# CVEs published 2018-08-15

109 CVEs were published on August 15, 2018: 0 critical, 4 high. 4 are now in CISA KEV. Days are UTC.

- [CVE-2017-13100](https://cve.now/CVE-2017-13100.md): DistinctDev, Inc., The Moron Test, 6.3.1, 2017-05-04, iOS application uses a hard-coded key for encryption (no CVSS, DistinctDev The Moron Test)
- [CVE-2017-13101](https://cve.now/CVE-2017-13101.md): Musical.ly Inc., musical.ly - your video social network, 6.1.6, 2017-10-03, iOS application uses a hard-coded key for encryption (no CVSS, musical.ly)
- [CVE-2017-13102](https://cve.now/CVE-2017-13102.md): Gameloft Asphalt Xtreme: Offroad Rally Racing, 1.6.0, 2017-08-13, iOS application uses a hard-coded key for encryption (no CVSS, Gameloft Asphalt Xtreme: Offroad Rally Racing)
- [CVE-2017-13104](https://cve.now/CVE-2017-13104.md): Uber Technologies, Inc. UberEATS: Uber for Food Delivery, 1.108.10001, 2017-11-02, iOS application uses a hard-coded key for encryption (no CVSS, Uber Technologies UberEATS: Uber for Food Delivery)
- [CVE-2017-13105](https://cve.now/CVE-2017-13105.md): Hi Security Virus Cleaner - Antivirus, Booster, 3.7.1.1329, 2017-09-13, Android application accepts all SSL certificates during SSL… (no CVSS, Hi Security Lab Virus Cleaner - Antivirus, Booster)
- [CVE-2017-13106](https://cve.now/CVE-2017-13106.md): Cheetahmobile CM Launcher 3D - Theme, wallpaper, Secure, Efficient, 5.0.3, 2017-09-19, Android application uses a hard-coded key for… (no CVSS, Cheetahmobile CM Launcher 3D - Theme, wallpaper, Secure, Ef…)
- [CVE-2017-13107](https://cve.now/CVE-2017-13107.md): Live.me - live stream video chat, 3.7.20, 2017-11-06, Android application uses a hard-coded key for encryption (no CVSS, Live.me)
- [CVE-2017-13108](https://cve.now/CVE-2017-13108.md): DFNDR Security Antivirus, Anti-hacking & Cleaner, 5.0.9, 2017-11-01, Android application uses a hard-coded key for encryption (no CVSS, DFNDR Security Antivirus, Anti-hacking & Cleaner)
- [CVE-2018-0367](https://cve.now/CVE-2018-0367.md): A vulnerability in the web-based management interface of the Cisco Registered Envelope Service could allow an authenticated, remote… (no CVSS, Cisco Systems Registered Envelope Service)
- [CVE-2018-0386](https://cve.now/CVE-2018-0386.md): A vulnerability in Cisco Unified Communications Domain Manager Software could allow an unauthenticated, remote attacker to conduct a… (no CVSS, Cisco Systems Unified Communications Domain Manager Software)
- [CVE-2018-0409](https://cve.now/CVE-2018-0409.md): A vulnerability in the XCP Router service of the Cisco Unified Communications Manager IM & Presence Service (CUCM IM&P) and the Cisco… (no CVSS, Cisco Systems Unified Communications Manager IM & Presence…)
- [CVE-2018-0410](https://cve.now/CVE-2018-0410.md): A vulnerability in the web proxy functionality of Cisco AsyncOS Software for Cisco Web Security Appliances could allow an unauthenticated… (no CVSS, Cisco Systems AsyncOS Software for Cisco Web Security Appli…)
- [CVE-2018-0412](https://cve.now/CVE-2018-0412.md): A vulnerability in the implementation of Extensible Authentication Protocol over LAN (EAPOL) functionality in Cisco Small Business 100… (no CVSS, Cisco Systems Small Business 100 Series Wireless Access Poi…)
- [CVE-2018-0415](https://cve.now/CVE-2018-0415.md): A vulnerability in the implementation of Extensible Authentication Protocol over LAN (EAPOL) functionality in Cisco Small Business 100… (no CVSS, Cisco Systems Small Business 100 Series Wireless Access Poi…)
- [CVE-2018-0418](https://cve.now/CVE-2018-0418.md): A vulnerability in the Local Packet Transport Services (LPTS) feature set of Cisco ASR 9000 Series Aggregation Services Router Software… (no CVSS, Cisco Systems ASR 9000 Series Aggregation Services Router S…)
- [CVE-2018-0419](https://cve.now/CVE-2018-0419.md): A vulnerability in certain attachment detection mechanisms of Cisco Email Security Appliances (ESA) could allow an unauthenticated, remote… (no CVSS, Cisco Systems Email Security Appliance)
