# CVEs published 2018-08-22

25 CVEs were published on August 22, 2018: 0 critical, 4 high. 1 is now in CISA KEV. Days are UTC.

- [CVE-2016-9605](https://cve.now/CVE-2016-9605.md): A flaw was found in cobbler software component version 2.6.11-1. (CVSS 6.1, The cobbler Project cobbler · cobbler)
- [CVE-2017-2575](https://cve.now/CVE-2017-2575.md): A vulnerability was found while fuzzing libbpg 0.9.7. (no CVSS, Fabrice Bellard libbpg)
- [CVE-2017-2635](https://cve.now/CVE-2017-2635.md): A NULL pointer deference flaw was found in the way libvirt from 2.5.0 to 3.0.0 handled empty drives. (CVSS 7.7, The libvirt Project libvirt)
- [CVE-2018-11758](https://cve.now/CVE-2018-11758.md): This affects Apache Cayenne 4.1.M1, 3.2.M1, 4.0.M2 to 4.0.M5, 4.0.B1, 4.0.B2, 4.0.RC1, 3.1, 3.1.1, 3.1.2. (no CVSS, Apache Software Foundation Apache Cayenne · org.apache.caye…)
- [CVE-2018-14787](https://cve.now/CVE-2018-14787.md): In Philips' IntelliSpace Cardiovascular (ISCV) products (ISCV Version 2.x or prior and Xcelera Version 4.1 or prior), an attacker with… (no CVSS, Philips IntelliSpace Cardiovascular (ISCV) products)
- [CVE-2018-14789](https://cve.now/CVE-2018-14789.md): In Philips' IntelliSpace Cardiovascular (ISCV) products (ISCV Version 3.1 or prior and Xcelera Version 4.1 or prior), an unquoted search… (no CVSS, Philips IntelliSpace Cardiovascular (ISCV) products)
- [CVE-2018-14799](https://cve.now/CVE-2018-14799.md): In Philips PageWriter TC10, TC20, TC30, TC50, TC70 Cardiographs, all versions prior to May 2018, the PageWriter device does not sanitize… (no CVSS, Philips PageWriter TC10, TC20, TC30, TC50, TC70 Cardiographs)
- [CVE-2018-14801](https://cve.now/CVE-2018-14801.md): In Philips PageWriter TC10, TC20, TC30, TC50, TC70 Cardiographs, all versions prior to May 2018, an attacker with both the superuser… (no CVSS, Philips PageWriter TC10, TC20, TC30, TC50, TC70 Cardiographs)
- [CVE-2017-2627](https://cve.now/CVE-2017-2627.md): A flaw was found in openstack-tripleo-common as shipped with Red Hat Openstack Enterprise 10 and 11. (CVSS 8.2, Red Hat openstack-tripleo-common)
- [CVE-2018-10858](https://cve.now/CVE-2018-10858.md): A heap-buffer overflow was found in the way samba clients processed extra long filename in a directory listing. (CVSS 4.3, The Samba Team samba)
- [CVE-2018-10918](https://cve.now/CVE-2018-10918.md): A null pointer dereference flaw was found in the way samba checked database outputs from the LDB database layer. (CVSS 5.2, The Samba Team samba)
- [CVE-2018-10919](https://cve.now/CVE-2018-10919.md): The Samba Active Directory LDAP server was vulnerable to an information disclosure flaw because of missing access control checks. (CVSS 4.3, The Samba Team samba)
- [CVE-2018-5235](https://cve.now/CVE-2018-5235.md): Norton Utilities (prior to 16.0.3.44) may be susceptible to a DLL Preloading vulnerability, which is a type of issue that can occur when… (no CVSS, Symantec Norton Utilities)
- [CVE-2018-5238](https://cve.now/CVE-2018-5238.md): Norton Power Eraser (prior to 5.3.0.24) and SymDiag (prior to 2.1.242) may be susceptible to a DLL Preloading vulnerability, which is a… (no CVSS, Symantec Norton Power Eraser · Symantec SymDiag)
- [CVE-2017-2662](https://cve.now/CVE-2017-2662.md): A flaw was found in Foreman's katello plugin version 3.4.5. (CVSS 4.3, The Foreman Project foreman katello plugin · katello)
- [CVE-2017-7528](https://cve.now/CVE-2017-7528.md): Ansible Tower as shipped with Red Hat CloudForms Management Engine 5 is vulnerable to CRLF Injection. (CVSS 5.2, Red Hat Ansible Tower)
- [CVE-2017-7513](https://cve.now/CVE-2017-7513.md): It was found that Satellite 5 configured with SSL/TLS for the PostgreSQL backend failed to correctly validate X.509 server certificate… (CVSS 5.4, Red Hat Satellite)
- [CVE-2018-10884](https://cve.now/CVE-2018-10884.md): Ansible Tower before versions 3.1.8 and 3.2.6 is vulnerable to cross-site request forgery (CSRF) in awx/api/authentication.py. (CVSS 8.8, Red Hat ansible-tower)
- [CVE-2018-1139](https://cve.now/CVE-2018-1139.md): A flaw was found in the way samba before 4.7.9 and 4.8.4 allowed the use of weak NTLMv1 authentication even when NTLMv1 was explicitly… (CVSS 5.4, The Samba Team samba)
- [CVE-2018-1140](https://cve.now/CVE-2018-1140.md): A missing input sanitization flaw was found in the implementation of LDP database used for the LDAP server. (CVSS 6.5, The Samba Team samba)
- [CVE-2018-10844](https://cve.now/CVE-2018-10844.md): It was found that the GnuTLS implementation of HMAC-SHA-256 was vulnerable to a Lucky thirteen style attack. (CVSS 5.9, \[UNKNOWN\] gnutls)
- [CVE-2018-10845](https://cve.now/CVE-2018-10845.md): It was found that the GnuTLS implementation of HMAC-SHA-384 was vulnerable to a Lucky thirteen style attack. (CVSS 5.9, \[UNKNOWN\] gnutls)
- [CVE-2018-10846](https://cve.now/CVE-2018-10846.md): A cache-based side channel in GnuTLS implementation that leads to plain text recovery in cross-VM attack setting was found. (CVSS 5.3, \[UNKNOWN\] gnutls)
- [CVE-2018-11776](https://cve.now/CVE-2018-11776.md): Apache Struts versions 2.3 to 2.3.34 and 2.5 to 2.5.16 suffer from possible Remote Code Execution when alwaysSelectFullNamespace is true (ei (CVSS 8.1, KEV, Apache Software Foundation Apache Struts · org.apache.strut…)
- [CVE-2018-1599](https://cve.now/CVE-2018-1599.md): IBM API Connect 5.0.0.0 through 5.0.8.3 could allow a remote attacker to hijack the clicking action of the victim. (CVSS 5.4, IBM API Connect)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/archive/2018-08-22
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.