CVEs published August 6, 2018
81 CVEs were published on August 6, 2018: 0 critical, 2 high.
- Published
- 81
- Critical
- 0
- High
- 2
- Medium
- 9
- Low
- 2
- Unrated
- 68
- Now in CISA KEV
- 0
- Fix available
- 7
Most affected products
- IBM Security Identity Governance and Intelligence
- 7
- Hewlett Packard Enterprise HPE CentralView Fraud Risk Manag…
- 5
- Hewlett Packard Enterprise Aruba ClearPass
- 4
- Hewlett Packard Enterprise HP Network Node Manager
- 4
- Hewlett Packard Enterprise HP Keyview
- 3
- Hewlett Packard Enterprise Aruba AirWave
- 2
- Hewlett Packard Enterprise ArubaOS
- 2
- Hewlett Packard Enterprise HP Business Service Manager
- 2
- Hewlett Packard Enterprise HPE Intelligent Management Cente…
- 2
- Hewlett Packard Enterprise HPE Intelligent Management Center
- 2
High 2
- CVE-2017-16252Specially crafted commands sent through the PubNub service in Insteon Hub 2245-222 with firmware version 1012 can cause a stack-based bufferTalos Insteon
- CVE-2017-14447An exploitable buffer overflow vulnerability exists in the PubNub message handler for the 'ad' channel of Insteon Hub running firmware versiTalos Insteon
Medium, low and unrated 79
- CVE-2017-2654jenkins-email-ext before version 2.57.1 is vulnerable to an Information Exposure.[UNKNOWN] jenkins-email-ext · org.jenkins-ci.plugins:email-…
- CVE-2017-16653An issue was discovered in Symfony before 2.7.38, 2.8.31, 3.2.14, 3.3.13, 3.4-BETA5, and 4.0-BETA5.symfony/security-csrf · symfony/security +1
- CVE-2017-16654An issue was discovered in Symfony before 2.7.38, 2.8.31, 3.2.14, 3.3.13, 3.4-BETA5, and 4.0-BETA5.symfony/intl · symfony/symfony
- CVE-2017-16790An issue was discovered in Symfony before 2.7.38, 2.8.31, 3.2.14, 3.3.13, 3.4-BETA5, and 4.0-BETA5.symfony/form · symfony/symfony
- CVE-2018-14857Unrestricted file upload (with remote code execution) in require/mail/NotificationMail.php in Webconsole in OCS Inventory NG OCS Inventory S
- CVE-2018-14869PHP Template Store Script 3.0.6 allows XSS via the Address line 1, Address Line 2, Bank name, or A/C Holder name field in a profile.
- CVE-2016-4391A remote code execution security vulnerability has been identified in all versions of the HP ArcSight WINC Connector prior to v7.3.0.Hewlett Packard Enterprise HP ArcSight WINC Connector
- CVE-2016-4392A remote cross site scripting vulnerability has been identified in HP Business Service Management software v9.1x, v9.20 - v9.25IP1.Hewlett Packard Enterprise HP Business Service Manager
- CVE-2016-4397A local code execution security vulnerability was identified in HP Network Node Manager i (NNMi) v10.00, v10.10 and v10.20 Software.Hewlett Packard Enterprise HP Network Node Manager
- CVE-2016-4398A remote arbitrary code execution vulnerability was identified in HP Network Node Manager i (NNMi) Software 10.00, 10.01 (patch1), 10.01 (paHewlett Packard Enterprise HP Network Node Manager
- CVE-2016-4399A security vulnerability was identified in HP Network Node Manager i (NNMi) Software 10.00, 10.01 (patch1), 10.01 (patch 2), 10.10.Hewlett Packard Enterprise HP Network Node Manager
- CVE-2016-4400A security vulnerability was identified in HP Network Node Manager i (NNMi) Software 10.00, 10.01 (patch1), 10.01 (patch 2), 10.10.Hewlett Packard Enterprise HP Network Node Manager
- CVE-2016-4402A security vulnerability was identified in the Filter SDK component of HP KeyView earlier than v11.2.Hewlett Packard Enterprise HP Keyview
