# CVEs published 2018-09-25

54 CVEs were published on September 25, 2018: 5 critical, 6 high. 2 are now in CISA KEV. Days are UTC.

- [CVE-2018-11763](https://cve.now/CVE-2018-11763.md): In Apache HTTP Server 2.4.17 to 2.4.34, by sending continuous, large SETTINGS frames a client can occupy a connection, server thread and… (no CVSS, Apache Software Foundation Apache HTTP Server)
- [CVE-2018-14634](https://cve.now/CVE-2018-14634.md): An integer overflow flaw was found in the Linux kernel's create\_elf\_tables() function. (CVSS 7.8, KEV, The Linux Foundation kernel)
- [CVE-2018-1539](https://cve.now/CVE-2018-1539.md): IBM Rational Engineering Lifecycle Manager 5.0 through 5.02 and 6.0 through 6.0.6 could allow remote attackers to bypass authentication… (CVSS 5.4, IBM Rational Engineering Lifecycle Manager)
- [CVE-2018-1560](https://cve.now/CVE-2018-1560.md): IBM Rational Engineering Lifecycle Manager 5.0 through 5.02 and 6.0 through 6.0.6 is vulnerable to cross-site scripting. (CVSS 5.4, IBM Rational Engineering Lifecycle Manager)
- [CVE-2018-1588](https://cve.now/CVE-2018-1588.md): IBM Jazz Foundation (IBM Rational Engineering Lifecycle Manager 5.0 through 5.02 and 6.0 through 6.0.6) is vulnerable to a XML External… (CVSS 7.1, IBM Rational Engineering Lifecycle Manager)
- [CVE-2018-1607](https://cve.now/CVE-2018-1607.md): IBM Rational Engineering Lifecycle Manager 5.0 through 5.02 and 6.0 through 6.0.6 is vulnerable to a XML External Entity Injection (XXE)… (CVSS 7.1, IBM Rational Engineering Lifecycle Manager)
- [CVE-2018-1659](https://cve.now/CVE-2018-1659.md): IBM Rational Engineering Lifecycle Manager 5.0 through 5.02 and 6.0 through 6.0.6 is vulnerable to cross-site scripting. (CVSS 5.4, IBM Rational Engineering Lifecycle Manager)
- [CVE-2018-1664](https://cve.now/CVE-2018-1664.md): IBM DataPower Gateway 7.1.0.0 - 7.1.0.23, 7.2.0.0 - 7.2.0.21, 7.5.0.0 - 7.5.0.16, 7.5.1.0 - 7.5.1.15, 7.5.2.0 - 7.5.2.15, and 7.6.0.0… (CVSS 6.2, IBM DataPower Gateway CD · IBM DataPower Gateways)
- [CVE-2018-1669](https://cve.now/CVE-2018-1669.md): IBM DataPower Gateway 7.1.0.0 - 7.1.0.23, 7.2.0.0 - 7.2.0.21, 7.5.0.0 - 7.5.0.16, 7.5.1.0 - 7.5.1.15, 7.5.2.0 - 7.5.2.15, and 7.6.0.0… (CVSS 7.1, IBM DataPower Gateways · IBM DataPower Gateway CD)
- [CVE-2018-6031](https://cve.now/CVE-2018-6031.md): Use after free in PDFium in Google Chrome prior to 64.0.3282.119 allowed a remote attacker to potentially exploit heap corruption via a… (no CVSS, Google Chrome)
- [CVE-2018-6032](https://cve.now/CVE-2018-6032.md): Insufficient policy enforcement in Blink in Google Chrome prior to 64.0.3282.119 allowed a remote attacker to potentially leak user… (no CVSS, Google Chrome)
- [CVE-2018-6033](https://cve.now/CVE-2018-6033.md): Insufficient data validation in Downloads in Google Chrome prior to 64.0.3282.119 allowed a remote attacker to potentially run arbitrary… (no CVSS, Google Chrome)
- [CVE-2018-6034](https://cve.now/CVE-2018-6034.md): Insufficient data validation in WebGL in Google Chrome prior to 64.0.3282.119 allowed a remote attacker to perform an out of bounds memory… (no CVSS, Google Chrome)
- [CVE-2018-6035](https://cve.now/CVE-2018-6035.md): Insufficient policy enforcement in DevTools in Google Chrome prior to 64.0.3282.119 allowed a remote attacker to potentially leak user… (no CVSS, Google Chrome)
- [CVE-2018-6036](https://cve.now/CVE-2018-6036.md): Insufficient data validation in V8 in Google Chrome prior to 64.0.3282.119 allowed a remote attacker to potentially leak user data via a… (no CVSS, Google Chrome)
- [CVE-2018-6037](https://cve.now/CVE-2018-6037.md): Inappropriate implementation in autofill in Google Chrome prior to 64.0.3282.119 allowed a remote attacker to obtain autofill data with… (no CVSS, Google Chrome)
- [CVE-2018-6038](https://cve.now/CVE-2018-6038.md): Heap buffer overflow in WebGL in Google Chrome prior to 64.0.3282.119 allowed a remote attacker to perform an out of bounds memory read… (no CVSS, Google Chrome)
