CVEs published August 2, 2018
40 CVEs were published on August 2, 2018: 1 critical, 15 high. 1 is now in CISA KEV.
- Published
- 40
- Critical
- 1
- High
- 15
- Medium
- 4
- Low
- 0
- Unrated
- 20
- Now in CISA KEV
- 1
- Fix available
- 4
Most affected products
- Insteon
- 14
- [UNKNOWN] ttembed
- 2
- Apache Software Foundation Apache Tomcat · org.apache.tomca…
- 2
- intelliants/subrion
- 2
- Tenable SecurityCenter
- 2
- Apache Software Foundation Apache Axis · org.apache.axis… +1
- 1
- cz.nic knot-resolver
- 1
- IBM Maximo Asset Management
- 1
- Insteon SAP
- 1
- NAVER Whale Browser
- 1
Critical 1
High 15
- CVE-2017-14444An exploitable buffer overflow vulnerability exists in Insteon Hub running firmware version 1012.Insteon
- CVE-2017-14446An exploitable stack-based buffer overflow vulnerability exists in Insteon Hub running firmware version 1012.Insteon
- CVE-2017-16338An attacker could send an authenticated HTTP request to trigger this vulnerability in Insteon Hub running firmware version 1012.Insteon
- CVE-2017-16339An attacker could send an authenticated HTTP request to trigger this vulnerability in Insteon Hub running firmware version 1012.Insteon
- CVE-2017-16340An attacker could send an authenticated HTTP request to trigger this vulnerability in Insteon Hub running firmware version 1012.Insteon
- CVE-2017-16341An attacker could send an authenticated HTTP request to trigger this vulnerability in Insteon Hub running firmware version 1012.Insteon
- CVE-2017-16342An attacker could send an authenticated HTTP request to trigger this vulnerability in Insteon Hub running firmware version 1012.Insteon
- CVE-2017-16343An attacker could send an authenticated HTTP request to trigger this vulnerability in Insteon Hub running firmware version 1012.Insteon
- CVE-2017-16344An attacker could send an authenticated HTTP request to trigger this vulnerability in Insteon Hub running firmware version 1012.Insteon
- CVE-2017-16345An attacker could send an authenticated HTTP request to trigger this vulnerability in Insteon Hub running firmware version 1012.Insteon
- CVE-2017-16346An attacker could send an authenticated HTTP request to trigger this vulnerability in Insteon Hub running firmware version 1012.Insteon
- CVE-2017-16347An attacker could send an authenticated HTTP request to trigger this vulnerability in Insteon Hub running firmware version 1012.Insteon
- CVE-2018-3834An exploitable permanent denial of service vulnerability exists in Insteon Hub running firmware version 1013.Insteon
- CVE-2018-10922An input validation flaw exists in ttembed.[UNKNOWN] ttembed
- CVE-2018-10920Improper input validation bug in DNS resolver component of Knot Resolver before 2.4.1 allows remote attacker to poison cache.cz.nic knot-resolver
Medium, low and unrated 24
- CVE-2017-6213paypal/invoice-sdk-php is vulnerable to reflected XSS in samples/permissions.php via the permToken parameter, resulting in code execution.paypal/invoice-sdk-php
- CVE-2017-6215paypal/permissions-sdk-php is vulnerable to reflected XSS in the samples/GetAccessToken.php verification_code parameter, resulting in code epaypal/permissions-sdk-php
- CVE-2018-14858An SSRF vulnerability was discovered in idreamsoft iCMS before V7.0.11 because the remote function in app/spider/spider_tools.class.php does
- CVE-2017-14445An exploitable buffer overflow vulnerability exists in Insteon Hub running firmware version 1012.Insteon
- CVE-2017-16349An exploitable XML external entity vulnerability exists in the reporting functionality of SAP BPC.Insteon SAP
- CVE-2018-1154In SecurityCenter versions prior to 5.7.0, a username enumeration issue could allow an unauthenticated attacker to automate the discovery ofTenable SecurityCenter
- CVE-2018-1155In SecurityCenter versions prior to 5.7.0, a cross-site scripting (XSS) issue could allow an authenticated attacker to inject JavaScript codTenable SecurityCenter
- CVE-2018-14851exif_process_IFD_in_MAKERNOTE in ext/exif/exif.c in PHP before 5.6.37, 7.0.x before 7.0.31, 7.1.x before 7.1.20, and 7.2.x before 7.2.8 allo
- CVE-2018-10921Certain input files may trigger an integer overflow in ttembed input file processing.[UNKNOWN] ttembed
- CVE-2018-7649Monitorix before 3.10.1 allows XSS via CGI variables.
- CVE-2017-9118PHP 7.1.5 has an Out of bounds access in php_pcre_replace_impl via a crafted preg_replace call.
- CVE-2017-9120PHP 7.x through 7.1.5 allows remote attackers to cause a denial of service (buffer overflow and application crash) or possibly have unspecif
- CVE-2018-1336An improper handing of overflow in the UTF-8 decoder with supplementary characters can lead to an infinite loop in the decoder causing a DenApache Software Foundation Apache Tomcat · org.apache.tomca…
- CVE-2018-1554IBM Maximo Asset Management 7.6 is vulnerable to cross-site scripting.IBM Maximo Asset Management
- CVE-2018-8037If an async request was completed by the application at the same time as the container triggered the async timeout, a race condition existedApache Software Foundation Apache Tomcat · org.apache.tomca…
- CVE-2018-12448Whale Browser before 1.3.48.4 displays no URL information but only a title of a web page on the browser's address bar when visiting a non-htNAVER Whale Browser
- CVE-2018-8032Apache Axis 1.x up to and including 1.4 is vulnerable to a cross-site scripting (XSS) attack in the default servlet/services.Apache Software Foundation Apache Axis · org.apache.axis… +1
- CVE-2018-2933Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: WLS Core Components).Oracle WebLogic Server
- CVE-2018-3108Vulnerability in the Oracle Fusion Middleware component of Oracle Fusion Middleware (subcomponent: Oracle Notification Service).Oracle Fusion Middleware
- CVE-2018-3109Vulnerability in the Oracle Fusion Middleware MapViewer component of Oracle Fusion Middleware (subcomponent: Map Builder).Oracle Fusion Middleware MapViewer
- CVE-2018-14838rejucms 2.1 has stored XSS via the admin/book.php content parameter.
- CVE-2018-14840uploads/.htaccess in Subrion CMS 4.2.1 allows XSS because it does not block .html file uploads (but does block, for example, .htm file uploaintelliants/subrion
- CVE-2018-14835Subrion CMS v4.2.1 is vulnerable to Stored XSS because of no escaping added to the tooltip information being displayed in multiple areas.intelliants/subrion
- CVE-2018-14836Subrion 4.2.1 is vulnerable to Improper Access control because user groups not having access to the Admin panel are able to access it (but n