CVEdetails.com the ultimate security vulnerability data source
(e.g.: CVE-2009-1234 or 2010-1234 or 20101234)
Log In   Register
  What's the CVSS score of your company?
Vulnerability Feeds & WidgetsNew   www.itsecdb.com  

Security Vulnerabilities Published In July 2018

Press ESC to close
# CVE ID CWE ID # of Exploits Vulnerability Type(s) Publish Date Update Date Score Gained Access Level Access Complexity Authentication Conf. Integ. Avail.
1101 CVE-2018-10887 125 DoS Overflow 2018-07-10 2020-08-31
5.8
None Remote Medium Not required Partial None Partial
A flaw was found in libgit2 before version 0.27.3. It has been discovered that an unexpected sign extension in git_delta_apply function in delta.c file may lead to an integer overflow which in turn leads to an out of bound read, allowing to read before the base object. An attacker may use this flaw to leak memory addresses or cause a Denial of Service.
1102 CVE-2018-10886 2018-07-16 2018-07-19
0.0
None ??? ??? ??? ??? ??? ???
ant before version 1.9.12 unzip and untar targets allows the extraction of files outside the target directory. A crafted zip or tar file submitted to an Ant build could create or overwrite arbitrary files with the privileges of the user running Ant.
1103 CVE-2018-10885 20 DoS 2018-07-05 2019-10-09
5.0
None Remote Low Not required None None Partial
In atomic-openshift before version 3.10.9 a malicious network-policy configuration can cause Openshift Routing to crash when using ovs-networkpolicy plugin. An attacker can use this flaw to cause a Denial of Service (DoS) attack on an Openshift 3.9, or 3.7 Cluster.
1104 CVE-2018-10883 787 DoS 2018-07-30 2019-10-09
4.9
None Local Low Not required None None Complete
A flaw was found in the Linux kernel's ext4 filesystem. A local user can cause an out-of-bounds write in jbd2_journal_dirty_metadata(), a denial of service, and a system crash by mounting and operating on a crafted ext4 filesystem image.
1105 CVE-2018-10882 787 DoS 2018-07-27 2019-10-09
4.9
None Local Low Not required None None Complete
A flaw was found in the Linux kernel's ext4 filesystem. A local user can cause an out-of-bound write in in fs/jbd2/transaction.c code, a denial of service, and a system crash by unmounting a crafted ext4 filesystem image.
1106 CVE-2018-10881 119 DoS Overflow 2018-07-26 2019-10-09
4.9
None Local Low Not required None None Complete
A flaw was found in the Linux kernel's ext4 filesystem. A local user can cause an out-of-bound access in ext4_get_group_info function, a denial of service, and a system crash by mounting and operating on a crafted ext4 filesystem image.
1107 CVE-2018-10880 787 DoS 2018-07-25 2019-04-01
7.1
None Remote Medium Not required None None Complete
Linux kernel is vulnerable to a stack-out-of-bounds write in the ext4 filesystem code when mounting and writing to a crafted ext4 image in ext4_update_inline_data(). An attacker could use this to cause a system crash and a denial of service.
1108 CVE-2018-10879 416 DoS 2018-07-26 2019-10-09
6.1
None Local Low Not required Partial Partial Complete
A flaw was found in the Linux kernel's ext4 filesystem. A local user can cause a use-after-free in ext4_xattr_set_entry function and a denial of service or unspecified other impact may occur by renaming a file in a crafted ext4 filesystem image.
1109 CVE-2018-10878 787 DoS 2018-07-26 2019-10-09
6.1
None Local Low Not required Partial Partial Complete
A flaw was found in the Linux kernel's ext4 filesystem. A local user can cause an out-of-bounds write and a denial of service or unspecified other impact is possible by mounting and operating a crafted ext4 filesystem image.
1110 CVE-2018-10877 125 2018-07-18 2019-04-01
6.8
None Remote Medium Not required Partial Partial Partial
Linux kernel ext4 filesystem is vulnerable to an out-of-bound access in the ext4_ext_drop_refs() function when operating on a crafted ext4 filesystem image.
