CVEs published August 13, 2018
36 CVEs were published on August 13, 2018: 0 critical, 1 high.
- Published
- 36
- Critical
- 0
- High
- 1
- Medium
- 5
- Low
- 1
- Unrated
- 29
- Now in CISA KEV
- 0
- Fix available
- 2
Most affected products
- Kaspersky Lab Zipato Zipabox Smart Home Controller
- 3
- HP inkjet printers
- 2
- ICS-CERT CNCSoft with ScreenEditor
- 2
- Medtronic MMT- 508 - MiniMed pump · Medtronic MMT – 511… +8
- 2
- [UNKNOWN] atomic-openshift
- 1
- [UNKNOWN] redhat-certification:
- 1
- [UNKNOWN] rpm
- 1
- Apache Software Foundation Apache Spark · org.apache.spa… +1
- 1
- Atlassian Fisheye and Crucible
- 1
- hikvision DS-2DE4xxxW,DS-2DE5xxxW,DS-2DE7xxxW
- 1
High 1
Medium, low and unrated 35
- CVE-2018-10598CNCSoft Version 1.00.83 and prior with ScreenEditor Version 1.00.54 has two out-of-bounds read vulnerabilities could cause the software to cICS-CERT CNCSoft with ScreenEditor
- CVE-2018-10634Medtronic MiniMed MMT-500/MMT-503 Remote Controllers Cleartext Transmission of Sensitive InformationMedtronic MMT- 508 - MiniMed pump · Medtronic MMT – 511… +8
- CVE-2018-10636CNCSoft Version 1.00.83 and prior with ScreenEditor Version 1.00.54 has multiple stack-based buffer overflow vulnerabilities that could causICS-CERT CNCSoft with ScreenEditor
- CVE-2018-14781Medtronic MiniMed MMT-500/MMT-503 Remote Controllers Authentication Bypass by Capture-replayMedtronic MMT- 508 - MiniMed pump · Medtronic MMT – 511… +8
- CVE-2018-15123Insecure configuration storage in Zipato Zipabox Smart Home Controller BOARD REV - 1 with System Version -118 allows remote attacker performKaspersky Lab Zipato Zipabox Smart Home Controller
- CVE-2018-15124Weak hashing algorithm in Zipato Zipabox Smart Home Controller BOARD REV - 1 with System Version -118 allows unauthenticated attacker extracKaspersky Lab Zipato Zipabox Smart Home Controller
- CVE-2018-15125Sensitive Information Disclosure in Zipato Zipabox Smart Home Controller allows remote attacker get sensitive information that expands attacKaspersky Lab Zipato Zipabox Smart Home Controller
- CVE-2018-6970VMware Horizon 6 (6.x.x before 6.2.7), Horizon 7 (7.x.x before 7.5.1), and Horizon Client (4.x.x and prior before 4.8.1) contain an out-of-bVMware Horizon 6, Horizon 7, and Horizon Client
- CVE-2018-3780A missing sanitization of search results for an autocomplete field in NextCloud Server <13.0.5 could lead to a stored XSS requiring user-intnextcloud/server
- CVE-2018-3781A missing sanitization of search results for an autocomplete field in NextCloud Talk <3.2.5 could lead to a stored XSS requiring user-interanextcloud/talk
- CVE-2018-15139Unrestricted file upload in interface/super/manage_site_files.php in versions of OpenEMR before 5.0.1.4 allows a remote authenticated attack
- CVE-2018-15140Directory traversal in portal/import_template.php in versions of OpenEMR before 5.0.1.4 allows a remote attacker authenticated in the patien
- CVE-2018-15141Directory traversal in portal/import_template.php in versions of OpenEMR before 5.0.1.4 allows a remote attacker authenticated in the patien
- CVE-2018-15142Directory traversal in portal/import_template.php in versions of OpenEMR before 5.0.1.4 allows a remote attacker authenticated in the patien
- CVE-2018-15143Multiple SQL injection vulnerabilities in portal/find_appt_popup_user.php in versions of OpenEMR before 5.0.1.4 allow a remote attacker to e
- CVE-2018-15144SQL injection vulnerability in interface/de_identification_forms/find_drug_popup.php in versions of OpenEMR before 5.0.1.4 allows a remote a
- CVE-2018-15145Multiple SQL injection vulnerabilities in portal/add_edit_event_user.php in versions of OpenEMR before 5.0.1.4 allow a remote attacker to ex
- CVE-2017-15138The OpenShift Enterprise cluster-read can access webhook tokens which would allow an attacker with sufficient privileges to view confidentia[UNKNOWN] atomic-openshift
- CVE-2018-10569An issue was discovered in Edimax EW-7438RPn Mini v2 before version 1.26.
- CVE-2018-10864An uncontrolled resource consumption flaw has been discovered in redhat-certification in the way documents are loaded.[UNKNOWN] redhat-certification:
- CVE-2018-12587A cross-site scripting (XSS) vulnerability was found in valeuraddons German Spelling Dictionary v1.3 (an Opera Browser add-on).
- CVE-2018-13415In Plex Media Server 1.13.2.5154, the XML parsing engine for SSDP/UPnP functionality is vulnerable to an XML External Entity Processing (XXE
- CVE-2018-13417In Vuze Bittorrent Client 5.7.6.0, the XML parsing engine for SSDP/UPnP functionality is vulnerable to an XML External Entity Processing (XX
- CVE-2018-14849Tiki before 18.2, 15.7 and 12.14 has XSS via link attributes, related to lib/core/WikiParser/OutputLink.php and lib/parser/parserlib.php.
- CVE-2018-14850Stored XSS vulnerabilities in Tiki before 18.2, 15.7 and 12.14 allow an authenticated user injecting JavaScript to gain administrator privil
- CVE-2018-14878JetBrains dotPeek before 2018.2 and ReSharper Ultimate before 2018.1.4 allow attackers to execute code by decompiling a compiled .NET object
- CVE-2016-2922IBM Rational ClearQuest 8.0 through 8.0.1.9 and 9.0 through 9.0.1.3 (CQ OSLC linkages, EmailRelay) fails to check the SSL certificate againsIBM Rational ClearQuest
- CVE-2017-1286Sensitive information about the configuration of the IBM UrbanCode Deploy 6.1 through 6.9.6.0 server and database can be obtained by a user
- CVE-2017-1749IBM UrbanCode Deploy 6.1 through 6.9.6.0 could allow a remote attacker to traverse directories on the system.IBM UrbanCode Deploy
- CVE-2018-5924A security vulnerability has been identified with certain HP Inkjet printers.HP inkjet printers
- CVE-2018-5925A security vulnerability has been identified with certain HP Inkjet printers.HP inkjet printers
- CVE-2018-6414A buffer overflow vulnerability in the web server of some Hikvision IP Cameras allows an attacker to send a specially crafted message to affhikvision DS-2DE4xxxW,DS-2DE5xxxW,DS-2DE7xxxW
- CVE-2018-0714Command injection vulnerability in Helpdesk versions 1.1.21 and earlier in QNAP QTS 4.2.6 build 20180531, QTS 4.3.3 build 20180528, QTS 4.3.QNAP Helpdesk in QTS
- CVE-2018-13392Several resources in Atlassian Fisheye and Crucible before version 4.6.0 allow remote attackers to inject arbitrary HTML or JavaScript via aAtlassian Fisheye and Crucible
- CVE-2018-11770From version 1.3.0 onward, Apache Spark's standalone master exposes a REST API for job submission, in addition to the submission mechanism uApache Software Foundation Apache Spark · org.apache.spa… +1