- [CVE-2018-0427](https://cve.now/CVE-2018-0427.md): A vulnerability in the CronJob scheduler API of Cisco Digital Network Architecture (DNA) Center could allow an authenticated, remote… (no CVSS, Cisco Systems Digital Network Architecture (DNA) Center)
- [CVE-2018-0428](https://cve.now/CVE-2018-0428.md): A vulnerability in the account management subsystem of Cisco Web Security Appliance (WSA) could allow an authenticated, local attacker to… (no CVSS, Cisco Systems Web Security Appliance)
- [CVE-2018-10510](https://cve.now/CVE-2018-10510.md): A Directory Traversal Remote Code Execution vulnerability in Trend Micro Control Manager (versions 6.0 and 7.0) could allow an attacker to… (no CVSS, Trend Micro Control Manager)
- [CVE-2018-10511](https://cve.now/CVE-2018-10511.md): A vulnerability in Trend Micro Control Manager (versions 6.0 and 7.0) could allow an attacker to conduct a server-side request forgery… (no CVSS, Trend Micro Control Manager)
- [CVE-2018-10512](https://cve.now/CVE-2018-10512.md): A vulnerability in Trend Micro Control Manager (versions 6.0 and 7.0) could allow an attacker to manipulate a reverse proxy .dll on… (no CVSS, Trend Micro Control Manager)
- [CVE-2018-11247](https://cve.now/CVE-2018-11247.md): The JMX/RMI interface in Nasdaq BWise 5.0 does not require authentication for an SAP BO Component, which allows remote attackers to… (no CVSS)
- [CVE-2018-14007](https://cve.now/CVE-2018-14007.md): Citrix XenServer 7.1 and newer allows Directory Traversal. (no CVSS)
- [CVE-2018-14722](https://cve.now/CVE-2018-14722.md): An issue was discovered in evaluate\_auto\_mountpoint in btrfsmaintenance-functions in btrfsmaintenance through 0.4.1. (no CVSS)
- [CVE-2018-14779](https://cve.now/CVE-2018-14779.md): A buffer overflow issue was discovered in the Yubico-Piv 1.5.0 smartcard driver. (no CVSS)
- [CVE-2018-14780](https://cve.now/CVE-2018-14780.md): An out-of-bounds read issue was discovered in the Yubico-Piv 1.5.0 smartcard driver. (no CVSS)
- [CVE-2018-8753](https://cve.now/CVE-2018-8753.md): The IKEv1 implementation in Clavister cOS Core before 11.00.11, 11.20.xx before 11.20.06, and 12.00.xx before 12.00.09 allows remote… (no CVSS)
- [CVE-2018-9129](https://cve.now/CVE-2018-9129.md): ZyXEL ZyWALL/USG series devices have a Bleichenbacher vulnerability in their Internet Key Exchange (IKE) handshake implementation used for… (no CVSS)
- [CVE-2018-0952](https://cve.now/CVE-2018-0952.md): An Elevation of Privilege vulnerability exists when Diagnostics Hub Standard Collector allows file creation in arbitrary locations, aka… (no CVSS, Microsoft Windows Server · Microsoft Windows +1)
- [CVE-2018-10369](https://cve.now/CVE-2018-10369.md): A Cross-site scripting (XSS) vulnerability was discovered on Intelbras Win 240 V1.1.0 devices. (no CVSS)
- [CVE-2018-10917](https://cve.now/CVE-2018-10917.md): pulp 2.16.x and possibly older is vulnerable to an improper path parsing. (CVSS 6.8, \[UNKNOWN\] pulp)
- [CVE-2018-11687](https://cve.now/CVE-2018-11687.md): An integer overflow in the distributeBTR function of a smart contract implementation for Bitcoin Red (BTCR), an Ethereum ERC20 token… (no CVSS)
- [CVE-2018-12056](https://cve.now/CVE-2018-12056.md): The maxRandom function of a smart contract implementation for All For One, an Ethereum gambling game, generates a random value with… (no CVSS)
- [CVE-2018-15138](https://cve.now/CVE-2018-15138.md): Ericsson-LG iPECS NMS 30M allows directory traversal via ipecs-cm/download?filename=../ URIs. (no CVSS)
- [CVE-2018-15146](https://cve.now/CVE-2018-15146.md): SQL injection vulnerability in interface/de\_identification\_forms/find\_immunization\_popup.php in versions of OpenEMR before 5.0.1.4 allows… (no CVSS)
- [CVE-2018-15147](https://cve.now/CVE-2018-15147.md): SQL injection vulnerability in interface/forms\_admin/forms\_admin.php from library/registry.inc in versions of OpenEMR before 5.0.1.4… (no CVSS)
- [CVE-2018-15148](https://cve.now/CVE-2018-15148.md): SQL injection vulnerability in interface/patient\_file/encounter/search\_code.php in versions of OpenEMR before 5.0.1.4 allows a remote… (no CVSS)
