CVEs published August 15, 2018
109 CVEs were published on August 15, 2018: 0 critical, 4 high. 4 are now in CISA KEV.
- Published
- 109
- Critical
- 0
- High
- 4
- Medium
- 2
- Low
- 0
- Unrated
- 103
- Now in CISA KEV
- 4
- Fix available
- 12
Most affected products
- Microsoft Windows
- 11
- Microsoft Windows Server · Microsoft Windows
- 9
- Microsoft Edge
- 6
- Microsoft Edge · Microsoft ChakraCore +1
- 4
- Microsoft Windows 10 Servers · Microsoft Windows
- 4
- Microsoft Internet Explorer
- 3
- Microsoft Internet Explorer · Microsoft Edge
- 3
- Trend Micro Control Manager
- 3
- Atlassian Confluence Questions
- 2
- Cisco Systems Small Business 100 Series Wireless Access Poi…
- 2
High 4
- CVE-2018-8373A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Internet Explorer, aka "ScripMicrosoft Internet Explorer
- CVE-2018-8405An elevation of privilege vulnerability exists when the DirectX Graphics Kernel (DXGKRNL) driver improperly handles objects in memory, aka "Microsoft Windows Server 2012 R2 · Microsoft Windows RT +2
- CVE-2018-8406An elevation of privilege vulnerability exists when the DirectX Graphics Kernel (DXGKRNL) driver improperly handles objects in memory, aka "Microsoft Windows Server · Microsoft Windows
- CVE-2018-8414A remote code execution vulnerability exists when the Windows Shell does not properly validate file paths, aka "Windows Shell Remote Code ExMicrosoft Windows 10 Servers · Microsoft Windows
Medium, low and unrated 105
- CVE-2017-13100DistinctDev, Inc., The Moron Test, 6.3.1, 2017-05-04, iOS application uses a hard-coded key for encryptionDistinctDev The Moron Test
- CVE-2017-13101Musical.ly Inc., musical.ly - your video social network, 6.1.6, 2017-10-03, iOS application uses a hard-coded key for encryptionmusical.ly
- CVE-2017-13102Gameloft Asphalt Xtreme: Offroad Rally Racing, 1.6.0, 2017-08-13, iOS application uses a hard-coded key for encryptionGameloft Asphalt Xtreme: Offroad Rally Racing
- CVE-2017-13104Uber Technologies, Inc. UberEATS: Uber for Food Delivery, 1.108.10001, 2017-11-02, iOS application uses a hard-coded key for encryptionUber Technologies UberEATS: Uber for Food Delivery
- CVE-2017-13105Hi Security Virus Cleaner - Antivirus, Booster, 3.7.1.1329, 2017-09-13, Android application accepts all SSL certificates during SSL communicationHi Security Lab Virus Cleaner - Antivirus, Booster
- CVE-2017-13106Cheetahmobile CM Launcher 3D - Theme, wallpaper, Secure, Efficient, 5.0.3, 2017-09-19, Android application uses a hard-coded key for encryptionCheetahmobile CM Launcher 3D - Theme, wallpaper, Secure, Ef…
- CVE-2017-13107Live.me - live stream video chat, 3.7.20, 2017-11-06, Android application uses a hard-coded key for encryptionLive.me
- CVE-2017-13108DFNDR Security Antivirus, Anti-hacking & Cleaner, 5.0.9, 2017-11-01, Android application uses a hard-coded key for encryptionDFNDR Security Antivirus, Anti-hacking & Cleaner
- CVE-2018-0367A vulnerability in the web-based management interface of the Cisco Registered Envelope Service could allow an authenticated, remote attackerCisco Systems Registered Envelope Service
- CVE-2018-0386A vulnerability in Cisco Unified Communications Domain Manager Software could allow an unauthenticated, remote attacker to conduct a cross-sCisco Systems Unified Communications Domain Manager Software
- CVE-2018-0409A vulnerability in the XCP Router service of the Cisco Unified Communications Manager IM & Presence Service (CUCM IM&P) and the Cisco TelePrCisco Systems Unified Communications Manager IM & Presence…
