# CVEs published 2018-08-06

81 CVEs were published on August 6, 2018: 0 critical, 2 high. Days are UTC.

- [CVE-2017-2654](https://cve.now/CVE-2017-2654.md): jenkins-email-ext before version 2.57.1 is vulnerable to an Information Exposure. (CVSS 3.7, \[UNKNOWN\] jenkins-email-ext · org.jenkins-ci.plugins:email-…)
- [CVE-2017-16252](https://cve.now/CVE-2017-16252.md): Specially crafted commands sent through the PubNub service in Insteon Hub 2245-222 with firmware version 1012 can cause a stack-based buffer (CVSS 8.5, Talos Insteon)
- [CVE-2017-16653](https://cve.now/CVE-2017-16653.md): An issue was discovered in Symfony before 2.7.38, 2.8.31, 3.2.14, 3.3.13, 3.4-BETA5, and 4.0-BETA5. (no CVSS, symfony/security-csrf · symfony/security +1)
- [CVE-2017-16654](https://cve.now/CVE-2017-16654.md): An issue was discovered in Symfony before 2.7.38, 2.8.31, 3.2.14, 3.3.13, 3.4-BETA5, and 4.0-BETA5. (no CVSS, symfony/intl · symfony/symfony)
- [CVE-2017-16790](https://cve.now/CVE-2017-16790.md): An issue was discovered in Symfony before 2.7.38, 2.8.31, 3.2.14, 3.3.13, 3.4-BETA5, and 4.0-BETA5. (no CVSS, symfony/form · symfony/symfony)
- [CVE-2018-14857](https://cve.now/CVE-2018-14857.md): Unrestricted file upload (with remote code execution) in require/mail/NotificationMail.php in Webconsole in OCS Inventory NG OCS Inventory S (no CVSS)
- [CVE-2018-14869](https://cve.now/CVE-2018-14869.md): PHP Template Store Script 3.0.6 allows XSS via the Address line 1, Address Line 2, Bank name, or A/C Holder name field in a profile. (no CVSS)
- [CVE-2016-4391](https://cve.now/CVE-2016-4391.md): A remote code execution security vulnerability has been identified in all versions of the HP ArcSight WINC Connector prior to v7.3.0. (no CVSS, Hewlett Packard Enterprise HP ArcSight WINC Connector)
- [CVE-2016-4392](https://cve.now/CVE-2016-4392.md): A remote cross site scripting vulnerability has been identified in HP Business Service Management software v9.1x, v9.20 - v9.25IP1. (no CVSS, Hewlett Packard Enterprise HP Business Service Manager)
- [CVE-2016-4397](https://cve.now/CVE-2016-4397.md): A local code execution security vulnerability was identified in HP Network Node Manager i (NNMi) v10.00, v10.10 and v10.20 Software. (no CVSS, Hewlett Packard Enterprise HP Network Node Manager)
- [CVE-2016-4398](https://cve.now/CVE-2016-4398.md): A remote arbitrary code execution vulnerability was identified in HP Network Node Manager i (NNMi) Software 10.00, 10.01 (patch1), 10.01 (pa (no CVSS, Hewlett Packard Enterprise HP Network Node Manager)
- [CVE-2016-4399](https://cve.now/CVE-2016-4399.md): A security vulnerability was identified in HP Network Node Manager i (NNMi) Software 10.00, 10.01 (patch1), 10.01 (patch 2), 10.10. (no CVSS, Hewlett Packard Enterprise HP Network Node Manager)
- [CVE-2016-4400](https://cve.now/CVE-2016-4400.md): A security vulnerability was identified in HP Network Node Manager i (NNMi) Software 10.00, 10.01 (patch1), 10.01 (patch 2), 10.10. (no CVSS, Hewlett Packard Enterprise HP Network Node Manager)
- [CVE-2016-4402](https://cve.now/CVE-2016-4402.md): A security vulnerability was identified in the Filter SDK component of HP KeyView earlier than v11.2. (no CVSS, Hewlett Packard Enterprise HP Keyview)
- [CVE-2016-4403](https://cve.now/CVE-2016-4403.md): A security vulnerability was identified in the Filter SDK component of HP KeyView earlier than v11.2. (no CVSS, Hewlett Packard Enterprise HP Keyview)
