# CVEs published 2018-09-18 78 CVEs were published on September 18, 2018: 0 critical, 1 high. Days are UTC. - [CVE-2017-3912](https://cve.now/CVE-2017-3912.md): McAfee Application Control and Change Control (MACC) - password management security feature bypass (SFB) leading to an authentication bypass (CVSS 4.4, McAfee Application Control and Change Control) - [CVE-2018-6690](https://cve.now/CVE-2018-6690.md): McAfee Application Control (MAC) - Whitelist bypass using a hard drive solidified by MACC (CVSS 6.1, McAfee Application Control) - [CVE-2018-6693](https://cve.now/CVE-2018-6693.md): Endpoint Security for Linux Threat Prevention (ENSLTP) privilege escalation vulnerability (CVSS 5.6, McAfee Endpoint Security for Linux Threat Prevention) - [CVE-2018-11071](https://cve.now/CVE-2018-11071.md): DSA-2018-147: Dell EMC Isilon OneFS and IsilonSD Edge Remote Process Crash Vulnerability (CVSS 7.5, Dell EMC Isilon OneFS · Dell EMC IsilonSD Edge) - [CVE-2018-11084](https://cve.now/CVE-2018-11084.md): Garden-runC prevents deletion of some app environments (CVSS 6.8, Cloud Foundry Garden-runC) - [CVE-2018-13982](https://cve.now/CVE-2018-13982.md): Smarty\_Security::isTrustedResourceDir() in Smarty before 3.1.33 is prone to a path traversal vulnerability due to insufficient template… (no CVSS, smarty/smarty) - [CVE-2018-15546](https://cve.now/CVE-2018-15546.md): Accusoft PrizmDoc version 13.3 and earlier contains a Stored Cross-Site Scripting issue through a crafted PDF file. (no CVSS) - [CVE-2018-16225](https://cve.now/CVE-2018-16225.md): The QBee MultiSensor Camera through 4.16.4 accepts unencrypted network traffic from clients (such as the QBee Cam application through… (no CVSS) - [CVE-2018-16515](https://cve.now/CVE-2018-16515.md): Matrix Synapse before 0.33.3.1 allows remote attackers to spoof events and possibly have unspecified other impacts by leveraging improper… (no CVSS, matrix-synapse) - [CVE-2018-16794](https://cve.now/CVE-2018-16794.md): Microsoft ADFS 4.0 Windows Server 2016 and previous (Active Directory Federation Services) has an SSRF vulnerability via the txtBoxEmail… (no CVSS) - [CVE-2018-16819](https://cve.now/CVE-2018-16819.md): admin/index.php in Monstra CMS 3.0.4 allows arbitrary file deletion via id=filesmanager&path=uploads/.......//./.......//./&delete\_file=… (no CVSS) - [CVE-2018-16820](https://cve.now/CVE-2018-16820.md): admin/index.php in Monstra CMS 3.0.4 allows arbitrary directory listing via id=filesmanager&path=uploads/.......//./.......//./ requests. (no CVSS) - [CVE-2018-17071](https://cve.now/CVE-2018-17071.md): The fallback function of a simple lottery smart contract implementation for Lucky9io, an Ethereum gambling game, generates a random value… (no CVSS) - [CVE-2018-17111](https://cve.now/CVE-2018-17111.md): The onlyOwner modifier of a smart contract implementation for Coinlancer (CL), an Ethereum ERC20 token, has a potential access control… (no CVSS) - [CVE-2017-6913](https://cve.now/CVE-2017-6913.md): Cross-site scripting (XSS) vulnerability in the Open-Xchange webmail before 7.6.3-rev28 allows remote attackers to inject arbitrary web… (no CVSS) - [CVE-2018-16668](https://cve.now/CVE-2018-16668.md): An issue was discovered in CIRCONTROL CirCarLife before 4.3. (no CVSS) - [CVE-2018-16669](https://cve.now/CVE-2018-16669.md): An issue was discovered in CIRCONTROL Open Charge Point Protocol (OCPP) before 1.5.0, as used in CirCarLife, PowerStudio, and other… (no CVSS) - [CVE-2018-16670](https://cve.now/CVE-2018-16670.md): An