# CVEs published 2018-09-04

52 CVEs were published on September 4, 2018: 0 critical, 7 high. Days are UTC.

- [CVE-2018-6554](https://cve.now/CVE-2018-6554.md): Memory leak in the irda\_bind function in net/irda/af\_irda.c and later in drivers/staging/irda/net/af\_irda.c in the Linux kernel before… (no CVSS, Linux Kernel)
- [CVE-2018-6555](https://cve.now/CVE-2018-6555.md): The irda\_setsockopt function in net/irda/af\_irda.c and later in drivers/staging/irda/net/af\_irda.c in the Linux kernel before 4.17 allows… (no CVSS, Linux Kernel)
- [CVE-2018-6923](https://cve.now/CVE-2018-6923.md): In FreeBSD before 11.1-STABLE, 11.2-RELEASE-p2, 11.1-RELEASE-p13, ip fragment reassembly code is vulnerable to a denial of service due to… (no CVSS, FreeBSD)
- [CVE-2018-10929](https://cve.now/CVE-2018-10929.md): A flaw was found in RPC request using gfs2\_create\_req in glusterfs server. (CVSS 8.8, Red Hat glusterfs)
- [CVE-2018-10930](https://cve.now/CVE-2018-10930.md): A flaw was found in RPC request using gfs3\_rename\_req in glusterfs server. (CVSS 6.5, Red Hat glusterfs)
- [CVE-2018-11262](https://cve.now/CVE-2018-11262.md): In Android for MSM, Firefox OS for MSM, and QRD Android with all Android releases from CAF using the Linux kernel while trying to find out… (no CVSS, Qualcomm Android for MSM, Firefox OS for MSM, QRD Android)
- [CVE-2018-7936](https://cve.now/CVE-2018-7936.md): Mate 10 Pro Huawei smart phones with the versions before BLA-L29 8.0.0.148(C432) have a Factory Reset Protection (FRP) bypass security… (no CVSS, Huawei Technologies Co. Mate 10 Pro)
- [CVE-2018-7937](https://cve.now/CVE-2018-7937.md): In Huawei HiRouter-CD20-10 with the versions before 1.9.6 and WS5200-10 with the versions before 1.9.6, there is a plug-in signature… (no CVSS, Huawei Technologies Co. HiRouter-CD20, WS5200-10)
- [CVE-2018-7938](https://cve.now/CVE-2018-7938.md): P10 Huawei smartphones with the versions before Victoria-AL00AC00B217 have an information leak vulnerability due to the lack of permission… (no CVSS, Huawei Technologies Co. P10)
- [CVE-2018-7990](https://cve.now/CVE-2018-7990.md): Mate10 Pro Huawei smart phones with the versions before 8.1.0.326(C00) have a FRP bypass vulnerability. (no CVSS, Huawei Technologies Co. Mate10 Pro)
- [CVE-2018-10924](https://cve.now/CVE-2018-10924.md): It was discovered that fsync(2) system call in glusterfs client code leaks memory. (CVSS 5.3, Red Hat glusterfs)
- [CVE-2018-10926](https://cve.now/CVE-2018-10926.md): A flaw was found in RPC request using gfs3\_mknod\_req supported by glusterfs server. (CVSS 8.1, Red Hat glusterfs)
- [CVE-2018-10927](https://cve.now/CVE-2018-10927.md): A flaw was found in RPC request using gfs3\_lookup\_req in glusterfs server. (CVSS 7.1, Red Hat glusterfs)
- [CVE-2018-10928](https://cve.now/CVE-2018-10928.md): A flaw was found in RPC request using gfs3\_symlink\_req in glusterfs server which allows symlink destinations to point to file paths… (CVSS 8.8, Red Hat glusterfs)
- [CVE-2018-10911](https://cve.now/CVE-2018-10911.md): A flaw was found in the way dic\_unserialize function of glusterfs does not handle negative key length values. (CVSS 6.5, Red Hat glusterfs:)
- [CVE-2018-10913](https://cve.now/CVE-2018-10913.md): An information disclosure vulnerability was discovered in glusterfs server. (CVSS 3.5, Red Hat glusterfs)
