# CVEs published 2018-09-19

57 CVEs were published on September 19, 2018: 1 critical, 7 high. Days are UTC.

- [CVE-2018-17229](https://cve.now/CVE-2018-17229.md): Exiv2::d2Data in types.cpp in Exiv2 v0.26 allows remote attackers to cause a denial of service (heap-based buffer overflow) via a crafted… (no CVSS)
- [CVE-2018-17230](https://cve.now/CVE-2018-17230.md): Exiv2::ul2Data in types.cpp in Exiv2 v0.26 allows remote attackers to cause a denial of service (heap-based buffer overflow) via a crafted… (no CVSS)
- [CVE-2018-17231](https://cve.now/CVE-2018-17231.md): Telegram Desktop (aka tdesktop) 1.3.14 might allow attackers to cause a denial of service (assertion failure and application exit) via an… (no CVSS)
- [CVE-2018-17228](https://cve.now/CVE-2018-17228.md): nmap4j 1.1.0 allows attackers to execute arbitrary commands via shell metacharacters in an includeHosts call. (no CVSS)
- [CVE-2018-8889](https://cve.now/CVE-2018-8889.md): A directory traversal vulnerability in the Connect Service of the BlackBerry Enterprise Mobility Server (BEMS) 2.8.17.29 and earlier could… (no CVSS, BlackBerry Enterprise Mobility Server)
- [CVE-2018-3823](https://cve.now/CVE-2018-3823.md): X-Pack Machine Learning versions before 6.2.4 and 5.6.9 had a cross-site scripting (XSS) vulnerability. (no CVSS, Elasticsearch X-Pack Machine Learning)
- [CVE-2018-3824](https://cve.now/CVE-2018-3824.md): X-Pack Machine Learning versions before 6.2.4 and 5.6.9 had a cross-site scripting (XSS) vulnerability. (no CVSS, Elasticsearch X-Pack Machine Learning · org.elasticsearch:e…)
- [CVE-2018-3825](https://cve.now/CVE-2018-3825.md): In Elastic Cloud Enterprise (ECE) versions prior to 1.1.4 a default master encryption key is used in the process of granting ZooKeeper… (no CVSS, Elastic Cloud Enterprise)
- [CVE-2018-3826](https://cve.now/CVE-2018-3826.md): In Elasticsearch versions 6.0.0-beta1 to 6.2.4 a disclosure flaw was found in the \_snapshot API. (no CVSS, Elasticsearch)
- [CVE-2018-3827](https://cve.now/CVE-2018-3827.md): A sensitive data disclosure flaw was found in the Elasticsearch repository-azure (formerly elasticsearch-cloud-azure) plugin. (no CVSS, Elasticsearch)
- [CVE-2018-3828](https://cve.now/CVE-2018-3828.md): Elastic Cloud Enterprise (ECE) versions prior to 1.1.4 contain an information exposure vulnerability. (no CVSS, Elastic Cloud Enterprise)
- [CVE-2018-3829](https://cve.now/CVE-2018-3829.md): In Elastic Cloud Enterprise (ECE) versions prior to 1.1.4 it was discovered that a user could scale out allocators on new hosts with an… (no CVSS, Elastic Cloud Enterprise)
- [CVE-2018-3830](https://cve.now/CVE-2018-3830.md): Kibana versions 5.3.0 to 6.4.1 had a cross-site scripting (XSS) vulnerability via the source field formatter that could allow an attacker… (no CVSS, Elastic Kibana)
- [CVE-2018-3831](https://cve.now/CVE-2018-3831.md): Elasticsearch Alerting and Monitoring in versions before 6.4.1 or 5.6.12 have an information disclosure issue when secrets are configured… (no CVSS, Elasticsearch · org.elasticsearch:elasticsearch)
- [CVE-2017-2873](https://cve.now/CVE-2017-2873.md): An exploitable command injection vulnerability exists in the web management interface used by the Foscam C1 Indoor HD Camera running… (CVSS 8.8, Foscam C1 Indoor HD Camera)
- [CVE-2017-2876](https://cve.now/CVE-2017-2876.md): An exploitable buffer overflow vulnerability exists in the Multi-Camera interface used by the Foscam C1 Indoor HD Camera running… (CVSS 8.8, Foscam C1 Indoor HD Camera)
- [CVE-2017-2877](https://cve.now/CVE-2017-2877.md): A missing error check exists in the Multi-Camera interface used by the Foscam C1 Indoor HD Camera running application firmware 2.52.2.43. (CVSS 9.8, Foscam C1 Indoor HD Camera)
- [CVE-2018-17208](https://cve.now/CVE-2018-17208.md): Linksys Velop 1.1.2.187020 devices allow unauthenticated command injection, providing an attacker with full root access, via… (no CVSS)
- [CVE-2017-2855](https://cve.now/CVE-2017-2855.md): An exploitable buffer overflow vulnerability exists in the DDNS client used by the Foscam C1 Indoor HD Camera running application firmware… (CVSS 8.1, Foscam C1 Indoor HD Camera)