- [CVE-2018-6039](https://cve.now/CVE-2018-6039.md): Insufficient data validation in DevTools in Google Chrome prior to 64.0.3282.119 allowed a remote attacker to potentially leak user… (no CVSS, Google Chrome)
- [CVE-2018-6040](https://cve.now/CVE-2018-6040.md): Insufficient policy enforcement in Blink in Google Chrome prior to 64.0.3282.119 allowed a remote attacker to potentially bypass content… (no CVSS, Google Chrome)
- [CVE-2018-6041](https://cve.now/CVE-2018-6041.md): Incorrect security UI in navigation in Google Chrome prior to 64.0.3282.119 allowed a remote attacker to spoof the contents of the Omnibox… (no CVSS, Google Chrome)
- [CVE-2018-6042](https://cve.now/CVE-2018-6042.md): Incorrect security UI in Omnibox in Google Chrome prior to 64.0.3282.119 allowed a remote attacker to spoof the contents of the Omnibox… (no CVSS, Google Chrome)
- [CVE-2018-6043](https://cve.now/CVE-2018-6043.md): Insufficient data validation in External Protocol Handler in Google Chrome prior to 64.0.3282.119 allowed a remote attacker to potentially… (no CVSS, Google Chrome)
- [CVE-2018-6045](https://cve.now/CVE-2018-6045.md): Insufficient policy enforcement in DevTools in Google Chrome prior to 64.0.3282.119 allowed a remote attacker to potentially leak user… (no CVSS)
- [CVE-2018-6046](https://cve.now/CVE-2018-6046.md): Insufficient data validation in DevTools in Google Chrome prior to 64.0.3282.119 allowed a remote attacker to potentially leak user… (no CVSS, Google Chrome)
- [CVE-2018-6047](https://cve.now/CVE-2018-6047.md): Insufficient policy enforcement in WebGL in Google Chrome prior to 64.0.3282.119 allowed a remote attacker to potentially leak user… (no CVSS, Google Chrome)
- [CVE-2018-6048](https://cve.now/CVE-2018-6048.md): Insufficient policy enforcement in Blink in Google Chrome prior to 64.0.3282.119 allowed a remote attacker to potentially leak referrer… (no CVSS, Google Chrome)
- [CVE-2018-6049](https://cve.now/CVE-2018-6049.md): Incorrect security UI in permissions prompt in Google Chrome prior to 64.0.3282.119 allowed a remote attacker to spoof the origin to which… (no CVSS, Google Chrome)
- [CVE-2018-6050](https://cve.now/CVE-2018-6050.md): Incorrect security UI in Omnibox in Google Chrome prior to 64.0.3282.119 allowed a remote attacker to spoof the contents of the Omnibox… (no CVSS, Google Chrome)
- [CVE-2018-6051](https://cve.now/CVE-2018-6051.md): XSS Auditor in Google Chrome prior to 64.0.3282.119, did not ensure the reporting URL was in the same origin as the page it was on, which… (no CVSS, Google Chrome)
- [CVE-2018-6052](https://cve.now/CVE-2018-6052.md): Lack of support for a non standard no-referrer policy value in Blink in Google Chrome prior to 64.0.3282.119 allowed a remote attacker to… (no CVSS, Google Chrome)
- [CVE-2018-6053](https://cve.now/CVE-2018-6053.md): Inappropriate implementation in New Tab Page in Google Chrome prior to 64.0.3282.119 allowed a local attacker to view website thumbnail… (no CVSS, Google Chrome)
- [CVE-2018-6054](https://cve.now/CVE-2018-6054.md): Use after free in WebUI in Google Chrome prior to 64.0.3282.119 allowed a remote attacker to potentially exploit heap corruption via a… (no CVSS, Google Chrome)
- [CVE-2018-6055](https://cve.now/CVE-2018-6055.md): Insufficient policy enforcement in Catalog Service in Google Chrome prior to 64.0.3282.119 allowed a remote attacker to potentially run… (no CVSS, Google Chrome)
- [CVE-2018-6119](https://cve.now/CVE-2018-6119.md): Incorrect security UI in Omnibox in Google Chrome prior to 64.0.3282.119 allowed a remote attacker to spoof the contents of the Omnibox… (no CVSS, Google Chrome)
- [CVE-2018-12775](https://cve.now/CVE-2018-12775.md): Adobe Acrobat and Reader versions 2018.011.20058 and earlier, 2017.011.30099 and earlier, and 2015.006.30448 and earlier have an… (no CVSS, Adobe Acrobat and Reader)
- [CVE-2018-12778](https://cve.now/CVE-2018-12778.md): Adobe Acrobat and Reader versions 2018.011.20058 and earlier, 2017.011.30099 and earlier, and 2015.006.30448 and earlier have an… (no CVSS, Adobe Acrobat and Reader)