- [CVE-2018-10914](https://cve.now/CVE-2018-10914.md): It was found that an attacker could issue a xattr request via glusterfs FUSE to cause gluster brick process to crash which will result in… (CVSS 5.5, Red Hat glusterfs)
- [CVE-2018-10923](https://cve.now/CVE-2018-10923.md): It was found that the "mknod" call derived from mknod(2) can create files pointing to devices on a glusterfs server node. (CVSS 7.6, Red Hat glusterfs)
- [CVE-2018-0646](https://cve.now/CVE-2018-0646.md): Directory traversal vulnerability in Explzh v.7.58 and earlier allows an attacker to read arbitrary files via unspecified vectors. (no CVSS, pon software Explzh)
- [CVE-2018-0656](https://cve.now/CVE-2018-0656.md): Untrusted search path vulnerability in The installer of Digital Paper App version 1.4.0.16050 and earlier allows an attacker to gain… (no CVSS, Sony The installer of Digital Paper App)
- [CVE-2018-0664](https://cve.now/CVE-2018-0664.md): A vulnerability in NoMachine App for Android 5.0.63 and earlier allows attackers to alter environment variables via unspecified vectors. (no CVSS, NoMachine S.a r.l. NoMachine App for Android)
- [CVE-2018-0672](https://cve.now/CVE-2018-0672.md): Cross-site scripting vulnerability in Movable Type versions prior to Ver. (no CVSS, Six Apart Movable Type)
- [CVE-2018-0674](https://cve.now/CVE-2018-0674.md): AttacheCase ver.2.8.4.0 and earlier allows an arbitrary script execution via unspecified vectors. (no CVSS, HiBARA Software AttacheCase)
- [CVE-2018-0675](https://cve.now/CVE-2018-0675.md): AttacheCase ver.3.3.0.0 and earlier allows an arbitrary script execution via unspecified vectors. (no CVSS, HiBARA Software AttacheCase)
- [CVE-2018-10904](https://cve.now/CVE-2018-10904.md): It was found that glusterfs server does not properly sanitize file paths in the "trusted.io-stats-dump" extended attribute which is used… (CVSS 8.8, Red Hat glusterfs)
- [CVE-2018-10907](https://cve.now/CVE-2018-10907.md): It was found that glusterfs server is vulnerable to multiple stack based buffer overflows due to functions in server-rpc-fopc.c allocating… (CVSS 8.8, Red Hat glusterfs)
- [CVE-2018-14627](https://cve.now/CVE-2018-14627.md): The IIOP OpenJDK Subsystem in WildFly before version 14.0.0 does not honour configuration when SSL transport is required. (CVSS 5.3, \[UNKNOWN\] JBoss/WildFly)
- [CVE-2018-16458](https://cve.now/CVE-2018-16458.md): An issue was discovered in baigo CMS v2.1.1. (no CVSS)
- [CVE-2018-16444](https://cve.now/CVE-2018-16444.md): An issue was discovered in SeaCMS 6.61. (no CVSS)
- [CVE-2018-16445](https://cve.now/CVE-2018-16445.md): An issue was discovered in SeaCMS through 6.61. (no CVSS)
- [CVE-2018-16446](https://cve.now/CVE-2018-16446.md): An issue was discovered in SeaCMS through 6.61. (no CVSS)
- [CVE-2018-16447](https://cve.now/CVE-2018-16447.md): Frog CMS 0.9.5 has admin/?/user/edit/1 CSRF. (no CVSS)
- [CVE-2018-16448](https://cve.now/CVE-2018-16448.md): Cscms 4 allows CSRF for creating a member via upload/admin.php/user/save, authenticating vip members via upload/admin.php/user/init/tid… (no CVSS)
- [CVE-2018-16449](https://cve.now/CVE-2018-16449.md): OneThink 1.1.141212 allows CSRF for adding a page via admin.php?s=/Channel/add.html, adding a blog via admin.php?s=/Article/update.html… (no CVSS)
- [CVE-2018-16450](https://cve.now/CVE-2018-16450.md): CraftedWeb through 2013-09-24 has reflected XSS via the p parameter. (no CVSS)