- [CVE-2016-4404](https://cve.now/CVE-2016-4404.md): A security vulnerability was identified in the Filter SDK component of HP KeyView earlier than v11.2. (no CVSS, Hewlett Packard Enterprise HP Keyview)
- [CVE-2016-4405](https://cve.now/CVE-2016-4405.md): A remote code execution vulnerability was identified in HP Business Service Management (BSM) using Apache Commons Collection Java Deserializ (no CVSS, Hewlett Packard Enterprise HP Business Service Manager)
- [CVE-2016-4406](https://cve.now/CVE-2016-4406.md): A remote cross site scripting vulnerability was identified in HPE iLO 3 all version prior to v1.88 and HPE iLO 4 all versions prior to v2.44 (no CVSS, Hewlett Packard Enterprise HP Integrated Lights-Out 3 (iLO…)
- [CVE-2016-8526](https://cve.now/CVE-2016-8526.md): Aruba Airwave all versions up to, but not including, 8.2.3.1 is vulnerable to an XML external entities (XXE). (no CVSS, Hewlett Packard Enterprise Aruba AirWave)
- [CVE-2016-8527](https://cve.now/CVE-2016-8527.md): Aruba Airwave all versions up to, but not including, 8.2.3.1 is vulnerable to a reflected cross-site scripting (XSS). (no CVSS, Hewlett Packard Enterprise Aruba AirWave)
- [CVE-2017-8968](https://cve.now/CVE-2017-8968.md): A remote execution of arbitrary code vulnerability has been identified in HPE RESTful Interface Tool 1.5, 2.0 (hprest-1.5-79.x86\_64.rpm, ilo (no CVSS, Hewlett Packard Enterprise HPE RESTful Interface Tool)
- [CVE-2017-8987](https://cve.now/CVE-2017-8987.md): A Unauthenticated Remote Denial of Service vulnerability was identified in HPE Integrated Lights-Out 3 (iLO 3) version v1.88 only. (no CVSS, Hewlett Packard Enterprise HPE Integrated Lights-Out)
- [CVE-2017-8988](https://cve.now/CVE-2017-8988.md): A Remote Bypass of Security Restrictions vulnerability was identified in HPE XP Command View Advanced Edition Software Earlier than 8.5.3-00 (no CVSS, Hewlett Packard Enterprise HPE Command View Advanced Edition)
- [CVE-2017-8989](https://cve.now/CVE-2017-8989.md): A security vulnerability in HPE IceWall SSO Dfw 10.0 and 11.0 on RHEL, HP-UX, and Windows could be exploited remotely to allow URL Redirecti (no CVSS, Hewlett Packard Enterprise HPE Icewall DFW)
- [CVE-2017-8990](https://cve.now/CVE-2017-8990.md): A remote code execution vulnerability was identified in HPE Intelligent Management Center (iMC) Wireless Service Manager (WSM) Software earl (no CVSS, Hewlett Packard Enterprise HPE Intelligent Management Cente…)
- [CVE-2017-8991](https://cve.now/CVE-2017-8991.md): HPE has identified a cross site scripting (XSS) vulnerability in HPE CentralView Fraud Risk Management earlier than version CV 6.1. (no CVSS, Hewlett Packard Enterprise HPE CentralView Fraud Risk Manag…)
- [CVE-2017-8992](https://cve.now/CVE-2017-8992.md): HPE has identified a remote privilege escalation vulnerability in HPE CentralView Fraud Risk Management earlier than version CV 6.1. (no CVSS, Hewlett Packard Enterprise HPE CentralView Fraud Risk Manag…)
- [CVE-2017-9000](https://cve.now/CVE-2017-9000.md): ArubaOS, all versions prior to 6.3.1.25, 6.4 prior to 6.4.4.16, 6.5.x prior to 6.5.1.9, 6.5.2, 6.5.3 prior to 6.5.3.3, 6.5.4 prior to 6.5.4. (no CVSS, Hewlett Packard Enterprise ArubaOS)
- [CVE-2017-9001](https://cve.now/CVE-2017-9001.md): Aruba ClearPass 6.6.3 and later includes a feature called "SSH Lockout", which causes ClearPass to lock accounts with too many login failure (no CVSS, Hewlett Packard Enterprise Aruba ClearPass)