- [CVE-2018-15149](https://cve.now/CVE-2018-15149.md): SQL injection vulnerability in interface/forms/eye\_mag/php/Anything\_simple.php from library/forms.inc in versions of OpenEMR before… (no CVSS)
- [CVE-2018-15150](https://cve.now/CVE-2018-15150.md): SQL injection vulnerability in interface/de\_identification\_forms/de\_identification\_screen2.php in versions of OpenEMR before 5.0.1.4… (no CVSS)
- [CVE-2018-15151](https://cve.now/CVE-2018-15151.md): SQL injection vulnerability in interface/de\_identification\_forms/find\_code\_popup.php in versions of OpenEMR before 5.0.1.4 allows a remote… (no CVSS)
- [CVE-2018-15152](https://cve.now/CVE-2018-15152.md): Authentication bypass vulnerability in portal/account/register.php in versions of OpenEMR before 5.0.1.4 allows a remote attacker to… (no CVSS)
- [CVE-2018-15153](https://cve.now/CVE-2018-15153.md): OS command injection occurring in versions of OpenEMR before 5.0.1.4 allows a remote authenticated attacker to execute arbitrary commands… (no CVSS)
- [CVE-2018-15154](https://cve.now/CVE-2018-15154.md): OS command injection occurring in versions of OpenEMR before 5.0.1.4 allows a remote authenticated attacker to execute arbitrary commands… (no CVSS)
- [CVE-2018-15155](https://cve.now/CVE-2018-15155.md): OS command injection occurring in versions of OpenEMR before 5.0.1.4 allows a remote authenticated attacker to execute arbitrary commands… (no CVSS)
- [CVE-2018-15156](https://cve.now/CVE-2018-15156.md): OS command injection occurring in versions of OpenEMR before 5.0.1.4 allows a remote authenticated attacker to execute arbitrary commands… (no CVSS)
- [CVE-2018-15172](https://cve.now/CVE-2018-15172.md): TP-Link WR840N devices have a buffer overflow via a long Authorization HTTP header. (no CVSS)
- [CVE-2018-8200](https://cve.now/CVE-2018-8200.md): A security feature bypass vulnerability exists in Device Guard that could allow an attacker to inject malicious code into a Windows… (no CVSS, Microsoft Windows Server · Microsoft Windows)
- [CVE-2018-8204](https://cve.now/CVE-2018-8204.md): A security feature bypass vulnerability exists in Device Guard that could allow an attacker to inject malicious code into a Windows… (no CVSS, Microsoft Windows Server · Microsoft Windows)
- [CVE-2018-8253](https://cve.now/CVE-2018-8253.md): An elevation of privilege vulnerability exists when Microsoft Cortana allows arbitrary website browsing on the lockscreen, aka "Microsoft… (no CVSS, Microsoft Windows Server · Microsoft Windows)
- [CVE-2018-8266](https://cve.now/CVE-2018-8266.md): A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka… (no CVSS, Microsoft Edge · Microsoft ChakraCore +1)
- [CVE-2018-8273](https://cve.now/CVE-2018-8273.md): A buffer overflow vulnerability exists in the Microsoft SQL Server that could allow remote code execution on an affected system, aka… (no CVSS, Microsoft SQL Server)
- [CVE-2018-8302](https://cve.now/CVE-2018-8302.md): A remote code execution vulnerability exists in Microsoft Exchange software when the software fails to properly handle objects in memory… (no CVSS, Microsoft Exchange Server)
- [CVE-2018-8316](https://cve.now/CVE-2018-8316.md): A remote code execution vulnerability exists when Internet Explorer improperly validates hyperlinks before loading executable libraries… (no CVSS, Microsoft Internet Explorer)
- [CVE-2018-8339](https://cve.now/CVE-2018-8339.md): An elevation of privilege vulnerability exists in the Windows Installer when the Windows Installer fails to properly sanitize input… (no CVSS, Microsoft Windows)
- [CVE-2018-8340](https://cve.now/CVE-2018-8340.md): A security feature bypass vulnerability exists when Active Directory Federation Services (AD FS) improperly handles multi-factor… (no CVSS, Microsoft Windows Server · Microsoft Windows 10 Servers)
