.plugins:meliora-testlab
- CVE-2018-1999032A data modification vulnerability exists in Jenkins Agiletestware Pangolin Connector for TestRail Plugin 2.1 and earlier in GlobalConfig.javorg.jenkins-ci.plugins:pangolin-testrail-connector
- CVE-2018-1999033An exposure of sensitive information vulnerability exists in Jenkins Anchore Container Image Scanner Plugin 10.16 and earlier in AnchoreBuilorg.jenkins-ci.plugins:anchore-container-scanner
- CVE-2018-1999034A man in the middle vulnerability exists in Jenkins Inedo ProGet Plugin 0.8 and earlier in ProGetApi.java, ProGetConfig.java, ProGetConfigurcom.inedo.proget:inedo-proget
- CVE-2018-1999035A man in the middle vulnerability exists in Jenkins Inedo BuildMaster Plugin 1.3 and earlier in BuildMasterConfiguration.java, BuildMasterCocom.inedo.buildmaster:inedo-buildmaster
- CVE-2018-1999036An exposure of sensitive information vulnerability exists in Jenkins SSH Agent Plugin 1.15 and earlier in SSHAgentStepExecution.java that exorg.jenkins-ci.plugins:ssh-agent
- CVE-2018-1999037A data modification vulnerability exists in Jenkins Resource Disposer Plugin 0.11 and earlier in AsyncResourceDisposer.java that allows attaorg.jenkins-ci.plugins:resource-disposer
- CVE-2018-1999038A confused deputy vulnerability exists in Jenkins Publisher Over CIFS Plugin 0.10 and earlier in CifsPublisherPluginDescriptor.java that allorg.jenkins-ci.plugins:publish-over-cifs
- CVE-2018-1999039A server-side request forgery vulnerability exists in Jenkins Confluence Publisher Plugin 2.0.1 and earlier in ConfluenceSite.java that alloorg.jenkins-ci.plugins:confluence-publisher
- CVE-2018-1999040An exposure of sensitive information vulnerability exists in Jenkins Kubernetes Plugin 1.10.1 and earlier in KubernetesCloud.java that alloworg.csanchez.jenkins.plugins:kubernetes
- CVE-2018-1999041An exposure of sensitive information vulnerability exists in Jenkins Tinfoil Security Plugin 1.6.1 and earlier in TinfoilScanRecorder.java tcom.tinfoilsecurity.plugins:tinfoil-scan
- CVE-2016-8634A vulnerability was found in foreman 1.14.0.The Foreman Project foreman
- CVE-2016-8615A flaw was found in curl before version 7.51.The Curl Project curl
- CVE-2016-8616A flaw was found in curl before version 7.51.0 When re-using a connection, curl was doing case insensitive comparisons of user name and passThe Curl Project curl
- CVE-2016-8619The function `read_data()` in security.c in curl before version 7.51.0 is vulnerable to memory double free.The Curl Project curl
- CVE-2016-8620The 'globbing' feature in curl before version 7.51.0 has a flaw that leads to integer overflow and out-of-bounds read via user controlled inThe Curl Project curl
- CVE-2016-8623A flaw was found in curl before version 7.51.0.The Curl Project curl
- CVE-2016-8625curl before version 7.51.0 uses outdated IDNA 2003 standard to handle International Domain Names and this may lead users to potentially and The Curl Project curl
- CVE-2016-9573An out-of-bounds read vulnerability was found in OpenJPEG 2.1.2, in the j2k_to_image tool.The OpenJPEG Project openjpeg
- CVE-2018-11050Dell EMC NetWorker versions between 9.0 and 9.1.1.8 through 9.2.1.3, and the version 18.1.0.1 contain a Clear-Text authentication over netwoDell EMC Networker
- CVE-2018-14775tss_alloc in sys/arch/i386/i386/gdt.c in OpenBSD 6.2 and 6.3 has a Local Denial of Service (system crash) due to incorrect I/O port access c
- CVE-2018-14776Click Studios Passwordstate before 8.3 Build 8397 allows XSS by authenticated users via an uploaded HTML document.