# CVEs published 2018-08-22 25 CVEs were published on August 22, 2018: 0 critical, 4 high. 1 is now in CISA KEV. Days are UTC. - [CVE-2016-9605](https://cve.now/CVE-2016-9605.md): A flaw was found in cobbler software component version 2.6.11-1. (CVSS 6.1, The cobbler Project cobbler · cobbler) - [CVE-2017-2575](https://cve.now/CVE-2017-2575.md): A vulnerability was found while fuzzing libbpg 0.9.7. (no CVSS, Fabrice Bellard libbpg) - [CVE-2017-2635](https://cve.now/CVE-2017-2635.md): A NULL pointer deference flaw was found in the way libvirt from 2.5.0 to 3.0.0 handled empty drives. (CVSS 7.7, The libvirt Project libvirt) - [CVE-2018-11758](https://cve.now/CVE-2018-11758.md): This affects Apache Cayenne 4.1.M1, 3.2.M1, 4.0.M2 to 4.0.M5, 4.0.B1, 4.0.B2, 4.0.RC1, 3.1, 3.1.1, 3.1.2. (no CVSS, Apache Software Foundation Apache Cayenne · org.apache.caye…) - [CVE-2018-14787](https://cve.now/CVE-2018-14787.md): In Philips' IntelliSpace Cardiovascular (ISCV) products (ISCV Version 2.x or prior and Xcelera Version 4.1 or prior), an attacker with escal (no CVSS, Philips IntelliSpace Cardiovascular (ISCV) products) - [CVE-2018-14789](https://cve.now/CVE-2018-14789.md): In Philips' IntelliSpace Cardiovascular (ISCV) products (ISCV Version 3.1 or prior and Xcelera Version 4.1 or prior), an unquoted search pat (no CVSS, Philips IntelliSpace Cardiovascular (ISCV) products) - [CVE-2018-14799](https://cve.now/CVE-2018-14799.md): In Philips PageWriter TC10, TC20, TC30, TC50, TC70 Cardiographs, all versions prior to May 2018, the PageWriter device does not sanitize dat (no CVSS, Philips PageWriter TC10, TC20, TC30, TC50, TC70 Cardiographs) - [CVE-2018-14801](https://cve.now/CVE-2018-14801.md): In Philips PageWriter TC10, TC20, TC30, TC50, TC70 Cardiographs, all versions prior to May 2018, an attacker with both the superuser passwor (no CVSS, Philips PageWriter TC10, TC20, TC30, TC50, TC70 Cardiographs) - [CVE-2017-2627](https://cve.now/CVE-2017-2627.md): A flaw was found in openstack-tripleo-common as shipped with Red Hat Openstack Enterprise 10 and 11. (CVSS 8.2, Red Hat openstack-tripleo-common) - [CVE-2018-10858](https://cve.now/CVE-2018-10858.md): A heap-buffer overflow was found in the way samba clients processed extra long filename in a directory listing. (CVSS 4.3, The Samba Team samba) - [CVE-2018-10918](https://cve.now/CVE-2018-10918.md): A null pointer dereference flaw was found in the way samba checked database outputs from the LDB database layer. (CVSS 5.2, The Samba Team samba) - [CVE-2018-10919](https://cve.now/CVE-2018-10919.md): The Samba Active Directory LDAP server was vulnerable to an information disclosure flaw because of missing access control checks. (CVSS 4.3, The Samba Team samba) - [CVE-2018-5235](https://cve.now/CVE-2018-5235.md): Norton Utilities (prior to 16.0.3.44) may be susceptible to a DLL Preloading vulnerability, which is a type of issue that can occur when an (no CVSS, Symantec Norton Utilities) - [CVE-2018-5238](https://cve.now/CVE-2018-5238.md): Norton Power Eraser (prior to 5.3.0.24) and SymDiag (prior to 2.1.242) may be susceptible to a DLL Preloading vulnerability, which is a type (no CVSS, Symantec Norton Power Eraser · Symantec SymDiag) - [CVE-2017-2662](https://cve.now/CVE-2017-2662.md): A flaw was found in Foreman's katello plugin version 3.4.5. (CVSS 4.3, The Foreman Project foreman katello plugin · katello) - [CVE-2017-7528](https://cve.now/CVE-2017-7528.md): Ansible Tower as shipped with Red Hat CloudForms Management Engine 5 is vulnerable to CRLF Injection. (CVSS 5.2, Red Hat Ansible Tower) - [CVE-2017-7513](https://cve.now/CVE-2017-7513.md): It was found that Satellite 5 configured with SSL/TLS for the PostgreSQL backend failed to correctly validate X.509 server certificate host (CVSS 5.4, Red Hat Satellite) - [CVE-2018-10884](https://cve.now/CVE-2018-10884.md): Ansible Tower before versions 3.1.8 and 3.2.6 is vulnerable to cross-site request forgery (CSRF) in awx/api/authentication.py. (CVSS 8.8, Red Hat ansible-tower) - [CVE-2018-1139](https://cve.now/CVE-2018-1139.md): A flaw was found in the way samba before 4.7.9 and 4.8.4 allowed the use of weak NTLMv1 authentication even when NTLMv1 was explicitly disab (CVSS 5.4, The Samba Team samba) - [CVE-2018-1140](https://cve.now/CVE-2018-1140.md): A missing input sanitization flaw was found in the implementation of LDP database used for the LDAP server. (CVSS 6.5, The Samba Team samba) - [CVE-2018-10844](https://cve.now/CVE-2018-10844.md): It was found that the GnuTLS implementation of HMAC-SHA-256 was vulnerable to a Lucky thirteen style attack. (CVSS 5.9, \[UNKNOWN\] gnutls) - [CVE-2018-10845](https://cve.now/CVE-2018-10845.md): It was found that the GnuTLS implementation of HMAC-SHA-384 was vulnerable to a Lucky thirteen style attack. (CVSS 5.9, \[UNKNOWN\] gnutls) - [CVE-2018-10846](https://cve.now/CVE-2018-10846.md): A cache-based side channel in GnuTLS implementation that leads to plain text recovery in cross-VM attack setting was found. (CVSS 5.3, \[UNKNOWN\] gnutls) - [CVE-2018-11776](https://cve.now/CVE-2018-11776.md): Apache Struts versions 2.3 to 2.3.34 and 2.5 to 2.5.16 suffer from possible Remote Code Execution when alwaysSelectFullNamespace is true (ei (CVSS 8.1, KEV, Apache Software Foundation Apache Struts · org.apache.strut…) - [CVE-2018-1599](https://cve.now/CVE-2018-1599.md): IBM API Connect 5.0.0.0 through 5.0.8.3 could allow a remote attacker to hijack the clicking action of the victim. (CVSS 5.4, IBM API Connect) --- Source: cve.now, built and run by Sazabi (AI-native observability and security) Page: https://cve.now/daily/2018-08-22 Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.