CVEs published August 27, 2018
27 CVEs were published on August 27, 2018: 2 critical, 0 high.
- Published
- 27
- Critical
- 2
- High
- 0
- Medium
- 3
- Low
- 1
- Unrated
- 21
- Now in CISA KEV
- 0
- Fix available
- 0
Most affected products
- Tenable ASUSTOR Data Master
- 6
- Samsung
- 3
- IBM WebSphere Commerce
- 1
- OpenStack Foundation openstack-cinder
- 1
- QNAP Photo Station
- 1
Critical 2
- CVE-2018-3893An exploitable buffer overflow vulnerability exists in the /cameras/XXXX/clips handler of video-core's HTTP server of Samsung SmartThings Hu
- CVE-2018-3904An exploitable buffer overflow vulnerability exists in the camera 'update' feature of video-core's HTTP server of Samsung SmartThings Hub STSamsung
Medium, low and unrated 25
- CVE-2017-15139A vulnerability was found in openstack-cinder releases up to and including Queens, allowing newly created volumes in certain storage volume OpenStack Foundation openstack-cinder
- CVE-2018-15908In Artifex Ghostscript 9.23 before 2018-08-23, attackers are able to supply malicious PostScript files to bypass .tempfile restrictions and
- CVE-2018-15909In Artifex Ghostscript 9.23 before 2018-08-24, a type confusion using the .shfill operator could be used by attackers able to supply crafted
- CVE-2018-15910In Artifex Ghostscript before 9.24, attackers able to supply crafted PostScript files could use a type confusion in the LockDistillerParams
- CVE-2018-15810Visiology Flipbox Software Suite before 2.7.0 allows directory traversal via %5c%2e%2e%2f because it does not sanitize filename parameters.
- CVE-2018-15887Main_Analysis_Content.asp in ASUS DSL-N12E_C1 1.1.2.3_345 is prone to Authenticated Remote Command Execution, which allows a remote attacker
- CVE-2018-1644IBM WebSphere Commerce Enterprise, Professional, Express, and Developer 9.0.0.0 - 9.0.0.4, 8.0.0.0 - 8.0.0.19, 8.0.1.0 - 8.0.1.13, 8.0.3.0 -IBM WebSphere Commerce
- CVE-2018-3918An exploitable vulnerability exists in the remote servers of Samsung SmartThings Hub STH-ETH-250 - Firmware version 0.20.17.Samsung
- CVE-2018-3927An exploitable information disclosure vulnerability exists in the crash handler of the hubCore binary of the Samsung SmartThings Hub STH-ETHSamsung
- CVE-2018-15694ASUSTOR Data Master 3.1.5 and below allows authenticated remote non-administrative users to upload files to arbitrary locations due to a patTenable ASUSTOR Data Master
- CVE-2018-15695ASUSTOR Data Master 3.1.5 and below allows authenticated remote non-administrative users to delete any file on the file system due to a pathTenable ASUSTOR Data Master
- CVE-2018-15696ASUSTOR Data Master 3.1.5 and below allows authenticated remote non-administrative users to enumerate all user accounts via user.cgi.Tenable ASUSTOR Data Master
- CVE-2018-15697ASUSTOR Data Master 3.1.5 and below allows authenticated remote non-administrative users to read any file on a share by providing the full pTenable ASUSTOR Data Master
- CVE-2018-15698ASUSTOR Data Master 3.1.5 and below allows authenticated remote non-administrative users to read any file on the file system when providing Tenable ASUSTOR Data Master
- CVE-2018-15699ASUSTOR Data Master 3.1.5 and below makes an HTTP request for a configuration file that is vulnerable to XSS.Tenable ASUSTOR Data Master
- CVE-2018-15904A10 ACOS Web Application Firewall (WAF) 2.7.1 and 2.7.2 before 2.7.2-P12, 4.1.0 before 4.1.0-P11, 4.1.1 before 4.1.1-P8, and 4.1.2 before 4.
- CVE-2018-0715Cross-site scripting vulnerability in QNAP Photo Station versions 5.7.0 and earlier could allow remote attackers to inject Javascript code iQNAP Photo Station
- CVE-2018-10938A flaw was found in the Linux kernel present since v4.0-rc1 and through v4.13-rc4.
- CVE-2014-10074Umbraco before 7.2.0 has a remote PHP code execution vulnerability because Umbraco.Web.UI/config/umbracoSettings.Release.config does not blo
- CVE-2015-9263An issue was discovered in post2file.php in Up.Time Monitoring Station 7.5.0 (build 16) and 7.4.0 (build 13).
- CVE-2015-9264Lansweeper 4.x through 6.x before 6.0.0.48 allows attackers to execute arbitrary code on the administrator's workstation via a crafted Windo
- CVE-2018-15893A SQL injection was discovered in /coreframe/app/admin/copyfrom.php in WUZHI CMS 4.1.0 via the index.php?m=core&f=copyfrom&v=listing keyword
- CVE-2018-15894A SQL injection was discovered in /coreframe/app/admin/pay/admin/index.php in WUZHI CMS 4.1.0 via the index.php?m=pay&f=index&v=listing keyV
- CVE-2018-15895An SSRF vulnerability was discovered in idreamsoft iCMS 7.0.11 because the remote function in app/spider/spider_tools.class.php does not blo
- CVE-2018-15899An issue was discovered in MiniCMS 1.10.