# CVEs published 2018-08-14

34 CVEs were published on August 14, 2018: 2 critical, 1 high. Days are UTC.

- [CVE-2018-12537](https://cve.now/CVE-2018-12537.md): In Eclipse Vert.x version 3.0 to 3.5.1, the HttpServer response headers and HttpClient request headers do not filter carriage return and lin (no CVSS, The Eclipse Foundation Eclipse Vert.x · io.vertx:vertx-core)
- [CVE-2018-12539](https://cve.now/CVE-2018-12539.md): In Eclipse OpenJ9 version 0.8, users other than the process owner may be able to use Java Attach API to connect to an Eclipse OpenJ9 or IBM (no CVSS, The Eclipse Foundation Eclipse OpenJ9)
- [CVE-2018-3615](https://cve.now/CVE-2018-3615.md): Systems with microprocessors utilizing speculative execution and Intel software guard extensions (Intel SGX) may allow unauthorized disclosu (CVSS 7.3, Intel Multiple)
- [CVE-2018-3620](https://cve.now/CVE-2018-3620.md): Systems with microprocessors utilizing speculative execution and address translations may allow unauthorized disclosure of information resid (CVSS 5.6, Intel Multiple)
- [CVE-2018-3646](https://cve.now/CVE-2018-3646.md): Systems with microprocessors utilizing speculative execution and address translations may allow unauthorized disclosure of information resid (CVSS 5.6, Intel Multiple)
- [CVE-2018-3937](https://cve.now/CVE-2018-3937.md): An exploitable command injection vulnerability exists in the measurementBitrateExec functionality of Sony IPELA E Series Network Camera G5 f (CVSS 9.1, Talos Sony)
- [CVE-2018-3938](https://cve.now/CVE-2018-3938.md): An exploitable stack-based buffer overflow vulnerability exists in the 802dot1xclientcert.cgi functionality of Sony IPELA E Series Camera G5 (CVSS 9.1, Talos Sony)
- [CVE-2018-0131](https://cve.now/CVE-2018-0131.md): A vulnerability in the implementation of RSA-encrypted nonces in Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated (no CVSS, Cisco Systems IOS and IOS XE)
- [CVE-2018-14348](https://cve.now/CVE-2018-14348.md): libcgroup up to and including 0.41 creates /var/log/cgred with mode 0666 regardless of the configured umask, leading to disclosure of inform (no CVSS)
- [CVE-2018-14424](https://cve.now/CVE-2018-14424.md): The daemon in GDM through 3.29.1 does not properly unexport display objects from its D-Bus interface when they are destroyed, which allows a (no CVSS)
- [CVE-2018-14429](https://cve.now/CVE-2018-14429.md): man-cgi before 1.16 allows Local File Inclusion via absolute path traversal, as demonstrated by a cgi-bin/man-cgi?/etc/passwd URI. (no CVSS)
- [CVE-2018-14888](https://cve.now/CVE-2018-14888.md): inc/plugins/thankyoulike.php in the Eldenroot Thank You/Like plugin before 3.1.0 for MyBB allows XSS via a post or thread subject. (no CVSS)
- [CVE-2018-14922](https://cve.now/CVE-2018-14922.md): Multiple cross-site scripting (XSS) vulnerabilities in Monstra CMS 3.0.4 allow remote attackers to inject arbitrary web script or HTML via t (no CVSS)
- [CVE-2018-2441](https://cve.now/CVE-2018-2441.md): Under certain conditions the SAP Change and Transport System (ABAP), SAP KERNEL 32 NUC, SAP KERNEL 32 Unicode, SAP KERNEL 64 NUC, SAP KERNEL (no CVSS, SAP Change and Transport System)
- [CVE-2018-2442](https://cve.now/CVE-2018-2442.md): In SAP BusinessObjects Business Intelligence, versions 4.0, 4.1 and 4.2, while viewing a Web Intelligence report from BI Launchpad, the user (no CVSS, SAP BusinessObjects Business Intelligence)
- [CVE-2018-2444](https://cve.now/CVE-2018-2444.md): SAP BusinessObjects Financial Consolidation, versions 10.0, 10.1, does not sufficiently encode user-controlled inputs, resulting in Cross-Si (no CVSS, SAP BusinessObjects Financial Consolidation)
- [CVE-2018-2445](https://cve.now/CVE-2018-2445.md): AdminTools in SAP BusinessObjects Business Intelligence, versions 4.1, 4.2, allows an attacker to manipulate the vulnerable application to s (no CVSS, SAP BusinessObjects Business Intelligence Platform)
