# CVEs published 2018-08-02

40 CVEs were published on August 2, 2018: 1 critical, 15 high. 1 is now in CISA KEV. Days are UTC.

- [CVE-2017-6213](https://cve.now/CVE-2017-6213.md): paypal/invoice-sdk-php is vulnerable to reflected XSS in samples/permissions.php via the permToken parameter, resulting in code execution. (no CVSS, paypal/invoice-sdk-php)
- [CVE-2017-6215](https://cve.now/CVE-2017-6215.md): paypal/permissions-sdk-php is vulnerable to reflected XSS in the samples/GetAccessToken.php verification\_code parameter, resulting in code e (no CVSS, paypal/permissions-sdk-php)
- [CVE-2018-14858](https://cve.now/CVE-2018-14858.md): An SSRF vulnerability was discovered in idreamsoft iCMS before V7.0.11 because the remote function in app/spider/spider\_tools.class.php does (no CVSS)
- [CVE-2017-14444](https://cve.now/CVE-2017-14444.md): An exploitable buffer overflow vulnerability exists in Insteon Hub running firmware version 1012. (CVSS 8.5, Insteon)
- [CVE-2017-14445](https://cve.now/CVE-2017-14445.md): An exploitable buffer overflow vulnerability exists in Insteon Hub running firmware version 1012. (CVSS 5.4, Insteon)
- [CVE-2017-14446](https://cve.now/CVE-2017-14446.md): An exploitable stack-based buffer overflow vulnerability exists in Insteon Hub running firmware version 1012. (CVSS 8.5, Insteon)
- [CVE-2017-16338](https://cve.now/CVE-2017-16338.md): An attacker could send an authenticated HTTP request to trigger this vulnerability in Insteon Hub running firmware version 1012. (CVSS 8.5, Insteon)
- [CVE-2017-16339](https://cve.now/CVE-2017-16339.md): An attacker could send an authenticated HTTP request to trigger this vulnerability in Insteon Hub running firmware version 1012. (CVSS 8.5, Insteon)
- [CVE-2017-16340](https://cve.now/CVE-2017-16340.md): An attacker could send an authenticated HTTP request to trigger this vulnerability in Insteon Hub running firmware version 1012. (CVSS 8.5, Insteon)
- [CVE-2017-16341](https://cve.now/CVE-2017-16341.md): An attacker could send an authenticated HTTP request to trigger this vulnerability in Insteon Hub running firmware version 1012. (CVSS 8.5, Insteon)
- [CVE-2017-16342](https://cve.now/CVE-2017-16342.md): An attacker could send an authenticated HTTP request to trigger this vulnerability in Insteon Hub running firmware version 1012. (CVSS 8.5, Insteon)
- [CVE-2017-16343](https://cve.now/CVE-2017-16343.md): An attacker could send an authenticated HTTP request to trigger this vulnerability in Insteon Hub running firmware version 1012. (CVSS 8.5, Insteon)
- [CVE-2017-16344](https://cve.now/CVE-2017-16344.md): An attacker could send an authenticated HTTP request to trigger this vulnerability in Insteon Hub running firmware version 1012. (CVSS 8.5, Insteon)
- [CVE-2017-16345](https://cve.now/CVE-2017-16345.md): An attacker could send an authenticated HTTP request to trigger this vulnerability in Insteon Hub running firmware version 1012. (CVSS 8.5, Insteon)
- [CVE-2017-16346](https://cve.now/CVE-2017-16346.md): An attacker could send an authenticated HTTP request to trigger this vulnerability in Insteon Hub running firmware version 1012. (CVSS 8.5, Insteon)
- [CVE-2017-16347](https://cve.now/CVE-2017-16347.md): An attacker could send an authenticated HTTP request to trigger this vulnerability in Insteon Hub running firmware version 1012. (CVSS 8.5, Insteon)
- [CVE-2017-16349](https://cve.now/CVE-2017-16349.md): An exploitable XML external entity vulnerability exists in the reporting functionality of SAP BPC. (CVSS 6.4, Insteon SAP)
- [CVE-2018-1154](https://cve.now/CVE-2018-1154.md): In SecurityCenter versions prior to 5.7.0, a username enumeration issue could allow an unauthenticated attacker to automate the discovery of (no CVSS, Tenable SecurityCenter)
- [CVE-2018-1155](https://cve.now/CVE-2018-1155.md): In SecurityCenter versions prior to 5.7.0, a cross-site scripting (XSS) issue could allow an authenticated attacker to inject JavaScript cod (no CVSS, Tenable SecurityCenter)
- [CVE-2018-14851](https://cve.now/CVE-2018-14851.md): exif\_process\_IFD\_in\_MAKERNOTE in ext/exif/exif.c in PHP before 5.6.37, 7.0.x before 7.0.31, 7.1.x before 7.1.20, and 7.2.x before 7.2.8 allo (no CVSS)