- CVE-2016-4403A security vulnerability was identified in the Filter SDK component of HP KeyView earlier than v11.2.Hewlett Packard Enterprise HP Keyview
- CVE-2016-4404A security vulnerability was identified in the Filter SDK component of HP KeyView earlier than v11.2.Hewlett Packard Enterprise HP Keyview
- CVE-2016-4405A remote code execution vulnerability was identified in HP Business Service Management (BSM) using Apache Commons Collection Java DeserializHewlett Packard Enterprise HP Business Service Manager
- CVE-2016-4406A remote cross site scripting vulnerability was identified in HPE iLO 3 all version prior to v1.88 and HPE iLO 4 all versions prior to v2.44Hewlett Packard Enterprise HP Integrated Lights-Out 3 (iLO…
- CVE-2016-8526Aruba Airwave all versions up to, but not including, 8.2.3.1 is vulnerable to an XML external entities (XXE).Hewlett Packard Enterprise Aruba AirWave
- CVE-2016-8527Aruba Airwave all versions up to, but not including, 8.2.3.1 is vulnerable to a reflected cross-site scripting (XSS).Hewlett Packard Enterprise Aruba AirWave
- CVE-2017-8968A remote execution of arbitrary code vulnerability has been identified in HPE RESTful Interface Tool 1.5, 2.0 (hprest-1.5-79.x86_64.rpm, iloHewlett Packard Enterprise HPE RESTful Interface Tool
- CVE-2017-8987A Unauthenticated Remote Denial of Service vulnerability was identified in HPE Integrated Lights-Out 3 (iLO 3) version v1.88 only.Hewlett Packard Enterprise HPE Integrated Lights-Out
- CVE-2017-8988A Remote Bypass of Security Restrictions vulnerability was identified in HPE XP Command View Advanced Edition Software Earlier than 8.5.3-00Hewlett Packard Enterprise HPE Command View Advanced Edition
- CVE-2017-8989A security vulnerability in HPE IceWall SSO Dfw 10.0 and 11.0 on RHEL, HP-UX, and Windows could be exploited remotely to allow URL RedirectiHewlett Packard Enterprise HPE Icewall DFW
- CVE-2017-8990A remote code execution vulnerability was identified in HPE Intelligent Management Center (iMC) Wireless Service Manager (WSM) Software earlHewlett Packard Enterprise HPE Intelligent Management Cente…
- CVE-2017-8991HPE has identified a cross site scripting (XSS) vulnerability in HPE CentralView Fraud Risk Management earlier than version CV 6.1.Hewlett Packard Enterprise HPE CentralView Fraud Risk Manag…
- CVE-2017-8992HPE has identified a remote privilege escalation vulnerability in HPE CentralView Fraud Risk Management earlier than version CV 6.1.Hewlett Packard Enterprise HPE CentralView Fraud Risk Manag…
- CVE-2017-9000ArubaOS, all versions prior to 6.3.1.25, 6.4 prior to 6.4.4.16, 6.5.x prior to 6.5.1.9, 6.5.2, 6.5.3 prior to 6.5.3.3, 6.5.4 prior to 6.5.4.Hewlett Packard Enterprise ArubaOS
- CVE-2017-9001Aruba ClearPass 6.6.3 and later includes a feature called "SSH Lockout", which causes ClearPass to lock accounts with too many login failureHewlett Packard Enterprise Aruba ClearPass
- CVE-2017-9002All versions of Aruba ClearPass prior to 6.6.8 contain reflected cross-site scripting vulnerabilities.Hewlett Packard Enterprise Aruba ClearPass
- CVE-2017-9003Multiple memory corruption flaws are present in ArubaOS which could allow an unauthenticated user to crash ArubaOS processes.Hewlett Packard Enterprise ArubaOS
- CVE-2018-13877The doPayouts() function of the smart contract implementation for MegaCryptoPolis, an Ethereum game, has a Denial of Service vulnerability.
