# CVEs published 2018-08-08

23 CVEs were published on August 8, 2018: 0 critical, 1 high. Days are UTC.

- [CVE-2018-3778](https://cve.now/CVE-2018-3778.md): Improper authorization in aedes version \<0.35.0 will publish a LWT in a channel when a client is not authorized. (no CVSS, HackerOne aedes · aedes)
- [CVE-2018-14526](https://cve.now/CVE-2018-14526.md): An issue was discovered in rsn\_supp/wpa.c in wpa\_supplicant 2.0 through 2.6. (no CVSS)
- [CVE-2018-11561](https://cve.now/CVE-2018-11561.md): An integer overflow in the unprotected distributeToken function of a smart contract implementation for EETHER (EETHER), an Ethereum ERC20 to (no CVSS)
- [CVE-2018-11769](https://cve.now/CVE-2018-11769.md): CouchDB administrative users before 2.2.0 can configure the database server via HTTP(S). (no CVSS, Apache Software Foundation Apache CouchDB)
- [CVE-2018-12408](https://cve.now/CVE-2018-12408.md): TIBCO ActiveMatrix BusinessWorks 5.X XML eXternal Entity Vulnerability (CVSS 7.5, TIBCO Software TIBCO ActiveMatrix BusinessWorks)
- [CVE-2018-15202](https://cve.now/CVE-2018-15202.md): An issue was discovered in Juunan06 eCommerce through 2018-08-05. (no CVSS)
- [CVE-2018-15203](https://cve.now/CVE-2018-15203.md): An issue was discovered in Ignited CMS through 2017-02-19. (no CVSS)
- [CVE-2018-15209](https://cve.now/CVE-2018-15209.md): ChopUpSingleUncompressedStrip in tif\_dirread.c in LibTIFF 4.0.9 allows remote attackers to cause a denial of service (heap-based buffer over (no CVSS)
- [CVE-2018-15197](https://cve.now/CVE-2018-15197.md): An issue was discovered in OneThink v1.1. (no CVSS)
- [CVE-2018-15198](https://cve.now/CVE-2018-15198.md): An issue was discovered in OneThink v1.1. (no CVSS)
- [CVE-2018-15199](https://cve.now/CVE-2018-15199.md): AuraCMS 2.3 allows XSS via a Bukutamu -\> AddGuestbook action. (no CVSS)
- [CVE-2018-15192](https://cve.now/CVE-2018-15192.md): An SSRF vulnerability in webhooks in Gitea through 1.5.0-rc2 and Gogs through 0.11.53 allows remote attackers to access intranet services. (no CVSS, code.gitea.io/gitea · gogs.io/gogs)
- [CVE-2018-15193](https://cve.now/CVE-2018-15193.md): A CSRF vulnerability in the admin panel in Gogs through 0.11.53 allows remote attackers to execute admin operations via a crafted issue / li (no CVSS)
- [CVE-2013-7464](https://cve.now/CVE-2013-7464.md): In csrf-magic before 1.0.4, if $GLOBALS\['csrf'\]\['secret'\] is not configured, the Anti-CSRF Token used is predictable and would permit an att (no CVSS)
- [CVE-2018-15137](https://cve.now/CVE-2018-15137.md): CeLa Link CLR-M20 devices allow unauthorized users to upload any file (e.g., asp, aspx, cfm, html, jhtml, jsp, or shtml), which causes remot (no CVSS)
- [CVE-2018-15168](https://cve.now/CVE-2018-15168.md): A SQL Injection vulnerability exists in the Zoho ManageEngine Applications Manager 13 before build 13820 via the resids parameter in a /edit (no CVSS)
- [CVE-2018-15169](https://cve.now/CVE-2018-15169.md): A reflected Cross-site scripting (XSS) vulnerability in Zoho ManageEngine Applications Manager 13 before build 13820 allows remote attackers (no CVSS)
- [CVE-2018-15173](https://cve.now/CVE-2018-15173.md): Nmap through 7.70, when the -sV option is used, allows remote attackers to cause a denial of service (stack consumption and application cras (no CVSS)
- [CVE-2018-15174](https://cve.now/CVE-2018-15174.md): XnView 2.45 allows remote attackers to cause a denial of service (Read Access Violation at the Instruction Pointer and application crash) or (no CVSS)
- [CVE-2018-15175](https://cve.now/CVE-2018-15175.md): XnView 2.45 allows remote attackers to cause a denial of service (User Mode Write AV starting at Qt5Core!QVariant::~QVariant+0x0000000000000 (no CVSS)
- [CVE-2018-15176](https://cve.now/CVE-2018-15176.md): XnView 2.45 allows remote attackers to cause a denial of service (User Mode Write AV starting at MSVCR120!memcpy+0x0000000000000074 and appl (no CVSS)
- [CVE-2018-15177](https://cve.now/CVE-2018-15177.md): In Gxlcms 2.0, a news/index.php?s=Admin-Admin-Insert CSRF attack can add an administrator account. (no CVSS)
- [CVE-2018-15178](https://cve.now/CVE-2018-15178.md): Open redirect vulnerability in Gogs before 0.12 allows remote attackers to redirect users to arbitrary websites and conduct phishing attacks (no CVSS, gogs.io/gogs)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2018-08-08
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.