1111 CVE-2018-10876 416 2018-07-26 2019-04-01
4.9
None Local Low Not required None None Complete
A flaw was found in Linux kernel in the ext4 filesystem code. A use-after-free is possible in ext4_ext_remove_space() function when mounting and operating a crafted ext4 image.
1112 CVE-2018-10875 426 Exec Code 2018-07-13 2021-08-04
4.6
None Local Low Not required Partial Partial Partial
A flaw was found in ansible. ansible.cfg is read from the current working directory which can be altered to make it point to a plugin or a module path under the control of an attacker, thus allowing the attacker to execute arbitrary code.
1113 CVE-2018-10874 20 2018-07-02 2021-08-04
4.6
None Local Low Not required Partial Partial Partial
In ansible it was found that inventory variables are loaded from current working directory when running ad-hoc command which are under attacker's control, allowing to run arbitrary code as a result.
1114 CVE-2018-10872 119 Overflow 2018-07-10 2020-07-15
4.9
None Local Low Not required None None Complete
A flaw was found in the way the Linux kernel handled exceptions delivered after a stack switch operation via Mov SS or Pop SS instructions. During the stack switch operation, processor does not deliver interrupts and exceptions, they are delivered once the first instruction after the stack switch is executed. An unprivileged system user could use this flaw to crash the system kernel resulting in DoS. This CVE-2018-10872 was assigned due to regression of CVE-2018-8897 in Red Hat Enterprise Linux 6.10 GA kernel. No other versions are affected by this CVE.
1115 CVE-2018-10871 312 2018-07-18 2019-10-09
4.0
None Remote Low ??? Partial None None
389-ds-base before versions 1.3.8.5, 1.4.0.12 is vulnerable to a Cleartext Storage of Sensitive Information. By default, when the Replica and/or retroChangeLog plugins are enabled, 389-ds-base stores passwords in plaintext format in their respective changelog files. An attacker with sufficiently high privileges, such as root or Directory Manager, can query these files in order to retrieve plaintext passwords.
1116 CVE-2018-10870 20 Exec Code 2018-07-19 2019-10-09
7.5
None Remote Low Not required Partial Partial Partial
redhat-certification does not properly sanitize paths in rhcertStore.py:__saveResultsFile. A remote attacker could use this flaw to overwrite any file, potentially gaining remote code execution.
1117 CVE-2018-10869 732 2018-07-19 2019-10-09
5.0
None Remote Low Not required Partial None None
redhat-certification does not properly restrict files that can be download through the /download page. A remote attacker may download any file accessible by the user running httpd.
1118 CVE-2018-10862 22 Dir. Trav. 2018-07-27 2019-04-26
4.9
None Remote Medium ??? None Partial Partial
WildFly Core before version 6.0.0.Alpha3 does not properly validate file paths in .war archives, allowing for the extraction of crafted .war archives to overwrite arbitrary files. This is an instance of the 'Zip Slip' vulnerability.
1119 CVE-2018-10861 287 2018-07-10 2019-10-09
5.5
None Remote Low ??? None Partial Partial
A flaw was found in the way ceph mon handles user requests. Any authenticated ceph user having read access to ceph can delete, create ceph storage pools and corrupt snapshot images. Ceph branches master, mimic, luminous and jewel are believed to be affected.
1120 CVE-2018-10859 200 +Info 2018-07-16 2019-10-09
5.0
None Remote Low Not required Partial None None
git-annex is vulnerable to an Information Exposure when decrypting files. A malicious server for a special remote could trick git-annex into decrypting a file that was encrypted to the user's gpg key. This attack could be used to expose encrypted data that was never stored in git-annex
1121 CVE-2018-10857 200 +Info 2018-07-16 2019-10-09
5.0
None Remote Low Not required Partial None None
git-annex is vulnerable to a private data exposure and exfiltration attack. It could expose the content of files located outside the git-annex repository, or content from a private web server on localhost or the LAN.