- [CVE-2018-12801](https://cve.now/CVE-2018-12801.md): Adobe Acrobat and Reader versions 2018.011.20058 and earlier, 2017.011.30099 and earlier, and 2015.006.30448 and earlier have an… (no CVSS, Adobe Acrobat and Reader)
- [CVE-2018-12840](https://cve.now/CVE-2018-12840.md): Adobe Acrobat and Reader versions 2018.011.20058 and earlier, 2017.011.30099 and earlier, and 2015.006.30448 and earlier have an… (no CVSS)
- [CVE-2018-12848](https://cve.now/CVE-2018-12848.md): Adobe Acrobat and Reader versions 2018.011.20058 and earlier, 2017.011.30099 and earlier, and 2015.006.30448 and earlier have an… (no CVSS, Adobe Acrobat and Reader)
- [CVE-2018-12849](https://cve.now/CVE-2018-12849.md): Adobe Acrobat and Reader versions 2018.011.20058 and earlier, 2017.011.30099 and earlier, and 2015.006.30448 and earlier have an… (no CVSS, Adobe Acrobat and Reader)
- [CVE-2018-12850](https://cve.now/CVE-2018-12850.md): Adobe Acrobat and Reader versions 2018.011.20058 and earlier, 2017.011.30099 and earlier, and 2015.006.30448 and earlier have an… (no CVSS, Adobe Acrobat and Reader)
- [CVE-2018-15957](https://cve.now/CVE-2018-15957.md): Adobe ColdFusion versions July 12 release (2018.0.0.310739), Update 6 and earlier, and Update 14 and earlier have a deserialization of… (CVSS 9.8, Adobe ColdFusion)
- [CVE-2018-15958](https://cve.now/CVE-2018-15958.md): Adobe ColdFusion versions July 12 release (2018.0.0.310739), Update 6 and earlier, and Update 14 and earlier have a deserialization of… (CVSS 9.8, Adobe ColdFusion)
- [CVE-2018-15959](https://cve.now/CVE-2018-15959.md): Adobe ColdFusion versions July 12 release (2018.0.0.310739), Update 6 and earlier, and Update 14 and earlier have a deserialization of… (CVSS 9.8, Adobe ColdFusion)
- [CVE-2018-15960](https://cve.now/CVE-2018-15960.md): Adobe ColdFusion versions July 12 release (2018.0.0.310739), Update 6 and earlier, and Update 14 and earlier have a use of a component… (no CVSS, Adobe ColdFusion)
- [CVE-2018-15961](https://cve.now/CVE-2018-15961.md): Adobe ColdFusion versions July 12 release (2018.0.0.310739), Update 6 and earlier, and Update 14 and earlier have an unrestricted file uploa (CVSS 9.8, KEV, Adobe ColdFusion)
- [CVE-2018-15962](https://cve.now/CVE-2018-15962.md): Adobe ColdFusion versions July 12 release (2018.0.0.310739), Update 6 and earlier, and Update 14 and earlier have a directory listing… (CVSS 5.3, Adobe ColdFusion)
- [CVE-2018-15963](https://cve.now/CVE-2018-15963.md): Adobe ColdFusion versions July 12 release (2018.0.0.310739), Update 6 and earlier, and Update 14 and earlier have a security bypass… (CVSS 5.3, Adobe ColdFusion)
- [CVE-2018-15964](https://cve.now/CVE-2018-15964.md): Adobe ColdFusion versions July 12 release (2018.0.0.310739), Update 6 and earlier, and Update 14 and earlier have a use of a component… (CVSS 7.5, Adobe ColdFusion)
- [CVE-2018-15965](https://cve.now/CVE-2018-15965.md): Adobe ColdFusion versions July 12 release (2018.0.0.310739), Update 6 and earlier, and Update 14 and earlier have a deserialization of… (CVSS 9.8, Adobe ColdFusion)
- [CVE-2018-15967](https://cve.now/CVE-2018-15967.md): Adobe Flash Player versions 30.0.0.154 and earlier have a privilege escalation vulnerability. (no CVSS, Adobe Flash Player)
- [CVE-2018-14318](https://cve.now/CVE-2018-14318.md): This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Samsung Galaxy S8 G950FXXU1AQL5. (no CVSS, Samsung Galaxy S8)
- [CVE-2018-14633](https://cve.now/CVE-2018-14633.md): A security flaw was found in the chap\_server\_compute\_md5() function in the ISCSI target code in the Linux kernel in a way an… (CVSS 7.0, The Linux Foundation kernel)
- [CVE-2018-14647](https://cve.now/CVE-2018-14647.md): Python's elementtree C accelerator failed to initialise Expat's hash salt during initialization. (CVSS 5.3, The Python Project Python)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/archive/2018-09-25
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.