- [CVE-2018-16418](https://cve.now/CVE-2018-16418.md): A buffer overflow when handling string concatenation in util\_acl\_to\_str in tools/util.c in OpenSC before 0.19.0-rc1 could be used by… (no CVSS)
- [CVE-2018-16419](https://cve.now/CVE-2018-16419.md): Several buffer overflows when handling responses from a Cryptoflex card in read\_public\_key in tools/cryptoflex-tool.c in OpenSC before… (no CVSS)
- [CVE-2018-16420](https://cve.now/CVE-2018-16420.md): Several buffer overflows when handling responses from an ePass 2003 Card in decrypt\_response in libopensc/card-epass2003.c in OpenSC… (no CVSS)
- [CVE-2018-16421](https://cve.now/CVE-2018-16421.md): Several buffer overflows when handling responses from a CAC Card in cac\_get\_serial\_nr\_from\_CUID in libopensc/card-cac.c in OpenSC before… (no CVSS)
- [CVE-2018-16422](https://cve.now/CVE-2018-16422.md): A single byte buffer overflow when handling responses from an esteid Card in sc\_pkcs15emu\_esteid\_init in libopensc/pkcs15-esteid.c in… (no CVSS)
- [CVE-2018-16423](https://cve.now/CVE-2018-16423.md): A double free when handling responses from a smartcard in sc\_file\_set\_sec\_attr in libopensc/sc.c in OpenSC before 0.19.0-rc1 could be used… (no CVSS)
- [CVE-2018-16424](https://cve.now/CVE-2018-16424.md): A double free when handling responses in read\_file in tools/egk-tool.c (aka the eGK card tool) in OpenSC before 0.19.0-rc1 could be used… (no CVSS)
- [CVE-2018-16425](https://cve.now/CVE-2018-16425.md): A double free when handling responses from an HSM Card in sc\_pkcs15emu\_sc\_hsm\_init in libopensc/pkcs15-sc-hsm.c in OpenSC before… (no CVSS)
- [CVE-2018-16426](https://cve.now/CVE-2018-16426.md): Endless recursion when handling responses from an IAS-ECC card in iasecc\_select\_file in libopensc/card-iasecc.c in OpenSC before… (no CVSS)
- [CVE-2018-16427](https://cve.now/CVE-2018-16427.md): Various out of bounds reads when handling responses in OpenSC before 0.19.0-rc1 could be used by attackers able to supply crafted… (no CVSS)
- [CVE-2018-16428](https://cve.now/CVE-2018-16428.md): In GNOME GLib 2.56.1, g\_markup\_parse\_context\_end\_parse() in gmarkup.c has a NULL pointer dereference. (no CVSS)
- [CVE-2018-16429](https://cve.now/CVE-2018-16429.md): GNOME GLib 2.56.1 has an out-of-bounds read vulnerability in g\_markup\_parse\_context\_parse() in gmarkup.c, related to utf8\_str(). (no CVSS)
- [CVE-2018-16430](https://cve.now/CVE-2018-16430.md): GNU Libextractor through 1.7 has an out-of-bounds read vulnerability in EXTRACTOR\_zip\_extract\_method() in zip\_extractor.c. (no CVSS)
- [CVE-2018-16431](https://cve.now/CVE-2018-16431.md): admin/admin/adminsave.html in YFCMF v3.0 allows CSRF to add an administrator account. (no CVSS)
- [CVE-2018-16432](https://cve.now/CVE-2018-16432.md): BlueCMS 1.6 allows SQL Injection via the user\_name parameter to uploads/user.php?act=index\_login. (no CVSS)
- [CVE-2018-16435](https://cve.now/CVE-2018-16435.md): Little CMS (aka Little Color Management System) 2.9 has an integer overflow in the AllocateDataSet function in cmscgats.c, leading to a… (no CVSS)
- [CVE-2018-16438](https://cve.now/CVE-2018-16438.md): An issue was discovered in the HDF HDF5 1.8.20 library. (no CVSS)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/archive/2018-09-04
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.