# CVEs published 2018-08-03

50 CVEs were published on August 3, 2018: 1 critical, 1 high. Days are UTC.

- [CVE-2018-14924](https://cve.now/CVE-2018-14924.md): Matera Banco 1.0.0 is vulnerable to multiple stored XSS, as demonstrated by the sca/privilegio/consultarUsuario.jsf "Nome Completo" (aka use (no CVSS)
- [CVE-2018-14925](https://cve.now/CVE-2018-14925.md): Matera Banco 1.0.0 mishandles Java errors in the backend, as demonstrated by a stack trace revealing use of net.sf.acegisecurity components. (no CVSS)
- [CVE-2018-14926](https://cve.now/CVE-2018-14926.md): Matera Banco 1.0.0 allows CSRF, as demonstrated by a /contingency/web/messageSend/messageSendHandler.jsp request. (no CVSS)
- [CVE-2018-14927](https://cve.now/CVE-2018-14927.md): Matera Banco 1.0.0 is vulnerable to path traversal (allowing access to system files outside the default application folder) via the /conting (no CVSS)
- [CVE-2018-14928](https://cve.now/CVE-2018-14928.md): /contingency/servlet/ServletFileDownload executes as root and provides unauthenticated access to files via the file parameter. (no CVSS)
- [CVE-2018-14929](https://cve.now/CVE-2018-14929.md): Matera Banco 1.0.0 is vulnerable to multiple reflected XSS, as demonstrated by the /contingency/web/index.jsp (aka home page) url parameter. (no CVSS)
- [CVE-2018-14923](https://cve.now/CVE-2018-14923.md): A vulnerability in uniview EZPlayer 1.0.6 could allow an attacker to execute arbitrary code on a targeted system via video playback. (no CVSS)
- [CVE-2018-3777](https://cve.now/CVE-2018-3777.md): Insufficient URI encoding in restforce before 3.0.0 allows attacker to inject arbitrary parameters into Salesforce API requests. (no CVSS, https://github.com/restforce restforce ruby gem · restforce)
- [CVE-2018-9866](https://cve.now/CVE-2018-9866.md): A vulnerability in lack of validation of user-supplied parameters pass to XML-RPC calls on SonicWall Global Management System (GMS) virtual (CVSS 9.8, SonicWall Global Management System)
- [CVE-2018-14910](https://cve.now/CVE-2018-14910.md): SeaCMS v6.61 allows Remote Code execution by placing PHP code in an allowed IP address (aka ip) to /admin/admin\_ip.php (aka /adm1n/admin\_ip. (no CVSS)
- [CVE-2018-14911](https://cve.now/CVE-2018-14911.md): A file upload vulnerability exists in ukcms v1.1.7 and earlier. (no CVSS)
- [CVE-2018-14912](https://cve.now/CVE-2018-14912.md): cgit\_clone\_objects in CGit before 1.2.1 has a directory traversal vulnerability when \`enable-http-clone=1\` is not turned off, as demonstrate (no CVSS)
- [CVE-2018-5490](https://cve.now/CVE-2018-5490.md): Read-Only export policy rules are not correctly enforced in Clustered Data ONTAP 8.3 Release Candidate versions and therefore may allow more (no CVSS, NetApp Clustered Data ONTAP)
- [CVE-2017-15358](https://cve.now/CVE-2017-15358.md): Race condition in the Charles Proxy Settings suid binary in Charles Proxy before 4.2.1 allows local users to gain privileges via vectors inv (no CVSS)
- [CVE-2018-12605](https://cve.now/CVE-2018-12605.md): An issue was discovered in GitLab Community Edition and Enterprise Edition 10.7.x before 10.7.6. (no CVSS)
- [CVE-2018-12606](https://cve.now/CVE-2018-12606.md): An issue was discovered in GitLab Community Edition and Enterprise Edition before 10.7.6, 10.8.x before 10.8.5, and 11.x before 11.0.1. (no CVSS)
