CVEdetails.com the ultimate security vulnerability data source
(e.g.: CVE-2009-1234 or 2010-1234 or 20101234)
Log In   Register
  What's the CVSS score of your company?
Vulnerability Feeds & WidgetsNew   www.itsecdb.com  

Security Vulnerabilities Published In June 2018

Press ESC to close
# CVE ID CWE ID # of Exploits Vulnerability Type(s) Publish Date Update Date Score Gained Access Level Access Complexity Authentication Conf. Integ. Avail.
101 CVE-2018-13011 125 2018-06-29 2018-08-21
7.5
None Remote Low Not required Partial Partial Partial
An issue was discovered in gpmf-parser 1.1.2. There is a heap-based buffer over-read in GPMF_parser.c in the function GPMF_Validate.
102 CVE-2018-13010 352 CSRF 2018-06-29 2018-08-24
6.8
None Remote Medium Not required Partial Partial Partial
WSTMall v1.9.1_170316 has CSRF via the index.php?m=Admin&c=Users&a=edit URI to add a user account.
103 CVE-2018-13009 125 2018-06-29 2018-08-21
7.5
None Remote Low Not required Partial Partial Partial
An issue was discovered in gpmf-parser 1.1.2. There is a heap-based buffer over-read in GPMF_parser.c in the function GPMF_Next, related to certain checks for GPMF_KEY_END and nest_level (conditional on a buffer_size_longs check).
104 CVE-2018-13008 125 2018-06-29 2018-08-21
7.5
None Remote Low Not required Partial Partial Partial
An issue was discovered in gpmf-parser 1.1.2. There is a heap-based buffer over-read in GPMF_parser.c in the function GPMF_Next, related to certain checks for a positive nest_level.
105 CVE-2018-13007 125 2018-06-29 2018-08-21
7.5
None Remote Low Not required Partial Partial Partial
An issue was discovered in gpmf-parser 1.1.2. There is a heap-based buffer over-read in GPMF_parser.c in the function GPMF_Next, related to certain checks for GPMF_KEY_END and nest_level (not conditional on a buffer_size_longs check).
106 CVE-2018-13006 125 2018-06-29 2019-03-29
7.5
None Remote Low Not required Partial Partial Partial
An issue was discovered in MP4Box in GPAC 0.7.1. There is a heap-based buffer over-read in the isomedia/box_dump.c function hdlr_dump.
107 CVE-2018-13005 125 2018-06-29 2019-03-29
7.5
None Remote Low Not required Partial Partial Partial
An issue was discovered in MP4Box in GPAC 0.7.1. The function urn_Read in isomedia/box_code_base.c has a heap-based buffer over-read.
108 CVE-2018-13003 79 XSS 2018-06-29 2018-08-21
4.3
None Remote Medium Not required None Partial None
An issue was discovered in OpenTSDB 2.3.0. There is XSS in parameter 'type' to the /suggest URI.
109 CVE-2018-13002 79 Exec Code XSS 2018-06-29 2018-08-20
3.5
None Remote Medium ??? None Partial None
An XSS issue was discovered in Inhaltsprojekte in Weblication CMS Core & Grid v12.6.24. The vulnerability is located in the `wFilemanager.php` and `index.php` files of the `/grid5/scripts/` modules. The injection point is located in the Project `Title` and the execution point occurs in the `Inhaltsprojekte` output listing section. Remote attackers with privileged user accounts are able to inject their own malicious script code with a persistent attack vector to compromise user session credentials or to manipulate the affected web-application module output context. The request method to inject is POST.
110 CVE-2018-13001 79 Exec Code XSS 2018-06-29 2018-08-20
4.3
None Remote Medium Not required None Partial None
An XSS issue was discovered in Sandoba CP:Shop v2016.1. The vulnerability is located in the `admin.php` file of the `./cpshop/` module. Remote attackers are able to inject their own script codes to the client-side requested vulnerable web-application parameters. The attack vector of the vulnerability is non-persistent and the request method to inject/execute is GET with the path, search, rename, or dir parameter.
