# CVEs published 2018-08-15

109 CVEs were published on August 15, 2018: 0 critical, 4 high. 4 are now in CISA KEV. Days are UTC.

- [CVE-2017-13100](https://cve.now/CVE-2017-13100.md): DistinctDev, Inc., The Moron Test, 6.3.1, 2017-05-04, iOS application uses a hard-coded key for encryption (no CVSS, DistinctDev The Moron Test)
- [CVE-2017-13101](https://cve.now/CVE-2017-13101.md): Musical.ly Inc., musical.ly - your video social network, 6.1.6, 2017-10-03, iOS application uses a hard-coded key for encryption (no CVSS, musical.ly)
- [CVE-2017-13102](https://cve.now/CVE-2017-13102.md): Gameloft Asphalt Xtreme: Offroad Rally Racing, 1.6.0, 2017-08-13, iOS application uses a hard-coded key for encryption (no CVSS, Gameloft Asphalt Xtreme: Offroad Rally Racing)
- [CVE-2017-13104](https://cve.now/CVE-2017-13104.md): Uber Technologies, Inc. UberEATS: Uber for Food Delivery, 1.108.10001, 2017-11-02, iOS application uses a hard-coded key for encryption (no CVSS, Uber Technologies UberEATS: Uber for Food Delivery)
- [CVE-2017-13105](https://cve.now/CVE-2017-13105.md): Hi Security Virus Cleaner - Antivirus, Booster, 3.7.1.1329, 2017-09-13, Android application accepts all SSL certificates during SSL communication (no CVSS, Hi Security Lab Virus Cleaner - Antivirus, Booster)
- [CVE-2017-13106](https://cve.now/CVE-2017-13106.md): Cheetahmobile CM Launcher 3D - Theme, wallpaper, Secure, Efficient, 5.0.3, 2017-09-19, Android application uses a hard-coded key for encryption (no CVSS, Cheetahmobile CM Launcher 3D - Theme, wallpaper, Secure, Ef…)
- [CVE-2017-13107](https://cve.now/CVE-2017-13107.md): Live.me - live stream video chat, 3.7.20, 2017-11-06, Android application uses a hard-coded key for encryption (no CVSS, Live.me)
- [CVE-2017-13108](https://cve.now/CVE-2017-13108.md): DFNDR Security Antivirus, Anti-hacking & Cleaner, 5.0.9, 2017-11-01, Android application uses a hard-coded key for encryption (no CVSS, DFNDR Security Antivirus, Anti-hacking & Cleaner)
- [CVE-2018-0367](https://cve.now/CVE-2018-0367.md): A vulnerability in the web-based management interface of the Cisco Registered Envelope Service could allow an authenticated, remote attacker (no CVSS, Cisco Systems Registered Envelope Service)
- [CVE-2018-0386](https://cve.now/CVE-2018-0386.md): A vulnerability in Cisco Unified Communications Domain Manager Software could allow an unauthenticated, remote attacker to conduct a cross-s (no CVSS, Cisco Systems Unified Communications Domain Manager Software)
- [CVE-2018-0409](https://cve.now/CVE-2018-0409.md): A vulnerability in the XCP Router service of the Cisco Unified Communications Manager IM & Presence Service (CUCM IM&P) and the Cisco TelePr (no CVSS, Cisco Systems Unified Communications Manager IM & Presence…)
- [CVE-2018-0410](https://cve.now/CVE-2018-0410.md): A vulnerability in the web proxy functionality of Cisco AsyncOS Software for Cisco Web Security Appliances could allow an unauthenticated, r (no CVSS, Cisco Systems AsyncOS Software for Cisco Web Security Appli…)
- [CVE-2018-0412](https://cve.now/CVE-2018-0412.md): A vulnerability in the implementation of Extensible Authentication Protocol over LAN (EAPOL) functionality in Cisco Small Business 100 Serie (no CVSS, Cisco Systems Small Business 100 Series Wireless Access Poi…)
- [CVE-2018-0415](https://cve.now/CVE-2018-0415.md): A vulnerability in the implementation of Extensible Authentication Protocol over LAN (EAPOL) functionality in Cisco Small Business 100 Serie (no CVSS, Cisco Systems Small Business 100 Series Wireless Access Poi…)
