CVEs published August 20, 2018
67 CVEs were published on August 20, 2018: 0 critical, 1 high.
- Published
- 67
- Critical
- 0
- High
- 1
- Medium
- 3
- Low
- 0
- Unrated
- 63
- Now in CISA KEV
- 0
- Fix available
- 8
Most affected products
- cobbler
- 2
- IBM Rational DOORS Next Generation · IBM Rational Rhapso… +5
- 2
- IBM SDK, Java Technology Edition
- 2
- ICS-CERT Niagara AX Framework and Niagara 4 Framework
- 2
- flask
- 1
- jsmitty12/phpwhois · phpwhois/phpwhois +7
- 1
- org.dom4j:dom4j · dom4j:dom4j
- 1
- org.eclipse.rdf4j:rdf4j-runtime
- 1
- oxid-esales/paymorrow-module
- 1
- pycryptodome
- 1
High 1
Medium, low and unrated 66
- CVE-2018-12579An issue was discovered in OXID eShop Enterprise Edition before 5.3.8, 6.0.x before 6.0.3, and 6.1.x before 6.1.0; Professional Edition befo
- CVE-2018-14020An issue was discovered in the Paymorrow module 1.0.0 before 1.0.2 and 2.0.0 before 2.0.1 for OXID eShop.oxid-esales/paymorrow-module
- CVE-2018-14023Open Whisper Signal (aka Signal-Desktop) before 1.15.0-beta.10 allows information leakage.
- CVE-2015-5160libvirt before 2.2 includes Ceph credentials on the qemu command line when using RADOS Block Device (aka RBD), which allows local users to o
- CVE-2015-5243phpWhois allows remote attackers to execute arbitrary code via a crafted whois record.jsmitty12/phpwhois · phpwhois/phpwhois +7
- CVE-2016-7048The interactive installer in PostgreSQL before 9.3.15, 9.4.x before 9.4.10, and 9.5.x before 9.5.5 might allow remote attackers to execute a
- CVE-2017-16744A path traversal vulnerability in Tridium Niagara AX Versions 3.8 and prior and Niagara 4 systems Versions 4.4 and prior installed on MicrosICS-CERT Niagara AX Framework and Niagara 4 Framework
- CVE-2017-16748An attacker can log into the local Niagara platform (Niagara AX Framework Versions 3.8 and prior or Niagara 4 Framework Versions 4.4 and priICS-CERT Niagara AX Framework and Niagara 4 Framework
- CVE-2017-1753Multiple IBM Rational products are vulnerable to HTML injection.IBM Rational DOORS Next Generation · IBM Rational Rhapso… +5
- CVE-2018-1394Multiple IBM Rational products are vulnerable to cross-site scripting.IBM Rational DOORS Next Generation · IBM Rational Rhapso… +5
- CVE-2018-1517A flaw in the java.math component in IBM SDK, Java Technology Edition 6.0, 7.0, and 8.0 may allow an attacker to inflict a denial-of-serviceIBM SDK, Java Technology Edition
- CVE-2018-1000215Dave Gamble cJSON version 1.7.6 and earlier contains a CWE-772 vulnerability in cJSON library that can result in Denial of Service (DoS).
- CVE-2018-1000216Dave Gamble cJSON version 1.7.2 and earlier contains a CWE-415: Double Free vulnerability in cJSON library that can result in Possible crash
- CVE-2018-1000217Dave Gamble cJSON version 1.7.3 and earlier contains a CWE-416: Use After Free vulnerability in cJSON library that can result in Possible cr
- CVE-2018-1000218OpenEMR version v5_0_1_4 contains a Cross Site Scripting (XSS) vulnerability in The 'file' parameter in line #43 of interface/fax/fax_view.p
- CVE-2018-1000219OpenEMR version v5_0_1_4 contains a Cross Site Scripting (XSS) vulnerability in The 'scan' parameter in line #41 of interface/fax/fax_view.p
- CVE-2018-1000221pkgconf version 1.5.0 to 1.5.2 contains a Buffer Overflow vulnerability in dequote() that can result in dequote() function returns 1-byte al
- CVE-2018-1000222Libgd version 2.2.5 contains a Double Free Vulnerability vulnerability in gdImageBmpPtr Function that can result in Remote Code Execution .