111 CVE-2018-13000 79 Exec Code XSS 2018-06-29 2018-08-20
3.5
None Remote Medium ??? None Partial None
An XSS issue was discovered in Advanced Electron Forum (AEF) v1.0.9. A persistent XSS vulnerability is located in the `FTP Link` element of the `Private Message` module. The editor of the private message module allows inserting links without sanitizing the content. This allows remote attackers to inject malicious script code payloads as a private message (aka pmbody). The injection point is the editor ftp link element and the execution point occurs in the message body context on arrival. The request method to inject is POST with restricted user privileges.
112 CVE-2018-12999 20 2018-06-29 2018-08-20
6.4
None Remote Low Not required None Partial Partial
Incorrect Access Control in AgentTrayIconServlet in Zoho ManageEngine Desktop Central 10.0.255 allows attackers to delete certain files on the web server without login by sending a specially crafted request to the server with a computerName=../ substring to the /agenttrayicon URI.
113 CVE-2018-12998 79 XSS 2018-06-29 2021-08-31
4.3
None Remote Medium Not required None Partial None
A reflected Cross-site scripting (XSS) vulnerability in Zoho ManageEngine Netflow Analyzer before build 123137, Network Configuration Manager before build 123128, OpManager before build 123148, OpUtils before build 123161, and Firewall Analyzer before build 123147 allows remote attackers to inject arbitrary web script or HTML via the parameter 'operation' to /servlet/com.adventnet.me.opmanager.servlet.FailOverHelperServlet.
114 CVE-2018-12997 200 +Info 2018-06-29 2021-08-31
5.0
None Remote Low Not required Partial None None
Incorrect Access Control in FailOverHelperServlet in Zoho ManageEngine Netflow Analyzer before build 123137, Network Configuration Manager before build 123128, OpManager before build 123148, OpUtils before build 123161, and Firewall Analyzer before build 123147 allows attackers to read certain files on the web server without login by sending a specially crafted request to the server with the operation=copyfile&fileName= substring.
115 CVE-2018-12996 79 XSS 2018-06-29 2018-08-20
4.3
None Remote Medium Not required None Partial None
A reflected Cross-site scripting (XSS) vulnerability in Zoho ManageEngine Applications Manager before 13 (Build 13800) allows remote attackers to inject arbitrary web script or HTML via the parameter 'method' to GraphicalView.do.
116 CVE-2018-12995 94 Exec Code 2018-06-29 2018-08-20
6.5
None Remote Low ??? Partial Partial Partial
onefilecms.php in OneFileCMS through 2012-04-14 might allow attackers to execute arbitrary PHP code via a .php filename on the Upload screen.
117 CVE-2018-12994 94 Exec Code 2018-06-29 2018-08-20
6.5
None Remote Low ??? Partial Partial Partial
onefilecms.php in OneFileCMS through 2012-04-14 might allow attackers to execute arbitrary PHP code via a .php filename on the New File screen.
118 CVE-2018-12993 307 2018-06-29 2019-10-03
5.0
None Remote Low Not required Partial None None
onefilecms.php in OneFileCMS through 2012-04-14 might allow attackers to conduct brute-force attacks via the onefilecms_username and onefilecms_password fields.
119 CVE-2018-12992 79 XSS 2018-06-29 2020-03-16
3.5
None Remote Medium ??? None Partial None
An issue was discovered CMS MaeloStore V.1.5.0. There is stored XSS in the Telephone field of the admin interface.
120 CVE-2018-12990 200 +Info CSRF 2018-06-30 2018-08-28
5.0
None Remote Low Not required Partial None None
phpwcms 1.8.9 allows remote attackers to discover the installation path via an invalid csrf_token_value field.
121 CVE-2018-12988 20 2018-06-29 2018-08-20
5.0
None Remote Low Not required Partial None None
GreenCMS 2.3.0603 has an arbitrary file download vulnerability via an index.php?m=admin&c=media&a=downfile URI.
122 CVE-2018-12984 287 Bypass 2018-06-29 2018-08-20
7.5
None Remote Low Not required Partial Partial Partial
Hycus CMS 1.0.4 allows Authentication Bypass via "'=' 'OR'" credentials.
123 CVE-2018-12983 125 2018-06-29 2020-07-11
6.8
None Remote Medium Not required Partial Partial Partial
A stack-based buffer over-read in the PdfEncryptMD5Base::ComputeEncryptionKey() function in PdfEncrypt.cpp in PoDoFo 0.9.6-rc1 could be leveraged by remote attackers to cause a denial-of-service via a crafted pdf file.
