CVEs published August 3, 2018
50 CVEs were published on August 3, 2018: 1 critical, 1 high.
- Published
- 50
- Critical
- 1
- High
- 1
- Medium
- 0
- Low
- 0
- Unrated
- 48
- Now in CISA KEV
- 0
- Fix available
- 7
Most affected products
- mantisbt/mantisbt
- 2
- ca technologies CA API Developer Portal
- 1
- django
- 1
- https://github.com/restforce restforce ruby gem · restforce
- 1
- IBM Maximo Asset Management
- 1
- JetBrains IntelliJ IDEA
- 1
- NetApp 7-Mode Transition Tool
- 1
- NetApp Clustered Data ONTAP
- 1
- SonicWall Global Management System
- 1
- symfony/http-foundation · symfony/symfony
- 1
Critical 1
High 1
Medium, low and unrated 48
- CVE-2018-14924Matera Banco 1.0.0 is vulnerable to multiple stored XSS, as demonstrated by the sca/privilegio/consultarUsuario.jsf "Nome Completo" (aka use
- CVE-2018-14925Matera Banco 1.0.0 mishandles Java errors in the backend, as demonstrated by a stack trace revealing use of net.sf.acegisecurity components.
- CVE-2018-14926Matera Banco 1.0.0 allows CSRF, as demonstrated by a /contingency/web/messageSend/messageSendHandler.jsp request.
- CVE-2018-14927Matera Banco 1.0.0 is vulnerable to path traversal (allowing access to system files outside the default application folder) via the /conting
- CVE-2018-14928/contingency/servlet/ServletFileDownload executes as root and provides unauthenticated access to files via the file parameter.
- CVE-2018-14929Matera Banco 1.0.0 is vulnerable to multiple reflected XSS, as demonstrated by the /contingency/web/index.jsp (aka home page) url parameter.
- CVE-2018-14923A vulnerability in uniview EZPlayer 1.0.6 could allow an attacker to execute arbitrary code on a targeted system via video playback.
- CVE-2018-3777Insufficient URI encoding in restforce before 3.0.0 allows attacker to inject arbitrary parameters into Salesforce API requests.https://github.com/restforce restforce ruby gem · restforce
- CVE-2018-14910SeaCMS v6.61 allows Remote Code execution by placing PHP code in an allowed IP address (aka ip) to /admin/admin_ip.php (aka /adm1n/admin_ip.
- CVE-2018-14911A file upload vulnerability exists in ukcms v1.1.7 and earlier.
- CVE-2018-14912cgit_clone_objects in CGit before 1.2.1 has a directory traversal vulnerability when `enable-http-clone=1` is not turned off, as demonstrate
- CVE-2018-5490Read-Only export policy rules are not correctly enforced in Clustered Data ONTAP 8.3 Release Candidate versions and therefore may allow moreNetApp Clustered Data ONTAP
- CVE-2017-15358Race condition in the Charles Proxy Settings suid binary in Charles Proxy before 4.2.1 allows local users to gain privileges via vectors inv
- CVE-2018-12605An issue was discovered in GitLab Community Edition and Enterprise Edition 10.7.x before 10.7.6.
- CVE-2018-12606An issue was discovered in GitLab Community Edition and Enterprise Edition before 10.7.6, 10.8.x before 10.8.5, and 11.x before 11.0.1.
- CVE-2018-12607An issue was discovered in GitLab Community Edition and Enterprise Edition before 10.7.6, 10.8.x before 10.8.5, and 11.x before 11.0.1.
- CVE-2018-12989The report-viewing feature in Pearson VUE Certiport Console 8 and IQSystem 7 before 2018-06-26 mishandles child processes and consequently l
- CVE-2018-13055A cross-site scripting (XSS) vulnerability in the View Filters page (view_filters_page.php) in MantisBT 2.1.0 through 2.15.0 allows remote amantisbt/mantisbt
- CVE-2018-14504An issue was discovered in manage_filter_edit_page.php in MantisBT 2.x through 2.15.0.mantisbt/mantisbt
- CVE-2018-14576The mintTokens function of a smart contract implementation for SunContract, an Ethereum token, has an integer overflow via the _amount varia
- CVE-2018-14715The endCoinFlip function and throwSlammer function of the smart contract implementations for Cryptogs, an Ethereum game, generate random num
- CVE-2018-14728upload.php in Responsive FileManager 9.13.1 allows SSRF via the url parameter.
