# CVEs published 2018-08-23

46 CVEs were published on August 23, 2018: 9 critical, 14 high. Days are UTC.

- [CVE-2018-15822](https://cve.now/CVE-2018-15822.md): The flv\_write\_packet function in libavformat/flvenc.c in FFmpeg through 2.8 does not check for an empty audio packet, leading to an assertio (no CVSS)
- [CVE-2018-3856](https://cve.now/CVE-2018-3856.md): An exploitable vulnerability exists in the smart cameras RTSP configuration of the Samsung SmartThings Hub STH-ETH-250 - Firmware version 0. (CVSS 9.9, Samsung)
- [CVE-2018-3866](https://cve.now/CVE-2018-3866.md): An exploitable buffer overflow vulnerability exists in the samsungWifiScan handler of video-core's HTTP server of Samsung SmartThings Hub ST (CVSS 9.9, Samsung)
- [CVE-2018-3872](https://cve.now/CVE-2018-3872.md): An exploitable buffer overflow vulnerability exists in the credentials handler of video-core's HTTP server of Samsung SmartThings Hub STH-ET (CVSS 9.9, Samsung)
- [CVE-2018-3880](https://cve.now/CVE-2018-3880.md): An exploitable stack-based buffer overflow vulnerability exists in the database 'find-by-cameraId' functionality of video-core's HTTP server (CVSS 8.2, Samsung)
- [CVE-2018-3911](https://cve.now/CVE-2018-3911.md): An exploitable HTTP header injection vulnerability exists in the remote servers of Samsung SmartThings Hub STH-ETH-250 - Firmware version 0. (CVSS 8.6, Samsung)
- [CVE-2018-15807](https://cve.now/CVE-2018-15807.md): POSIM EVO 15.13 for Windows includes an "Emergency Override" administrative account that may be accessed through POSIM's "override" feature. (no CVSS)
- [CVE-2018-15808](https://cve.now/CVE-2018-15808.md): POSIM EVO 15.13 for Windows includes hardcoded database credentials for the "root" database user. (no CVSS)
- [CVE-2018-15809](https://cve.now/CVE-2018-15809.md): AccuPOS 2017.8 is installed with the insecure "Authenticated Users: Modify" permission for files within the installation path. (no CVSS)
- [CVE-2018-6558](https://cve.now/CVE-2018-6558.md): The pam\_fscrypt module in fscrypt before 0.2.4 may incorrectly restore primary and supplementary group IDs to the values associated with the (no CVSS, The fscrypt Project fscrypt · github.com/google/fscrypt)
- [CVE-2003-1605](https://cve.now/CVE-2003-1605.md): curl 7.x before 7.10.7 sends CONNECT proxy credentials to the remote server. (no CVSS)
- [CVE-2018-1156](https://cve.now/CVE-2018-1156.md): Mikrotik RouterOS before 6.42.7 and 6.40.9 is vulnerable to stack buffer overflow through the license upgrade interface. (no CVSS)
- [CVE-2018-1157](https://cve.now/CVE-2018-1157.md): Mikrotik RouterOS before 6.42.7 and 6.40.9 is vulnerable to a memory exhaustion vulnerability. (no CVSS)
- [CVE-2018-1158](https://cve.now/CVE-2018-1158.md): Mikrotik RouterOS before 6.42.7 and 6.40.9 is vulnerable to a stack exhaustion vulnerability. (no CVSS)
- [CVE-2018-1159](https://cve.now/CVE-2018-1159.md): Mikrotik RouterOS before 6.42.7 and 6.40.9 is vulnerable to a memory corruption vulnerability. (no CVSS)
- [CVE-2018-14786](https://cve.now/CVE-2018-14786.md): Becton, Dickinson and Company (BD) Alaris Plus medical syringe pumps (models Alaris GS, Alaris GH, Alaris CC, and Alaris TIVA) versions 2.3. (no CVSS, Becton, Dickinson and Company Alaris GS, Alaris GH, Alaris…)
- [CVE-2018-14791](https://cve.now/CVE-2018-14791.md): Emerson DeltaV DCS versions 11.3.1, 12.3.1, 13.3.0, 13.3.1, R5 may allow non-administrative users to change executable and library files on (no CVSS, Emerson DeltaV DCS)
