CVEs published in July 2018
2,161 vulnerabilities, 252 critical, 3 exploited.
- echelon i.lon 100, i.lon 600, smartserver 1 +5 more +7 moreEchelon SmartServer 1 all versions, SmartServer 2 all versions prior to release 4.11.007, i.LON...9.8 Critical
- echelon i.lon 100, i.lon 600, smartserver 1 +5 more +7 moreEchelon SmartServer 1 all versions, SmartServer 2 all versions prior to release 4.11.007, i.LON...9.8 Critical
- echelon i.lon 100, i.lon 600, smartserver 1 +5 more +7 moreEchelon SmartServer 1 all versions, SmartServer 2 all versions prior to release 4.11.007, i.LON...9.8 Critical
- moxa nport 5210, 5230, and 5232, nport 5210 firmware, nport 5230 firmware +1 more +3 moreIn Moxa NPort 5210, 5230, and 5232 versions 2.9 build 17030709 and prior, the amount of resources...7.5 High
- echelon i.lon 100, i.lon 600, smartserver 1 +4 more +6 moreEchelon SmartServer 1 all versions, SmartServer 2 all versions prior to release 4.11.007, i.LON...9.8 Critical
- axiosys bento4An issue has been discovered in Bento4 1.5.1-624. A SEGV can occur in AP4_Processor:...7.5 High
- axiosys bento4An issue has been discovered in Bento4 1.5.1-624. AP4_Mp4AudioDsiParser::ReadBits in Codecs...8.8 High
- axiosys bento4An issue has been discovered in Bento4 1.5.1-624. A NULL pointer dereference can occur in...7.5 High
- axiosys bento4An issue has been discovered in Bento4 1.5.1-624. AP4_MemoryByteStream::WritePartial in Core...8.8 High
- axiosys bento4An issue has been discovered in Bento4 1.5.1-624. A SEGV can occur in...8.8 High
- axiosys bento4An issue has been discovered in Bento4 1.5.1-624. AP4_BytesToUInt16BE in Core/Ap4Utils.h has a...8.8 High
- axiosys bento4An issue has been discovered in Bento4 1.5.1-624. AP4_AvccAtom::Create in Core/Ap4AvccAtom.cpp...8.8 High
- xyhcmsxyhai.php?s=/Auth/addUser in XYHCMS 3.5 allows CSRF to add a background administrator account.8.8 High
- bagesoft bagecmsindex.php?r=admini/admin/create in BageCMS V3.1.3 allows CSRF to add a background administrator...8.8 High
- wizkunde samlbaseWizkunde SAMLBase SAML Bypass7.5 High
- navarino infinitySome Navarino Infinity functions placed in the URL can bypass any authentication mechanism leading to an information leak7.5 High
- navarino infinityNavarino Infinity web interface up to version 2.2 is prone to session fixation attacks8.8 High
- navarino infinityNavarino Infinity web interface up to version 2.2 exposes an unauthenticated script that is prone to blind sql injection9.8 Critical
- das u-bootDas U-Boot's AES-CBC encryption feature improperly handles an error condition and may allow attacks against the underlying cryptographic implementation and allow an attacker to decrypt the data6.4 Medium
- das u-bootDas U-Boot's AES-CBC encryption feature uses a zero (0) initialization vector that may allow attacks against the underlying cryptographic implementation and allow an attacker to decrypt the data4.6 Medium
- open shortest path first (ospf) protocol, quagga, suse opensuse +2 more +4 moreOpen Shortest Path First (OSPF) protocol implementations may improperly determine LSA recency in affected Quagga and downstream implementations (SUSE, openSUSE, and Red Hat packages)8.2 High
- bos ip camera, dahuasecurity ip camera firmware +1 moreDahua IP camera products using firmware versions prior to V2.400.0000.14.R.20170713 include a version of the Sonia web interface that may be vulnerable to a stack buffer overflow9.8 Critical
- calamp lmu 3030 obd-ii, lmu 3030 cdma firmware, lmu 3030 gsm firmware +1 more +3 moreCalAmp LMU 3030 series OBD-II CDMA and GSM devices has an SMS (text message) interface that can be deployed where no password is configured for this interface by the integrator / reseller8.1 High
- fujitsu displayview click, displayview click suite, hp display assistant +4 more +6 moreApplications developed using the Portrait Display SDK, versions 2.30 through 2.34, default to insecure configurations which allow arbitrary code execution7.8 High
- dbpower u818a wifi quadcopter drone, u818a firmware +1 moreThe DBPOWER U818A WIFI quadcopter drone provides FTP access over its own local access point, and allows full file permissions to the anonymous user8.1 High
