CVEs published August 8, 2018
23 CVEs were published on August 8, 2018: 0 critical, 1 high.
- Published
- 23
- Critical
- 0
- High
- 1
- Medium
- 0
- Low
- 0
- Unrated
- 22
- Now in CISA KEV
- 0
- Fix available
- 3
Most affected products
- Apache Software Foundation Apache CouchDB
- 1
- code.gitea.io/gitea · gogs.io/gogs
- 1
- gogs.io/gogs
- 1
- HackerOne aedes · aedes
- 1
- TIBCO Software TIBCO ActiveMatrix BusinessWorks
- 1
High 1
Medium, low and unrated 22
- CVE-2018-3778Improper authorization in aedes version <0.35.0 will publish a LWT in a channel when a client is not authorized.HackerOne aedes · aedes
- CVE-2018-14526An issue was discovered in rsn_supp/wpa.c in wpa_supplicant 2.0 through 2.6.
- CVE-2018-11561An integer overflow in the unprotected distributeToken function of a smart contract implementation for EETHER (EETHER), an Ethereum ERC20 to
- CVE-2018-11769CouchDB administrative users before 2.2.0 can configure the database server via HTTP(S).Apache Software Foundation Apache CouchDB
- CVE-2018-15202An issue was discovered in Juunan06 eCommerce through 2018-08-05.
- CVE-2018-15203An issue was discovered in Ignited CMS through 2017-02-19.
- CVE-2018-15209ChopUpSingleUncompressedStrip in tif_dirread.c in LibTIFF 4.0.9 allows remote attackers to cause a denial of service (heap-based buffer over
- CVE-2018-15197An issue was discovered in OneThink v1.1.
- CVE-2018-15198An issue was discovered in OneThink v1.1.
- CVE-2018-15199AuraCMS 2.3 allows XSS via a Bukutamu -> AddGuestbook action.
- CVE-2018-15192An SSRF vulnerability in webhooks in Gitea through 1.5.0-rc2 and Gogs through 0.11.53 allows remote attackers to access intranet services.code.gitea.io/gitea · gogs.io/gogs
- CVE-2018-15193A CSRF vulnerability in the admin panel in Gogs through 0.11.53 allows remote attackers to execute admin operations via a crafted issue / li
- CVE-2013-7464In csrf-magic before 1.0.4, if $GLOBALS['csrf']['secret'] is not configured, the Anti-CSRF Token used is predictable and would permit an att
- CVE-2018-15137CeLa Link CLR-M20 devices allow unauthorized users to upload any file (e.g., asp, aspx, cfm, html, jhtml, jsp, or shtml), which causes remot
- CVE-2018-15168A SQL Injection vulnerability exists in the Zoho ManageEngine Applications Manager 13 before build 13820 via the resids parameter in a /edit
- CVE-2018-15169A reflected Cross-site scripting (XSS) vulnerability in Zoho ManageEngine Applications Manager 13 before build 13820 allows remote attackers
- CVE-2018-15173Nmap through 7.70, when the -sV option is used, allows remote attackers to cause a denial of service (stack consumption and application cras
- CVE-2018-15174XnView 2.45 allows remote attackers to cause a denial of service (Read Access Violation at the Instruction Pointer and application crash) or
- CVE-2018-15175XnView 2.45 allows remote attackers to cause a denial of service (User Mode Write AV starting at Qt5Core!QVariant::~QVariant+0x0000000000000
- CVE-2018-15176XnView 2.45 allows remote attackers to cause a denial of service (User Mode Write AV starting at MSVCR120!memcpy+0x0000000000000074 and appl
- CVE-2018-15177In Gxlcms 2.0, a news/index.php?s=Admin-Admin-Insert CSRF attack can add an administrator account.
- CVE-2018-15178Open redirect vulnerability in Gogs before 0.12 allows remote attackers to redirect users to arbitrary websites and conduct phishing attacksgogs.io/gogs