CVEs published August 24, 2018
34 CVEs were published on August 24, 2018: 4 critical, 0 high.
- Published
- 34
- Critical
- 4
- High
- 0
- Medium
- 2
- Low
- 1
- Unrated
- 27
- Now in CISA KEV
- 0
- Fix available
- 5
Most affected products
- Talos Samsung
- 2
- Dell EMC RSA Archer
- 1
- Dell EMC RSA NetWitness · Dell EMC RSA Security Analytics
- 1
- egg-scripts
- 1
- IBM Maximo Asset Management
- 1
- IBM Security Access Manager Appliance
- 1
- IBM WebSphere Application Server
- 1
- phpmyadmin/phpmyadmin
- 1
- pimcore/pimcore
- 1
- Puppet Enterprise
- 1
Critical 4
- CVE-2018-11061RSA NetWitness Platform versions prior to 11.1.0.2 and RSA Security Analytics versions prior to 10.6.6 are vulnerable to a server-side templDell EMC RSA NetWitness · Dell EMC RSA Security Analytics
- CVE-2018-1722IBM Security Access Manager Appliance 9.0.4.0 and 9.0.5.0 could allow remote code execution when Advanced Access Control or Federation serviIBM Security Access Manager Appliance
- CVE-2018-3907An exploitable vulnerability exists in the REST parser of video-core's HTTP server of the Samsung SmartThings Hub STH-ETH-250 - Firmware verTalos Samsung
- CVE-2018-3909An exploitable vulnerability exists in the REST parser of video-core's HTTP server of the Samsung SmartThings Hub STH-ETH-250 - Firmware verTalos Samsung
Medium, low and unrated 30
- CVE-2018-14059Pimcore allows XSS via Users, Assets, Data Objects, Video Thumbnails, Image Thumbnails, Field-Collections, Objectbrick, Classification Storepimcore/pimcore
- CVE-2017-9818The National Payments Corporation of India BHIM application 1.3 for Android relies on a four-digit passcode, which makes it easier for attac
- CVE-2017-9819The National Payments Corporation of India BHIM application 1.3 for Android does not properly restrict use of the OTP feature, which makes i
- CVE-2017-9820The National Payments Corporation of India BHIM application 1.3 for Android uses a custom keypad for which the input element is available to
- CVE-2017-9821The National Payments Corporation of India BHIM application 1.3 for Android relies on three hardcoded strings (AK-NPCIMB, IM-NPCIBM, and VK-
- CVE-2018-11502An issue was discovered in the Moderator Log Notes plugin 1.1 for MyBB.
- CVE-2018-11653Information disclosure in Netwave IP camera at //etc/RT2870STA.dat (via HTTP on port 8000) allows an unauthenticated attacker to exfiltrate
- CVE-2018-11654Information disclosure in Netwave IP camera at get_status.cgi (via HTTP on port 8000) allows an unauthenticated attacker to exfiltrate sensi
- CVE-2018-15576An issue was discovered in EasyLogin Pro through 1.3.0.
- CVE-2018-3786A command injection vulnerability in egg-scripts <v2.8.1 allows arbitrary shell command execution through a maliciously crafted command lineegg-scripts
- CVE-2017-11563D-Link EyeOn Baby Monitor (DCS-825L) 1.08.1 has a remote code execution vulnerability.
- CVE-2017-11564The D-Link EyeOn Baby Monitor (DCS-825L) 1.08.1 has multiple command injection vulnerabilities in the web service framework.
- CVE-2017-12573An issue was discovered on PLANEX CS-W50HD devices with firmware before 030720.
- CVE-2017-12574An issue was discovered on PLANEX CS-W50HD devices with firmware before 030720.
- CVE-2017-12575An issue was discovered on the NEC Aterm WG2600HP2 1.0.2.
- CVE-2017-12576An issue was discovered on the PLANEX CS-QR20 1.30.
- CVE-2017-12577An issue was discovered on the PLANEX CS-QR20 1.30.
- CVE-2018-14598An issue was discovered in XListExtensions in ListExt.c in libX11 through 1.6.5.
- CVE-2018-14599An issue was discovered in libX11 through 1.6.5.
- CVE-2018-14600An issue was discovered in libX11 through 1.6.5.
- CVE-2018-15120libpango in Pango 1.40.8 through 1.42.3, as used in hexchat and other products, allows remote attackers to cause a denial of service (applic
- CVE-2018-15499GEAR Software products that include GEARAspiWDM.sys, 2.2.5.0, allow local users to cause a denial of service (Race Condition and BSoD on Win
- CVE-2018-15535/filemanager/ajax_calls.php in tecrail Responsive FileManager before 9.13.4 uses external input to construct a pathname that should be withi
- CVE-2018-15536/filemanager/ajax_calls.php in tecrail Responsive FileManager before 9.13.4 does not properly validate file paths in archives, allowing for
- CVE-2018-15605An issue was discovered in phpMyAdmin before 4.8.3.phpmyadmin/phpmyadmin
- CVE-2018-15728Couchbase Server exposed the '/diag/eval' endpoint which by default is available on TCP/8091 and/or TCP/18091.
- CVE-2018-11065The WorkPoint component, which is embedded in all RSA Archer, versions 6.1.x, 6.2.x, 6.3.x prior to 6.3.0.7 and 6.4.x prior to 6.4.0.1, contDell EMC RSA Archer
- CVE-2018-11749When users are configured to use startTLS with RBAC LDAP, at login time, the user's credentials are sent via plaintext to the LDAP server.Puppet Enterprise
- CVE-2018-1699IBM Maximo Asset Management 7.6 through 7.6.3 is vulnerable to SQL injection.IBM Maximo Asset Management
- CVE-2018-1755IBM WebSphere Application Server Liberty could allow a remote attacker to obtain sensitive information, caused by incorrect transport being IBM WebSphere Application Server