- [CVE-2018-8341](https://cve.now/CVE-2018-8341.md): An information disclosure vulnerability exists when the Windows kernel improperly handles objects in memory, aka "Windows Kernel… (no CVSS, Microsoft Windows)
- [CVE-2018-8342](https://cve.now/CVE-2018-8342.md): An elevation of privilege vulnerability exists in the Network Driver Interface Specification (NDIS) when ndis.sys fails to check the… (no CVSS, Microsoft Windows)
- [CVE-2018-8343](https://cve.now/CVE-2018-8343.md): An elevation of privilege vulnerability exists in the Network Driver Interface Specification (NDIS) when ndis.sys fails to check the… (no CVSS, Microsoft Windows)
- [CVE-2018-8344](https://cve.now/CVE-2018-8344.md): A remote code execution vulnerability exists when the Windows font library improperly handles specially crafted embedded fonts, aka… (no CVSS, Microsoft Windows)
- [CVE-2018-8345](https://cve.now/CVE-2018-8345.md): A remote code execution vulnerability exists in Microsoft Windows that could allow remote code execution if a .LNK file is processed, aka… (no CVSS, Microsoft Windows)
- [CVE-2018-8346](https://cve.now/CVE-2018-8346.md): A remote code execution vulnerability exists in Microsoft Windows that could allow remote code execution if a .LNK file is processed, aka… (no CVSS, Microsoft Windows Server · Microsoft Windows)
- [CVE-2018-8347](https://cve.now/CVE-2018-8347.md): An elevation of privilege vulnerability exists in Microsoft Windows when the Windows kernel fails to properly handle parsing of certain… (no CVSS, Microsoft Windows Server · Microsoft Windows)
- [CVE-2018-8348](https://cve.now/CVE-2018-8348.md): An information disclosure vulnerability exists when the Windows kernel improperly handles objects in memory, aka "Windows Kernel… (no CVSS, Microsoft Windows)
- [CVE-2018-8349](https://cve.now/CVE-2018-8349.md): A remote code execution vulnerability exists in "Microsoft COM for Windows" when it fails to properly handle serialized objects, aka… (no CVSS, Microsoft Windows)
- [CVE-2018-8350](https://cve.now/CVE-2018-8350.md): A remote code execution vulnerability exists when Microsoft Windows PDF Library improperly handles objects in memory, aka "Windows PDF… (no CVSS, Microsoft Windows 10 Servers · Microsoft Windows)
- [CVE-2018-8351](https://cve.now/CVE-2018-8351.md): An information disclosure vulnerability exists when affected Microsoft browsers improperly allow cross-frame interaction, aka "Microsoft… (no CVSS, Microsoft Internet Explorer · Microsoft Edge)
- [CVE-2018-8353](https://cve.now/CVE-2018-8353.md): A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Internet Explorer, aka… (no CVSS)
- [CVE-2018-8355](https://cve.now/CVE-2018-8355.md): A remote code execution vulnerability exists in the way the scripting engine handles objects in memory in Microsoft browsers, aka… (no CVSS, Microsoft ChakraCore · Microsoft Internet Explorer +2)
- [CVE-2018-8357](https://cve.now/CVE-2018-8357.md): An elevation of privilege vulnerability exists in Microsoft browsers allowing sandbox escape, aka "Microsoft Browser Elevation of… (no CVSS, Microsoft Internet Explorer · Microsoft Edge)
- [CVE-2018-8358](https://cve.now/CVE-2018-8358.md): A security feature bypass vulnerability exists when Microsoft Edge improperly handles redirect requests, aka "Microsoft Edge Security… (no CVSS, Microsoft Edge)
- [CVE-2018-8359](https://cve.now/CVE-2018-8359.md): A remote code execution vulnerability exists in the way that the ChakraCore scripting engine handles objects in memory, aka "Scripting… (no CVSS, Microsoft ChakraCore · Microsoft.ChakraCore)
- [CVE-2018-8360](https://cve.now/CVE-2018-8360.md): An information disclosure vulnerability exists in Microsoft .NET Framework that could allow an attacker to access information in… (no CVSS, Microsoft .NET Framework)
- [CVE-2018-8370](https://cve.now/CVE-2018-8370.md): A information disclosure vulnerability exists when WebAudio Library improperly handles audio requests, aka "Microsoft Edge Information… (no CVSS, Microsoft Edge)
- [CVE-2018-8371](https://cve.now/CVE-2018-8371.md): A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Internet Explorer, aka… (no CVSS, Microsoft Internet Explorer · Microsoft.ChakraCore)
