# CVEs published 2018-08-24 34 CVEs were published on August 24, 2018: 4 critical, 0 high. Days are UTC. - [CVE-2018-14059](https://cve.now/CVE-2018-14059.md): Pimcore allows XSS via Users, Assets, Data Objects, Video Thumbnails, Image Thumbnails, Field-Collections, Objectbrick, Classification Store (no CVSS, pimcore/pimcore) - [CVE-2017-9818](https://cve.now/CVE-2017-9818.md): The National Payments Corporation of India BHIM application 1.3 for Android relies on a four-digit passcode, which makes it easier for attac (no CVSS) - [CVE-2017-9819](https://cve.now/CVE-2017-9819.md): The National Payments Corporation of India BHIM application 1.3 for Android does not properly restrict use of the OTP feature, which makes i (no CVSS) - [CVE-2017-9820](https://cve.now/CVE-2017-9820.md): The National Payments Corporation of India BHIM application 1.3 for Android uses a custom keypad for which the input element is available to (no CVSS) - [CVE-2017-9821](https://cve.now/CVE-2017-9821.md): The National Payments Corporation of India BHIM application 1.3 for Android relies on three hardcoded strings (AK-NPCIMB, IM-NPCIBM, and VK- (no CVSS) - [CVE-2018-11502](https://cve.now/CVE-2018-11502.md): An issue was discovered in the Moderator Log Notes plugin 1.1 for MyBB. (no CVSS) - [CVE-2018-11653](https://cve.now/CVE-2018-11653.md): Information disclosure in Netwave IP camera at //etc/RT2870STA.dat (via HTTP on port 8000) allows an unauthenticated attacker to exfiltrate (no CVSS) - [CVE-2018-11654](https://cve.now/CVE-2018-11654.md): Information disclosure in Netwave IP camera at get\_status.cgi (via HTTP on port 8000) allows an unauthenticated attacker to exfiltrate sensi (no CVSS) - [CVE-2018-15576](https://cve.now/CVE-2018-15576.md): An issue was discovered in EasyLogin Pro through 1.3.0. (no CVSS) - [CVE-2018-3786](https://cve.now/CVE-2018-3786.md): A command injection vulnerability in egg-scripts \