124 CVE-2018-12982 119 Overflow 2018-06-29 2018-08-20
4.3
None Remote Medium Not required None None Partial
Invalid memory read in the PoDoFo::PdfVariant::DelayedLoad() function in PdfVariant.h in PoDoFo 0.9.6-rc1 allows remote attackers to have denial-of-service impact via a crafted file.
125 CVE-2018-12973 79 XSS 2018-06-29 2018-08-21
4.3
None Remote Medium Not required None Partial None
An issue was discovered in OpenTSDB 2.3.0. There is XSS in parameter 'json' to the /q URI.
126 CVE-2018-12972 78 Exec Code 2018-06-29 2019-10-03
7.5
None Remote Low Not required Partial Partial Partial
An issue was discovered in OpenTSDB 2.3.0. Many parameters to the /q URI can execute commands, including o, key, style, and yrange and y2range and their JSON input.
127 CVE-2018-12971 352 CSRF 2018-06-29 2018-08-20
5.8
None Remote Medium Not required None Partial Partial
EasyCMS 1.3 has CSRF via the index.php?s=/admin/user/delAll URI to delete users.
128 CVE-2018-12938 DoS Exec Code 2018-06-28 2018-07-05
0.0
None ??? ??? ??? ??? ??? ???
slpd_process.c in OpenSLP 2.0.0 has a double free resulting in denial of service (daemon crash) or possibly unauthenticated remote code execution.
129 CVE-2018-12934 770 2018-06-28 2020-04-21
5.0
None Remote Low Not required None None Partial
remember_Ktype in cplus-dem.c in GNU libiberty, as distributed in GNU Binutils 2.30, allows attackers to trigger excessive memory consumption (aka OOM). This can occur during execution of cxxfilt.
130 CVE-2018-12933 787 DoS 2018-06-28 2018-08-17
7.5
None Remote Low Not required Partial Partial Partial
PlayEnhMetaFileRecord in enhmetafile.c in Wine 3.7 allows attackers to cause a denial of service (out-of-bounds write) or possibly have unspecified other impact because the attacker controls the pCreatePen->ihPen array index.
131 CVE-2018-12932 787 DoS Overflow 2018-06-28 2020-08-24
7.5
None Remote Low Not required Partial Partial Partial
PlayEnhMetaFileRecord in enhmetafile.c in Wine 3.7 allows attackers to cause a denial of service (heap-based buffer overflow) or possibly have unspecified other impact by triggering a large pAlphaBlend->cbBitsSrc value.
132 CVE-2018-12931 787 DoS 2018-06-28 2019-03-26
7.2
None Local Low Not required Complete Complete Complete
ntfs_attr_find in the ntfs.ko filesystem driver in the Linux kernel 4.15.0 allows attackers to trigger a stack-based out-of-bounds write and cause a denial of service (kernel oops or panic) or possibly have unspecified other impact via a crafted ntfs filesystem.
133 CVE-2018-12930 787 DoS 2018-06-28 2019-03-26
7.2
None Local Low Not required Complete Complete Complete
ntfs_end_buffer_async_read in the ntfs.ko filesystem driver in the Linux kernel 4.15.0 allows attackers to trigger a stack-based out-of-bounds write and cause a denial of service (kernel oops or panic) or possibly have unspecified other impact via a crafted ntfs filesystem.
134 CVE-2018-12929 416 DoS 2018-06-28 2019-03-26
4.9
None Local Low Not required None None Complete
ntfs_read_locked_inode in the ntfs.ko filesystem driver in the Linux kernel 4.15.0 allows attackers to trigger a use-after-free read and possibly cause a denial of service (kernel oops or panic) via a crafted ntfs filesystem.
135 CVE-2018-12928 476 2018-06-28 2018-08-21
4.9
None Local Low Not required None None Complete
In the Linux kernel 4.15.0, a NULL pointer dereference was discovered in hfs_ext_read_extent in hfs.ko. This can occur during a mount of a crafted hfs filesystem.
136 CVE-2018-12927 200 +Info 2018-06-28 2018-08-30
5.0
None Remote Low Not required Partial None None
Northern Electric & Power (NEP) inverter devices allow remote attackers to obtain potentially sensitive information via a direct request for the nep/status/index/1 URI.