- [CVE-2018-0418](https://cve.now/CVE-2018-0418.md): A vulnerability in the Local Packet Transport Services (LPTS) feature set of Cisco ASR 9000 Series Aggregation Services Router Software coul (no CVSS, Cisco Systems ASR 9000 Series Aggregation Services Router S…)
- [CVE-2018-0419](https://cve.now/CVE-2018-0419.md): A vulnerability in certain attachment detection mechanisms of Cisco Email Security Appliances (ESA) could allow an unauthenticated, remote a (no CVSS, Cisco Systems Email Security Appliance)
- [CVE-2018-0427](https://cve.now/CVE-2018-0427.md): A vulnerability in the CronJob scheduler API of Cisco Digital Network Architecture (DNA) Center could allow an authenticated, remote attacke (no CVSS, Cisco Systems Digital Network Architecture (DNA) Center)
- [CVE-2018-0428](https://cve.now/CVE-2018-0428.md): A vulnerability in the account management subsystem of Cisco Web Security Appliance (WSA) could allow an authenticated, local attacker to el (no CVSS, Cisco Systems Web Security Appliance)
- [CVE-2018-10510](https://cve.now/CVE-2018-10510.md): A Directory Traversal Remote Code Execution vulnerability in Trend Micro Control Manager (versions 6.0 and 7.0) could allow an attacker to e (no CVSS, Trend Micro Control Manager)
- [CVE-2018-10511](https://cve.now/CVE-2018-10511.md): A vulnerability in Trend Micro Control Manager (versions 6.0 and 7.0) could allow an attacker to conduct a server-side request forgery (SSRF (no CVSS, Trend Micro Control Manager)
- [CVE-2018-10512](https://cve.now/CVE-2018-10512.md): A vulnerability in Trend Micro Control Manager (versions 6.0 and 7.0) could allow an attacker to manipulate a reverse proxy .dll on vulnerab (no CVSS, Trend Micro Control Manager)
- [CVE-2018-11247](https://cve.now/CVE-2018-11247.md): The JMX/RMI interface in Nasdaq BWise 5.0 does not require authentication for an SAP BO Component, which allows remote attackers to execute (no CVSS)
- [CVE-2018-14007](https://cve.now/CVE-2018-14007.md): Citrix XenServer 7.1 and newer allows Directory Traversal. (no CVSS)
- [CVE-2018-14722](https://cve.now/CVE-2018-14722.md): An issue was discovered in evaluate\_auto\_mountpoint in btrfsmaintenance-functions in btrfsmaintenance through 0.4.1. (no CVSS)
- [CVE-2018-14779](https://cve.now/CVE-2018-14779.md): A buffer overflow issue was discovered in the Yubico-Piv 1.5.0 smartcard driver. (no CVSS)
- [CVE-2018-14780](https://cve.now/CVE-2018-14780.md): An out-of-bounds read issue was discovered in the Yubico-Piv 1.5.0 smartcard driver. (no CVSS)
- [CVE-2018-8753](https://cve.now/CVE-2018-8753.md): The IKEv1 implementation in Clavister cOS Core before 11.00.11, 11.20.xx before 11.20.06, and 12.00.xx before 12.00.09 allows remote attacke (no CVSS)
- [CVE-2018-9129](https://cve.now/CVE-2018-9129.md): ZyXEL ZyWALL/USG series devices have a Bleichenbacher vulnerability in their Internet Key Exchange (IKE) handshake implementation used for I (no CVSS)
- [CVE-2018-0952](https://cve.now/CVE-2018-0952.md): An Elevation of Privilege vulnerability exists when Diagnostics Hub Standard Collector allows file creation in arbitrary locations, aka "Dia (no CVSS, Microsoft Windows Server · Microsoft Windows +1)
- [CVE-2018-10369](https://cve.now/CVE-2018-10369.md): A Cross-site scripting (XSS) vulnerability was discovered on Intelbras Win 240 V1.1.0 devices. (no CVSS)
- [CVE-2018-10917](https://cve.now/CVE-2018-10917.md): pulp 2.16.x and possibly older is vulnerable to an improper path parsing. (CVSS 6.8, \[UNKNOWN\] pulp)