- [CVE-2017-9002](https://cve.now/CVE-2017-9002.md): All versions of Aruba ClearPass prior to 6.6.8 contain reflected cross-site scripting vulnerabilities. (no CVSS, Hewlett Packard Enterprise Aruba ClearPass)
- [CVE-2017-9003](https://cve.now/CVE-2017-9003.md): Multiple memory corruption flaws are present in ArubaOS which could allow an unauthenticated user to crash ArubaOS processes. (no CVSS, Hewlett Packard Enterprise ArubaOS)
- [CVE-2018-13877](https://cve.now/CVE-2018-13877.md): The doPayouts() function of the smart contract implementation for MegaCryptoPolis, an Ethereum game, has a Denial of Service vulnerability. (no CVSS)
- [CVE-2018-14716](https://cve.now/CVE-2018-14716.md): A Server Side Template Injection (SSTI) was discovered in the SEOmatic plugin before 3.1.4 for Craft CMS, because requests that don't match (no CVSS, nystudio107/craft-seomatic)
- [CVE-2018-5390](https://cve.now/CVE-2018-5390.md): Linux kernel versions 4.9+ can be forced to make very expensive calls to tcp\_collapse\_ofo\_queue() and tcp\_prune\_ofo\_queue() for every incoming packet which can lead to a denial of service (no CVSS, Linux Kernel)
- [CVE-2018-7058](https://cve.now/CVE-2018-7058.md): Aruba ClearPass, all versions of 6.6.x prior to 6.6.9 are affected by an authentication bypass vulnerability, an attacker can leverage this (no CVSS, Hewlett Packard Enterprise Aruba ClearPass)
- [CVE-2018-7059](https://cve.now/CVE-2018-7059.md): Aruba ClearPass prior to 6.6.9 has a vulnerability in the API that helps to coordinate cluster actions. (no CVSS)
- [CVE-2018-7060](https://cve.now/CVE-2018-7060.md): Aruba ClearPass 6.6.x prior to 6.6.9 and 6.7.x prior to 6.7.1 is vulnerable to CSRF attacks against authenticated users. (no CVSS, Hewlett Packard Enterprise Aruba ClearPass)
- [CVE-2018-7068](https://cve.now/CVE-2018-7068.md): HPE has identified a remote HOST header attack vulnerability in HPE CentralView Fraud Risk Management earlier than version CV 6.1. (no CVSS, Hewlett Packard Enterprise HPE CentralView Fraud Risk Manag…)
- [CVE-2018-7069](https://cve.now/CVE-2018-7069.md): HPE has identified a remote unauthenticated access to files vulnerability in HPE CentralView Fraud Risk Management earlier than version CV 6 (no CVSS, Hewlett Packard Enterprise HPE CentralView Fraud Risk Manag…)
- [CVE-2018-7070](https://cve.now/CVE-2018-7070.md): HPE has identified a remote disclosure of information vulnerability in HPE CentralView Fraud Risk Management earlier than version CV 6.1. (no CVSS, Hewlett Packard Enterprise HPE CentralView Fraud Risk Manag…)
- [CVE-2018-7071](https://cve.now/CVE-2018-7071.md): HPE has identified a remote access to sensitive information vulnerability in HPE Network Function Virtualization Director (NFVD) 4.2.1 prior (no CVSS, Hewlett Packard Enterprise HPE Network Function Virtualizat…)
- [CVE-2018-7072](https://cve.now/CVE-2018-7072.md): A remote bypass of security restrictions vulnerability was identified in HPE Moonshot Provisioning Manager prior to v1.24. (no CVSS, Hewlett Packard Enterprise HPE Moonshot Provisioning Manager)
- [CVE-2018-7073](https://cve.now/CVE-2018-7073.md): A local arbitrary file modification vulnerability was identified in HPE Moonshot Provisioning Manager prior to v1.24. (no CVSS, Hewlett Packard Enterprise HPE Moonshot Provisioning Manager)