- [CVE-2018-12607](https://cve.now/CVE-2018-12607.md): An issue was discovered in GitLab Community Edition and Enterprise Edition before 10.7.6, 10.8.x before 10.8.5, and 11.x before 11.0.1. (no CVSS)
- [CVE-2018-12989](https://cve.now/CVE-2018-12989.md): The report-viewing feature in Pearson VUE Certiport Console 8 and IQSystem 7 before 2018-06-26 mishandles child processes and consequently l (no CVSS)
- [CVE-2018-13055](https://cve.now/CVE-2018-13055.md): A cross-site scripting (XSS) vulnerability in the View Filters page (view\_filters\_page.php) in MantisBT 2.1.0 through 2.15.0 allows remote a (no CVSS, mantisbt/mantisbt)
- [CVE-2018-14504](https://cve.now/CVE-2018-14504.md): An issue was discovered in manage\_filter\_edit\_page.php in MantisBT 2.x through 2.15.0. (no CVSS, mantisbt/mantisbt)
- [CVE-2018-14576](https://cve.now/CVE-2018-14576.md): The mintTokens function of a smart contract implementation for SunContract, an Ethereum token, has an integer overflow via the \_amount varia (no CVSS)
- [CVE-2018-14715](https://cve.now/CVE-2018-14715.md): The endCoinFlip function and throwSlammer function of the smart contract implementations for Cryptogs, an Ethereum game, generate random num (no CVSS)
- [CVE-2018-14728](https://cve.now/CVE-2018-14728.md): upload.php in Responsive FileManager 9.13.1 allows SSRF via the url parameter. (no CVSS)
- [CVE-2018-14904](https://cve.now/CVE-2018-14904.md): Samsung Syncthru Web Service V4.05.61 is vulnerable to Multiple unauthenticated XSS attacks on several parameters, as demonstrated by ruiFw\_ (no CVSS)
- [CVE-2018-14905](https://cve.now/CVE-2018-14905.md): The Web server in 3CX version 15.5.8801.3 is vulnerable to Reflected XSS on the api/CallLog TimeZoneName parameter. (no CVSS)
- [CVE-2018-14906](https://cve.now/CVE-2018-14906.md): The Web server in 3CX version 15.5.8801.3 is vulnerable to Reflected XSS on all stack traces' propertyPath parameters. (no CVSS)
- [CVE-2018-14907](https://cve.now/CVE-2018-14907.md): The Web server in 3CX version 15.5.8801.3 is vulnerable to Information Leakage, because of improper error handling in Stack traces, as demon (no CVSS)
- [CVE-2018-14908](https://cve.now/CVE-2018-14908.md): Samsung Syncthru Web Service V4.05.61 is vulnerable to CSRF on every request, as demonstrated by sws.application/printinformation/printRepor (no CVSS)
- [CVE-2018-7748](https://cve.now/CVE-2018-7748.md): report\_viewer.do in ServiceNow Release Jakarta Patch 8 and earlier allows remote attackers to execute arbitrary code via '${xyz}' Glide Scri (no CVSS)
- [CVE-2018-13416](https://cve.now/CVE-2018-13416.md): In Universal Media Server (UMS) 7.1.0, the XML parsing engine for SSDP/UPnP functionality is vulnerable to an XML External Entity Processing (no CVSS)
- [CVE-2018-14574](https://cve.now/CVE-2018-14574.md): django.middleware.common.CommonMiddleware in Django 1.11.x before 1.11.15 and 2.0.x before 2.0.8 has an Open Redirect. (no CVSS, django)
- [CVE-2018-14773](https://cve.now/CVE-2018-14773.md): An issue was discovered in Http Foundation in Symfony 2.7.0 through 2.7.48, 2.8.0 through 2.8.43, 3.3.0 through 3.3.17, 3.4.0 through 3.4.13 (no CVSS, symfony/http-foundation · symfony/symfony)
