# CVEs published 2018-08-21

28 CVEs were published on August 21, 2018: 0 critical, 1 high. Days are UTC.

- [CVE-2018-15667](https://cve.now/CVE-2018-15667.md): An issue was discovered in Bloop Airmail 3 3.5.9 for macOS. (no CVSS)
- [CVE-2018-15668](https://cve.now/CVE-2018-15668.md): An issue was discovered in Bloop Airmail 3 3.5.9 for macOS. (no CVSS)
- [CVE-2018-15669](https://cve.now/CVE-2018-15669.md): An issue was discovered in Bloop Airmail 3 3.5.9 for macOS. (no CVSS)
- [CVE-2018-15670](https://cve.now/CVE-2018-15670.md): An issue was discovered in Bloop Airmail 3 3.5.9 for macOS. (no CVSS)
- [CVE-2018-15671](https://cve.now/CVE-2018-15671.md): An issue was discovered in the HDF HDF5 1.10.2 library. (no CVSS)
- [CVE-2018-10902](https://cve.now/CVE-2018-10902.md): It was found that the raw midi kernel driver does not protect against concurrent access which leads to a double realloc (double free) in snd (CVSS 7.8, Linux)
- [CVE-2018-10932](https://cve.now/CVE-2018-10932.md): lldptool version 1.0.1 and older can print a raw, unsanitized attacker controlled buffer when mngAddr information is displayed. (CVSS 4.3, Intel lldptool)
- [CVE-2018-15660](https://cve.now/CVE-2018-15660.md): An issue was discovered in the Ola Money (aka com.olacabs.olamoney) application 1.9.0 for Android. (no CVSS)
- [CVE-2018-15661](https://cve.now/CVE-2018-15661.md): An issue was discovered in the Ola Money (aka com.olacabs.olamoney) application 1.9.0 for Android. (no CVSS)
- [CVE-2018-15481](https://cve.now/CVE-2018-15481.md): Improper input sanitization within the restricted administration shell on UCOPIA Wireless Appliance devices using firmware version 5.1.x bef (no CVSS)
- [CVE-2018-15528](https://cve.now/CVE-2018-15528.md): Reflected Cross-Site Scripting exists in the Java System Solutions SSO plugin 4.0.13.1 for BMC MyIT. (no CVSS)
- [CVE-2018-15533](https://cve.now/CVE-2018-15533.md): A reflected cross-site scripting vulnerability exists in Geutebrueck re\_porter 16 before 7.8.974.20 by appending a query string to /modifych (no CVSS)
- [CVE-2018-15534](https://cve.now/CVE-2018-15534.md): Geutebrueck re\_porter 16 before 7.8.974.20 has a possibility of unauthenticated access to sensitive information including usernames and hash (no CVSS)
- [CVE-2018-6557](https://cve.now/CVE-2018-6557.md): Insecure temporary file use in base-files (no CVSS, Ubuntu base-files)
- [CVE-2018-15607](https://cve.now/CVE-2018-15607.md): In ImageMagick 7.0.8-11 Q16, a tiny input file 0x50 0x36 0x36 0x36 0x36 0x4c 0x36 0x38 0x36 0x36 0x36 0x36 0x36 0x36 0x1f 0x35 0x50 0x00 can (no CVSS)
- [CVE-2018-14793](https://cve.now/CVE-2018-14793.md): DeltaV Versions 11.3.1, 12.3.1, 13.3.0, 13.3.1, and R5 is vulnerable to a buffer overflow exploit through an open communication port to allo (no CVSS, ICS-CERT DeltaV)
- [CVE-2018-14795](https://cve.now/CVE-2018-14795.md): DeltaV Versions 11.3.1, 12.3.1, 13.3.0, 13.3.1, and R5 is vulnerable due to improper path validation which may allow an attacker to replace (no CVSS, ICS-CERT DeltaV)
- [CVE-2018-6692](https://cve.now/CVE-2018-6692.md): Wemo Insight Smart Plug - Remote Code Execution vulnerability (CVSS 5.9, Belkin Wemo Insight Smart Plug)
- [CVE-2017-17305](https://cve.now/CVE-2017-17305.md): Some Huawei Firewall products USG2205BSR V300R001C10SPC600; USG2220BSR V300R001C00; USG5120BSR V300R001C00; USG5150BSR V300R001C00 have a Bl (no CVSS, Huawei Technologies Co. USG2205BSR; USG2220BSR; USG5120BSR;…)
- [CVE-2017-17311](https://cve.now/CVE-2017-17311.md): Some Huawei Firewall products USG2205BSR V300R001C10SPC600; USG2220BSR V300R001C00; USG5120BSR V300R001C00; USG5150BSR V300R001C00 have a Do (no CVSS, Huawei Technologies Co. USG2205BSR; USG2220BSR; USG5120BSR;…)
- [CVE-2017-17312](https://cve.now/CVE-2017-17312.md): Some Huawei Firewall products USG2205BSR V300R001C10SPC600; USG2220BSR V300R001C00; USG5120BSR V300R001C00; USG5150BSR V300R001C00 have a Do (no CVSS, Huawei Technologies Co. USG2205BSR; USG2220BSR; USG5120BSR;…)
- [CVE-2018-12115](https://cve.now/CVE-2018-12115.md): In all versions of Node.js prior to 6.14.4, 8.11.4 and 10.9.0 when used with UCS-2 encoding (recognized by Node.js under the names \`'ucs2'\`, (no CVSS, The Node.js Project Node.js)
- [CVE-2018-7166](https://cve.now/CVE-2018-7166.md): In all versions of Node.js 10 prior to 10.9.0, an argument processing flaw can cause \`Buffer.alloc()\` to return uninitialized memory. (no CVSS, The Node.js Project Node.js)
- [CVE-2018-15601](https://cve.now/CVE-2018-15601.md): apps/filemanager/handlers/upload/drop.php in Elefant CMS 2.0.3 performs a urldecode step too late in the "Cannot upload executable files" pr (no CVSS, elefant/cms)
- [CVE-2018-15603](https://cve.now/CVE-2018-15603.md): An issue was discovered in Victor CMS through 2018-05-10. (no CVSS)
- [CVE-2018-15598](https://cve.now/CVE-2018-15598.md): Containous Traefik 1.6.x before 1.6.6, when --api is used, exposes the configuration and secret if authentication is missing and the API's p (no CVSS, github.com/traefik/traefik)
- [CVE-2018-15599](https://cve.now/CVE-2018-15599.md): The recv\_msg\_userauth\_request function in svr-auth.c in Dropbear through 2018.76 is prone to a user enumeration vulnerability because userna (no CVSS)
- [CVE-2018-0501](https://cve.now/CVE-2018-0501.md): The mirror:// method implementation in Advanced Package Tool (APT) 1.6.x before 1.6.4 and 1.7.x before 1.7.0~alpha3 mishandles gpg signature (no CVSS, APT 1.6.x before 1.6.4 and 1.7.x before 1.7.0~alpha3)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2018-08-21
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.