# CVEs published 2018-08-20 67 CVEs were published on August 20, 2018: 0 critical, 1 high. Days are UTC. - [CVE-2018-12579](https://cve.now/CVE-2018-12579.md): An issue was discovered in OXID eShop Enterprise Edition before 5.3.8, 6.0.x before 6.0.3, and 6.1.x before 6.1.0; Professional Edition befo (no CVSS) - [CVE-2018-14020](https://cve.now/CVE-2018-14020.md): An issue was discovered in the Paymorrow module 1.0.0 before 1.0.2 and 2.0.0 before 2.0.1 for OXID eShop. (no CVSS, oxid-esales/paymorrow-module) - [CVE-2018-14023](https://cve.now/CVE-2018-14023.md): Open Whisper Signal (aka Signal-Desktop) before 1.15.0-beta.10 allows information leakage. (no CVSS) - [CVE-2015-5160](https://cve.now/CVE-2015-5160.md): libvirt before 2.2 includes Ceph credentials on the qemu command line when using RADOS Block Device (aka RBD), which allows local users to o (no CVSS) - [CVE-2015-5243](https://cve.now/CVE-2015-5243.md): phpWhois allows remote attackers to execute arbitrary code via a crafted whois record. (no CVSS, jsmitty12/phpwhois · phpwhois/phpwhois +7) - [CVE-2016-7048](https://cve.now/CVE-2016-7048.md): The interactive installer in PostgreSQL before 9.3.15, 9.4.x before 9.4.10, and 9.5.x before 9.5.5 might allow remote attackers to execute a (no CVSS) - [CVE-2017-16744](https://cve.now/CVE-2017-16744.md): A path traversal vulnerability in Tridium Niagara AX Versions 3.8 and prior and Niagara 4 systems Versions 4.4 and prior installed on Micros (no CVSS, ICS-CERT Niagara AX Framework and Niagara 4 Framework) - [CVE-2017-16748](https://cve.now/CVE-2017-16748.md): An attacker can log into the local Niagara platform (Niagara AX Framework Versions 3.8 and prior or Niagara 4 Framework Versions 4.4 and pri (no CVSS, ICS-CERT Niagara AX Framework and Niagara 4 Framework) - [CVE-2017-1753](https://cve.now/CVE-2017-1753.md): Multiple IBM Rational products are vulnerable to HTML injection. (CVSS 5.4, IBM Rational DOORS Next Generation · IBM Rational Rhapso… +5) - [CVE-2018-1394](https://cve.now/CVE-2018-1394.md): Multiple IBM Rational products are vulnerable to cross-site scripting. (CVSS 5.4, IBM Rational DOORS Next Generation · IBM Rational Rhapso… +5) - [CVE-2018-1517](https://cve.now/CVE-2018-1517.md): A flaw in the java.math component in IBM SDK, Java Technology Edition 6.0, 7.0, and 8.0 may allow an attacker to inflict a denial-of-service (CVSS 5.9, IBM SDK, Java Technology Edition) - [CVE-2018-1656](https://cve.now/CVE-2018-1656.md): The IBM Java Runtime Environment's Diagnostic Tooling Framework for Java (DTFJ) (IBM SDK, Java Technology Edition 6.0 , 7.0, and 8.0) does n (CVSS 7.4, IBM SDK, Java Technology Edition) - [CVE-2018-1000215](https://cve.now/CVE-2018-1000215.md): Dave Gamble cJSON version 1.7.6 and earlier contains a CWE-772 vulnerability in cJSON library that can result in Denial of Service (DoS). (no CVSS) - [CVE-2018-1000216](https://cve.now/CVE-2018-1000216.md): Dave Gamble cJSON version 1.7.2 and earlier contains a CWE-415: Double Free vulnerability in cJSON library that can result in Possible crash (no CVSS) - [CVE-2018-1000217](https://cve.now/CVE-2018-1000217.md): Dave Gamble cJSON version 1.7.3 and earlier contains a CWE-416: Use After Free vulnerability in cJSON library that can result in Possible cr (no CVSS) - [CVE-2018-1000218](https://cve.now/CVE-2018-1000218.md): OpenEMR version v5\_0\_1\_4 contains a Cross Site Scripting (XSS) vulnerability in The 'file' parameter in line #43 of interface/fax/fax\_view.p (no CVSS) - [CVE-2018-1000219](https://cve.now/CVE-2018-1000219.md): OpenEMR version v5\_0\_1\_4 contains a Cross Site Scripting (XSS) vulnerability in The 'scan' parameter in line #41 of interface/fax/fax\_view.p (no CVSS) - [CVE-2018-1000221](https://cve.now/CVE-2018-1000221.md): pkgconf version 1.5.0 to 1.5.2 contains a Buffer Overflow vulnerability in dequote() that can result in dequote() function returns 1-byte al (no CVSS) - [CVE-2018-1000222](https://cve.now/CVE-2018-1000222.md): Libgd version 2.2.5 contains a Double Free Vulnerability vulnerability in gdImageBmpPtr Function that