# CVEs published 2018-08-17 29 CVEs were published on August 17, 2018: 0 critical, 1 high. Days are UTC. - [CVE-2018-14981](https://cve.now/CVE-2018-14981.md): Certain LG devices based on Android 6.0 through 8.1 have incorrect access control for SystemUI application intents. (no CVSS) - [CVE-2018-14982](https://cve.now/CVE-2018-14982.md): Certain LG devices based on Android 6.0 through 8.1 have incorrect access control in the GNSS application. (no CVSS) - [CVE-2018-15482](https://cve.now/CVE-2018-15482.md): Certain LG devices based on Android 6.0 through 8.1 have incorrect access control for MLT application intents. (no CVSS) - [CVE-2018-14057](https://cve.now/CVE-2018-14057.md): Pimcore before 5.3.0 allows remote attackers to conduct cross-site request forgery (CSRF) attacks by leveraging validation of the X-pimcore- (no CVSS, pimcore/pimcore) - [CVE-2018-14058](https://cve.now/CVE-2018-14058.md): Pimcore before 5.3.0 allows SQL Injection via the REST web service API. (no CVSS, pimcore/pimcore) - [CVE-2018-6622](https://cve.now/CVE-2018-6622.md): An issue was discovered that affects all producers of BIOS firmware who make a certain realistic interpretation of an obscure portion of the (no CVSS) - [CVE-2018-15468](https://cve.now/CVE-2018-15468.md): An issue was discovered in Xen through 4.11.x. (no CVSS) - [CVE-2018-15469](https://cve.now/CVE-2018-15469.md): An issue was discovered in Xen through 4.11.x. (no CVSS) - [CVE-2018-15470](https://cve.now/CVE-2018-15470.md): An issue was discovered in Xen through 4.11.x. (no CVSS) - [CVE-2018-15471](https://cve.now/CVE-2018-15471.md): An issue was discovered in xenvif\_set\_hash\_mapping in drivers/net/xen-netback/hash.c in the Linux kernel through 4.18.1, as used in Xen thro (no CVSS) - [CVE-2017-1732](https://cve.now/CVE-2017-1732.md): IBM Security Access Manager for Enterprise Single Sign-On 8.2.2 does not set the secure attribute on authorization tokens or session cookies (CVSS 4.3, IBM Security Access Manager for Enterprise Single Sign-On) - [CVE-2018-15356](https://cve.now/CVE-2018-15356.md): An authenticated attacker can execute arbitrary code using command ejection in Eltex ESP-200 firmware version 1.2.0. (no CVSS, Kaspersky Lab Eltex ESP-200) - [CVE-2018-15357](https://cve.now/CVE-2018-15357.md): An authenticated attacker with low privileges can extract password hash information for all users in Eltex ESP-200 firmware version 1.2.0. (no CVSS, Kaspersky Lab Eltex ESP-200) - [CVE-2018-15358](https://cve.now/CVE-2018-15358.md): An authenticated attacker with low privileges can activate high privileged user and use it to expand attack surface in Eltex ESP-200 firmwar (no CVSS, Kaspersky Lab Eltex ESP-200) - [CVE-2018-15359](https://cve.now/CVE-2018-15359.md): An authenticated attacker with low privileges can use insecure sudo configuration to expand attack surface in Eltex ESP-200 firmware version (no CVSS, Kaspersky Lab Eltex ESP-200) - [CVE-2018-15360](https://cve.now/CVE-2018-15360.md): An attacker without authentication can login with default credentials for privileged users in Eltex ESP-200 firmware version 1.2.0. (no CVSS, Kaspersky Lab Eltex ESP-200) - [CVE-2018-15350](https://cve.now/CVE-2018-15350.md): Router Default Credentials in Kraftway 24F2XG Router firmware version 3.5.30.1118 allow remote attackers to get privileged access to the rou (no CVSS, Kaspersky Lab Kraftway) - [CVE-2018-15351](https://cve.now/CVE-2018-15351.md): Denial of service via crafting malicious link and sending it to a privileged user can cause Denial of Service in Kraftway 24F2XG Router firm (no CVSS, Kaspersky Lab Kraftway) - [CVE-2018-15352](https://cve.now/CVE-2018-15352.md): An attacker with low privileges can cause denial of service in Kraftway 24F2XG Router firmware version 3.5.30.1118. (no CVSS, Kaspersky Lab Kraftway) - [CVE-2018-15353](https://cve.now/CVE-2018-15353.md): A Buffer Overflow exploited through web interface by remote attacker can cause remote code execution in Kraftway 24F2XG Router firmware 3.5. (no CVSS, Kaspersky Lab Kraftway) - [CVE-2018-15354](https://cve.now/CVE-2018-15354.md): A Buffer Overflow exploited through web interface by remote attacker can cause denial of service in Kraftway 24F2XG Router firmware 3.5.30.1 (no CVSS, Kaspersky Lab Kraftway) - [CVE-2018-15355](https://cve.now/CVE-2018-15355.md): Usage of SSLv2 and SSLv3 leads to transmitted data decryption in Kraftway 24F2XG Router firmware 3.5.30.1118. (no CVSS, Kaspersky Lab Kraftway) - [CVE-2018-3783](https://cve.now/CVE-2018-3783.md): A privilege escalation detected in flintcms versions \<= 1.1.9 allows account takeover due to blind MongoDB injection in password reset. (no CVSS, https://github.com/JasonEtco flintcms · flintcms) - [CVE-2018-3784](https://cve.now/CVE-2018-3784.md): A code injection in cryo 0.0.6 allows an attacker to arbitrarily execute code due to insecure implementation of deserialization. (no CVSS, https://github.com/hunterloftis cryo · cryo) - [CVE-2018-3785](https://cve.now/CVE-2018-3785.md): A command injection in git-dummy-commit v1.3.0 allows os level commands to be executed due to an unescaped parameter. (no CVSS, https://github.com/stevemao git-dummy-commit · git-dummy-co…) - [CVE-2018-5546](https://cve.now/CVE-2018-5546.md): The svpn and policyserver components of the F5 BIG-IP APM client prior to version 7.1.7.1 for Linux and macOS runs as a privileged process a (no CVSS, F5 Networks BIG-IP APM client for Linux · F5 Networks BIG-I…) - [CVE-2018-5547](https://cve.now/CVE-2018-5547.md): Windows Logon Integration feature of F5 BIG-IP APM client prior to version 7.1.7.1 for Windows by default uses Legacy logon mode which uses (no CVSS, F5 Networks BIG-IP APM client for Windows) - [CVE-2018-10873](https://cve.now/CVE-2018-10873.md): A vulnerability was discovered in SPICE before version 0.14.1 where the generated code used for demarshalling messages lacked sufficient bou (CVSS 8.3, \[UNKNOWN\] spice:) - [CVE-2018-15473](https://cve.now/CVE-2018-15473.md): OpenSSH through 7.7 is prone to a user enumeration vulnerability due to not delaying bailout for an invalid authenticating user until after (CVSS 5.9) --- Source: cve.now, built and run by Sazabi (AI-native observability and security) Page: https://cve.now/daily/2018-08-17 Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.