- [CVE-2018-7074](https://cve.now/CVE-2018-7074.md): A remote code execution vulnerability was identified in HPE Intelligent Management Center (iMC) PLAT 7.3 E0506P07. (no CVSS, Hewlett Packard Enterprise HPE Intelligent Management Center)
- [CVE-2018-7075](https://cve.now/CVE-2018-7075.md): A remote cross-site scripting (XSS) vulnerability was identified in HPE Intelligent Management Center (iMC) PLAT version v7.3 (E0506). (no CVSS, Hewlett Packard Enterprise HPE Intelligent Management Center)
- [CVE-2018-7078](https://cve.now/CVE-2018-7078.md): A remote code execution was identified in HPE Integrated Lights-Out 4 (iLO 4) earlier than version v2.60 and HPE Integrated Lights-Out 5 (iL (no CVSS, Hewlett Packard Enterprise HPE Integrated Lights-Out 4 (iLO…)
- [CVE-2018-7090](https://cve.now/CVE-2018-7090.md): HPE XP P9000 Command View Advanced Edition Software (CVAE) has local and remote cross site scripting vulnerability in versions 7.0.0-00 to e (no CVSS, Hewlett Packard Enterprise HPE XP P9000 Command View Advanc…)
- [CVE-2018-7091](https://cve.now/CVE-2018-7091.md): HPE XP P9000 Command View Advanced Edition Software (CVAE) has open URL redirection vulnerability in versions 7.0.0-00 to earlier than 8.60- (no CVSS, Hewlett Packard Enterprise HPE XP P9000 Command View Advanc…)
- [CVE-2018-7092](https://cve.now/CVE-2018-7092.md): A potential security vulnerability has been identified in HPE Intelligent Management Center Platform (IMC Plat) 7.3 E0506P09. (no CVSS, Hewlett Packard Enterprise HPE Intelligent Management Cente…)
- [CVE-2017-14447](https://cve.now/CVE-2017-14447.md): An exploitable buffer overflow vulnerability exists in the PubNub message handler for the 'ad' channel of Insteon Hub running firmware versi (CVSS 8.5, Talos Insteon)
- [CVE-2017-6920](https://cve.now/CVE-2017-6920.md): Drupal core 8 before versions 8.3.4 allows remote attackers to execute arbitrary code due to the PECL YAML parser not handling PHP objects s (no CVSS, Drupal.org Drupal Core · drupal/core +1)
- [CVE-2018-14960](https://cve.now/CVE-2018-14960.md): Xiao5uCompany 1.7 has CSRF via admin/Admin.asp. (no CVSS)
- [CVE-2018-14961](https://cve.now/CVE-2018-14961.md): dl/dl\_sendmail.php in zzcms 8.3 has SQL Injection via the sql parameter. (no CVSS)
- [CVE-2018-14962](https://cve.now/CVE-2018-14962.md): zzcms 8.3 has stored XSS related to the content variable in user/manage.php and zt/show.php. (no CVSS)
- [CVE-2018-14963](https://cve.now/CVE-2018-14963.md): zzcms 8.3 has CSRF via the admin/adminadd.php?action=add URI. (no CVSS)
- [CVE-2018-14964](https://cve.now/CVE-2018-14964.md): An issue was discovered in EMLsoft 5.4.5. (no CVSS)
- [CVE-2018-14965](https://cve.now/CVE-2018-14965.md): An issue was discovered in EMLsoft 5.4.5. (no CVSS)
- [CVE-2018-14966](https://cve.now/CVE-2018-14966.md): An issue was discovered in EMLsoft 5.4.5. (no CVSS)
- [CVE-2018-14967](https://cve.now/CVE-2018-14967.md): An issue was discovered in EMLsoft 5.4.5. (no CVSS)
- [CVE-2018-14968](https://cve.now/CVE-2018-14968.md): An issue was discovered in EMLsoft 5.4.5. (no CVSS)
- [CVE-2018-14969](https://cve.now/CVE-2018-14969.md): An issue was discovered in QCMS 3.0.1. (no CVSS)
- [CVE-2018-14970](https://cve.now/CVE-2018-14970.md): An issue was discovered in QCMS 3.0.1. (no CVSS)
- [CVE-2018-14971](https://cve.now/CVE-2018-14971.md): An issue was discovered in QCMS 3.0.1. (no CVSS)
- [CVE-2018-14972](https://cve.now/CVE-2018-14972.md): An issue was discovered in QCMS 3.0.1. (no CVSS)