- CVE-2018-0410A vulnerability in the web proxy functionality of Cisco AsyncOS Software for Cisco Web Security Appliances could allow an unauthenticated, rCisco Systems AsyncOS Software for Cisco Web Security Appli…
- CVE-2018-0412A vulnerability in the implementation of Extensible Authentication Protocol over LAN (EAPOL) functionality in Cisco Small Business 100 SerieCisco Systems Small Business 100 Series Wireless Access Poi…
- CVE-2018-0415A vulnerability in the implementation of Extensible Authentication Protocol over LAN (EAPOL) functionality in Cisco Small Business 100 SerieCisco Systems Small Business 100 Series Wireless Access Poi…
- CVE-2018-0418A vulnerability in the Local Packet Transport Services (LPTS) feature set of Cisco ASR 9000 Series Aggregation Services Router Software coulCisco Systems ASR 9000 Series Aggregation Services Router S…
- CVE-2018-0419A vulnerability in certain attachment detection mechanisms of Cisco Email Security Appliances (ESA) could allow an unauthenticated, remote aCisco Systems Email Security Appliance
- CVE-2018-0427A vulnerability in the CronJob scheduler API of Cisco Digital Network Architecture (DNA) Center could allow an authenticated, remote attackeCisco Systems Digital Network Architecture (DNA) Center
- CVE-2018-0428A vulnerability in the account management subsystem of Cisco Web Security Appliance (WSA) could allow an authenticated, local attacker to elCisco Systems Web Security Appliance
- CVE-2018-10510A Directory Traversal Remote Code Execution vulnerability in Trend Micro Control Manager (versions 6.0 and 7.0) could allow an attacker to eTrend Micro Control Manager
- CVE-2018-10511A vulnerability in Trend Micro Control Manager (versions 6.0 and 7.0) could allow an attacker to conduct a server-side request forgery (SSRFTrend Micro Control Manager
- CVE-2018-10512A vulnerability in Trend Micro Control Manager (versions 6.0 and 7.0) could allow an attacker to manipulate a reverse proxy .dll on vulnerabTrend Micro Control Manager
- CVE-2018-11247The JMX/RMI interface in Nasdaq BWise 5.0 does not require authentication for an SAP BO Component, which allows remote attackers to execute
- CVE-2018-14007Citrix XenServer 7.1 and newer allows Directory Traversal.
- CVE-2018-14722An issue was discovered in evaluate_auto_mountpoint in btrfsmaintenance-functions in btrfsmaintenance through 0.4.1.
- CVE-2018-14779A buffer overflow issue was discovered in the Yubico-Piv 1.5.0 smartcard driver.
- CVE-2018-14780An out-of-bounds read issue was discovered in the Yubico-Piv 1.5.0 smartcard driver.
- CVE-2018-8753The IKEv1 implementation in Clavister cOS Core before 11.00.11, 11.20.xx before 11.20.06, and 12.00.xx before 12.00.09 allows remote attacke
- CVE-2018-9129ZyXEL ZyWALL/USG series devices have a Bleichenbacher vulnerability in their Internet Key Exchange (IKE) handshake implementation used for I
- CVE-2018-0952An Elevation of Privilege vulnerability exists when Diagnostics Hub Standard Collector allows file creation in arbitrary locations, aka "DiaMicrosoft Windows Server · Microsoft Windows +1
- CVE-2018-10369A Cross-site scripting (XSS) vulnerability was discovered on Intelbras Win 240 V1.1.0 devices.
- CVE-2018-10917pulp 2.16.x and possibly older is vulnerable to an improper path parsing.[UNKNOWN] pulp
- CVE-2018-11687An integer overflow in the distributeBTR function of a smart contract implementation for Bitcoin Red (BTCR), an Ethereum ERC20 token, allows
- CVE-2018-12056The maxRandom function of a smart contract implementation for All For One, an Ethereum gambling game, generates a random value with publicly
- CVE-2018-15138Ericsson-LG iPECS NMS 30M allows directory traversal via ipecs-cm/download?filename=../ URIs.