- [CVE-2018-3834](https://cve.now/CVE-2018-3834.md): An exploitable permanent denial of service vulnerability exists in Insteon Hub running firmware version 1013. (CVSS 8.7, Insteon)
- [CVE-2018-10921](https://cve.now/CVE-2018-10921.md): Certain input files may trigger an integer overflow in ttembed input file processing. (CVSS 4.3, \[UNKNOWN\] ttembed)
- [CVE-2018-10922](https://cve.now/CVE-2018-10922.md): An input validation flaw exists in ttembed. (CVSS 7.5, \[UNKNOWN\] ttembed)
- [CVE-2018-7649](https://cve.now/CVE-2018-7649.md): Monitorix before 3.10.1 allows XSS via CGI variables. (no CVSS)
- [CVE-2017-9118](https://cve.now/CVE-2017-9118.md): PHP 7.1.5 has an Out of bounds access in php\_pcre\_replace\_impl via a crafted preg\_replace call. (no CVSS)
- [CVE-2017-9120](https://cve.now/CVE-2017-9120.md): PHP 7.x through 7.1.5 allows remote attackers to cause a denial of service (buffer overflow and application crash) or possibly have unspecif (no CVSS)
- [CVE-2018-1336](https://cve.now/CVE-2018-1336.md): An improper handing of overflow in the UTF-8 decoder with supplementary characters can lead to an infinite loop in the decoder causing a Den (no CVSS, Apache Software Foundation Apache Tomcat · org.apache.tomca…)
- [CVE-2018-1554](https://cve.now/CVE-2018-1554.md): IBM Maximo Asset Management 7.6 is vulnerable to cross-site scripting. (CVSS 5.4, IBM Maximo Asset Management)
- [CVE-2018-8037](https://cve.now/CVE-2018-8037.md): If an async request was completed by the application at the same time as the container triggered the async timeout, a race condition existed (no CVSS, Apache Software Foundation Apache Tomcat · org.apache.tomca…)
- [CVE-2018-10920](https://cve.now/CVE-2018-10920.md): Improper input validation bug in DNS resolver component of Knot Resolver before 2.4.1 allows remote attacker to poison cache. (CVSS 7.5, cz.nic knot-resolver)
- [CVE-2018-12448](https://cve.now/CVE-2018-12448.md): Whale Browser before 1.3.48.4 displays no URL information but only a title of a web page on the browser's address bar when visiting a non-ht (no CVSS, NAVER Whale Browser)
- [CVE-2018-8032](https://cve.now/CVE-2018-8032.md): Apache Axis 1.x up to and including 1.4 is vulnerable to a cross-site scripting (XSS) attack in the default servlet/services. (no CVSS, Apache Software Foundation Apache Axis · org.apache.axis… +1)
- [CVE-2018-2933](https://cve.now/CVE-2018-2933.md): Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: WLS Core Components). (no CVSS, Oracle WebLogic Server)
- [CVE-2018-3108](https://cve.now/CVE-2018-3108.md): Vulnerability in the Oracle Fusion Middleware component of Oracle Fusion Middleware (subcomponent: Oracle Notification Service). (no CVSS, Oracle Fusion Middleware)
- [CVE-2018-3109](https://cve.now/CVE-2018-3109.md): Vulnerability in the Oracle Fusion Middleware MapViewer component of Oracle Fusion Middleware (subcomponent: Map Builder). (no CVSS, Oracle Fusion Middleware MapViewer)
- [CVE-2018-14847](https://cve.now/CVE-2018-14847.md): MikroTik RouterOS through 6.42 allows unauthenticated remote attackers to read arbitrary files and remote authenticated attackers to write a (CVSS 9.1, KEV)
- [CVE-2018-14838](https://cve.now/CVE-2018-14838.md): rejucms 2.1 has stored XSS via the admin/book.php content parameter. (no CVSS)
- [CVE-2018-14840](https://cve.now/CVE-2018-14840.md): uploads/.htaccess in Subrion CMS 4.2.1 allows XSS because it does not block .html file uploads (but does block, for example, .htm file uploa (no CVSS, intelliants/subrion)
- [CVE-2018-14835](https://cve.now/CVE-2018-14835.md): Subrion CMS v4.2.1 is vulnerable to Stored XSS because of no escaping added to the tooltip information being displayed in multiple areas. (no CVSS, intelliants/subrion)
- [CVE-2018-14836](https://cve.now/CVE-2018-14836.md): Subrion 4.2.1 is vulnerable to Improper Access control because user groups not having access to the Admin panel are able to access it (but n (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2018-08-02
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.