- [CVE-2017-2875](https://cve.now/CVE-2017-2875.md): An exploitable buffer overflow vulnerability exists in the Multi-Camera interface used by the Foscam C1 Indoor HD Camera running… (CVSS 8.8, Foscam C1 Indoor HD Camera)
- [CVE-2017-2878](https://cve.now/CVE-2017-2878.md): An exploitable buffer overflow vulnerability exists in the web management interface used by the Foscam C1 Indoor HD Camera running… (CVSS 8.8, Foscam C1 Indoor HD Camera)
- [CVE-2017-2879](https://cve.now/CVE-2017-2879.md): An exploitable buffer overflow vulnerability exists in the UPnP implementation used by the Foscam C1 Indoor HD Camera running application… (CVSS 7.5, Foscam C1 Indoor HD Camera)
- [CVE-2018-17204](https://cve.now/CVE-2018-17204.md): An issue was discovered in Open vSwitch (OvS) 2.7.x through 2.7.6, affecting parse\_group\_prop\_ntr\_selection\_method in lib/ofp-util.c. (no CVSS)
- [CVE-2018-17205](https://cve.now/CVE-2018-17205.md): An issue was discovered in Open vSwitch (OvS) 2.7.x through 2.7.6, affecting ofproto\_rule\_insert\_\_ in ofproto/ofproto.c. (no CVSS)
- [CVE-2018-17206](https://cve.now/CVE-2018-17206.md): An issue was discovered in Open vSwitch (OvS) 2.7.x through 2.7.6. (no CVSS)
- [CVE-2018-17207](https://cve.now/CVE-2018-17207.md): An issue was discovered in Snap Creek Duplicator before 1.2.42. (no CVSS)
- [CVE-2017-1794](https://cve.now/CVE-2017-1794.md): IBM Tivoli Monitoring 6.2.3 through 6.2.3.5 and 6.3.0 through 6.3.0.7 are vulnerable to both TEPS user privilege escalation and possible… (CVSS 7.5, IBM Tivoli Monitoring)
- [CVE-2018-1149](https://cve.now/CVE-2018-1149.md): cgi\_system in NUUO's NVRMini2 3.8.0 and below allows remote attackers to execute arbitrary code via crafted HTTP requests. (no CVSS, NUUO NVRMini2)
- [CVE-2018-1150](https://cve.now/CVE-2018-1150.md): NUUO's NVRMini2 3.8.0 and below contains a backdoor that would allow an unauthenticated remote attacker to take over user accounts if the… (no CVSS, NUUO NVRMini2)
- [CVE-2018-12242](https://cve.now/CVE-2018-12242.md): The Symantec Messaging Gateway product prior to 10.6.6 may be susceptible to an authentication bypass exploit, which is a type of issue… (no CVSS, Symantec Messaging Gateway)
- [CVE-2018-12243](https://cve.now/CVE-2018-12243.md): The Symantec Messaging Gateway product prior to 10.6.6 may be susceptible to a XML external entity (XXE) exploit, which is a type of issue… (no CVSS, Symantec Messaging Gateway)
- [CVE-2018-14792](https://cve.now/CVE-2018-14792.md): WECON PLC Editor version 1.3.3U may allow an attacker to execute code under the current process when processing project files. (no CVSS, WECON PLC Editor)
- [CVE-2018-16607](https://cve.now/CVE-2018-16607.md): Cross-site scripting (XSS) vulnerability in the Orgs Page in Open-AudIT Professional edition in 2.2.7 allows remote attackers to inject… (no CVSS)
- [CVE-2018-16785](https://cve.now/CVE-2018-16785.md): XML injection vulnerability exists in the file of DedeCMS V5.7 SP2 version, which can be utilized by attackers to create script file to… (no CVSS)
- [CVE-2018-17183](https://cve.now/CVE-2018-17183.md): Artifex Ghostscript before 9.25 allowed a user-writable error exception table, which could be used by remote attackers able to supply… (no CVSS)
- [CVE-2018-1782](https://cve.now/CVE-2018-1782.md): IBM GPFS (IBM Spectrum Scale 5.0.1.0 and 5.0.1.1) allows a local, unprivileged user to cause a kernel panic on a node running GPFS by… (CVSS 6.5, IBM Spectrum Scale)
- [CVE-2018-11761](https://cve.now/CVE-2018-11761.md): In Apache Tika 0.1 to 1.18, the XML parsers were not configured to limit entity expansion. (no CVSS, Apache Software Foundation Apache Tika · org.apache.tika:ti…)
- [CVE-2018-11762](https://cve.now/CVE-2018-11762.md): In Apache Tika 0.9 to 1.18, in a rare edge case where a user does not specify an extract directory on the commandline (--extract-dir=) and… (no CVSS, Apache Software Foundation Apache Tika · org.apache.tika:ti…)
- [CVE-2018-11878](https://cve.now/CVE-2018-11878.md): In all android releases (Android for MSM, Firefox OS for MSM, QRD Android) from CAF using the linux kernel, possibility of invalid memory… (no CVSS, Qualcomm Android for MSM, Firefox OS for MSM, QRD Android)
- [CVE-2018-11883](https://cve.now/CVE-2018-11883.md): In all android releases (Android for MSM, Firefox OS for MSM, QRD Android) from CAF using the linux kernel, in policy mgr unit test if… (no CVSS, Qualcomm Android for MSM, Firefox OS for MSM, QRD Android)