- [CVE-2018-14774](https://cve.now/CVE-2018-14774.md): An issue was discovered in HttpKernel in Symfony 2.7.0 through 2.7.48, 2.8.0 through 2.8.43, 3.3.0 through 3.3.17, 3.4.0 through 3.4.13, 4.0 (no CVSS, symfony/symfony)
- [CVE-2018-12482](https://cve.now/CVE-2018-12482.md): OCS Inventory 2.4.1 contains multiple SQL injections in the search engine. (no CVSS)
- [CVE-2018-12483](https://cve.now/CVE-2018-12483.md): OCS Inventory 2.4.1 is prone to a remote command-execution vulnerability. (no CVSS)
- [CVE-2018-14417](https://cve.now/CVE-2018-14417.md): A command injection vulnerability was found in the web administration console in SoftNAS Cloud before 4.0.3. (no CVSS)
- [CVE-2018-14473](https://cve.now/CVE-2018-14473.md): OCS Inventory 2.4.1 lacks a proper XML parsing configuration, allowing the use of external entities. (no CVSS)
- [CVE-2018-14497](https://cve.now/CVE-2018-14497.md): Tenda D152 ADSL routers allow XSS via a crafted SSID. (no CVSS)
- [CVE-2018-14541](https://cve.now/CVE-2018-14541.md): PHP Scripts Mall Basic B2B Script 2.0.0 has Reflected and Stored XSS via the First name, Last name, Address 1, City, State, and Company name (no CVSS)
- [CVE-2018-14593](https://cve.now/CVE-2018-14593.md): An issue was discovered in Open Ticket Request System (OTRS) 6.0.x through 6.0.9, 5.0.x through 5.0.28, and 4.0.x through 4.0.30. (no CVSS)
- [CVE-2017-8316](https://cve.now/CVE-2017-8316.md): IntelliJ IDEA XML parser was found vulnerable to XML External Entity attack, an attacker can exploit the vulnerability by implementing malic (no CVSS, JetBrains IntelliJ IDEA)
- [CVE-2018-1524](https://cve.now/CVE-2018-1524.md): IBM Maximo Asset Management 7.6 through 7.6.3 installs with a default administrator account that a remote intruder could use to gain adminis (CVSS 8.8, IBM Maximo Asset Management)
- [CVE-2018-6590](https://cve.now/CVE-2018-6590.md): CA API Developer Portal 4.x, prior to v4.2.5.3 and v4.2.7.1, has an unspecified reflected cross-site scripting vulnerability. (no CVSS, ca technologies CA API Developer Portal)
- [CVE-2018-14883](https://cve.now/CVE-2018-14883.md): An issue was discovered in PHP before 5.6.37, 7.0.x before 7.0.31, 7.1.x before 7.1.20, and 7.2.x before 7.2.8. (no CVSS)
- [CVE-2018-14884](https://cve.now/CVE-2018-14884.md): An issue was discovered in PHP 7.0.x before 7.0.27, 7.1.x before 7.1.13, and 7.2.x before 7.2.1. (no CVSS)
- [CVE-2018-5489](https://cve.now/CVE-2018-5489.md): NetApp 7-Mode Transition Tool allows users with valid credentials to access functions and information which may have been intended to be res (no CVSS, NetApp 7-Mode Transition Tool)
- [CVE-2018-14872](https://cve.now/CVE-2018-14872.md): An issue was discovered in Rincewind 0.1. (no CVSS)
- [CVE-2018-14873](https://cve.now/CVE-2018-14873.md): An issue was discovered in Rincewind 0.1. (no CVSS)
- [CVE-2018-14876](https://cve.now/CVE-2018-14876.md): An issue was discovered in image\_save\_png in image/image-png.cpp in Free Lossless Image Format (FLIF) 0.3. (no CVSS)
- [CVE-2018-14877](https://cve.now/CVE-2018-14877.md): An issue was discovered in WeaselCMS v0.3.5. (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2018-08-03
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.