issue was discovered in CIRCONTROL CirCarLife before 4.3. (no CVSS) - [CVE-2018-16671](https://cve.now/CVE-2018-16671.md): An issue was discovered in CIRCONTROL CirCarLife before 4.3. (no CVSS) - [CVE-2017-15818](https://cve.now/CVE-2017-15818.md): In all android releases (Android for MSM, Firefox OS for MSM, QRD Android) from CAF using the linux kernel, while loading a user… (no CVSS, Qualcomm Android for MSM, Firefox OS for MSM, QRD Android) - [CVE-2017-15825](https://cve.now/CVE-2017-15825.md): In all android releases (Android for MSM, Firefox OS for MSM, QRD Android) from CAF using the linux kernel, while processing a gpt update… (no CVSS, Qualcomm Android for MSM, Firefox OS for MSM, QRD Android) - [CVE-2017-15828](https://cve.now/CVE-2017-15828.md): In all android releases (Android for MSM, Firefox OS for MSM, QRD Android) from CAF using the linux kernel, while accessing the keystore… (no CVSS, Qualcomm Android for MSM, Firefox OS for MSM, QRD Android) - [CVE-2017-15844](https://cve.now/CVE-2017-15844.md): In all android releases (Android for MSM, Firefox OS for MSM, QRD Android) from CAF using the linux kernel, while processing the function… (no CVSS, Qualcomm Android for MSM, Firefox OS for MSM, QRD Android) - [CVE-2018-11265](https://cve.now/CVE-2018-11265.md): In all android releases (Android for MSM, Firefox OS for MSM, QRD Android) from CAF using the linux kernel, possible buffer overflow while… (no CVSS, Qualcomm Android for MSM, Firefox OS for MSM, QRD Android) - [CVE-2018-11270](https://cve.now/CVE-2018-11270.md): In all android releases (Android for MSM, Firefox OS for MSM, QRD Android) from CAF using the linux kernel, memory allocated with… (no CVSS, Qualcomm Android for MSM, Firefox OS for MSM, QRD Android) - [CVE-2018-11273](https://cve.now/CVE-2018-11273.md): In all android releases (Android for MSM, Firefox OS for MSM, QRD Android) from CAF using the linux kernel, 'voice\_svc\_dev' is allocated… (no CVSS) - [CVE-2018-11274](https://cve.now/CVE-2018-11274.md): In all android releases (Android for MSM, Firefox OS for MSM, QRD Android) from CAF using the linux kernel, buffer overflow may occur when… (no CVSS, Qualcomm Android for MSM, Firefox OS for MSM, QRD Android) - [CVE-2018-11275](https://cve.now/CVE-2018-11275.md): In all android releases (Android for MSM, Firefox OS for MSM, QRD Android) from CAF using the linux kernel, when flashing image using… (no CVSS, Qualcomm Android for MSM, Firefox OS for MSM, QRD Android) - [CVE-2018-11276](https://cve.now/CVE-2018-11276.md): In all android releases (Android for MSM, Firefox OS for MSM, QRD Android) from CAF using the linux kernel, double free of memory… (no CVSS, Qualcomm Android for MSM, Firefox OS for MSM, QRD Android) - [CVE-2018-11278](https://cve.now/CVE-2018-11278.md): In all android releases (Android for MSM, Firefox OS for MSM, QRD Android) from CAF using the linux kernel, Venus HW searches for start… (no CVSS, Qualcomm Android for MSM, Firefox OS for MSM, QRD Android) - [CVE-2018-11280](https://cve.now/CVE-2018-11280.md): In all android releases (Android for MSM, Firefox OS for MSM, QRD Android) from CAF using the linux kernel, while processing user-space… (no CVSS, Qualcomm Android for MSM, Firefox OS for MSM, QRD Android) - [CVE-2018-11281](https://cve.now/CVE-2018-11281.md): In all android releases (Android for MSM, Firefox OS for MSM, QRD Android) from CAF using the linux kernel, while calling… (no CVSS, Qualcomm Android for MSM, Firefox OS for MSM, QRD