- [CVE-2018-11687](https://cve.now/CVE-2018-11687.md): An integer overflow in the distributeBTR function of a smart contract implementation for Bitcoin Red (BTCR), an Ethereum ERC20 token, allows (no CVSS)
- [CVE-2018-12056](https://cve.now/CVE-2018-12056.md): The maxRandom function of a smart contract implementation for All For One, an Ethereum gambling game, generates a random value with publicly (no CVSS)
- [CVE-2018-15138](https://cve.now/CVE-2018-15138.md): Ericsson-LG iPECS NMS 30M allows directory traversal via ipecs-cm/download?filename=../ URIs. (no CVSS)
- [CVE-2018-15146](https://cve.now/CVE-2018-15146.md): SQL injection vulnerability in interface/de\_identification\_forms/find\_immunization\_popup.php in versions of OpenEMR before 5.0.1.4 allows a (no CVSS)
- [CVE-2018-15147](https://cve.now/CVE-2018-15147.md): SQL injection vulnerability in interface/forms\_admin/forms\_admin.php from library/registry.inc in versions of OpenEMR before 5.0.1.4 allows (no CVSS)
- [CVE-2018-15148](https://cve.now/CVE-2018-15148.md): SQL injection vulnerability in interface/patient\_file/encounter/search\_code.php in versions of OpenEMR before 5.0.1.4 allows a remote authen (no CVSS)
- [CVE-2018-15149](https://cve.now/CVE-2018-15149.md): SQL injection vulnerability in interface/forms/eye\_mag/php/Anything\_simple.php from library/forms.inc in versions of OpenEMR before 5.0.1.4 (no CVSS)
- [CVE-2018-15150](https://cve.now/CVE-2018-15150.md): SQL injection vulnerability in interface/de\_identification\_forms/de\_identification\_screen2.php in versions of OpenEMR before 5.0.1.4 allows (no CVSS)
- [CVE-2018-15151](https://cve.now/CVE-2018-15151.md): SQL injection vulnerability in interface/de\_identification\_forms/find\_code\_popup.php in versions of OpenEMR before 5.0.1.4 allows a remote a (no CVSS)
- [CVE-2018-15152](https://cve.now/CVE-2018-15152.md): Authentication bypass vulnerability in portal/account/register.php in versions of OpenEMR before 5.0.1.4 allows a remote attacker to access (no CVSS)
- [CVE-2018-15153](https://cve.now/CVE-2018-15153.md): OS command injection occurring in versions of OpenEMR before 5.0.1.4 allows a remote authenticated attacker to execute arbitrary commands by (no CVSS)
- [CVE-2018-15154](https://cve.now/CVE-2018-15154.md): OS command injection occurring in versions of OpenEMR before 5.0.1.4 allows a remote authenticated attacker to execute arbitrary commands by (no CVSS)
- [CVE-2018-15155](https://cve.now/CVE-2018-15155.md): OS command injection occurring in versions of OpenEMR before 5.0.1.4 allows a remote authenticated attacker to execute arbitrary commands by (no CVSS)
- [CVE-2018-15156](https://cve.now/CVE-2018-15156.md): OS command injection occurring in versions of OpenEMR before 5.0.1.4 allows a remote authenticated attacker to execute arbitrary commands by (no CVSS)
- [CVE-2018-15172](https://cve.now/CVE-2018-15172.md): TP-Link WR840N devices have a buffer overflow via a long Authorization HTTP header. (no CVSS)
- [CVE-2018-8200](https://cve.now/CVE-2018-8200.md): A security feature bypass vulnerability exists in Device Guard that could allow an attacker to inject malicious code into a Windows PowerShe (no CVSS, Microsoft Windows Server · Microsoft Windows)
- [CVE-2018-8204](https://cve.now/CVE-2018-8204.md): A security feature bypass vulnerability exists in Device Guard that could allow an attacker to inject malicious code into a Windows PowerShe (no CVSS, Microsoft Windows Server · Microsoft Windows)