- [CVE-2018-8372](https://cve.now/CVE-2018-8372.md): A remote code execution vulnerability exists in the way the scripting engine handles objects in memory in Microsoft browsers, aka… (no CVSS, Microsoft ChakraCore · Microsoft Internet Explorer +2)
- [CVE-2018-8373](https://cve.now/CVE-2018-8373.md): A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Internet Explorer, aka "Scrip (CVSS 7.5, KEV, Microsoft Internet Explorer)
- [CVE-2018-8374](https://cve.now/CVE-2018-8374.md): A tampering vulnerability exists when Microsoft Exchange Server fails to properly handle profile data, aka "Microsoft Exchange Server… (no CVSS, Microsoft Exchange Server)
- [CVE-2018-8375](https://cve.now/CVE-2018-8375.md): A remote code execution vulnerability exists in Microsoft Excel software when the software fails to properly handle objects in memory, aka… (no CVSS, Microsoft Excel Viewer · Microsoft Office +1)
- [CVE-2018-8376](https://cve.now/CVE-2018-8376.md): A remote code execution vulnerability exists in Microsoft PowerPoint software when the software fails to properly handle objects in… (no CVSS, Microsoft PowerPoint)
- [CVE-2018-8377](https://cve.now/CVE-2018-8377.md): A remote code execution vulnerability exists when Microsoft Edge improperly accesses objects in memory, aka "Microsoft Edge Memory… (no CVSS, Microsoft Edge)
- [CVE-2018-8378](https://cve.now/CVE-2018-8378.md): An information disclosure vulnerability exists when Microsoft Office software reads out of bound memory due to an uninitialized variable… (no CVSS, Microsoft Word · Microsoft SharePoint Server +4)
- [CVE-2018-8379](https://cve.now/CVE-2018-8379.md): A remote code execution vulnerability exists in Microsoft Excel software when the software fails to properly handle objects in memory, aka… (no CVSS, Microsoft Excel)
- [CVE-2018-8380](https://cve.now/CVE-2018-8380.md): A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka… (no CVSS, Microsoft Edge · Microsoft ChakraCore +1)
- [CVE-2018-8381](https://cve.now/CVE-2018-8381.md): A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka… (no CVSS, Microsoft Edge · Microsoft ChakraCore +1)
- [CVE-2018-8382](https://cve.now/CVE-2018-8382.md): An information disclosure vulnerability exists when Microsoft Excel improperly discloses the contents of its memory, aka "Microsoft Excel… (no CVSS, Microsoft Excel Viewer · Microsoft Office +1)
- [CVE-2018-8383](https://cve.now/CVE-2018-8383.md): A spoofing vulnerability exists when Microsoft Edge does not properly parse HTTP content, aka "Microsoft Edge Spoofing Vulnerability."… (no CVSS, Microsoft Edge)
- [CVE-2018-8384](https://cve.now/CVE-2018-8384.md): A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka… (no CVSS, Microsoft ChakraCore · Microsoft.ChakraCore)
- [CVE-2018-8385](https://cve.now/CVE-2018-8385.md): A remote code execution vulnerability exists in the way the scripting engine handles objects in memory in Microsoft browsers, aka… (no CVSS, Microsoft Internet Explorer · Microsoft ChakraCore +2)
- [CVE-2018-8387](https://cve.now/CVE-2018-8387.md): A remote code execution vulnerability exists when Microsoft Edge improperly accesses objects in memory, aka "Microsoft Edge Memory… (no CVSS, Microsoft Edge)
- [CVE-2018-8388](https://cve.now/CVE-2018-8388.md): A spoofing vulnerability exists when Microsoft Edge improperly handles specific HTML content, aka "Microsoft Edge Spoofing Vulnerability."… (no CVSS, Microsoft Edge)
- [CVE-2018-8389](https://cve.now/CVE-2018-8389.md): A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Internet Explorer, aka… (no CVSS, Microsoft Internet Explorer)
- [CVE-2018-8390](https://cve.now/CVE-2018-8390.md): A remote code execution vulnerability exists in the way that the ChakraCore scripting engine handles objects in memory, aka "Scripting… (no CVSS, Microsoft Edge · Microsoft ChakraCore +1)
