CVEs published August 17, 2018
29 CVEs were published on August 17, 2018: 0 critical, 1 high.
- Published
- 29
- Critical
- 0
- High
- 1
- Medium
- 2
- Low
- 0
- Unrated
- 26
- Now in CISA KEV
- 0
- Fix available
- 3
Most affected products
- Kaspersky Lab Kraftway
- 6
- Kaspersky Lab Eltex ESP-200
- 5
- pimcore/pimcore
- 2
- [UNKNOWN] spice:
- 1
- F5 Networks BIG-IP APM client for Linux · F5 Networks BIG-I…
- 1
- F5 Networks BIG-IP APM client for Windows
- 1
- https://github.com/hunterloftis cryo · cryo
- 1
- https://github.com/JasonEtco flintcms · flintcms
- 1
- https://github.com/stevemao git-dummy-commit · git-dummy-co…
- 1
- IBM Security Access Manager for Enterprise Single Sign-On
- 1
High 1
Medium, low and unrated 28
- CVE-2018-14981Certain LG devices based on Android 6.0 through 8.1 have incorrect access control for SystemUI application intents.
- CVE-2018-14982Certain LG devices based on Android 6.0 through 8.1 have incorrect access control in the GNSS application.
- CVE-2018-15482Certain LG devices based on Android 6.0 through 8.1 have incorrect access control for MLT application intents.
- CVE-2018-14057Pimcore before 5.3.0 allows remote attackers to conduct cross-site request forgery (CSRF) attacks by leveraging validation of the X-pimcore-pimcore/pimcore
- CVE-2018-14058Pimcore before 5.3.0 allows SQL Injection via the REST web service API.pimcore/pimcore
- CVE-2018-6622An issue was discovered that affects all producers of BIOS firmware who make a certain realistic interpretation of an obscure portion of the
- CVE-2018-15468An issue was discovered in Xen through 4.11.x.
- CVE-2018-15469An issue was discovered in Xen through 4.11.x.
- CVE-2018-15470An issue was discovered in Xen through 4.11.x.
- CVE-2018-15471An issue was discovered in xenvif_set_hash_mapping in drivers/net/xen-netback/hash.c in the Linux kernel through 4.18.1, as used in Xen thro
- CVE-2017-1732IBM Security Access Manager for Enterprise Single Sign-On 8.2.2 does not set the secure attribute on authorization tokens or session cookiesIBM Security Access Manager for Enterprise Single Sign-On
- CVE-2018-15356An authenticated attacker can execute arbitrary code using command ejection in Eltex ESP-200 firmware version 1.2.0.Kaspersky Lab Eltex ESP-200
- CVE-2018-15357An authenticated attacker with low privileges can extract password hash information for all users in Eltex ESP-200 firmware version 1.2.0.Kaspersky Lab Eltex ESP-200
- CVE-2018-15358An authenticated attacker with low privileges can activate high privileged user and use it to expand attack surface in Eltex ESP-200 firmwarKaspersky Lab Eltex ESP-200
- CVE-2018-15359An authenticated attacker with low privileges can use insecure sudo configuration to expand attack surface in Eltex ESP-200 firmware versionKaspersky Lab Eltex ESP-200
- CVE-2018-15360An attacker without authentication can login with default credentials for privileged users in Eltex ESP-200 firmware version 1.2.0.Kaspersky Lab Eltex ESP-200
- CVE-2018-15350Router Default Credentials in Kraftway 24F2XG Router firmware version 3.5.30.1118 allow remote attackers to get privileged access to the rouKaspersky Lab Kraftway
- CVE-2018-15351Denial of service via crafting malicious link and sending it to a privileged user can cause Denial of Service in Kraftway 24F2XG Router firmKaspersky Lab Kraftway
- CVE-2018-15352An attacker with low privileges can cause denial of service in Kraftway 24F2XG Router firmware version 3.5.30.1118.Kaspersky Lab Kraftway
- CVE-2018-15353A Buffer Overflow exploited through web interface by remote attacker can cause remote code execution in Kraftway 24F2XG Router firmware 3.5.Kaspersky Lab Kraftway
- CVE-2018-15354A Buffer Overflow exploited through web interface by remote attacker can cause denial of service in Kraftway 24F2XG Router firmware 3.5.30.1Kaspersky Lab Kraftway
- CVE-2018-15355Usage of SSLv2 and SSLv3 leads to transmitted data decryption in Kraftway 24F2XG Router firmware 3.5.30.1118.Kaspersky Lab Kraftway
- CVE-2018-3783A privilege escalation detected in flintcms versions <= 1.1.9 allows account takeover due to blind MongoDB injection in password reset.https://github.com/JasonEtco flintcms · flintcms
- CVE-2018-3784A code injection in cryo 0.0.6 allows an attacker to arbitrarily execute code due to insecure implementation of deserialization.https://github.com/hunterloftis cryo · cryo
- CVE-2018-3785A command injection in git-dummy-commit v1.3.0 allows os level commands to be executed due to an unescaped parameter.https://github.com/stevemao git-dummy-commit · git-dummy-co…
- CVE-2018-5546The svpn and policyserver components of the F5 BIG-IP APM client prior to version 7.1.7.1 for Linux and macOS runs as a privileged process aF5 Networks BIG-IP APM client for Linux · F5 Networks BIG-I…
- CVE-2018-5547Windows Logon Integration feature of F5 BIG-IP APM client prior to version 7.1.7.1 for Windows by default uses Legacy logon mode which uses F5 Networks BIG-IP APM client for Windows
- CVE-2018-15473OpenSSH through 7.7 is prone to a user enumeration vulnerability due to not delaying bailout for an invalid authenticating user until after