# CVEs published 2018-08-14

34 CVEs were published on August 14, 2018: 2 critical, 1 high. Days are UTC.

- [CVE-2018-12537](https://cve.now/CVE-2018-12537.md): In Eclipse Vert.x version 3.0 to 3.5.1, the HttpServer response headers and HttpClient request headers do not filter carriage return and… (no CVSS, The Eclipse Foundation Eclipse Vert.x · io.vertx:vertx-core)
- [CVE-2018-12539](https://cve.now/CVE-2018-12539.md): In Eclipse OpenJ9 version 0.8, users other than the process owner may be able to use Java Attach API to connect to an Eclipse OpenJ9 or… (no CVSS, The Eclipse Foundation Eclipse OpenJ9)
- [CVE-2018-3615](https://cve.now/CVE-2018-3615.md): Systems with microprocessors utilizing speculative execution and Intel software guard extensions (Intel SGX) may allow unauthorized… (CVSS 7.3, Intel Multiple)
- [CVE-2018-3620](https://cve.now/CVE-2018-3620.md): Systems with microprocessors utilizing speculative execution and address translations may allow unauthorized disclosure of information… (CVSS 5.6, Intel Multiple)
- [CVE-2018-3646](https://cve.now/CVE-2018-3646.md): Systems with microprocessors utilizing speculative execution and address translations may allow unauthorized disclosure of information… (CVSS 5.6, Intel Multiple)
- [CVE-2018-3937](https://cve.now/CVE-2018-3937.md): An exploitable command injection vulnerability exists in the measurementBitrateExec functionality of Sony IPELA E Series Network Camera G5… (CVSS 9.1, Talos Sony)
- [CVE-2018-3938](https://cve.now/CVE-2018-3938.md): An exploitable stack-based buffer overflow vulnerability exists in the 802dot1xclientcert.cgi functionality of Sony IPELA E Series Camera… (CVSS 9.1, Talos Sony)
- [CVE-2018-0131](https://cve.now/CVE-2018-0131.md): A vulnerability in the implementation of RSA-encrypted nonces in Cisco IOS Software and Cisco IOS XE Software could allow an… (no CVSS, Cisco Systems IOS and IOS XE)
- [CVE-2018-14348](https://cve.now/CVE-2018-14348.md): libcgroup up to and including 0.41 creates /var/log/cgred with mode 0666 regardless of the configured umask, leading to disclosure of… (no CVSS)
- [CVE-2018-14424](https://cve.now/CVE-2018-14424.md): The daemon in GDM through 3.29.1 does not properly unexport display objects from its D-Bus interface when they are destroyed, which allows… (no CVSS)
- [CVE-2018-14429](https://cve.now/CVE-2018-14429.md): man-cgi before 1.16 allows Local File Inclusion via absolute path traversal, as demonstrated by a cgi-bin/man-cgi?/etc/passwd URI. (no CVSS)
- [CVE-2018-14888](https://cve.now/CVE-2018-14888.md): inc/plugins/thankyoulike.php in the Eldenroot Thank You/Like plugin before 3.1.0 for MyBB allows XSS via a post or thread subject. (no CVSS)
- [CVE-2018-14922](https://cve.now/CVE-2018-14922.md): Multiple cross-site scripting (XSS) vulnerabilities in Monstra CMS 3.0.4 allow remote attackers to inject arbitrary web script or HTML via… (no CVSS)
- [CVE-2018-2441](https://cve.now/CVE-2018-2441.md): Under certain conditions the SAP Change and Transport System (ABAP), SAP KERNEL 32 NUC, SAP KERNEL 32 Unicode, SAP KERNEL 64 NUC, SAP… (no CVSS, SAP Change and Transport System)
- [CVE-2018-2442](https://cve.now/CVE-2018-2442.md): In SAP BusinessObjects Business Intelligence, versions 4.0, 4.1 and 4.2, while viewing a Web Intelligence report from BI Launchpad, the… (no CVSS, SAP BusinessObjects Business Intelligence)
- [CVE-2018-2444](https://cve.now/CVE-2018-2444.md): SAP BusinessObjects Financial Consolidation, versions 10.0, 10.1, does not sufficiently encode user-controlled inputs, resulting in… (no CVSS, SAP BusinessObjects Financial Consolidation)
- [CVE-2018-2445](https://cve.now/CVE-2018-2445.md): AdminTools in SAP BusinessObjects Business Intelligence, versions 4.1, 4.2, allows an attacker to manipulate the vulnerable application to… (no CVSS, SAP BusinessObjects Business Intelligence Platform)