- [CVE-2018-2446](https://cve.now/CVE-2018-2446.md): Admin tools in SAP BusinessObjects Business Intelligence, versions 4.1, 4.2, allow an unauthenticated user to read sensitive information (se (no CVSS, SAP BusinessObjects Business Intelligence)
- [CVE-2018-2447](https://cve.now/CVE-2018-2447.md): SAP BusinessObjects Business Intelligence (Launchpad Web Intelligence), version 4.2, allows an attacker to execute crafted InfoObject querie (no CVSS, SAP BusinessObjects Business Intelligence)
- [CVE-2018-2448](https://cve.now/CVE-2018-2448.md): Under certain conditions SAP SRM-MDM (CATALOG versions 3.0, 7.01, 7.02) utilities functionality allows an attacker to access information of (no CVSS, SAP SRM-MDM CATALOG)
- [CVE-2018-2449](https://cve.now/CVE-2018-2449.md): SAP SRM MDM Catalog versions 3.73, 7.31, 7.32 in (SAP NetWeaver 7.3) - import functionality does not perform authentication checks for valid (no CVSS, SAP Supplier Relationship Management Master Data Management…)
- [CVE-2018-2450](https://cve.now/CVE-2018-2450.md): SAP MaxDB (liveCache), versions 7.8 and 7.9, allows an attacker who gets DBM operator privileges to execute crafted database queries and the (no CVSS, SAP MaxDB)
- [CVE-2018-2451](https://cve.now/CVE-2018-2451.md): XS Command-Line Interface (CLI) user sessions with the SAP HANA Extended Application Services (XS), version 1, advanced server may have an u (no CVSS, SAP HANA Extended Application Services)
- [CVE-2018-5392](https://cve.now/CVE-2018-5392.md): mingw-w64 version 5.0.4 by default produces executables that opt in to ASLR, but are not compatible with ASLR (no CVSS, mingw-w64)
- [CVE-2018-7077](https://cve.now/CVE-2018-7077.md): A security vulnerability in HPE XP P9000 Command View Advanced Edition (CVAE) Device Manager (DevMgr 8.5.0-00 and prior to 8.6.0-00), Config (no CVSS, Hewlett Packard Enterprise HPE XP P9000 Command View Advanc…)
- [CVE-2018-7093](https://cve.now/CVE-2018-7093.md): A security vulnerability in HPE Integrated Lights-Out 3 prior to v1.90, iLO 4 prior to v2.60, iLO 5 prior to v1.30, Moonshot Chassis Manager (no CVSS, Hewlett Packard Enterprise iLO 5 for HPE Gen10 Servers, iLO…)
- [CVE-2018-7094](https://cve.now/CVE-2018-7094.md): A security vulnerability was identified in 3PAR Service Processor (SP) prior to SP-5.0.0.0-22913(GA). (no CVSS, Hewlett Packard Enterprise HPE 3PAR Service Processors)
- [CVE-2018-7095](https://cve.now/CVE-2018-7095.md): A security vulnerability was identified in 3PAR Service Processor (SP) prior to SP-4.4.0.GA-110(MU7). (no CVSS, Hewlett Packard Enterprise HPE 3PAR Service Processors)
- [CVE-2018-7096](https://cve.now/CVE-2018-7096.md): A security vulnerability was identified in 3PAR Service Processor (SP) prior to SP-4.4.0.GA-110(MU7). (no CVSS, Hewlett Packard Enterprise HPE 3PAR Service Processors)
- [CVE-2018-7097](https://cve.now/CVE-2018-7097.md): A security vulnerability was identified in 3PAR Service Processor (SP) prior to SP-4.4.0.GA-110(MU7). (no CVSS, Hewlett Packard Enterprise HPE 3PAR Service Processors)
- [CVE-2018-7098](https://cve.now/CVE-2018-7098.md): A security vulnerability was identified in 3PAR Service Processor (SP) prior to SP-4.4.0.GA-110(MU7). (no CVSS, Hewlett Packard Enterprise HPE 3PAR Service Processors)
- [CVE-2018-7099](https://cve.now/CVE-2018-7099.md): A security vulnerability was identified in 3PAR Service Processor (SP) prior to SP-4.4.0.GA-110(MU7). (no CVSS, Hewlett Packard Enterprise HPE 3PAR Service Processors)
- [CVE-2018-7100](https://cve.now/CVE-2018-7100.md): A potential security vulnerability has been identified in HPE OfficeConnect 1810 Switch Series (HP 1810-24G - P.2.22 and previous versions, (no CVSS, Hewlett Packard Enterprise HP 1810-24G, HP 1810-48G, HP 181…)
- [CVE-2016-4975](https://cve.now/CVE-2016-4975.md): mod\_userdir CRLF injection (no CVSS, Apache Software Foundation Apache HTTP Server)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2018-08-14
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.