CVEs published August 23, 2018
46 CVEs were published on August 23, 2018: 9 critical, 14 high.
- Published
- 46
- Critical
- 9
- High
- 14
- Medium
- 0
- Low
- 0
- Unrated
- 23
- Now in CISA KEV
- 0
- Fix available
- 9
Most affected products
- Samsung SmartThings Hub STH-ETH-250
- 10
- org.jenkins-ci.main:jenkins-core
- 6
- Samsung
- 5
- Insteon Hub 2245-222
- 4
- Insteon
- 3
- Emerson DeltaV DCS
- 2
- Apache Software Foundation Apache Sentry · org.apache.sentr…
- 1
- Becton, Dickinson and Company Alaris GS, Alaris GH, Alaris…
- 1
- electron
- 1
- Talos Samsung
- 1
Critical 9
- CVE-2018-3856An exploitable vulnerability exists in the smart cameras RTSP configuration of the Samsung SmartThings Hub STH-ETH-250 - Firmware version 0.Samsung
- CVE-2018-3866An exploitable buffer overflow vulnerability exists in the samsungWifiScan handler of video-core's HTTP server of Samsung SmartThings Hub STSamsung
- CVE-2018-3872An exploitable buffer overflow vulnerability exists in the credentials handler of video-core's HTTP server of Samsung SmartThings Hub STH-ETSamsung
- CVE-2018-3863On Samsung SmartThings Hub STH-ETH-250 devices with firmware version 0.20.17, the video-core process incorrectly extracts fields from a userSamsung SmartThings Hub STH-ETH-250
- CVE-2018-3867An exploitable stack-based buffer overflow vulnerability exists in the samsungWifiScan callback notification of video-core's HTTP server of Samsung SmartThings Hub STH-ETH-250
- CVE-2018-3878Multiple exploitable buffer overflow vulnerabilities exist in the credentials handler of video-core's HTTP server of Samsung SmartThings HubSamsung SmartThings Hub STH-ETH-250
- CVE-2018-3902An exploitable buffer overflow vulnerability exists in the camera "replace" feature of video-core's HTTP server of Samsung SmartThings Hub SSamsung SmartThings Hub STH-ETH-250
- CVE-2018-3903On Samsung SmartThings Hub STH-ETH-250 devices with firmware version 0.20.17, the video-core process incorrectly extracts fields from a userTalos Samsung
- CVE-2018-3832An exploitable firmware update vulnerability exists in Insteon Hub running firmware version 1013.Insteon
High 14
- CVE-2018-3880An exploitable stack-based buffer overflow vulnerability exists in the database 'find-by-cameraId' functionality of video-core's HTTP serverSamsung
- CVE-2018-3911An exploitable HTTP header injection vulnerability exists in the remote servers of Samsung SmartThings Hub STH-ETH-250 - Firmware version 0.Samsung
- CVE-2017-14452An exploitable buffer overflow vulnerability exists in the PubNub message handler for the "control" channel of Insteon Hub running firmware Insteon Hub 2245-222
- CVE-2018-3912On Samsung SmartThings Hub STH-ETH-250 devices with firmware version 0.20.17, the video-core process insecurely extracts the fields from theSamsung SmartThings Hub STH-ETH-250
- CVE-2017-14453On Insteon Hub 2245-222 devices with firmware version 1012, specially crafted replies received from the PubNub service can cause buffer overInsteon Hub 2245-222
- CVE-2017-14455On Insteon Hub 2245-222 devices with firmware version 1012, specially crafted replies received from the PubNub service can cause buffer overInsteon Hub 2245-222
- CVE-2017-16337On Insteon Hub 2245-222 devices with firmware version 1012, specially crafted commands sent through the PubNub service can cause a stack-basInsteon Hub 2245-222
- CVE-2018-3879An exploitable JSON injection vulnerability exists in the credentials handler of video-core's HTTP server of Samsung SmartThings Hub STH-ETHSamsung SmartThings Hub STH-ETH-250
- CVE-2018-3905An exploitable buffer overflow vulnerability exists in the camera "create" feature of video-core's HTTP server of Samsung SmartThings Hub STSamsung SmartThings Hub STH-ETH-250
- CVE-2018-3917On Samsung SmartThings Hub STH-ETH-250 devices with firmware version 0.20.17, the video-core process insecurely extracts the fields from theSamsung SmartThings Hub STH-ETH-250
- CVE-2018-3919An exploitable stack-based buffer overflow vulnerability exists in the retrieval of database fields in video-core's HTTP server of Samsung SSamsung SmartThings Hub STH-ETH-250
- CVE-2018-3925An exploitable buffer overflow vulnerability exists in the remote video-host communication of video-core's HTTP server of Samsung SmartThingSamsung SmartThings Hub STH-ETH-250
- CVE-2017-16348An exploitable denial of service vulnerability exists in Insteon Hub running firmware version 1012.Insteon
- CVE-2018-3833An exploitable firmware downgrade vulnerability exists in Insteon Hub running firmware version 1013.Insteon
Medium, low and unrated 23
- CVE-2018-15822The flv_write_packet function in libavformat/flvenc.c in FFmpeg through 2.8 does not check for an empty audio packet, leading to an assertio
- CVE-2018-15807POSIM EVO 15.13 for Windows includes an "Emergency Override" administrative account that may be accessed through POSIM's "override" feature.