- [CVE-2018-14973](https://cve.now/CVE-2018-14973.md): An issue was discovered in QCMS 3.0.1. (no CVSS)
- [CVE-2018-14974](https://cve.now/CVE-2018-14974.md): An issue was discovered in QCMS 3.0.1. (no CVSS)
- [CVE-2018-14975](https://cve.now/CVE-2018-14975.md): An issue was discovered in QCMS 3.0.1. (no CVSS)
- [CVE-2018-14976](https://cve.now/CVE-2018-14976.md): An issue was discovered in QCMS 3.0.1. (no CVSS)
- [CVE-2018-14977](https://cve.now/CVE-2018-14977.md): An issue was discovered in QCMS 3.0.1. (no CVSS)
- [CVE-2018-14978](https://cve.now/CVE-2018-14978.md): An issue was discovered in QCMS 3.0.1. (no CVSS)
- [CVE-2017-1366](https://cve.now/CVE-2017-1366.md): IBM Security Identity Governance Virtual Appliance 5.2 through 5.2.3.2 uses weaker than expected cryptographic algorithms that could allow a (CVSS 5.9, IBM Security Identity Governance and Intelligence)
- [CVE-2017-1368](https://cve.now/CVE-2017-1368.md): IBM Security Identity Governance Virtual Appliance 5.2 through 5.2.3.2 does not set the secure attribute on authorization tokens or session (CVSS 4.3, IBM Security Identity Governance and Intelligence)
- [CVE-2017-1396](https://cve.now/CVE-2017-1396.md): IBM Security Identity Governance Virtual Appliance 5.2 through 5.2.3.2 specifies permissions for a security-critical resource in a way that (CVSS 4.2, IBM Security Identity Governance and Intelligence)
- [CVE-2017-1409](https://cve.now/CVE-2017-1409.md): IBM Security Identity Governance Virtual Appliance 5.2 through 5.2.3.2 discloses sensitive information to unauthorized users. (CVSS 5.3, IBM Security Identity Governance and Intelligence)
- [CVE-2017-1411](https://cve.now/CVE-2017-1411.md): IBM Security Identity Governance Virtual Appliance 5.2 through 5.2.3.2 does not require that users should have strong passwords by default, (CVSS 5.9, IBM Security Identity Governance and Intelligence)
- [CVE-2017-1412](https://cve.now/CVE-2017-1412.md): IBM Security Identity Governance Virtual Appliance 5.2 through 5.2.3.2 generates an error message that includes sensitive information about (CVSS 4.3, IBM Security Identity Governance and Intelligence)
- [CVE-2017-1755](https://cve.now/CVE-2017-1755.md): IBM Security Identity Governance Virtual Appliance 5.2 through 5.2.3.2 could allow a local attacker to inject commands into malicious files (CVSS 6.5, IBM Security Identity Governance and Intelligence)
- [CVE-2018-1422](https://cve.now/CVE-2018-1422.md): IBM Jazz Foundation products (IBM Rational DOORS Next Generation 5.0 through 5.0.2 and 6.0 through 6.0.5) are vulnerable to cross-site scrip (CVSS 5.4, IBM Rational DOORS Next Generation)
- [CVE-2018-1528](https://cve.now/CVE-2018-1528.md): IBM Maximo Asset Management 7.6 through 7.6.3 could allow an authenticated user to obtain sensitive information from the WhoAmI API. (CVSS 4.3, IBM Maximo Asset Management)
- [CVE-2018-1551](https://cve.now/CVE-2018-1551.md): IBM WebSphere MQ 8.0.0.2 through 8.0.0.8 and 9.0.0.0 through 9.0.0.3 could allow users to have more authority than they should have if an MQ (CVSS 3.1, IBM WebSphere MQ)
- [CVE-2017-12614](https://cve.now/CVE-2017-12614.md): It was noticed an XSS in certain 404 pages that could be exploited to perform an XSS attack. (no CVSS, Apache Software Foundation Apache Airflow · apache-airflow)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2018-08-06
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.