- CVE-2018-15146SQL injection vulnerability in interface/de_identification_forms/find_immunization_popup.php in versions of OpenEMR before 5.0.1.4 allows a
- CVE-2018-15147SQL injection vulnerability in interface/forms_admin/forms_admin.php from library/registry.inc in versions of OpenEMR before 5.0.1.4 allows
- CVE-2018-15148SQL injection vulnerability in interface/patient_file/encounter/search_code.php in versions of OpenEMR before 5.0.1.4 allows a remote authen
- CVE-2018-15149SQL injection vulnerability in interface/forms/eye_mag/php/Anything_simple.php from library/forms.inc in versions of OpenEMR before 5.0.1.4
- CVE-2018-15150SQL injection vulnerability in interface/de_identification_forms/de_identification_screen2.php in versions of OpenEMR before 5.0.1.4 allows
- CVE-2018-15151SQL injection vulnerability in interface/de_identification_forms/find_code_popup.php in versions of OpenEMR before 5.0.1.4 allows a remote a
- CVE-2018-15152Authentication bypass vulnerability in portal/account/register.php in versions of OpenEMR before 5.0.1.4 allows a remote attacker to access
- CVE-2018-15153OS command injection occurring in versions of OpenEMR before 5.0.1.4 allows a remote authenticated attacker to execute arbitrary commands by
- CVE-2018-15154OS command injection occurring in versions of OpenEMR before 5.0.1.4 allows a remote authenticated attacker to execute arbitrary commands by
- CVE-2018-15155OS command injection occurring in versions of OpenEMR before 5.0.1.4 allows a remote authenticated attacker to execute arbitrary commands by
- CVE-2018-15156OS command injection occurring in versions of OpenEMR before 5.0.1.4 allows a remote authenticated attacker to execute arbitrary commands by
- CVE-2018-15172TP-Link WR840N devices have a buffer overflow via a long Authorization HTTP header.
- CVE-2018-8200A security feature bypass vulnerability exists in Device Guard that could allow an attacker to inject malicious code into a Windows PowerSheMicrosoft Windows Server · Microsoft Windows
- CVE-2018-8204A security feature bypass vulnerability exists in Device Guard that could allow an attacker to inject malicious code into a Windows PowerSheMicrosoft Windows Server · Microsoft Windows
- CVE-2018-8253An elevation of privilege vulnerability exists when Microsoft Cortana allows arbitrary website browsing on the lockscreen, aka "Microsoft CoMicrosoft Windows Server · Microsoft Windows
- CVE-2018-8266A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka "CMicrosoft Edge · Microsoft ChakraCore +1
- CVE-2018-8273A buffer overflow vulnerability exists in the Microsoft SQL Server that could allow remote code execution on an affected system, aka "MicrosMicrosoft SQL Server
- CVE-2018-8302A remote code execution vulnerability exists in Microsoft Exchange software when the software fails to properly handle objects in memory, akMicrosoft Exchange Server
- CVE-2018-8316A remote code execution vulnerability exists when Internet Explorer improperly validates hyperlinks before loading executable libraries, akaMicrosoft Internet Explorer
- CVE-2018-8339An elevation of privilege vulnerability exists in the Windows Installer when the Windows Installer fails to properly sanitize input leading Microsoft Windows
- CVE-2018-8340A security feature bypass vulnerability exists when Active Directory Federation Services (AD FS) improperly handles multi-factor authenticatMicrosoft Windows Server · Microsoft Windows 10 Servers
- CVE-2018-8341An information disclosure vulnerability exists when the Windows kernel improperly handles objects in memory, aka "Windows Kernel InformationMicrosoft Windows
- CVE-2018-8342An elevation of privilege vulnerability exists in the Network Driver Interface Specification (NDIS) when ndis.sys fails to check the length Microsoft Windows
- CVE-2018-8343An elevation of privilege vulnerability exists in the Network Driver Interface Specification (NDIS) when ndis.sys fails to check the length Microsoft Windows
- CVE-2018-8344A remote code execution vulnerability exists when the Windows font library improperly handles specially crafted embedded fonts, aka "MicrosoMicrosoft Windows
