Security Vulnerabilities - CVEs Published In July 2018
In Bento4 v1.5.1-624, AP4_File::ParseStream in Ap4File.cpp allows remote attackers to cause a denial of service (infinite loop) via a crafted MP4 file.
CVSS Score
6.5
EPSS Score
0.003
Published
2018-07-20
MP4Integer32Property::Read in atom_avcC.cpp in MP4v2 2.1.0 allows remote attackers to cause a denial of service (heap-based buffer overflow and application crash) or possibly have unspecified other impact via a crafted MP4 file.
CVSS Score
8.8
EPSS Score
0.009
Published
2018-07-20
trim_whitespace in lexer.l in libConfuse v3.2.1 has an out-of-bounds read.
CVSS Score
8.8
EPSS Score
0.005
Published
2018-07-20
Codec::parse in track.cpp in Untrunc through 2018-06-07 has a NULL pointer dereference via a crafted MP4 file because of improper interaction with libav.
CVSS Score
6.5
EPSS Score
0.003
Published
2018-07-20
Foxit Reader before 9.2 and PhantomPDF before 9.2 have a Use-After-Free that leads to Remote Code Execution, aka V-88f4smlocs.
CVSS Score
9.8
EPSS Score
0.057
Published
2018-07-20
camel/providers/imapx/camel-imapx-server.c in the IMAPx component in GNOME evolution-data-server before 3.21.2 proceeds with cleartext data containing a password if the client wishes to use STARTTLS but the server will not use STARTTLS, which makes it easier for remote attackers to obtain sensitive information by sniffing the network. The server code was intended to report an error and not proceed, but the code was written incorrectly.
CVSS Score
9.8
EPSS Score
0.009
Published
2018-07-20
In Apache Ignite before 2.4.8 and 2.5.x before 2.5.3, the serialization mechanism does not have a list of classes allowed for serialization/deserialization, which makes it possible to run arbitrary code when 3-rd party vulnerable classes are present in Ignite classpath. The vulnerability can be exploited if the one sends a specially prepared form of a serialized object to GridClientJdkMarshaller deserialization endpoint.
CVSS Score
9.8
EPSS Score
0.055
Published
2018-07-20
An issue was discovered in idreamsoft iCMS before 7.0.10. XSS exists via the fourth and fifth input elements on the admincp.php?app=prop&do=add screen.
CVSS Score
6.1
EPSS Score
0.002
Published
2018-07-20
In Msvod Cms v10, SQL Injection exists via an images/lists?cid= URI.
CVSS Score
9.8
EPSS Score
0.048
Published
2018-07-20
MetInfo 6.0.0 allows XSS via a modified name of the navigation bar on the home page.
CVSS Score
4.8
EPSS Score
0.002
Published
2018-07-20