- [CVE-2018-14797](https://cve.now/CVE-2018-14797.md): Emerson DeltaV DCS versions 11.3.1, 12.3.1, 13.3.0, 13.3.1, R5 allow a specially crafted DLL file to be placed in the search path and loaded (no CVSS, Emerson DeltaV DCS)
- [CVE-2017-14452](https://cve.now/CVE-2017-14452.md): An exploitable buffer overflow vulnerability exists in the PubNub message handler for the "control" channel of Insteon Hub running firmware (CVSS 8.5, Insteon Hub 2245-222)
- [CVE-2018-15804](https://cve.now/CVE-2018-15804.md): An issue was discovered in the MapR File System in MapR Converged Data Platform and MapR-XD 6.x and earlier. (no CVSS)
- [CVE-2018-1999042](https://cve.now/CVE-2018-1999042.md): A vulnerability exists in Jenkins 2.137 and earlier, 2.121.2 and earlier in XStream2.java that allows attackers to have Jenkins resolve a do (no CVSS, org.jenkins-ci.main:jenkins-core)
- [CVE-2018-1999043](https://cve.now/CVE-2018-1999043.md): A denial of service vulnerability exists in Jenkins 2.137 and earlier, 2.121.2 and earlier in BasicAuthenticationFilter.java, BasicHeaderApi (no CVSS, org.jenkins-ci.main:jenkins-core)
- [CVE-2018-1999044](https://cve.now/CVE-2018-1999044.md): A denial of service vulnerability exists in Jenkins 2.137 and earlier, 2.121.2 and earlier in CronTab.java that allows attackers with Overal (no CVSS, org.jenkins-ci.main:jenkins-core)
- [CVE-2018-1999045](https://cve.now/CVE-2018-1999045.md): A improper authentication vulnerability exists in Jenkins 2.137 and earlier, 2.121.2 and earlier in SecurityRealm.java, TokenBasedRememberMe (no CVSS, org.jenkins-ci.main:jenkins-core)
- [CVE-2018-1999046](https://cve.now/CVE-2018-1999046.md): A exposure of sensitive information vulnerability exists in Jenkins 2.137 and earlier, 2.121.2 and earlier in Computer.java that allows atta (no CVSS, org.jenkins-ci.main:jenkins-core)
- [CVE-2018-1999047](https://cve.now/CVE-2018-1999047.md): A improper authorization vulnerability exists in Jenkins 2.137 and earlier, 2.121.2 and earlier in UpdateCenter.java that allows attackers t (no CVSS, org.jenkins-ci.main:jenkins-core)
- [CVE-2018-3912](https://cve.now/CVE-2018-3912.md): On Samsung SmartThings Hub STH-ETH-250 devices with firmware version 0.20.17, the video-core process insecurely extracts the fields from the (CVSS 7.5, Samsung SmartThings Hub STH-ETH-250)
- [CVE-2017-14453](https://cve.now/CVE-2017-14453.md): On Insteon Hub 2245-222 devices with firmware version 1012, specially crafted replies received from the PubNub service can cause buffer over (CVSS 8.5, Insteon Hub 2245-222)
- [CVE-2017-14455](https://cve.now/CVE-2017-14455.md): On Insteon Hub 2245-222 devices with firmware version 1012, specially crafted replies received from the PubNub service can cause buffer over (CVSS 8.5, Insteon Hub 2245-222)
- [CVE-2017-16337](https://cve.now/CVE-2017-16337.md): On Insteon Hub 2245-222 devices with firmware version 1012, specially crafted commands sent through the PubNub service can cause a stack-bas (CVSS 8.5, Insteon Hub 2245-222)
- [CVE-2018-15748](https://cve.now/CVE-2018-15748.md): On Dell 2335dn printers with Printer Firmware Version 2.70.05.02, Engine Firmware Version 1.10.65, and Network Firmware Version V4.02.15(233 (no CVSS)