Android) - [CVE-2018-11286](https://cve.now/CVE-2018-11286.md): In all android releases (Android for MSM, Firefox OS for MSM, QRD Android) from CAF using the linux kernel, while accessing global… (no CVSS) - [CVE-2018-11293](https://cve.now/CVE-2018-11293.md): In all android releases (Android for MSM, Firefox OS for MSM, QRD Android) from CAF using the linux kernel, in… (no CVSS, Qualcomm Android for MSM, Firefox OS for MSM, QRD Android) - [CVE-2018-11294](https://cve.now/CVE-2018-11294.md): In all android releases (Android for MSM, Firefox OS for MSM, QRD Android) from CAF using the linux kernel, WLAN handler indication from… (no CVSS, Qualcomm Android for MSM, Firefox OS for MSM, QRD Android) - [CVE-2018-11295](https://cve.now/CVE-2018-11295.md): In all android releases (Android for MSM, Firefox OS for MSM, QRD Android) from CAF using the linux kernel, WMA handler carries a fixed… (no CVSS, Qualcomm Android for MSM, Firefox OS for MSM, QRD Android) - [CVE-2018-11296](https://cve.now/CVE-2018-11296.md): In all android releases (Android for MSM, Firefox OS for MSM, QRD Android) from CAF using the linux kernel, while processing a message… (no CVSS, Qualcomm Android for MSM, Firefox OS for MSM, QRD Android) - [CVE-2018-11297](https://cve.now/CVE-2018-11297.md): In all android releases (Android for MSM, Firefox OS for MSM, QRD Android) from CAF using the linux kernel, a buffer over-read can occur… (no CVSS, Qualcomm Android for MSM, Firefox OS for MSM, QRD Android) - [CVE-2018-11298](https://cve.now/CVE-2018-11298.md): In all android releases (Android for MSM, Firefox OS for MSM, QRD Android) from CAF using the linux kernel, while processing… (no CVSS, Qualcomm Android for MSM, Firefox OS for MSM, QRD Android) - [CVE-2018-11299](https://cve.now/CVE-2018-11299.md): In all android releases (Android for MSM, Firefox OS for MSM, QRD Android) from CAF using the linux kernel, when WLAN FW has not filled… (no CVSS, Qualcomm Android for MSM, Firefox OS for MSM, QRD Android) - [CVE-2018-11300](https://cve.now/CVE-2018-11300.md): In all android releases (Android for MSM, Firefox OS for MSM, QRD Android) from CAF using the linux kernel, callback executed from the… (no CVSS) - [CVE-2018-11301](https://cve.now/CVE-2018-11301.md): In all android releases (Android for MSM, Firefox OS for MSM, QRD Android) from CAF using the linux kernel, lack of check on buffer length… (no CVSS, Qualcomm Android for MSM, Firefox OS for MSM, QRD Android) - [CVE-2018-11302](https://cve.now/CVE-2018-11302.md): In all android releases (Android for MSM, Firefox OS for MSM, QRD Android) from CAF using the linux kernel, lack of check of input… (no CVSS, Qualcomm Android for MSM, Firefox OS for MSM, QRD Android) - [CVE-2018-11818](https://cve.now/CVE-2018-11818.md): In all android releases (Android for MSM, Firefox OS for MSM, QRD Android) from CAF using the linux kernel, LUT configuration is passed… (no CVSS, Qualcomm Android for MSM, Firefox OS for MSM, QRD Android) - [CVE-2018-11826](https://cve.now/CVE-2018-11826.md): In all android releases (Android for MSM, Firefox OS for MSM, QRD Android) from CAF using the linux kernel, lack of check on integer… (no CVSS, Qualcomm Android for MSM, Firefox OS for MSM, QRD Android) - [CVE-2018-11827](https://cve.now/CVE-2018-11827.md): In all android releases (Android for MSM, Firefox OS for MSM, QRD Android) from CAF using the linux kernel, improper validation of array… (no CVSS, Qualcomm Android for MSM, Firefox OS for MSM, QRD