# CVEs published 2018-08-09

14 CVEs were published on August 9, 2018: 1 critical, 3 high. 1 is now in CISA KEV. Days are UTC.

- [CVE-2018-10925](https://cve.now/CVE-2018-10925.md): It was discovered that PostgreSQL versions before 10.5, 9.6.10, 9.5.14, 9.4.19, and 9.3.24 failed to properly check authorization on certain (CVSS 7.1, PostgreSQL Global Development Group postgresql)
- [CVE-2018-7686](https://cve.now/CVE-2018-7686.md): Information leakage vulnerability in NetIQ eDirectory before 9.1.1 HF1 due to shared memory usage. (no CVSS, Micro Focus eDirectory)
- [CVE-2018-7692](https://cve.now/CVE-2018-7692.md): Unvalidated redirect vulnerability in in NetIQ eDirectory before 9.1.1 HF1. (no CVSS, Micro Focus NetIQ eDirectory Versions prior to 9.1.1 HF1)
- [CVE-2018-0429](https://cve.now/CVE-2018-0429.md): Stack-based buffer overflow in the Cisco Thor decoder before commit 18de8f9f0762c3a542b1122589edb8af859d9813 allows local users to cause a d (no CVSS)
- [CVE-2018-10915](https://cve.now/CVE-2018-10915.md): A vulnerability was found in libpq, the default PostgreSQL client library where libpq failed to properly reset its internal state between co (CVSS 8.5, PostgreSQL Global Development Group postgresql)
- [CVE-2018-10931](https://cve.now/CVE-2018-10931.md): It was found that cobbler 2.6.x exposed all functions from its CobblerXMLRPCInterface class over XMLRPC. (CVSS 9.8, The Cobbler Project cobbler · cobbler)
- [CVE-2018-14735](https://cve.now/CVE-2018-14735.md): An Information Exposure issue was discovered in Hitachi Command Suite 8.5.3. (no CVSS)
- [CVE-2018-10908](https://cve.now/CVE-2018-10908.md): It was found that vdsm before version 4.20.37 invokes qemu-img on untrusted inputs without limiting resources. (CVSS 6.5, \[UNKNOWN\] vdsm)
- [CVE-2018-15133](https://cve.now/CVE-2018-15133.md): In Laravel Framework through 5.5.40 and 5.6.x through 5.6.29, remote code execution might occur as a result of an unserialize call on a pote (CVSS 8.1, KEV, laravel/framework)
- [CVE-2018-15181](https://cve.now/CVE-2018-15181.md): JioFi 4G Hotspot M2S devices allow attackers to cause a denial of service (secure configuration outage) via an XSS payload in the SSID name (no CVSS)
- [CVE-2018-15182](https://cve.now/CVE-2018-15182.md): PHP Scripts Mall Car Rental Script 2.0.8 has XSS via the FirstName and LastName fields. (no CVSS)
- [CVE-2018-15183](https://cve.now/CVE-2018-15183.md): PHP Scripts Mall Myperfectresume / JobHero / Resume Clone Script 2.0.6 has Stored XSS via the Full Name and Title fields. (no CVSS)
- [CVE-2018-15184](https://cve.now/CVE-2018-15184.md): PHP Scripts Mall Naukri / Shine / Jobsite Clone Script 3.0.4 has Stored XSS via the USERNAME field, a related issue to CVE-2018-6795. (no CVSS)
- [CVE-2018-6922](https://cve.now/CVE-2018-6922.md): One of the data structures that holds TCP segments in all versions of FreeBSD prior to 11.2-RELEASE-p1, 11.1-RELEASE-p12, and 10.4-RELEASE-p (no CVSS, FreeBSD)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2018-08-09
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.