- [CVE-2018-11886](https://cve.now/CVE-2018-11886.md): In all android releases (Android for MSM, Firefox OS for MSM, QRD Android) from CAF using the linux kernel, lack of check while… (no CVSS, Qualcomm Android for MSM, Firefox OS for MSM, QRD Android)
- [CVE-2018-11889](https://cve.now/CVE-2018-11889.md): In all android releases (Android for MSM, Firefox OS for MSM, QRD Android) from CAF using the linux kernel, when requesting rssi timeout… (no CVSS)
- [CVE-2018-11891](https://cve.now/CVE-2018-11891.md): In all android releases (Android for MSM, Firefox OS for MSM, QRD Android) from CAF using the linux kernel, lack of check on the length of… (no CVSS, Qualcomm Android for MSM, Firefox OS for MSM, QRD Android)
- [CVE-2018-11893](https://cve.now/CVE-2018-11893.md): In all android releases (Android for MSM, Firefox OS for MSM, QRD Android) from CAF using the linux kernel, while processing vendor scan… (no CVSS)
- [CVE-2018-11894](https://cve.now/CVE-2018-11894.md): In all android releases (Android for MSM, Firefox OS for MSM, QRD Android) from CAF using the linux kernel, while processing preferred… (no CVSS, Qualcomm Android for MSM, Firefox OS for MSM, QRD Android)
- [CVE-2018-11895](https://cve.now/CVE-2018-11895.md): In all android releases (Android for MSM, Firefox OS for MSM, QRD Android) from CAF using the linux kernel, improper length check… (no CVSS, Qualcomm Android for MSM, Firefox OS for MSM, QRD Android)
- [CVE-2018-11897](https://cve.now/CVE-2018-11897.md): In all android releases (Android for MSM, Firefox OS for MSM, QRD Android) from CAF using the linux kernel, while processing diag event… (no CVSS, Qualcomm Android for MSM, Firefox OS for MSM, QRD Android)
- [CVE-2018-11898](https://cve.now/CVE-2018-11898.md): In all android releases (Android for MSM, Firefox OS for MSM, QRD Android) from CAF using the linux kernel, while processing start bss… (no CVSS, Qualcomm Android for MSM, Firefox OS for MSM, QRD Android)
- [CVE-2018-11902](https://cve.now/CVE-2018-11902.md): In all android releases (Android for MSM, Firefox OS for MSM, QRD Android) from CAF using the linux kernel, lack of length validation… (no CVSS, Qualcomm Android for MSM, Firefox OS for MSM, QRD Android)
- [CVE-2018-11903](https://cve.now/CVE-2018-11903.md): In all android releases (Android for MSM, Firefox OS for MSM, QRD Android) from CAF using the linux kernel, lack of length validation… (no CVSS, Qualcomm Android for MSM, Firefox OS for MSM, QRD Android)
- [CVE-2018-11904](https://cve.now/CVE-2018-11904.md): In all android releases (Android for MSM, Firefox OS for MSM, QRD Android) from CAF using the linux kernel, asynchronous callbacks… (no CVSS, Qualcomm Android for MSM, Firefox OS for MSM, QRD Android)
- [CVE-2018-3573](https://cve.now/CVE-2018-3573.md): In all android releases (Android for MSM, Firefox OS for MSM, QRD Android) from CAF using the linux kernel, while relocating kernel images… (no CVSS, Qualcomm Android for MSM, Firefox OS for MSM, QRD Android)
- [CVE-2018-3574](https://cve.now/CVE-2018-3574.md): In all android releases (Android for MSM, Firefox OS for MSM, QRD Android) from CAF using the linux kernel, userspace can request ION… (no CVSS, Qualcomm Android for MSM, Firefox OS for MSM, QRD Android)
- [CVE-2018-5905](https://cve.now/CVE-2018-5905.md): In all android releases (Android for MSM, Firefox OS for MSM, QRD Android) from CAF using the linux kernel, a race condition while… (no CVSS)
- [CVE-2018-8017](https://cve.now/CVE-2018-8017.md): In Apache Tika 1.2 to 1.18, a carefully crafted file can trigger an infinite loop in the IptcAnpaParser. (no CVSS, Apache Software Foundation Apache Tika · org.apache.tika:ti…)
- [CVE-2018-17182](https://cve.now/CVE-2018-17182.md): An issue was discovered in the Linux kernel through 4.18.8. (no CVSS)
- [CVE-2018-17144](https://cve.now/CVE-2018-17144.md): Bitcoin Core 0.14.x before 0.14.3, 0.15.x before 0.15.2, and 0.16.x before 0.16.3 and Bitcoin Knots 0.14.x through 0.16.x before 0.16.3… (no CVSS)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/archive/2018-09-19
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.