# CVEs published 2018-08-13

36 CVEs were published on August 13, 2018: 0 critical, 1 high. Days are UTC.

- [CVE-2018-10598](https://cve.now/CVE-2018-10598.md): CNCSoft Version 1.00.83 and prior with ScreenEditor Version 1.00.54 has two out-of-bounds read vulnerabilities could cause the software to c (no CVSS, ICS-CERT CNCSoft with ScreenEditor)
- [CVE-2018-10634](https://cve.now/CVE-2018-10634.md): Medtronic MiniMed MMT-500/MMT-503 Remote Controllers Cleartext Transmission of Sensitive Information (CVSS 4.8, Medtronic MMT- 508 - MiniMed pump · Medtronic MMT – 511… +8)
- [CVE-2018-10636](https://cve.now/CVE-2018-10636.md): CNCSoft Version 1.00.83 and prior with ScreenEditor Version 1.00.54 has multiple stack-based buffer overflow vulnerabilities that could caus (no CVSS, ICS-CERT CNCSoft with ScreenEditor)
- [CVE-2018-14781](https://cve.now/CVE-2018-14781.md): Medtronic MiniMed MMT-500/MMT-503 Remote Controllers Authentication Bypass by Capture-replay (CVSS 5.3, Medtronic MMT- 508 - MiniMed pump · Medtronic MMT – 511… +8)
- [CVE-2018-15123](https://cve.now/CVE-2018-15123.md): Insecure configuration storage in Zipato Zipabox Smart Home Controller BOARD REV - 1 with System Version -118 allows remote attacker perform (no CVSS, Kaspersky Lab Zipato Zipabox Smart Home Controller)
- [CVE-2018-15124](https://cve.now/CVE-2018-15124.md): Weak hashing algorithm in Zipato Zipabox Smart Home Controller BOARD REV - 1 with System Version -118 allows unauthenticated attacker extrac (no CVSS, Kaspersky Lab Zipato Zipabox Smart Home Controller)
- [CVE-2018-15125](https://cve.now/CVE-2018-15125.md): Sensitive Information Disclosure in Zipato Zipabox Smart Home Controller allows remote attacker get sensitive information that expands attac (no CVSS, Kaspersky Lab Zipato Zipabox Smart Home Controller)
- [CVE-2018-6970](https://cve.now/CVE-2018-6970.md): VMware Horizon 6 (6.x.x before 6.2.7), Horizon 7 (7.x.x before 7.5.1), and Horizon Client (4.x.x and prior before 4.8.1) contain an out-of-b (no CVSS, VMware Horizon 6, Horizon 7, and Horizon Client)
- [CVE-2018-3780](https://cve.now/CVE-2018-3780.md): A missing sanitization of search results for an autocomplete field in NextCloud Server \<13.0.5 could lead to a stored XSS requiring user-int (no CVSS, nextcloud/server)
- [CVE-2018-3781](https://cve.now/CVE-2018-3781.md): A missing sanitization of search results for an autocomplete field in NextCloud Talk \<3.2.5 could lead to a stored XSS requiring user-intera (no CVSS, nextcloud/talk)
- [CVE-2018-15139](https://cve.now/CVE-2018-15139.md): Unrestricted file upload in interface/super/manage\_site\_files.php in versions of OpenEMR before 5.0.1.4 allows a remote authenticated attack (no CVSS)
- [CVE-2018-15140](https://cve.now/CVE-2018-15140.md): Directory traversal in portal/import\_template.php in versions of OpenEMR before 5.0.1.4 allows a remote attacker authenticated in the patien (no CVSS)
- [CVE-2018-15141](https://cve.now/CVE-2018-15141.md): Directory traversal in portal/import\_template.php in versions of OpenEMR before 5.0.1.4 allows a remote attacker authenticated in the patien (no CVSS)
- [CVE-2018-15142](https://cve.now/CVE-2018-15142.md): Directory traversal in portal/import\_template.php in versions of OpenEMR before 5.0.1.4 allows a remote attacker authenticated in the patien (no CVSS)
- [CVE-2018-15143](https://cve.now/CVE-2018-15143.md): Multiple SQL injection vulnerabilities in portal/find\_appt\_popup\_user.php in versions of OpenEMR before 5.0.1.4 allow a remote attacker to e (no CVSS)
- [CVE-2018-15144](https://cve.now/CVE-2018-15144.md): SQL injection vulnerability in interface/de\_identification\_forms/find\_drug\_popup.php in versions of OpenEMR before 5.0.1.4 allows a remote a (no CVSS)
- [CVE-2018-15145](https://cve.now/CVE-2018-15145.md): Multiple SQL injection vulnerabilities in portal/add\_edit\_event\_user.php in versions of OpenEMR before 5.0.1.4 allow a remote attacker to ex (no CVSS)