Android) - [CVE-2018-11832](https://cve.now/CVE-2018-11832.md): In all android releases (Android for MSM, Firefox OS for MSM, QRD Android) from CAF using the linux kernel, lack of input size validation… (no CVSS, Qualcomm Android for MSM, Firefox OS for MSM, QRD Android) - [CVE-2018-11836](https://cve.now/CVE-2018-11836.md): In all android releases (Android for MSM, Firefox OS for MSM, QRD Android) from CAF using the linux kernel, improper length check can lead… (no CVSS, Qualcomm Android for MSM, Firefox OS for MSM, QRD Android) - [CVE-2018-11840](https://cve.now/CVE-2018-11840.md): In all android releases (Android for MSM, Firefox OS for MSM, QRD Android) from CAF using the linux kernel, while processing the WLAN… (no CVSS, Qualcomm Android for MSM, Firefox OS for MSM, QRD Android) - [CVE-2018-11842](https://cve.now/CVE-2018-11842.md): In all android releases (Android for MSM, Firefox OS for MSM, QRD Android) from CAF using the linux kernel, during wlan association… (no CVSS, Qualcomm Android for MSM, Firefox OS for MSM, QRD Android) - [CVE-2018-11843](https://cve.now/CVE-2018-11843.md): In all android releases (Android for MSM, Firefox OS for MSM, QRD Android) from CAF using the linux kernel, lack fo check on return value… (no CVSS, Qualcomm Android for MSM, Firefox OS for MSM, QRD Android) - [CVE-2018-11851](https://cve.now/CVE-2018-11851.md): In all android releases (Android for MSM, Firefox OS for MSM, QRD Android) from CAF using the linux kernel, lack of check on input… (no CVSS, Qualcomm Android for MSM, Firefox OS for MSM, QRD Android) - [CVE-2018-11852](https://cve.now/CVE-2018-11852.md): In all android releases (Android for MSM, Firefox OS for MSM, QRD Android) from CAF using the linux kernel, improper check In the WMA API… (no CVSS, Qualcomm Android for MSM, Firefox OS for MSM, QRD Android) - [CVE-2018-11860](https://cve.now/CVE-2018-11860.md): In all android releases (Android for MSM, Firefox OS for MSM, QRD Android) from CAF using the linux kernel, a potential buffer over flow… (no CVSS, Qualcomm Android for MSM, Firefox OS for MSM, QRD Android) - [CVE-2018-11863](https://cve.now/CVE-2018-11863.md): In all android releases (Android for MSM, Firefox OS for MSM, QRD Android) from CAF using the linux kernel, lack of check of input… (no CVSS, Qualcomm Android for MSM, Firefox OS for MSM, QRD Android) - [CVE-2018-11868](https://cve.now/CVE-2018-11868.md): In all android releases (Android for MSM, Firefox OS for MSM, QRD Android) from CAF using the linux kernel, lack of length validation… (no CVSS, Qualcomm Android for MSM, Firefox OS for MSM, QRD Android) - [CVE-2018-11869](https://cve.now/CVE-2018-11869.md): In all android releases (Android for MSM, Firefox OS for MSM, QRD Android) from CAF using the linux kernel, lack of length validation… (no CVSS, Qualcomm Android for MSM, Firefox OS for MSM, QRD Android) - [CVE-2018-17176](https://cve.now/CVE-2018-17176.md): A replay issue was discovered on Neato Botvac Connected 2.2.0 devices. (no CVSS) - [CVE-2018-17177](https://cve.now/CVE-2018-17177.md): An issue was discovered on Neato Botvac Connected 2.2.0 and Botvac 85 1.2.1 devices. (no CVSS) - [CVE-2018-17178](https://cve.now/CVE-2018-17178.md): An issue was discovered on Neato Botvac Connected 2.2.0 devices. (no CVSS) - [CVE-2018-17175](https://cve.now/CVE-2018-17175.md): In the marshmallow library before 2.15.1 and 3.x before 3.0.0b9 for Python, the schema "only" option treats an empty list as implying no… (no CVSS, marshmallow) - [CVE-2018-11786](https://cve.now/CVE-2018-11786.md): In