- [CVE-2018-3863](https://cve.now/CVE-2018-3863.md): On Samsung SmartThings Hub STH-ETH-250 devices with firmware version 0.20.17, the video-core process incorrectly extracts fields from a user (CVSS 9.9, Samsung SmartThings Hub STH-ETH-250)
- [CVE-2018-3867](https://cve.now/CVE-2018-3867.md): An exploitable stack-based buffer overflow vulnerability exists in the samsungWifiScan callback notification of video-core's HTTP server of (CVSS 9.9, Samsung SmartThings Hub STH-ETH-250)
- [CVE-2018-3878](https://cve.now/CVE-2018-3878.md): Multiple exploitable buffer overflow vulnerabilities exist in the credentials handler of video-core's HTTP server of Samsung SmartThings Hub (CVSS 9.9, Samsung SmartThings Hub STH-ETH-250)
- [CVE-2018-3879](https://cve.now/CVE-2018-3879.md): An exploitable JSON injection vulnerability exists in the credentials handler of video-core's HTTP server of Samsung SmartThings Hub STH-ETH (CVSS 8.8, Samsung SmartThings Hub STH-ETH-250)
- [CVE-2018-3902](https://cve.now/CVE-2018-3902.md): An exploitable buffer overflow vulnerability exists in the camera "replace" feature of video-core's HTTP server of Samsung SmartThings Hub S (CVSS 9.9, Samsung SmartThings Hub STH-ETH-250)
- [CVE-2018-3903](https://cve.now/CVE-2018-3903.md): On Samsung SmartThings Hub STH-ETH-250 devices with firmware version 0.20.17, the video-core process incorrectly extracts fields from a user (CVSS 9.9, Talos Samsung)
- [CVE-2018-3905](https://cve.now/CVE-2018-3905.md): An exploitable buffer overflow vulnerability exists in the camera "create" feature of video-core's HTTP server of Samsung SmartThings Hub ST (CVSS 8.5, Samsung SmartThings Hub STH-ETH-250)
- [CVE-2018-3917](https://cve.now/CVE-2018-3917.md): On Samsung SmartThings Hub STH-ETH-250 devices with firmware version 0.20.17, the video-core process insecurely extracts the fields from the (CVSS 7.5, Samsung SmartThings Hub STH-ETH-250)
- [CVE-2018-3919](https://cve.now/CVE-2018-3919.md): An exploitable stack-based buffer overflow vulnerability exists in the retrieval of database fields in video-core's HTTP server of Samsung S (CVSS 7.5, Samsung SmartThings Hub STH-ETH-250)
- [CVE-2018-3925](https://cve.now/CVE-2018-3925.md): An exploitable buffer overflow vulnerability exists in the remote video-host communication of video-core's HTTP server of Samsung SmartThing (CVSS 8.5, Samsung SmartThings Hub STH-ETH-250)
- [CVE-2018-8028](https://cve.now/CVE-2018-8028.md): An authenticated user can execute ALTER TABLE EXCHANGE PARTITIONS without being authorized by Apache Sentry before 2.0.1. (no CVSS, Apache Software Foundation Apache Sentry · org.apache.sentr…)
- [CVE-2017-16348](https://cve.now/CVE-2017-16348.md): An exploitable denial of service vulnerability exists in Insteon Hub running firmware version 1012. (CVSS 7.5, Insteon)
- [CVE-2018-3832](https://cve.now/CVE-2018-3832.md): An exploitable firmware update vulnerability exists in Insteon Hub running firmware version 1013. (CVSS 9.9, Insteon)
- [CVE-2018-3833](https://cve.now/CVE-2018-3833.md): An exploitable firmware downgrade vulnerability exists in Insteon Hub running firmware version 1013. (CVSS 8.6, Insteon)
- [CVE-2018-15685](https://cve.now/CVE-2018-15685.md): GitHub Electron 1.7.15, 1.8.7, 2.0.7, and 3.0.0-beta.6, in certain scenarios involving IFRAME elements and "nativeWindowOpen: true" or "sand (no CVSS, electron)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2018-08-23
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.