137 CVE-2018-12926 200 +Info 2018-06-28 2018-08-30
5.0
None Remote Low Not required Partial None None
Pharos Controls devices allow remote attackers to obtain potentially sensitive information via a direct request for the default/index.lsp or default/log.lsp URI.
138 CVE-2018-12925 521 2018-06-28 2019-10-03
10.0
None Remote Low Not required Complete Complete Complete
Baseon Lantronix MSS devices do not require a password for TELNET access.
139 CVE-2018-12924 798 2018-06-28 2018-08-24
10.0
None Remote Low Not required Complete Complete Complete
Sollae Serial-Ethernet-Module and Remote-I/O-Device-Server devices have a default password of sollae for the TELNET service.
140 CVE-2018-12923 200 +Info 2018-06-28 2020-09-16
5.0
None Remote Low Not required Partial None None
BWS Systems HA-Bridge devices allow remote attackers to obtain potentially sensitive information via a direct request for the #!/system URI.
141 CVE-2018-12922 732 2018-06-28 2021-09-13
5.0
None Remote Low Not required None Partial None
Emerson Liebert IntelliSlot Web Card devices allow remote attackers to reconfigure access control via the config/configUser.htm or config/configTelnet.htm URI.
142 CVE-2018-12921 200 +Info 2018-06-28 2018-08-31
5.0
None Remote Low Not required Partial None None
Electro Industries GaugeTech Nexus devices allow remote attackers to obtain potentially sensitive information via a direct request for the meter_information.htm, diag_system.htm, or diag_dnp_lan_wan.htm URI.
143 CVE-2018-12920 200 +Info 2018-06-28 2021-05-03
5.0
None Remote Low Not required Partial None None
Brickstream 2300 devices allow remote attackers to obtain potentially sensitive information via a direct request for the basic.html#ipsettings or basic.html#datadelivery URI.
144 CVE-2018-12919 79 XSS 2018-06-27 2018-08-20
4.3
None Remote Medium Not required None Partial None
In CraftedWeb through 2013-09-24, aasp_includes/pages/notice.php allows XSS via the e parameter.
145 CVE-2018-12918 119 Overflow 2018-06-27 2020-03-16
7.5
None Remote Low Not required Partial Partial Partial
In libpbc.a in PBC through 2017-03-02, there is a Segmentation fault in _pbcB_register_fields in bootstrap.c.
146 CVE-2018-12917 125 2018-06-27 2019-10-03
7.5
None Remote Low Not required Partial Partial Partial
In libpbc.a in PBC through 2017-03-02, there is a heap-based buffer over-read in _pbcM_ip_new in map.c.
147 CVE-2018-12916 119 Overflow 2018-06-27 2018-08-17
7.5
None Remote Low Not required Partial Partial Partial
In libpbc.a in PBC through 2017-03-02, there is a Segmentation fault in _pbcP_message_default in proto.c.
148 CVE-2018-12915 125 2018-06-27 2019-10-03
7.5
None Remote Low Not required Partial Partial Partial
In libpbc.a in PBC through 2017-03-02, there is a buffer over-read in calc_hash in map.c.
149 CVE-2018-12914 434 Exec Code Dir. Trav. 2018-06-27 2018-08-20
7.5
None Remote Low Not required Partial Partial Partial
A remote code execution issue was discovered in PublicCMS V4.0.20180210. An attacker can upload a ZIP archive that contains a .jsp file with a directory traversal pathname. After an unzip operation, the attacker can execute arbitrary code by visiting a .jsp URI.
150 CVE-2018-12913 835 2018-06-27 2019-10-03
5.0
None Remote Low Not required None None Partial
In Miniz 2.0.7, tinfl_decompress in miniz_tinfl.c has an infinite loop because sym2 and counter can both remain equal to zero.
Total number of vulnerabilities : 1788   Page : 1 2 3 (This Page)4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36
CVE is a registred trademark of the MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. CWE is a registred trademark of the MITRE Corporation and the authoritative source of CWE content is MITRE's CWE web site. OVAL is a registered trademark of The MITRE Corporation and the authoritative source of OVAL content is MITRE's OVAL web site.
Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.