- CVE-2018-1000223soundtouch version up to and including 2.0.0 contains a Buffer Overflow vulnerability in SoundStretch/WavFile.cpp:WavInFile::readHeaderBlock
- CVE-2018-1000224Godot Engine version All versions prior to 2.1.5, all 3.0 versions prior to 3.0.6.
- CVE-2018-1000225Cobbler version Verified as present in Cobbler versions 2.6.11+, but code inspection suggests at least 2.0.0+ or possibly even older versioncobbler
- CVE-2018-1000226Cobbler version Verified as present in Cobbler versions 2.6.11+, but code inspection suggests at least 2.0.0+ or possibly even older versioncobbler
- CVE-2018-14077Wi2be SMART HP WMT R1.2.20_201400922 allows unauthorized remote attackers to backup the device configuration via a direct request to /Mainte
- CVE-2018-14078Wi2be SMART HP WMT R1.2.20_201400922 allows unauthorized remote attackers to reset the admin password via the /ConfigWizard/ChangePwd.esp?2a
- CVE-2018-14079Wi2be SMART HP WMT R1.2.20_201400922 allows unauthorized remote attackers to obtain sensitive information via /Status/SystemStatusRpm.esp.
- CVE-2018-1000632dom4j version prior to version 2.1.1 contains a CWE-91: XML Injection vulnerability in Class: Element.org.dom4j:dom4j · dom4j:dom4j
- CVE-2018-1000633The Open Microscopy Environment OMERO.web version prior to 5.4.7 contains an Information Exposure Through Log Files vulnerability in the log
- CVE-2018-1000634The Open Microscopy Environment OMERO.server version 5.4.0 to 5.4.6 contains an Improper Access Control vulnerability in User management tha
- CVE-2018-1000635The Open Microscopy Environment OMERO.server version 5.4.0 to 5.4.6 contains a Information Exposure Through Sent Data vulnerability in OMERO
- CVE-2018-1000636JerryScript version Tested on commit f86d7459d195c8ba58479d1861b0cc726c8b3793.
- CVE-2018-1000637zutils version prior to version 1.8-pre2 contains a Buffer Overflow vulnerability in zcat that can result in Potential denial of service or
- CVE-2018-1000638MiniCMS version 1.1 contains a Cross Site Scripting (XSS) vulnerability in http://example.org/mc-admin/page.php?date={payload} that can resu
- CVE-2018-1000639LatexDraw version <=4.0 contains a XML External Entity (XXE) vulnerability in SVG parsing functionality that can result in disclosure of dat
- CVE-2018-1000640OpenCart-Overclocked version <=1.11.1 contains a Cross Site Scripting (XSS) vulnerability in User input entered unsanitised within JS functivillagedefrance/opencart-overclocked
- CVE-2018-1000641YesWiki version <= cercopitheque beta 1 contains a PHP Object Injection vulnerability in Unserialising user entered parameter in i18n.inc.ph
- CVE-2018-1000642FlightAirMap version <=v1.0-beta.21 contains a Cross Site Scripting (XSS) vulnerability in GET variable used within registration sub menu pa
- CVE-2018-1000644Eclipse RDF4j version < 2.4.0 Milestone 2 contains a XML External Entity (XXE) vulnerability in RDF4j XML parser parsing RDF files that can org.eclipse.rdf4j:rdf4j-runtime
- CVE-2018-1000645LibreHealthIO lh-ehr version <REL-2.0.0 contains an Authenticated Local File Disclosure vulnerability in Importing of templates allows local
- CVE-2018-1000646LibreHealthIO LH-EHR version REL-2.0.0 contains an Authenticated Unrestricted File Write vulnerability in Import template that can result in
- CVE-2018-1000647LibreHealthIO lh-ehr version REL-2.0.0 contains a Authenticated Unrestricted File Deletion vulnerability in Import template that can result