- [CVE-2017-15138](https://cve.now/CVE-2017-15138.md): The OpenShift Enterprise cluster-read can access webhook tokens which would allow an attacker with sufficient privileges to view confidentia (CVSS 5.0, \[UNKNOWN\] atomic-openshift)
- [CVE-2017-7500](https://cve.now/CVE-2017-7500.md): It was found that rpm did not properly handle RPM installations when a destination path was a symbolic link to a directory, possibly changin (CVSS 7.3, \[UNKNOWN\] rpm)
- [CVE-2018-10569](https://cve.now/CVE-2018-10569.md): An issue was discovered in Edimax EW-7438RPn Mini v2 before version 1.26. (no CVSS)
- [CVE-2018-10864](https://cve.now/CVE-2018-10864.md): An uncontrolled resource consumption flaw has been discovered in redhat-certification in the way documents are loaded. (CVSS 5.3, \[UNKNOWN\] redhat-certification:)
- [CVE-2018-12587](https://cve.now/CVE-2018-12587.md): A cross-site scripting (XSS) vulnerability was found in valeuraddons German Spelling Dictionary v1.3 (an Opera Browser add-on). (no CVSS)
- [CVE-2018-13415](https://cve.now/CVE-2018-13415.md): In Plex Media Server 1.13.2.5154, the XML parsing engine for SSDP/UPnP functionality is vulnerable to an XML External Entity Processing (XXE (no CVSS)
- [CVE-2018-13417](https://cve.now/CVE-2018-13417.md): In Vuze Bittorrent Client 5.7.6.0, the XML parsing engine for SSDP/UPnP functionality is vulnerable to an XML External Entity Processing (XX (no CVSS)
- [CVE-2018-14849](https://cve.now/CVE-2018-14849.md): Tiki before 18.2, 15.7 and 12.14 has XSS via link attributes, related to lib/core/WikiParser/OutputLink.php and lib/parser/parserlib.php. (no CVSS)
- [CVE-2018-14850](https://cve.now/CVE-2018-14850.md): Stored XSS vulnerabilities in Tiki before 18.2, 15.7 and 12.14 allow an authenticated user injecting JavaScript to gain administrator privil (no CVSS)
- [CVE-2018-14878](https://cve.now/CVE-2018-14878.md): JetBrains dotPeek before 2018.2 and ReSharper Ultimate before 2018.1.4 allow attackers to execute code by decompiling a compiled .NET object (no CVSS)
- [CVE-2016-2922](https://cve.now/CVE-2016-2922.md): IBM Rational ClearQuest 8.0 through 8.0.1.9 and 9.0 through 9.0.1.3 (CQ OSLC linkages, EmailRelay) fails to check the SSL certificate agains (CVSS 3.7, IBM Rational ClearQuest)
- [CVE-2017-1286](https://cve.now/CVE-2017-1286.md): Sensitive information about the configuration of the IBM UrbanCode Deploy 6.1 through 6.9.6.0 server and database can be obtained by a user (no CVSS)
- [CVE-2017-1749](https://cve.now/CVE-2017-1749.md): IBM UrbanCode Deploy 6.1 through 6.9.6.0 could allow a remote attacker to traverse directories on the system. (CVSS 5.3, IBM UrbanCode Deploy)
- [CVE-2018-5924](https://cve.now/CVE-2018-5924.md): A security vulnerability has been identified with certain HP Inkjet printers. (no CVSS, HP inkjet printers)
- [CVE-2018-5925](https://cve.now/CVE-2018-5925.md): A security vulnerability has been identified with certain HP Inkjet printers. (no CVSS, HP inkjet printers)
- [CVE-2018-6414](https://cve.now/CVE-2018-6414.md): A buffer overflow vulnerability in the web server of some Hikvision IP Cameras allows an attacker to send a specially crafted message to aff (no CVSS, hikvision DS-2DE4xxxW,DS-2DE5xxxW,DS-2DE7xxxW)
- [CVE-2018-0714](https://cve.now/CVE-2018-0714.md): Command injection vulnerability in Helpdesk versions 1.1.21 and earlier in QNAP QTS 4.2.6 build 20180531, QTS 4.3.3 build 20180528, QTS 4.3. (no CVSS, QNAP Helpdesk in QTS)
- [CVE-2018-13392](https://cve.now/CVE-2018-13392.md): Several resources in Atlassian Fisheye and Crucible before version 4.6.0 allow remote attackers to inject arbitrary HTML or JavaScript via a (no CVSS, Atlassian Fisheye and Crucible)
- [CVE-2018-11770](https://cve.now/CVE-2018-11770.md): From version 1.3.0 onward, Apache Spark's standalone master exposes a REST API for job submission, in addition to the submission mechanism u (no CVSS, Apache Software Foundation Apache Spark · org.apache.spa… +1)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2018-08-13
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.