1122 CVE-2018-10856 732 2018-07-03 2019-10-09
6.5
None Remote Low ??? Partial Partial Partial
It has been discovered that podman before version 0.6.1 does not drop capabilities when executing a container as a non-root user. This results in unnecessary privileges being granted to the container.
1123 CVE-2018-10855 532 2018-07-03 2021-08-04
4.3
None Remote Medium Not required Partial None None
Ansible 2.5 prior to 2.5.5, and 2.4 prior to 2.4.5, do not honor the no_log task flag for failed tasks. When the no_log flag has been used to protect sensitive data passed to a task from being logged, and that task does not run successfully, Ansible will expose sensitive data in log files and on the terminal of the user running Ansible.
1124 CVE-2018-10847 287 Bypass 2018-07-30 2019-10-09
6.5
None Remote Low ??? Partial Partial Partial
prosody before versions 0.10.2, 0.9.14 is vulnerable to an Authentication Bypass. Prosody did not verify that the virtual host associated with a user session remained the same across stream restarts. A user may authenticate to XMPP host A and migrate their authenticated session to XMPP host B of the same Prosody instance.
1125 CVE-2018-10843 732 2018-07-02 2019-10-09
9.0
None Remote Low ??? Complete Complete Complete
source-to-image component of Openshift Container Platform before versions atomic-openshift 3.7.53, atomic-openshift 3.9.31 is vulnerable to a privilege escalation which allows the assemble script to run as the root user in a non-privileged container. An attacker can use this flaw to open network connections, and possibly other actions, on the host which are normally only available to a root user.
1126 CVE-2018-10840 787 Overflow 2018-07-16 2020-08-28
7.2
None Local Low Not required Complete Complete Complete
Linux kernel is vulnerable to a heap-based buffer overflow in the fs/ext4/xattr.c:ext4_xattr_set_entry() function. An attacker could exploit this by operating on a mounted crafted ext4 image.
1127 CVE-2018-10635 306 Exec Code 2018-07-11 2019-10-09
10.0
None Remote Low Not required Complete Complete Complete
In Universal Robots Robot Controllers Version CB 3.1, SW Version 3.4.5-100, ports 30001/TCP to 30003/TCP listen for arbitrary URScript code and execute the code. This enables a remote attacker who has access to the ports to remotely execute code that may allow root access to be obtained.
1128 CVE-2018-10633 798 2018-07-11 2019-10-09
7.5
None Remote Low Not required Partial Partial Partial
Universal Robots Robot Controllers Version CB 3.1, SW Version 3.4.5-100 utilizes hard-coded credentials that may allow an attacker to reset passwords for the controller.
1129 CVE-2018-10632 400 2018-07-24 2019-10-09
5.0
None Remote Low Not required None None Partial
In Moxa NPort 5210, 5230, and 5232 versions 2.9 build 17030709 and prior, the amount of resources requested by a malicious actor are not restricted, allowing for a denial-of-service condition.
1130 CVE-2018-10631 693 Exec Code Bypass 2018-07-13 2019-10-09
4.6
None Local Low Not required Partial Partial Partial
Medtronic N'Vision Clinician Programmer 8840 N'Vision Clinician Programmer, all versions, and 8870 N'Vision removable Application Card, all versions. The 8840 Clinician Programmer executes the application program from the 8870 Application Card. An attacker with physical access to an 8870 Application Card and sufficient technical capability can modify the contents of this card, including the binary executables. If modified to bypass protection mechanisms, this malicious code will be run when the card is inserted into an 8840 Clinician Programmer.
1131 CVE-2018-10628 119 Exec Code Overflow 2018-07-24 2019-10-09
7.5
None Remote Low Not required Partial Partial Partial
AVEVA InTouch 2014 R2 SP1 and prior, InTouch 2017, InTouch 2017 Update 1, and InTouch 2017 Update 2 allow an unauthenticated user to send a specially crafted packet that could overflow the buffer on a locale not using a dot floating point separator. Exploitation could allow remote code execution under the privileges of the InTouch View process.