- CVE-2018-14716A Server Side Template Injection (SSTI) was discovered in the SEOmatic plugin before 3.1.4 for Craft CMS, because requests that don't match nystudio107/craft-seomatic
- CVE-2018-5390Linux kernel versions 4.9+ can be forced to make very expensive calls to tcp_collapse_ofo_queue() and tcp_prune_ofo_queue() for every incoming packet which can lead to a denial of serviceLinux Kernel
- CVE-2018-7058Aruba ClearPass, all versions of 6.6.x prior to 6.6.9 are affected by an authentication bypass vulnerability, an attacker can leverage this Hewlett Packard Enterprise Aruba ClearPass
- CVE-2018-7059Aruba ClearPass prior to 6.6.9 has a vulnerability in the API that helps to coordinate cluster actions.
- CVE-2018-7060Aruba ClearPass 6.6.x prior to 6.6.9 and 6.7.x prior to 6.7.1 is vulnerable to CSRF attacks against authenticated users.Hewlett Packard Enterprise Aruba ClearPass
- CVE-2018-7068HPE has identified a remote HOST header attack vulnerability in HPE CentralView Fraud Risk Management earlier than version CV 6.1.Hewlett Packard Enterprise HPE CentralView Fraud Risk Manag…
- CVE-2018-7069HPE has identified a remote unauthenticated access to files vulnerability in HPE CentralView Fraud Risk Management earlier than version CV 6Hewlett Packard Enterprise HPE CentralView Fraud Risk Manag…
- CVE-2018-7070HPE has identified a remote disclosure of information vulnerability in HPE CentralView Fraud Risk Management earlier than version CV 6.1.Hewlett Packard Enterprise HPE CentralView Fraud Risk Manag…
- CVE-2018-7071HPE has identified a remote access to sensitive information vulnerability in HPE Network Function Virtualization Director (NFVD) 4.2.1 priorHewlett Packard Enterprise HPE Network Function Virtualizat…
- CVE-2018-7072A remote bypass of security restrictions vulnerability was identified in HPE Moonshot Provisioning Manager prior to v1.24.Hewlett Packard Enterprise HPE Moonshot Provisioning Manager
- CVE-2018-7073A local arbitrary file modification vulnerability was identified in HPE Moonshot Provisioning Manager prior to v1.24.Hewlett Packard Enterprise HPE Moonshot Provisioning Manager
- CVE-2018-7074A remote code execution vulnerability was identified in HPE Intelligent Management Center (iMC) PLAT 7.3 E0506P07.Hewlett Packard Enterprise HPE Intelligent Management Center
- CVE-2018-7075A remote cross-site scripting (XSS) vulnerability was identified in HPE Intelligent Management Center (iMC) PLAT version v7.3 (E0506).Hewlett Packard Enterprise HPE Intelligent Management Center
- CVE-2018-7078A remote code execution was identified in HPE Integrated Lights-Out 4 (iLO 4) earlier than version v2.60 and HPE Integrated Lights-Out 5 (iLHewlett Packard Enterprise HPE Integrated Lights-Out 4 (iLO…
- CVE-2018-7090HPE XP P9000 Command View Advanced Edition Software (CVAE) has local and remote cross site scripting vulnerability in versions 7.0.0-00 to eHewlett Packard Enterprise HPE XP P9000 Command View Advanc…
- CVE-2018-7091HPE XP P9000 Command View Advanced Edition Software (CVAE) has open URL redirection vulnerability in versions 7.0.0-00 to earlier than 8.60-Hewlett Packard Enterprise HPE XP P9000 Command View Advanc…
- CVE-2018-7092A potential security vulnerability has been identified in HPE Intelligent Management Center Platform (IMC Plat) 7.3 E0506P09.Hewlett Packard Enterprise HPE Intelligent Management Cente…
- CVE-2017-6920Drupal core 8 before versions 8.3.4 allows remote attackers to execute arbitrary code due to the PECL YAML parser not handling PHP objects sDrupal.org Drupal Core · drupal/core +1
- CVE-2018-14960Xiao5uCompany 1.7 has CSRF via admin/Admin.asp.