- [CVE-2018-8253](https://cve.now/CVE-2018-8253.md): An elevation of privilege vulnerability exists when Microsoft Cortana allows arbitrary website browsing on the lockscreen, aka "Microsoft Co (no CVSS, Microsoft Windows Server · Microsoft Windows)
- [CVE-2018-8266](https://cve.now/CVE-2018-8266.md): A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka "C (no CVSS, Microsoft Edge · Microsoft ChakraCore +1)
- [CVE-2018-8273](https://cve.now/CVE-2018-8273.md): A buffer overflow vulnerability exists in the Microsoft SQL Server that could allow remote code execution on an affected system, aka "Micros (no CVSS, Microsoft SQL Server)
- [CVE-2018-8302](https://cve.now/CVE-2018-8302.md): A remote code execution vulnerability exists in Microsoft Exchange software when the software fails to properly handle objects in memory, ak (no CVSS, Microsoft Exchange Server)
- [CVE-2018-8316](https://cve.now/CVE-2018-8316.md): A remote code execution vulnerability exists when Internet Explorer improperly validates hyperlinks before loading executable libraries, aka (no CVSS, Microsoft Internet Explorer)
- [CVE-2018-8339](https://cve.now/CVE-2018-8339.md): An elevation of privilege vulnerability exists in the Windows Installer when the Windows Installer fails to properly sanitize input leading (no CVSS, Microsoft Windows)
- [CVE-2018-8340](https://cve.now/CVE-2018-8340.md): A security feature bypass vulnerability exists when Active Directory Federation Services (AD FS) improperly handles multi-factor authenticat (no CVSS, Microsoft Windows Server · Microsoft Windows 10 Servers)
- [CVE-2018-8341](https://cve.now/CVE-2018-8341.md): An information disclosure vulnerability exists when the Windows kernel improperly handles objects in memory, aka "Windows Kernel Information (no CVSS, Microsoft Windows)
- [CVE-2018-8342](https://cve.now/CVE-2018-8342.md): An elevation of privilege vulnerability exists in the Network Driver Interface Specification (NDIS) when ndis.sys fails to check the length (no CVSS, Microsoft Windows)
- [CVE-2018-8343](https://cve.now/CVE-2018-8343.md): An elevation of privilege vulnerability exists in the Network Driver Interface Specification (NDIS) when ndis.sys fails to check the length (no CVSS, Microsoft Windows)
- [CVE-2018-8344](https://cve.now/CVE-2018-8344.md): A remote code execution vulnerability exists when the Windows font library improperly handles specially crafted embedded fonts, aka "Microso (no CVSS, Microsoft Windows)
- [CVE-2018-8345](https://cve.now/CVE-2018-8345.md): A remote code execution vulnerability exists in Microsoft Windows that could allow remote code execution if a .LNK file is processed, aka "L (no CVSS, Microsoft Windows)
- [CVE-2018-8346](https://cve.now/CVE-2018-8346.md): A remote code execution vulnerability exists in Microsoft Windows that could allow remote code execution if a .LNK file is processed, aka "L (no CVSS, Microsoft Windows Server · Microsoft Windows)
- [CVE-2018-8347](https://cve.now/CVE-2018-8347.md): An elevation of privilege vulnerability exists in Microsoft Windows when the Windows kernel fails to properly handle parsing of certain symb (no CVSS, Microsoft Windows Server · Microsoft Windows)
- [CVE-2018-8348](https://cve.now/CVE-2018-8348.md): An information disclosure vulnerability exists when the Windows kernel improperly handles objects in memory, aka "Windows Kernel Information (no CVSS, Microsoft Windows)