- [CVE-2018-8394](https://cve.now/CVE-2018-8394.md): An information disclosure vulnerability exists when the Windows GDI component improperly discloses the contents of its memory, aka… (no CVSS, Microsoft Windows)
- [CVE-2018-8396](https://cve.now/CVE-2018-8396.md): An information disclosure vulnerability exists when the Windows GDI component improperly discloses the contents of its memory, aka… (no CVSS, Microsoft Windows Server · Microsoft Windows)
- [CVE-2018-8397](https://cve.now/CVE-2018-8397.md): A remote code execution vulnerability exists in the way that the Windows Graphics Device Interface (GDI) handles objects in the memory… (no CVSS, Microsoft Windows Server · Microsoft Windows)
- [CVE-2018-8398](https://cve.now/CVE-2018-8398.md): An information disclosure vulnerability exists when the Windows GDI component improperly discloses the contents of its memory, aka… (no CVSS, Microsoft Windows)
- [CVE-2018-8399](https://cve.now/CVE-2018-8399.md): An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in memory, aka… (no CVSS, Microsoft Windows 10 Servers · Microsoft Windows)
- [CVE-2018-8400](https://cve.now/CVE-2018-8400.md): An elevation of privilege vulnerability exists when the DirectX Graphics Kernel (DXGKRNL) driver improperly handles objects in memory, aka… (no CVSS, Microsoft Windows 10 Servers · Microsoft Windows)
- [CVE-2018-8401](https://cve.now/CVE-2018-8401.md): An elevation of privilege vulnerability exists when the DirectX Graphics Kernel (DXGKRNL) driver improperly handles objects in memory, aka… (no CVSS, Microsoft Windows Server · Microsoft Windows)
- [CVE-2018-8403](https://cve.now/CVE-2018-8403.md): A remote code execution vulnerability exists in the way that Microsoft browsers access objects in memory, aka "Microsoft Browser Memory… (no CVSS, Microsoft Internet Explorer · Microsoft Edge)
- [CVE-2018-8404](https://cve.now/CVE-2018-8404.md): An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in memory, aka… (no CVSS, Microsoft Windows)
- [CVE-2018-8405](https://cve.now/CVE-2018-8405.md): An elevation of privilege vulnerability exists when the DirectX Graphics Kernel (DXGKRNL) driver improperly handles objects in memory, aka " (CVSS 7.8, KEV, Microsoft Windows Server 2012 R2 · Microsoft Windows RT +2)
- [CVE-2018-8406](https://cve.now/CVE-2018-8406.md): An elevation of privilege vulnerability exists when the DirectX Graphics Kernel (DXGKRNL) driver improperly handles objects in memory, aka " (CVSS 7.8, KEV, Microsoft Windows Server · Microsoft Windows)
- [CVE-2018-8412](https://cve.now/CVE-2018-8412.md): An elevation of privilege vulnerability exists when the Microsoft AutoUpdate (MAU) application for Mac improperly validates updates before… (no CVSS, Microsoft Office)
- [CVE-2018-8414](https://cve.now/CVE-2018-8414.md): A remote code execution vulnerability exists when the Windows Shell does not properly validate file paths, aka "Windows Shell Remote Code Ex (CVSS 8.8, KEV, Microsoft Windows 10 Servers · Microsoft Windows)
- [CVE-2018-1455](https://cve.now/CVE-2018-1455.md): IBM Tivoli Application Dependency Discovery Manager 7.2.2 and 7.3 is vulnerable to cross-site request forgery which could allow an… (CVSS 4.3, IBM Tivoli Application Dependency Discovery Manager)
- [CVE-2018-13393](https://cve.now/CVE-2018-13393.md): The convertCommentToAnswer resource in Atlassian Confluence Questions before version 2.6.6, the bundled version of Confluence Questions… (no CVSS, Atlassian Confluence Questions)
- [CVE-2018-13394](https://cve.now/CVE-2018-13394.md): The acceptAnswer resource in Atlassian Confluence Questions before version 2.6.6, the bundled version of Confluence Questions was updated… (no CVSS, Atlassian Confluence Questions)
- [CVE-2018-6973](https://cve.now/CVE-2018-6973.md): VMware Workstation (14.x before 14.1.3) and Fusion (10.x before 10.1.3) contain an out-of-bounds write vulnerability in the e1000 device. (no CVSS, VMware Workstation · VMware Fusion)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/archive/2018-08-15
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.