- CVE-2018-14961dl/dl_sendmail.php in zzcms 8.3 has SQL Injection via the sql parameter.
- CVE-2018-14962zzcms 8.3 has stored XSS related to the content variable in user/manage.php and zt/show.php.
- CVE-2018-14963zzcms 8.3 has CSRF via the admin/adminadd.php?action=add URI.
- CVE-2018-14964An issue was discovered in EMLsoft 5.4.5.
- CVE-2018-14965An issue was discovered in EMLsoft 5.4.5.
- CVE-2018-14966An issue was discovered in EMLsoft 5.4.5.
- CVE-2018-14967An issue was discovered in EMLsoft 5.4.5.
- CVE-2018-14968An issue was discovered in EMLsoft 5.4.5.
- CVE-2018-14969An issue was discovered in QCMS 3.0.1.
- CVE-2018-14970An issue was discovered in QCMS 3.0.1.
- CVE-2018-14971An issue was discovered in QCMS 3.0.1.
- CVE-2018-14972An issue was discovered in QCMS 3.0.1.
- CVE-2018-14973An issue was discovered in QCMS 3.0.1.
- CVE-2018-14974An issue was discovered in QCMS 3.0.1.
- CVE-2018-14975An issue was discovered in QCMS 3.0.1.
- CVE-2018-14976An issue was discovered in QCMS 3.0.1.
- CVE-2018-14977An issue was discovered in QCMS 3.0.1.
- CVE-2018-14978An issue was discovered in QCMS 3.0.1.
- CVE-2017-1366IBM Security Identity Governance Virtual Appliance 5.2 through 5.2.3.2 uses weaker than expected cryptographic algorithms that could allow aIBM Security Identity Governance and Intelligence
- CVE-2017-1368IBM Security Identity Governance Virtual Appliance 5.2 through 5.2.3.2 does not set the secure attribute on authorization tokens or session IBM Security Identity Governance and Intelligence
- CVE-2017-1396IBM Security Identity Governance Virtual Appliance 5.2 through 5.2.3.2 specifies permissions for a security-critical resource in a way that IBM Security Identity Governance and Intelligence
- CVE-2017-1409IBM Security Identity Governance Virtual Appliance 5.2 through 5.2.3.2 discloses sensitive information to unauthorized users.IBM Security Identity Governance and Intelligence
- CVE-2017-1411IBM Security Identity Governance Virtual Appliance 5.2 through 5.2.3.2 does not require that users should have strong passwords by default, IBM Security Identity Governance and Intelligence
- CVE-2017-1412IBM Security Identity Governance Virtual Appliance 5.2 through 5.2.3.2 generates an error message that includes sensitive information about IBM Security Identity Governance and Intelligence
- CVE-2017-1755IBM Security Identity Governance Virtual Appliance 5.2 through 5.2.3.2 could allow a local attacker to inject commands into malicious files IBM Security Identity Governance and Intelligence
- CVE-2018-1422IBM Jazz Foundation products (IBM Rational DOORS Next Generation 5.0 through 5.0.2 and 6.0 through 6.0.5) are vulnerable to cross-site scripIBM Rational DOORS Next Generation
- CVE-2018-1528IBM Maximo Asset Management 7.6 through 7.6.3 could allow an authenticated user to obtain sensitive information from the WhoAmI API.IBM Maximo Asset Management
- CVE-2018-1551IBM WebSphere MQ 8.0.0.2 through 8.0.0.8 and 9.0.0.0 through 9.0.0.3 could allow users to have more authority than they should have if an MQIBM WebSphere MQ
- CVE-2017-12614It was noticed an XSS in certain 404 pages that could be exploited to perform an XSS attack.Apache Software Foundation Apache Airflow · apache-airflow