- [CVE-2018-2446](https://cve.now/CVE-2018-2446.md): Admin tools in SAP BusinessObjects Business Intelligence, versions 4.1, 4.2, allow an unauthenticated user to read sensitive information… (no CVSS, SAP BusinessObjects Business Intelligence)
- [CVE-2018-2447](https://cve.now/CVE-2018-2447.md): SAP BusinessObjects Business Intelligence (Launchpad Web Intelligence), version 4.2, allows an attacker to execute crafted InfoObject… (no CVSS, SAP BusinessObjects Business Intelligence)
- [CVE-2018-2448](https://cve.now/CVE-2018-2448.md): Under certain conditions SAP SRM-MDM (CATALOG versions 3.0, 7.01, 7.02) utilities functionality allows an attacker to access information… (no CVSS, SAP SRM-MDM CATALOG)
- [CVE-2018-2449](https://cve.now/CVE-2018-2449.md): SAP SRM MDM Catalog versions 3.73, 7.31, 7.32 in (SAP NetWeaver 7.3) - import functionality does not perform authentication checks for… (no CVSS, SAP Supplier Relationship Management Master Data Management…)
- [CVE-2018-2450](https://cve.now/CVE-2018-2450.md): SAP MaxDB (liveCache), versions 7.8 and 7.9, allows an attacker who gets DBM operator privileges to execute crafted database queries and… (no CVSS, SAP MaxDB)
- [CVE-2018-2451](https://cve.now/CVE-2018-2451.md): XS Command-Line Interface (CLI) user sessions with the SAP HANA Extended Application Services (XS), version 1, advanced server may have an… (no CVSS, SAP HANA Extended Application Services)
- [CVE-2018-5392](https://cve.now/CVE-2018-5392.md): mingw-w64 version 5.0.4 by default produces executables that opt in to ASLR, but are not compatible with ASLR (no CVSS, mingw-w64)
- [CVE-2018-7077](https://cve.now/CVE-2018-7077.md): A security vulnerability in HPE XP P9000 Command View Advanced Edition (CVAE) Device Manager (DevMgr 8.5.0-00 and prior to 8.6.0-00)… (no CVSS, Hewlett Packard Enterprise HPE XP P9000 Command View Advanc…)
- [CVE-2018-7093](https://cve.now/CVE-2018-7093.md): A security vulnerability in HPE Integrated Lights-Out 3 prior to v1.90, iLO 4 prior to v2.60, iLO 5 prior to v1.30, Moonshot Chassis… (no CVSS, Hewlett Packard Enterprise iLO 5 for HPE Gen10 Servers, iLO…)
- [CVE-2018-7094](https://cve.now/CVE-2018-7094.md): A security vulnerability was identified in 3PAR Service Processor (SP) prior to SP-5.0.0.0-22913(GA). (no CVSS, Hewlett Packard Enterprise HPE 3PAR Service Processors)
- [CVE-2018-7095](https://cve.now/CVE-2018-7095.md): A security vulnerability was identified in 3PAR Service Processor (SP) prior to SP-4.4.0.GA-110(MU7). (no CVSS, Hewlett Packard Enterprise HPE 3PAR Service Processors)
- [CVE-2018-7096](https://cve.now/CVE-2018-7096.md): A security vulnerability was identified in 3PAR Service Processor (SP) prior to SP-4.4.0.GA-110(MU7). (no CVSS, Hewlett Packard Enterprise HPE 3PAR Service Processors)
- [CVE-2018-7097](https://cve.now/CVE-2018-7097.md): A security vulnerability was identified in 3PAR Service Processor (SP) prior to SP-4.4.0.GA-110(MU7). (no CVSS, Hewlett Packard Enterprise HPE 3PAR Service Processors)
- [CVE-2018-7098](https://cve.now/CVE-2018-7098.md): A security vulnerability was identified in 3PAR Service Processor (SP) prior to SP-4.4.0.GA-110(MU7). (no CVSS, Hewlett Packard Enterprise HPE 3PAR Service Processors)
- [CVE-2018-7099](https://cve.now/CVE-2018-7099.md): A security vulnerability was identified in 3PAR Service Processor (SP) prior to SP-4.4.0.GA-110(MU7). (no CVSS, Hewlett Packard Enterprise HPE 3PAR Service Processors)
- [CVE-2018-7100](https://cve.now/CVE-2018-7100.md): A potential security vulnerability has been identified in HPE OfficeConnect 1810 Switch Series (HP 1810-24G - P.2.22 and previous… (no CVSS, Hewlett Packard Enterprise HP 1810-24G, HP 1810-48G, HP 181…)
- [CVE-2016-4975](https://cve.now/CVE-2016-4975.md): mod\_userdir CRLF injection (no CVSS, Apache Software Foundation Apache HTTP Server)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/archive/2018-08-14
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.