- CVE-2018-1000648LibreHealthIO lh-ehr version REL-2.0.0 contains a Authenticated Unrestricted File Write vulnerability in Patient file letter functions that
- CVE-2018-1000649LibreHealthIO lh-ehr version REL-2.0.0 contains a Authenticated Unrestricted File Write in letter.php (2) vulnerability in Patient file lett
- CVE-2018-1000650LibreHealthIO lh-ehr version REL-2.0.0 contains a SQL Injection vulnerability in Show Groups Popup SQL query functions that can result in Ab
- CVE-2018-1000651Stroom version <5.4.5 contains a XML External Entity (XXE) vulnerability in XML Parser that can result in disclosure of confidential data, d
- CVE-2018-1000652JabRef version <=4.3.1 contains a XML External Entity (XXE) vulnerability in MsBibImporter XML Parser that can result in disclosure of confi
- CVE-2018-1000653zzcms version 8.3 and earlier contains a SQL Injection vulnerability in zt/top.php line 5 that can result in could be attacked by sql inject
- CVE-2018-1000654GNU Libtasn1-4.13 libtasn1-4.13 version libtasn1-4.13, libtasn1-4.12 contains a DoS, specifically CPU usage will reach 100% when running asn
- CVE-2018-1000655Jsish version 2.4.65 contains a CWE-476: NULL Pointer Dereference vulnerability in Function jsi_ValueCopyMove from jsiValue.c:240 that can r
- CVE-2018-1000656The Pallets Project flask version Before 0.12.3 contains a CWE-20: Improper Input Validation vulnerability in flask that can result in Largeflask
- CVE-2018-1000657Rust Programming Language Rust standard library version Commit bfa0e1f58acf1c28d500c34ed258f09ae021893e and later; stable release 1.3.0 and
- CVE-2018-5243The Symantec Encryption Management Server (SEMS) product, prior to version 3.4.2 MP1, may be susceptible to a denial of service (DoS) exploiSymantec Encryption Management Server
- CVE-2011-2765Insecure temporary file handlingpyro
- CVE-2018-15594arch/x86/kernel/paravirt.c in the Linux kernel before 4.18.1 mishandles certain indirect calls, which makes it easier for attackers to condu
- CVE-2018-15572The spectre_v2_select_mitigation function in arch/x86/kernel/cpu/bugs.c in the Linux kernel before 4.18.1 does not always fill RSB upon a co
- CVE-2018-15573An issue was discovered in Reprise License Manager (RLM) through 12.2BL2.
- CVE-2018-15574An issue was discovered in the license editor in Reprise License Manager (RLM) through 12.2BL2.
- CVE-2018-15564An issue was discovered in daveismyname simple-cms through 2014-03-11.
- CVE-2018-15565An issue was discovered in daveismyname simple-cms through 2014-03-11.
- CVE-2018-15566tp5cms through 2017-05-25 has XSS via the admin.php/article/index.html q parameter.
- CVE-2018-15567CMSUno before 1.5.3 has XSS via the title field.
- CVE-2018-15568tp5cms through 2017-05-25 has CSRF via admin.php/category/delete.html.
- CVE-2018-15569my little forum 2.4.12 allows CSRF for deletion of users.
- CVE-2018-15570In waimai Super Cms 20150505, there is stored XSS via the /admin.php/Foodcat/editsave fcname parameter.
- CVE-2018-15553fileshare.cmd on Telus Actiontec T2200H T2200H-31.128L.03 devices allows OS Command Injection via shell metacharacters in the smbdUserid or
- CVE-2018-15559The editor in Xiuno BBS 4.0.4 allows stored XSS.
- CVE-2018-15560PyCryptodome before 3.6.6 has an integer overflow in the data_len variable in AESNI.c, related to the AESNI_encrypt and AESNI_decrypt functipycryptodome