- CVE-2018-8345A remote code execution vulnerability exists in Microsoft Windows that could allow remote code execution if a .LNK file is processed, aka "LMicrosoft Windows
- CVE-2018-8346A remote code execution vulnerability exists in Microsoft Windows that could allow remote code execution if a .LNK file is processed, aka "LMicrosoft Windows Server · Microsoft Windows
- CVE-2018-8347An elevation of privilege vulnerability exists in Microsoft Windows when the Windows kernel fails to properly handle parsing of certain symbMicrosoft Windows Server · Microsoft Windows
- CVE-2018-8348An information disclosure vulnerability exists when the Windows kernel improperly handles objects in memory, aka "Windows Kernel InformationMicrosoft Windows
- CVE-2018-8349A remote code execution vulnerability exists in "Microsoft COM for Windows" when it fails to properly handle serialized objects, aka "MicrosMicrosoft Windows
- CVE-2018-8350A remote code execution vulnerability exists when Microsoft Windows PDF Library improperly handles objects in memory, aka "Windows PDF RemotMicrosoft Windows 10 Servers · Microsoft Windows
- CVE-2018-8351An information disclosure vulnerability exists when affected Microsoft browsers improperly allow cross-frame interaction, aka "Microsoft BroMicrosoft Internet Explorer · Microsoft Edge
- CVE-2018-8353A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Internet Explorer, aka "Scrip
- CVE-2018-8355A remote code execution vulnerability exists in the way the scripting engine handles objects in memory in Microsoft browsers, aka "ScriptingMicrosoft ChakraCore · Microsoft Internet Explorer +2
- CVE-2018-8357An elevation of privilege vulnerability exists in Microsoft browsers allowing sandbox escape, aka "Microsoft Browser Elevation of Privilege Microsoft Internet Explorer · Microsoft Edge
- CVE-2018-8358A security feature bypass vulnerability exists when Microsoft Edge improperly handles redirect requests, aka "Microsoft Edge Security FeaturMicrosoft Edge
- CVE-2018-8359A remote code execution vulnerability exists in the way that the ChakraCore scripting engine handles objects in memory, aka "Scripting EnginMicrosoft ChakraCore · Microsoft.ChakraCore
- CVE-2018-8360An information disclosure vulnerability exists in Microsoft .NET Framework that could allow an attacker to access information in multi-tenanMicrosoft .NET Framework
- CVE-2018-8370A information disclosure vulnerability exists when WebAudio Library improperly handles audio requests, aka "Microsoft Edge Information DisclMicrosoft Edge
- CVE-2018-8371A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Internet Explorer, aka "ScripMicrosoft Internet Explorer · Microsoft.ChakraCore
- CVE-2018-8372A remote code execution vulnerability exists in the way the scripting engine handles objects in memory in Microsoft browsers, aka "ScriptingMicrosoft ChakraCore · Microsoft Internet Explorer +2
- CVE-2018-8374A tampering vulnerability exists when Microsoft Exchange Server fails to properly handle profile data, aka "Microsoft Exchange Server TamperMicrosoft Exchange Server
- CVE-2018-8375A remote code execution vulnerability exists in Microsoft Excel software when the software fails to properly handle objects in memory, aka "Microsoft Excel Viewer · Microsoft Office +1
- CVE-2018-8376A remote code execution vulnerability exists in Microsoft PowerPoint software when the software fails to properly handle objects in memory, Microsoft PowerPoint
- CVE-2018-8377A remote code execution vulnerability exists when Microsoft Edge improperly accesses objects in memory, aka "Microsoft Edge Memory CorruptioMicrosoft Edge
- CVE-2018-8378An information disclosure vulnerability exists when Microsoft Office software reads out of bound memory due to an uninitialized variable, whMicrosoft Word · Microsoft SharePoint Server +4
- CVE-2018-8379A remote code execution vulnerability exists in Microsoft Excel software when the software fails to properly handle objects in memory, aka "Microsoft Excel