- CVE-2018-14904Samsung Syncthru Web Service V4.05.61 is vulnerable to Multiple unauthenticated XSS attacks on several parameters, as demonstrated by ruiFw_
- CVE-2018-14905The Web server in 3CX version 15.5.8801.3 is vulnerable to Reflected XSS on the api/CallLog TimeZoneName parameter.
- CVE-2018-14906The Web server in 3CX version 15.5.8801.3 is vulnerable to Reflected XSS on all stack traces' propertyPath parameters.
- CVE-2018-14907The Web server in 3CX version 15.5.8801.3 is vulnerable to Information Leakage, because of improper error handling in Stack traces, as demon
- CVE-2018-14908Samsung Syncthru Web Service V4.05.61 is vulnerable to CSRF on every request, as demonstrated by sws.application/printinformation/printRepor
- CVE-2018-7748report_viewer.do in ServiceNow Release Jakarta Patch 8 and earlier allows remote attackers to execute arbitrary code via '${xyz}' Glide Scri
- CVE-2018-13416In Universal Media Server (UMS) 7.1.0, the XML parsing engine for SSDP/UPnP functionality is vulnerable to an XML External Entity Processing
- CVE-2018-14574django.middleware.common.CommonMiddleware in Django 1.11.x before 1.11.15 and 2.0.x before 2.0.8 has an Open Redirect.django
- CVE-2018-14773An issue was discovered in Http Foundation in Symfony 2.7.0 through 2.7.48, 2.8.0 through 2.8.43, 3.3.0 through 3.3.17, 3.4.0 through 3.4.13symfony/http-foundation · symfony/symfony
- CVE-2018-14774An issue was discovered in HttpKernel in Symfony 2.7.0 through 2.7.48, 2.8.0 through 2.8.43, 3.3.0 through 3.3.17, 3.4.0 through 3.4.13, 4.0symfony/symfony
- CVE-2018-12482OCS Inventory 2.4.1 contains multiple SQL injections in the search engine.
- CVE-2018-12483OCS Inventory 2.4.1 is prone to a remote command-execution vulnerability.
- CVE-2018-14417A command injection vulnerability was found in the web administration console in SoftNAS Cloud before 4.0.3.
- CVE-2018-14473OCS Inventory 2.4.1 lacks a proper XML parsing configuration, allowing the use of external entities.
- CVE-2018-14497Tenda D152 ADSL routers allow XSS via a crafted SSID.
- CVE-2018-14541PHP Scripts Mall Basic B2B Script 2.0.0 has Reflected and Stored XSS via the First name, Last name, Address 1, City, State, and Company name
- CVE-2018-14593An issue was discovered in Open Ticket Request System (OTRS) 6.0.x through 6.0.9, 5.0.x through 5.0.28, and 4.0.x through 4.0.30.
- CVE-2017-8316IntelliJ IDEA XML parser was found vulnerable to XML External Entity attack, an attacker can exploit the vulnerability by implementing malicJetBrains IntelliJ IDEA
- CVE-2018-6590CA API Developer Portal 4.x, prior to v4.2.5.3 and v4.2.7.1, has an unspecified reflected cross-site scripting vulnerability.ca technologies CA API Developer Portal
- CVE-2018-14883An issue was discovered in PHP before 5.6.37, 7.0.x before 7.0.31, 7.1.x before 7.1.20, and 7.2.x before 7.2.8.
- CVE-2018-14884An issue was discovered in PHP 7.0.x before 7.0.27, 7.1.x before 7.1.13, and 7.2.x before 7.2.1.
- CVE-2018-5489NetApp 7-Mode Transition Tool allows users with valid credentials to access functions and information which may have been intended to be resNetApp 7-Mode Transition Tool
- CVE-2018-14872An issue was discovered in Rincewind 0.1.
- CVE-2018-14873An issue was discovered in Rincewind 0.1.
- CVE-2018-14876An issue was discovered in image_save_png in image/image-png.cpp in Free Lossless Image Format (FLIF) 0.3.
- CVE-2018-14877An issue was discovered in WeaselCMS v0.3.5.