- [CVE-2018-8349](https://cve.now/CVE-2018-8349.md): A remote code execution vulnerability exists in "Microsoft COM for Windows" when it fails to properly handle serialized objects, aka "Micros (no CVSS, Microsoft Windows)
- [CVE-2018-8350](https://cve.now/CVE-2018-8350.md): A remote code execution vulnerability exists when Microsoft Windows PDF Library improperly handles objects in memory, aka "Windows PDF Remot (no CVSS, Microsoft Windows 10 Servers · Microsoft Windows)
- [CVE-2018-8351](https://cve.now/CVE-2018-8351.md): An information disclosure vulnerability exists when affected Microsoft browsers improperly allow cross-frame interaction, aka "Microsoft Bro (no CVSS, Microsoft Internet Explorer · Microsoft Edge)
- [CVE-2018-8353](https://cve.now/CVE-2018-8353.md): A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Internet Explorer, aka "Scrip (no CVSS)
- [CVE-2018-8355](https://cve.now/CVE-2018-8355.md): A remote code execution vulnerability exists in the way the scripting engine handles objects in memory in Microsoft browsers, aka "Scripting (no CVSS, Microsoft ChakraCore · Microsoft Internet Explorer +2)
- [CVE-2018-8357](https://cve.now/CVE-2018-8357.md): An elevation of privilege vulnerability exists in Microsoft browsers allowing sandbox escape, aka "Microsoft Browser Elevation of Privilege (no CVSS, Microsoft Internet Explorer · Microsoft Edge)
- [CVE-2018-8358](https://cve.now/CVE-2018-8358.md): A security feature bypass vulnerability exists when Microsoft Edge improperly handles redirect requests, aka "Microsoft Edge Security Featur (no CVSS, Microsoft Edge)
- [CVE-2018-8359](https://cve.now/CVE-2018-8359.md): A remote code execution vulnerability exists in the way that the ChakraCore scripting engine handles objects in memory, aka "Scripting Engin (no CVSS, Microsoft ChakraCore · Microsoft.ChakraCore)
- [CVE-2018-8360](https://cve.now/CVE-2018-8360.md): An information disclosure vulnerability exists in Microsoft .NET Framework that could allow an attacker to access information in multi-tenan (no CVSS, Microsoft .NET Framework)
- [CVE-2018-8370](https://cve.now/CVE-2018-8370.md): A information disclosure vulnerability exists when WebAudio Library improperly handles audio requests, aka "Microsoft Edge Information Discl (no CVSS, Microsoft Edge)
- [CVE-2018-8371](https://cve.now/CVE-2018-8371.md): A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Internet Explorer, aka "Scrip (no CVSS, Microsoft Internet Explorer · Microsoft.ChakraCore)
- [CVE-2018-8372](https://cve.now/CVE-2018-8372.md): A remote code execution vulnerability exists in the way the scripting engine handles objects in memory in Microsoft browsers, aka "Scripting (no CVSS, Microsoft ChakraCore · Microsoft Internet Explorer +2)
- [CVE-2018-8373](https://cve.now/CVE-2018-8373.md): A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Internet Explorer, aka "Scrip (CVSS 7.5, KEV, Microsoft Internet Explorer)
- [CVE-2018-8374](https://cve.now/CVE-2018-8374.md): A tampering vulnerability exists when Microsoft Exchange Server fails to properly handle profile data, aka "Microsoft Exchange Server Tamper (no CVSS, Microsoft Exchange Server)
- [CVE-2018-8375](https://cve.now/CVE-2018-8375.md): A remote code execution vulnerability exists in Microsoft Excel software when the software fails to properly handle objects in memory, aka " (no CVSS, Microsoft Excel Viewer · Microsoft Office +1)
- [CVE-2018-8376](https://cve.now/CVE-2018-8376.md): A remote code execution vulnerability exists in Microsoft PowerPoint software when the software fails to properly handle objects in memory, (no CVSS, Microsoft PowerPoint)