1132 CVE-2018-10627 200 +Info 2018-07-24 2019-10-09
6.4
None Remote Low Not required Partial Partial None
Echelon SmartServer 1 all versions, SmartServer 2 all versions prior to release 4.11.007, i.LON 100 all versions, and i.LON 600 all versions. An attacker can use the SOAP API to retrieve and change sensitive configuration items such as the usernames and passwords for the Web and FTP servers. This vulnerability does not affect the i.LON 600 product.
1133 CVE-2018-10620 787 Exec Code Overflow 2018-07-19 2020-08-31
7.5
None Remote Low Not required Partial Partial Partial
AVEVA InduSoft Web Studio v8.1 and v8.1SP1, and InTouch Machine Edition v2017 8.1 and v2017 8.1 SP1 a remote user could send a carefully crafted packet to exploit a stack-based buffer overflow vulnerability during tag, alarm, or event related actions such as read and write, with potential for code to be executed.
1134 CVE-2018-10616 20 2018-07-18 2019-10-09
9.3
None Remote Medium Not required Complete Complete Complete
ABB Panel Builder 800 all versions has an improper input validation vulnerability which may allow an attacker to insert and run arbitrary code on a computer where the affected product is used.
1135 CVE-2018-10609 79 Exec Code XSS 2018-07-31 2021-06-23
4.3
None Remote Medium Not required None Partial None
Martem TELEM GW6 and GWM devices with firmware 2018.04.18-linux_4-01-601cb47 and prior allow improper sanitization of data over a Websocket which may allow cross-site scripting and client-side code execution with target user privileges.
1136 CVE-2018-10608 400 DoS 2018-07-24 2019-05-17
7.8
None Remote Low Not required None None Complete
SEL AcSELerator Architect version 2.2.24.0 and prior can be exploited when the AcSELerator Architect FTP client connects to a malicious FTP server, which may cause denial of service via 100% CPU utilization. Restart of the application is required.
1137 CVE-2018-10607 400 DoS 2018-07-31 2021-06-23
5.0
None Remote Low Not required None None Partial
Martem TELEM GW6 and GWM devices with firmware 2018.04.18-linux_4-01-601cb47 and prior allow the creation of new connections to one or more IOAs, without closing them properly, which may cause a denial of service within the industrial process control channel.
1138 CVE-2018-10604 276 Exec Code 2018-07-24 2020-08-31
6.5
None Remote Low ??? Partial Partial Partial
SEL Compass version 3.0.5.1 and prior allows all users full access to the SEL Compass directory, which may allow modification or overwriting of files within the Compass installation folder, resulting in escalation of privilege and/or malicious code execution.
1139 CVE-2018-10603 287 2018-07-31 2021-06-23
7.5
None Remote Low Not required Partial Partial Partial
Martem TELEM GW6 and GWM devices with firmware 2018.04.18-linux_4-01-601cb47 and prior do not perform authentication of IEC-104 control commands, which may allow a rogue node a remote control of the industrial process.
1140 CVE-2018-10600 611 DoS Exec Code 2018-07-24 2019-10-09
7.5
None Remote Low Not required Partial Partial Partial
SEL AcSELerator Architect version 2.2.24.0 and prior allows unsanitized input to be passed to the XML parser, which may allow disclosure and retrieval of arbitrary data, arbitrary code execution (in certain situations on specific platforms), and denial of service attacks.
1141 CVE-2018-10596 200 +Info 2018-07-03 2019-10-09
5.2
None Local Network Low ??? Partial Partial Partial
Medtronic 2090 CareLink Programmer all versions The affected product uses a virtual private network connection to securely download updates. The product does not verify it is still connected to this virtual private network before downloading updates. An attacker with local network access to the programmer could influence these communications.