- doccms administration panel, dotcms +1 moreThe dotCMS administration panel, versions 3.7.1 and earlier, "Push Publishing" feature in Enterprise Pro is vulnerable to arbitrary file upload8.1 High
- doccms administration panel, dotcms +1 moreThe dotCMS administration panel, versions 3.7.1 and earlier, "Push Publishing" feature in Enterprise Pro is vulnerable to path traversal6.5 Medium
- doccms administration panel, dotcms +1 moreThe dotCMS administration panel, versions 3.7.1 and earlier, are vulnerable to cross-site request forgery8.8 High
- sage xrt treasurySage XRT Treasury, version 3, fails to properly restrict database access to authorized users, which may enable any authenticated user to gain full access to privileged database functions8.8 High
- redwoodjs sdkOn the iOS platform, the ThreatMetrix SDK versions prior to 3.2 fail to validate SSL certificates provided by HTTPS connections, which may allow an attacker to perform a man-in-the-middle (MITM) attac…6.8 Medium
- spotfire analyst, desktop, tibco spotfire analyst +7 more +9 moreMultiple TIBCO Spotfire components are vulnerable to multiple unspecified SQL-injection vulnerabilities because it fails to properly sanitize user-supplied input before using it in an SQL query9.8 Critical
- spotfire analyst, desktop, tibco silver fabric enabler for spotfire web player +12 more +14 moreMultiple TIBCO Spotfire components fail to sanitize user-supplied inout and are vulnerable to cross-site scripting5.4 Medium
- netgear dgn2200, dgnd3700, dgn2200 firmware +1 more +3 moreNetgear DGN2200 and DGND3700 disclose the administrator password9.8 Critical
- netgear wndr4500, wndr4500 firmware +1 moreNetgear WNDR4500 running firmware version V1.0.1.40_1.0.6877 reveals some sensitive information such as 2.4GHz & 5GHz Wireless Network Name (SSID) and Network Key (Password) in clear text7.5 High
- golemcms project golemcmsGolemCMS through 2008-12-24, if the install/ directory remains active after an installation,...9.8 Critical
- h2database h2An issue was discovered in H2 1.4.197. Insecure handling of permissions in the backup function...6.5 Medium
- atlassian sourcetree, sourcetree for windows +1 moreThere was an argument injection vulnerability in Sourcetree for Windows via filenames in...8.1 High
- atlassian sourcetree, sourcetree for macos +1 moreThere was an argument injection vulnerability in Sourcetree for macOS via filenames in Mercurial...9.8 Critical
- [unknown] cfme, redhat cloudforms, cloudforms management engine +2 moreCloudForms Management Engine (cfme) is vulnerable to an improper security setting in the dRuby...7.8 High
- schweitzer engineering laboratories, inc. acselerator architectSEL AcSELerator Architect version 2.2.24.0 and prior can be exploited when the AcSELerator...7.5 High
- hcl software compass, selinc sel compass +1 moreSEL Compass version 3.0.5.1 and prior allows all users full access to the SEL Compass directory,...8.8 High
- schweitzer engineering laboratories, inc. acselerator architectSEL AcSELerator Architect version 2.2.24.0 and prior allows unsanitized input to be passed to the...9.8 Critical
- atlassian jira, jira server +1 moreThe Webhooks component of Atlassian Jira before version 7.6.7 and from version 7.7.0 before...5.9 Medium
- google androidIn driver_override_store of bus.c, there is a possible out of bounds write due to an incorrect...7.8 High
- apache tomcat, canonical ubuntu linux, debian linux +1 more +3 moreThe host name verification missing in Apache Tomcat7.5 High
- apache tomcat, canonical ubuntu linux, debian linux +5 more +7 moreIn Apache Tomcat there is an improper handing of overflow in the UTF-8 decoder7.5 High
- bluez, canonical ubuntu linux +1 moreA bug in Bluez may allow for the Bluetooth Discoverable state being set to on when no Bluetooth...4.5 Medium
- trms tightrope media carousel digital signageA Local File Inclusion (LFI) vulnerability exists in the Web Interface API of TightRope Media...5.5 Medium
- apache tomeeApache TomEE console vulnerable to Cross-site Scripting6.1 Medium
- [unknown] keycloak, redhat single sign-on +1 moreModerate severity vulnerability that affects org.keycloak:keycloak-core4.4 Medium
- Show moreLoading…