- CVE-2018-8380A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka "CMicrosoft Edge · Microsoft ChakraCore +1
- CVE-2018-8381A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka "CMicrosoft Edge · Microsoft ChakraCore +1
- CVE-2018-8382An information disclosure vulnerability exists when Microsoft Excel improperly discloses the contents of its memory, aka "Microsoft Excel InMicrosoft Excel Viewer · Microsoft Office +1
- CVE-2018-8383A spoofing vulnerability exists when Microsoft Edge does not properly parse HTTP content, aka "Microsoft Edge Spoofing Vulnerability." This Microsoft Edge
- CVE-2018-8384A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka "CMicrosoft ChakraCore · Microsoft.ChakraCore
- CVE-2018-8385A remote code execution vulnerability exists in the way the scripting engine handles objects in memory in Microsoft browsers, aka "ScriptingMicrosoft Internet Explorer · Microsoft ChakraCore +2
- CVE-2018-8387A remote code execution vulnerability exists when Microsoft Edge improperly accesses objects in memory, aka "Microsoft Edge Memory CorruptioMicrosoft Edge
- CVE-2018-8388A spoofing vulnerability exists when Microsoft Edge improperly handles specific HTML content, aka "Microsoft Edge Spoofing Vulnerability." TMicrosoft Edge
- CVE-2018-8389A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Internet Explorer, aka "ScripMicrosoft Internet Explorer
- CVE-2018-8390A remote code execution vulnerability exists in the way that the ChakraCore scripting engine handles objects in memory, aka "Scripting EnginMicrosoft Edge · Microsoft ChakraCore +1
- CVE-2018-8394An information disclosure vulnerability exists when the Windows GDI component improperly discloses the contents of its memory, aka "Windows Microsoft Windows
- CVE-2018-8396An information disclosure vulnerability exists when the Windows GDI component improperly discloses the contents of its memory, aka "Windows Microsoft Windows Server · Microsoft Windows
- CVE-2018-8397A remote code execution vulnerability exists in the way that the Windows Graphics Device Interface (GDI) handles objects in the memory, aka Microsoft Windows Server · Microsoft Windows
- CVE-2018-8398An information disclosure vulnerability exists when the Windows GDI component improperly discloses the contents of its memory, aka "Windows Microsoft Windows
- CVE-2018-8399An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in memory, aka "Win32k Microsoft Windows 10 Servers · Microsoft Windows
- CVE-2018-8400An elevation of privilege vulnerability exists when the DirectX Graphics Kernel (DXGKRNL) driver improperly handles objects in memory, aka "Microsoft Windows 10 Servers · Microsoft Windows
- CVE-2018-8401An elevation of privilege vulnerability exists when the DirectX Graphics Kernel (DXGKRNL) driver improperly handles objects in memory, aka "Microsoft Windows Server · Microsoft Windows
- CVE-2018-8403A remote code execution vulnerability exists in the way that Microsoft browsers access objects in memory, aka "Microsoft Browser Memory CorrMicrosoft Internet Explorer · Microsoft Edge
- CVE-2018-8404An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in memory, aka "Win32k Microsoft Windows
- CVE-2018-8412An elevation of privilege vulnerability exists when the Microsoft AutoUpdate (MAU) application for Mac improperly validates updates before eMicrosoft Office
- CVE-2018-1455IBM Tivoli Application Dependency Discovery Manager 7.2.2 and 7.3 is vulnerable to cross-site request forgery which could allow an attacker IBM Tivoli Application Dependency Discovery Manager
- CVE-2018-13393The convertCommentToAnswer resource in Atlassian Confluence Questions before version 2.6.6, the bundled version of Confluence Questions was Atlassian Confluence Questions
- CVE-2018-13394The acceptAnswer resource in Atlassian Confluence Questions before version 2.6.6, the bundled version of Confluence Questions was updated toAtlassian Confluence Questions
- CVE-2018-6973VMware Workstation (14.x before 14.1.3) and Fusion (10.x before 10.1.3) contain an out-of-bounds write vulnerability in the e1000 device.VMware Workstation · VMware Fusion