can result in Remote Code Execution . (no CVSS) - [CVE-2018-1000223](https://cve.now/CVE-2018-1000223.md): soundtouch version up to and including 2.0.0 contains a Buffer Overflow vulnerability in SoundStretch/WavFile.cpp:WavInFile::readHeaderBlock (no CVSS) - [CVE-2018-1000224](https://cve.now/CVE-2018-1000224.md): Godot Engine version All versions prior to 2.1.5, all 3.0 versions prior to 3.0.6. (no CVSS) - [CVE-2018-1000225](https://cve.now/CVE-2018-1000225.md): Cobbler version Verified as present in Cobbler versions 2.6.11+, but code inspection suggests at least 2.0.0+ or possibly even older version (no CVSS, cobbler) - [CVE-2018-1000226](https://cve.now/CVE-2018-1000226.md): Cobbler version Verified as present in Cobbler versions 2.6.11+, but code inspection suggests at least 2.0.0+ or possibly even older version (no CVSS, cobbler) - [CVE-2018-14077](https://cve.now/CVE-2018-14077.md): Wi2be SMART HP WMT R1.2.20\_201400922 allows unauthorized remote attackers to backup the device configuration via a direct request to /Mainte (no CVSS) - [CVE-2018-14078](https://cve.now/CVE-2018-14078.md): Wi2be SMART HP WMT R1.2.20\_201400922 allows unauthorized remote attackers to reset the admin password via the /ConfigWizard/ChangePwd.esp?2a (no CVSS) - [CVE-2018-14079](https://cve.now/CVE-2018-14079.md): Wi2be SMART HP WMT R1.2.20\_201400922 allows unauthorized remote attackers to obtain sensitive information via /Status/SystemStatusRpm.esp. (no CVSS) - [CVE-2018-1000632](https://cve.now/CVE-2018-1000632.md): dom4j version prior to version 2.1.1 contains a CWE-91: XML Injection vulnerability in Class: Element. (no CVSS, org.dom4j:dom4j · dom4j:dom4j) - [CVE-2018-1000633](https://cve.now/CVE-2018-1000633.md): The Open Microscopy Environment OMERO.web version prior to 5.4.7 contains an Information Exposure Through Log Files vulnerability in the log (no CVSS) - [CVE-2018-1000634](https://cve.now/CVE-2018-1000634.md): The Open Microscopy Environment OMERO.server version 5.4.0 to 5.4.6 contains an Improper Access Control vulnerability in User management tha (no CVSS) - [CVE-2018-1000635](https://cve.now/CVE-2018-1000635.md): The Open Microscopy Environment OMERO.server version 5.4.0 to 5.4.6 contains a Information Exposure Through Sent Data vulnerability in OMERO (no CVSS) - [CVE-2018-1000636](https://cve.now/CVE-2018-1000636.md): JerryScript version Tested on commit f86d7459d195c8ba58479d1861b0cc726c8b3793. (no CVSS) - [CVE-2018-1000637](https://cve.now/CVE-2018-1000637.md): zutils version prior to version 1.8-pre2 contains a Buffer Overflow vulnerability in zcat that can result in Potential denial of service or (no CVSS) - [CVE-2018-1000638](https://cve.now/CVE-2018-1000638.md): MiniCMS version 1.1 contains a Cross Site Scripting (XSS) vulnerability in http://example.org/mc-admin/page.php?date={payload} that can resu (no CVSS) - [CVE-2018-1000639](https://cve.now/CVE-2018-1000639.md): LatexDraw version \<=4.0 contains a XML External Entity (XXE) vulnerability in SVG parsing functionality that can result in disclosure of dat (no CVSS) - [CVE-2018-1000640](https://cve.now/CVE-2018-1000640.md): OpenCart-Overclocked version \<=1.11.1 contains a Cross Site Scripting (XSS) vulnerability in User input entered unsanitised within JS functi (no CVSS, villagedefrance/opencart-overclocked) - [CVE-2018-1000641](https://cve.now/CVE-2018-1000641.md): YesWiki version \<= cercopitheque beta 1 contains a PHP Object Injection vulnerability in Unserialising user entered parameter in i18n.inc.ph (no CVSS) - [CVE-2018-1000642](https://cve.now/CVE-2018-1000642.md): FlightAirMap version \<=v1.0-beta.21 contains a Cross Site Scripting (XSS) vulnerability in GET variable used within registration sub menu pa (no CVSS) - [CVE-2018-1000644](https://cve.now/CVE-2018-1000644.md): Eclipse RDF4j version \< 2.4.0 Milestone 2 contains a XML External Entity (XXE) vulnerability in RDF4j XML parser parsing RDF files that can (no CVSS, org.eclipse.rdf4j:rdf4j-runtime) - [CVE-2018-1000645](https://cve.now/CVE-2018-1000645.md): LibreHealthIO lh-ehr version \