- CVE-2018-15808POSIM EVO 15.13 for Windows includes hardcoded database credentials for the "root" database user.
- CVE-2018-15809AccuPOS 2017.8 is installed with the insecure "Authenticated Users: Modify" permission for files within the installation path.
- CVE-2018-6558The pam_fscrypt module in fscrypt before 0.2.4 may incorrectly restore primary and supplementary group IDs to the values associated with theThe fscrypt Project fscrypt · github.com/google/fscrypt
- CVE-2003-1605curl 7.x before 7.10.7 sends CONNECT proxy credentials to the remote server.
- CVE-2018-1156Mikrotik RouterOS before 6.42.7 and 6.40.9 is vulnerable to stack buffer overflow through the license upgrade interface.
- CVE-2018-1157Mikrotik RouterOS before 6.42.7 and 6.40.9 is vulnerable to a memory exhaustion vulnerability.
- CVE-2018-1158Mikrotik RouterOS before 6.42.7 and 6.40.9 is vulnerable to a stack exhaustion vulnerability.
- CVE-2018-1159Mikrotik RouterOS before 6.42.7 and 6.40.9 is vulnerable to a memory corruption vulnerability.
- CVE-2018-14786Becton, Dickinson and Company (BD) Alaris Plus medical syringe pumps (models Alaris GS, Alaris GH, Alaris CC, and Alaris TIVA) versions 2.3.Becton, Dickinson and Company Alaris GS, Alaris GH, Alaris…
- CVE-2018-14791Emerson DeltaV DCS versions 11.3.1, 12.3.1, 13.3.0, 13.3.1, R5 may allow non-administrative users to change executable and library files on Emerson DeltaV DCS
- CVE-2018-14797Emerson DeltaV DCS versions 11.3.1, 12.3.1, 13.3.0, 13.3.1, R5 allow a specially crafted DLL file to be placed in the search path and loadedEmerson DeltaV DCS
- CVE-2018-15804An issue was discovered in the MapR File System in MapR Converged Data Platform and MapR-XD 6.x and earlier.
- CVE-2018-1999042A vulnerability exists in Jenkins 2.137 and earlier, 2.121.2 and earlier in XStream2.java that allows attackers to have Jenkins resolve a doorg.jenkins-ci.main:jenkins-core
- CVE-2018-1999043A denial of service vulnerability exists in Jenkins 2.137 and earlier, 2.121.2 and earlier in BasicAuthenticationFilter.java, BasicHeaderApiorg.jenkins-ci.main:jenkins-core
- CVE-2018-1999044A denial of service vulnerability exists in Jenkins 2.137 and earlier, 2.121.2 and earlier in CronTab.java that allows attackers with Overalorg.jenkins-ci.main:jenkins-core
- CVE-2018-1999045A improper authentication vulnerability exists in Jenkins 2.137 and earlier, 2.121.2 and earlier in SecurityRealm.java, TokenBasedRememberMeorg.jenkins-ci.main:jenkins-core
- CVE-2018-1999046A exposure of sensitive information vulnerability exists in Jenkins 2.137 and earlier, 2.121.2 and earlier in Computer.java that allows attaorg.jenkins-ci.main:jenkins-core
- CVE-2018-1999047A improper authorization vulnerability exists in Jenkins 2.137 and earlier, 2.121.2 and earlier in UpdateCenter.java that allows attackers torg.jenkins-ci.main:jenkins-core
- CVE-2018-15748On Dell 2335dn printers with Printer Firmware Version 2.70.05.02, Engine Firmware Version 1.10.65, and Network Firmware Version V4.02.15(233
- CVE-2018-8028An authenticated user can execute ALTER TABLE EXCHANGE PARTITIONS without being authorized by Apache Sentry before 2.0.1.Apache Software Foundation Apache Sentry · org.apache.sentr…
- CVE-2018-15685GitHub Electron 1.7.15, 1.8.7, 2.0.7, and 3.0.0-beta.6, in certain scenarios involving IFRAME elements and "nativeWindowOpen: true" or "sandelectron