- [CVE-2018-8377](https://cve.now/CVE-2018-8377.md): A remote code execution vulnerability exists when Microsoft Edge improperly accesses objects in memory, aka "Microsoft Edge Memory Corruptio (no CVSS, Microsoft Edge)
- [CVE-2018-8378](https://cve.now/CVE-2018-8378.md): An information disclosure vulnerability exists when Microsoft Office software reads out of bound memory due to an uninitialized variable, wh (no CVSS, Microsoft Word · Microsoft SharePoint Server +4)
- [CVE-2018-8379](https://cve.now/CVE-2018-8379.md): A remote code execution vulnerability exists in Microsoft Excel software when the software fails to properly handle objects in memory, aka " (no CVSS, Microsoft Excel)
- [CVE-2018-8380](https://cve.now/CVE-2018-8380.md): A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka "C (no CVSS, Microsoft Edge · Microsoft ChakraCore +1)
- [CVE-2018-8381](https://cve.now/CVE-2018-8381.md): A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka "C (no CVSS, Microsoft Edge · Microsoft ChakraCore +1)
- [CVE-2018-8382](https://cve.now/CVE-2018-8382.md): An information disclosure vulnerability exists when Microsoft Excel improperly discloses the contents of its memory, aka "Microsoft Excel In (no CVSS, Microsoft Excel Viewer · Microsoft Office +1)
- [CVE-2018-8383](https://cve.now/CVE-2018-8383.md): A spoofing vulnerability exists when Microsoft Edge does not properly parse HTTP content, aka "Microsoft Edge Spoofing Vulnerability." This (no CVSS, Microsoft Edge)
- [CVE-2018-8384](https://cve.now/CVE-2018-8384.md): A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka "C (no CVSS, Microsoft ChakraCore · Microsoft.ChakraCore)
- [CVE-2018-8385](https://cve.now/CVE-2018-8385.md): A remote code execution vulnerability exists in the way the scripting engine handles objects in memory in Microsoft browsers, aka "Scripting (no CVSS, Microsoft Internet Explorer · Microsoft ChakraCore +2)
- [CVE-2018-8387](https://cve.now/CVE-2018-8387.md): A remote code execution vulnerability exists when Microsoft Edge improperly accesses objects in memory, aka "Microsoft Edge Memory Corruptio (no CVSS, Microsoft Edge)
- [CVE-2018-8388](https://cve.now/CVE-2018-8388.md): A spoofing vulnerability exists when Microsoft Edge improperly handles specific HTML content, aka "Microsoft Edge Spoofing Vulnerability." T (no CVSS, Microsoft Edge)
- [CVE-2018-8389](https://cve.now/CVE-2018-8389.md): A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Internet Explorer, aka "Scrip (no CVSS, Microsoft Internet Explorer)
- [CVE-2018-8390](https://cve.now/CVE-2018-8390.md): A remote code execution vulnerability exists in the way that the ChakraCore scripting engine handles objects in memory, aka "Scripting Engin (no CVSS, Microsoft Edge · Microsoft ChakraCore +1)
- [CVE-2018-8394](https://cve.now/CVE-2018-8394.md): An information disclosure vulnerability exists when the Windows GDI component improperly discloses the contents of its memory, aka "Windows (no CVSS, Microsoft Windows)
- [CVE-2018-8396](https://cve.now/CVE-2018-8396.md): An information disclosure vulnerability exists when the Windows GDI component improperly discloses the contents of its memory, aka "Windows (no CVSS, Microsoft Windows Server · Microsoft Windows)
- [CVE-2018-8397](https://cve.now/CVE-2018-8397.md): A remote code execution vulnerability exists in the way that the Windows Graphics Device Interface (GDI) handles objects in the memory, aka (no CVSS, Microsoft Windows Server · Microsoft Windows)