Apache Karaf prior to 4.2.0 release, if the sshd service in Karaf is left on so an administrator can manage the running instance, any… (no CVSS, Apache Software Foundation Apache Karaf · org.apache.karaf:…) - [CVE-2018-11787](https://cve.now/CVE-2018-11787.md): In Apache Karaf version prior to 3.0.9, 4.0.9, 4.1.1, when the webconsole feature is installed in Karaf, it is available at… (no CVSS, Apache Software Foundation Apache Karaf · org.apache.karaf:…) - [CVE-2018-13398](https://cve.now/CVE-2018-13398.md): The administrative smart-commits resource in Atlassian Fisheye and Crucible before version 4.5.4 allows remote attackers to modify… (no CVSS, Atlassian Fisheye and Crucible) - [CVE-2018-14641](https://cve.now/CVE-2018-14641.md): A security flaw was found in the ip\_frag\_reasm() function in net/ipv4/ip\_fragment.c in the Linux kernel from 4.19-rc1 to 4.19-rc3… (CVSS 6.5, The Linux Foundation kernel) - [CVE-2018-14642](https://cve.now/CVE-2018-14642.md): An information leak vulnerability was found in Undertow. (CVSS 5.3, Red Hat undertow · io.undertow:undertow-core) - [CVE-2018-7929](https://cve.now/CVE-2018-7929.md): Huawei Mate RS smartphones with the versions before NEO-AL00D 8.1.0.167(C786) have a lock-screen bypass vulnerability. (no CVSS, Huawei Technologies Co. Mate RS) - [CVE-2018-7991](https://cve.now/CVE-2018-7991.md): Huawei smartphones Mate10 with versions earlier before ALP-AL00B 8.0.0.110(C00) have a Factory Reset Protection (FRP) bypass vulnerability. (no CVSS, Huawei Technologies Co. Mate10) - [CVE-2018-16952](https://cve.now/CVE-2018-16952.md): The Oracle WebCenter Interaction Portal 10.3.3 does not implement protection against Cross-site Request Forgery in its design. (no CVSS) - [CVE-2018-16953](https://cve.now/CVE-2018-16953.md): The AjaxView::DisplayResponse() function of the portalpages.dll assembly in Oracle WebCenter Interaction Portal 10.3.3 is vulnerable to… (no CVSS) - [CVE-2018-16954](https://cve.now/CVE-2018-16954.md): An issue was discovered in Oracle WebCenter Interaction Portal 10.3.3. (no CVSS) - [CVE-2018-16955](https://cve.now/CVE-2018-16955.md): The login function of Oracle WebCenter Interaction Portal 10.3.3 is vulnerable to reflected cross-site scripting (XSS). (no CVSS) - [CVE-2018-16956](https://cve.now/CVE-2018-16956.md): The AjaxControl component of Oracle WebCenter Interaction Portal 10.3.3 does not validate the names of pages when processing page rename… (no CVSS) - [CVE-2018-16957](https://cve.now/CVE-2018-16957.md): The Oracle WebCenter Interaction 10.3.3 search service queryd.exe binary is compiled with the i1g2s3c4 hardcoded password. (no CVSS) - [CVE-2018-16958](https://cve.now/CVE-2018-16958.md): An issue was discovered in Oracle WebCenter Interaction Portal 10.3.3. (no CVSS) - [CVE-2018-16959](https://cve.now/CVE-2018-16959.md): An issue was discovered in Oracle WebCenter Interaction Portal 10.3.3. (no CVSS) - [CVE-2018-1000802](https://cve.now/CVE-2018-1000802.md): Python Software Foundation Python (CPython) version 2.7 contains a CWE-77: Improper Neutralization of Special Elements used in a Command ('C (no CVSS) - [CVE-2018-17153](https://cve.now/CVE-2018-17153.md): It was discovered that the Western Digital My Cloud device before 2.30.196 is affected by an authentication bypass vulnerability. (no CVSS) --- Source: cve.now Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards. Page: https://cve.now/archive/2018-09-18 Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.