1142 CVE-2018-10592 798 Exec Code 2018-07-31 2019-10-09
10.0
None Remote Low Not required Complete Complete Complete
Yokogawa STARDOM FCJ controllers R4.02 and prior, FCN-100 controllers R4.02 and prior, FCN-RTU controllers R4.02 and prior, and FCN-500 controllers R4.02 and prior utilize hard-coded credentials that could allow an attacker to gain unauthorized administrative access to the device, which could result in remote code execution.
1143 CVE-2018-10232 352 +Info CSRF 2018-07-11 2020-07-20
4.3
None Remote Medium Not required Partial None None
Cross-site request forgery (CSRF) vulnerability in TOPdesk before 8.05.017 (June 2018 version) and before 5.7.SR9 allows remote attackers to hijack the authentication of authenticated users for requests that can obtain sensitive information via unspecified vectors.
1144 CVE-2018-10231 79 XSS 2018-07-11 2018-09-04
4.3
None Remote Medium Not required None Partial None
Cross-site scripting (XSS) vulnerability in TOPdesk before 8.05.017 (June 2018 version) and before 5.7.SR9 allows remote attackers to inject arbitrary web script or HTML via unspecified parameters.
1145 CVE-2018-10197 89 Sql 2018-07-11 2018-09-11
7.5
None Remote Low Not required Partial Partial Partial
There is a time-based blind SQL injection vulnerability in the Access Manager component before 9.18.040 and 10.x before 10.18.040 in ELO ELOenterprise 9 and 10 and ELOprofessional 9 and 10 that makes it possible to read all database content. The vulnerability exists in the ticket HTTP GET parameter. For example, one can succeed in reading the password hash of the administrator user in the "userdata" table from the "eloam" database.
1146 CVE-2018-10098 119 DoS Overflow 2018-07-13 2018-09-10
4.9
None Local Low Not required None None Complete
In MicroWorld eScan Internet Security Suite (ISS) for Business 14.0.1400.2029, the driver econceal.sys allows a non-privileged user to send a 0x830020E0 IOCTL request to \\.\econceal to cause a denial of service (BSOD).
1147 CVE-2018-10076 79 XSS 2018-07-02 2018-08-30
4.3
None Remote Medium Not required None Partial None
An issue was discovered in Zoho ManageEngine EventLog Analyzer 11.12. A Cross-Site Scripting vulnerability allows a remote attacker to inject arbitrary web script or HTML via the search functionality (the search box of the Dashboard).
1148 CVE-2018-10075 79 XSS 2018-07-02 2018-08-30
4.3
None Remote Medium Not required None Partial None
Cross-site scripting (XSS) vulnerability in Zoho ManageEngine EventLog Analyzer 11.12 allows remote attackers to inject arbitrary web script or HTML via the import logs feature.
1149 CVE-2018-10018 119 Overflow 2018-07-13 2018-09-11
6.8
None Remote Medium Not required Partial Partial Partial
The GDASPAMLib.AntiSpam ActiveX control ASK\GDASpam.dll in G DATA Total Security 25.4.0.3 has a buffer overflow via a long IsBlackListed argument.
1150 CVE-2018-9998 200 +Info 2018-07-05 2018-09-02
4.0
None Remote Low ??? Partial None None
Open-Xchange OX App Suite before 7.6.3-rev37, 7.8.x before 7.8.2-rev40, 7.8.3 before 7.8.3-rev48, and 7.8.4 before 7.8.4-rev28 include folder names in API error responses, which allows remote attackers to obtain sensitive information via the folder parameter in an "all" action to api/tasks.
Total number of vulnerabilities : 2175   Page : 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 (This Page)24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44
CVE is a registred trademark of the MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. CWE is a registred trademark of the MITRE Corporation and the authoritative source of CWE content is MITRE's CWE web site. OVAL is a registered trademark of The MITRE Corporation and the authoritative source of OVAL content is MITRE's OVAL web site.
Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.