- [CVE-2018-8398](https://cve.now/CVE-2018-8398.md): An information disclosure vulnerability exists when the Windows GDI component improperly discloses the contents of its memory, aka "Windows (no CVSS, Microsoft Windows)
- [CVE-2018-8399](https://cve.now/CVE-2018-8399.md): An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in memory, aka "Win32k (no CVSS, Microsoft Windows 10 Servers · Microsoft Windows)
- [CVE-2018-8400](https://cve.now/CVE-2018-8400.md): An elevation of privilege vulnerability exists when the DirectX Graphics Kernel (DXGKRNL) driver improperly handles objects in memory, aka " (no CVSS, Microsoft Windows 10 Servers · Microsoft Windows)
- [CVE-2018-8401](https://cve.now/CVE-2018-8401.md): An elevation of privilege vulnerability exists when the DirectX Graphics Kernel (DXGKRNL) driver improperly handles objects in memory, aka " (no CVSS, Microsoft Windows Server · Microsoft Windows)
- [CVE-2018-8403](https://cve.now/CVE-2018-8403.md): A remote code execution vulnerability exists in the way that Microsoft browsers access objects in memory, aka "Microsoft Browser Memory Corr (no CVSS, Microsoft Internet Explorer · Microsoft Edge)
- [CVE-2018-8404](https://cve.now/CVE-2018-8404.md): An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in memory, aka "Win32k (no CVSS, Microsoft Windows)
- [CVE-2018-8405](https://cve.now/CVE-2018-8405.md): An elevation of privilege vulnerability exists when the DirectX Graphics Kernel (DXGKRNL) driver improperly handles objects in memory, aka " (CVSS 7.8, KEV, Microsoft Windows Server 2012 R2 · Microsoft Windows RT +2)
- [CVE-2018-8406](https://cve.now/CVE-2018-8406.md): An elevation of privilege vulnerability exists when the DirectX Graphics Kernel (DXGKRNL) driver improperly handles objects in memory, aka " (CVSS 7.8, KEV, Microsoft Windows Server · Microsoft Windows)
- [CVE-2018-8412](https://cve.now/CVE-2018-8412.md): An elevation of privilege vulnerability exists when the Microsoft AutoUpdate (MAU) application for Mac improperly validates updates before e (no CVSS, Microsoft Office)
- [CVE-2018-8414](https://cve.now/CVE-2018-8414.md): A remote code execution vulnerability exists when the Windows Shell does not properly validate file paths, aka "Windows Shell Remote Code Ex (CVSS 8.8, KEV, Microsoft Windows 10 Servers · Microsoft Windows)
- [CVE-2018-1455](https://cve.now/CVE-2018-1455.md): IBM Tivoli Application Dependency Discovery Manager 7.2.2 and 7.3 is vulnerable to cross-site request forgery which could allow an attacker (CVSS 4.3, IBM Tivoli Application Dependency Discovery Manager)
- [CVE-2018-13393](https://cve.now/CVE-2018-13393.md): The convertCommentToAnswer resource in Atlassian Confluence Questions before version 2.6.6, the bundled version of Confluence Questions was (no CVSS, Atlassian Confluence Questions)
- [CVE-2018-13394](https://cve.now/CVE-2018-13394.md): The acceptAnswer resource in Atlassian Confluence Questions before version 2.6.6, the bundled version of Confluence Questions was updated to (no CVSS, Atlassian Confluence Questions)
- [CVE-2018-6973](https://cve.now/CVE-2018-6973.md): VMware Workstation (14.x before 14.1.3) and Fusion (10.x before 10.1.3) contain an out-of-bounds write vulnerability in the e1000 device. (no CVSS, VMware Workstation · VMware Fusion)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2018-08-15
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.