# CVEs published 2018-08-27

27 CVEs were published on August 27, 2018: 2 critical, 0 high. Days are UTC.

- [CVE-2017-15139](https://cve.now/CVE-2017-15139.md): A vulnerability was found in openstack-cinder releases up to and including Queens, allowing newly created volumes in certain storage volume (CVSS 5.1, OpenStack Foundation openstack-cinder)
- [CVE-2018-15908](https://cve.now/CVE-2018-15908.md): In Artifex Ghostscript 9.23 before 2018-08-23, attackers are able to supply malicious PostScript files to bypass .tempfile restrictions and (no CVSS)
- [CVE-2018-15909](https://cve.now/CVE-2018-15909.md): In Artifex Ghostscript 9.23 before 2018-08-24, a type confusion using the .shfill operator could be used by attackers able to supply crafted (no CVSS)
- [CVE-2018-15910](https://cve.now/CVE-2018-15910.md): In Artifex Ghostscript before 9.24, attackers able to supply crafted PostScript files could use a type confusion in the LockDistillerParams (no CVSS)
- [CVE-2018-15810](https://cve.now/CVE-2018-15810.md): Visiology Flipbox Software Suite before 2.7.0 allows directory traversal via %5c%2e%2e%2f because it does not sanitize filename parameters. (no CVSS)
- [CVE-2018-15887](https://cve.now/CVE-2018-15887.md): Main\_Analysis\_Content.asp in ASUS DSL-N12E\_C1 1.1.2.3\_345 is prone to Authenticated Remote Command Execution, which allows a remote attacker (no CVSS)
- [CVE-2018-1644](https://cve.now/CVE-2018-1644.md): IBM WebSphere Commerce Enterprise, Professional, Express, and Developer 9.0.0.0 - 9.0.0.4, 8.0.0.0 - 8.0.0.19, 8.0.1.0 - 8.0.1.13, 8.0.3.0 - (CVSS 3.1, IBM WebSphere Commerce)
- [CVE-2018-3893](https://cve.now/CVE-2018-3893.md): An exploitable buffer overflow vulnerability exists in the /cameras/XXXX/clips handler of video-core's HTTP server of Samsung SmartThings Hu (CVSS 9.9)
- [CVE-2018-3904](https://cve.now/CVE-2018-3904.md): An exploitable buffer overflow vulnerability exists in the camera 'update' feature of video-core's HTTP server of Samsung SmartThings Hub ST (CVSS 9.9, Samsung)
- [CVE-2018-3918](https://cve.now/CVE-2018-3918.md): An exploitable vulnerability exists in the remote servers of Samsung SmartThings Hub STH-ETH-250 - Firmware version 0.20.17. (CVSS 6.5, Samsung)
- [CVE-2018-3927](https://cve.now/CVE-2018-3927.md): An exploitable information disclosure vulnerability exists in the crash handler of the hubCore binary of the Samsung SmartThings Hub STH-ETH (CVSS 6.8, Samsung)
- [CVE-2018-15694](https://cve.now/CVE-2018-15694.md): ASUSTOR Data Master 3.1.5 and below allows authenticated remote non-administrative users to upload files to arbitrary locations due to a pat (no CVSS, Tenable ASUSTOR Data Master)
- [CVE-2018-15695](https://cve.now/CVE-2018-15695.md): ASUSTOR Data Master 3.1.5 and below allows authenticated remote non-administrative users to delete any file on the file system due to a path (no CVSS, Tenable ASUSTOR Data Master)
- [CVE-2018-15696](https://cve.now/CVE-2018-15696.md): ASUSTOR Data Master 3.1.5 and below allows authenticated remote non-administrative users to enumerate all user accounts via user.cgi. (no CVSS, Tenable ASUSTOR Data Master)
- [CVE-2018-15697](https://cve.now/CVE-2018-15697.md): ASUSTOR Data Master 3.1.5 and below allows authenticated remote non-administrative users to read any file on a share by providing the full p (no CVSS, Tenable ASUSTOR Data Master)
- [CVE-2018-15698](https://cve.now/CVE-2018-15698.md): ASUSTOR Data Master 3.1.5 and below allows authenticated remote non-administrative users to read any file on the file system when providing (no CVSS, Tenable ASUSTOR Data Master)
- [CVE-2018-15699](https://cve.now/CVE-2018-15699.md): ASUSTOR Data Master 3.1.5 and below makes an HTTP request for a configuration file that is vulnerable to XSS. (no CVSS, Tenable ASUSTOR Data Master)
- [CVE-2018-15904](https://cve.now/CVE-2018-15904.md): A10 ACOS Web Application Firewall (WAF) 2.7.1 and 2.7.2 before 2.7.2-P12, 4.1.0 before 4.1.0-P11, 4.1.1 before 4.1.1-P8, and 4.1.2 before 4. (no CVSS)
- [CVE-2018-0715](https://cve.now/CVE-2018-0715.md): Cross-site scripting vulnerability in QNAP Photo Station versions 5.7.0 and earlier could allow remote attackers to inject Javascript code i (no CVSS, QNAP Photo Station)
- [CVE-2018-10938](https://cve.now/CVE-2018-10938.md): A flaw was found in the Linux kernel present since v4.0-rc1 and through v4.13-rc4. (no CVSS)
- [CVE-2014-10074](https://cve.now/CVE-2014-10074.md): Umbraco before 7.2.0 has a remote PHP code execution vulnerability because Umbraco.Web.UI/config/umbracoSettings.Release.config does not blo (no CVSS)
- [CVE-2015-9263](https://cve.now/CVE-2015-9263.md): An issue was discovered in post2file.php in Up.Time Monitoring Station 7.5.0 (build 16) and 7.4.0 (build 13). (no CVSS)
- [CVE-2015-9264](https://cve.now/CVE-2015-9264.md): Lansweeper 4.x through 6.x before 6.0.0.48 allows attackers to execute arbitrary code on the administrator's workstation via a crafted Windo (no CVSS)
- [CVE-2018-15893](https://cve.now/CVE-2018-15893.md): A SQL injection was discovered in /coreframe/app/admin/copyfrom.php in WUZHI CMS 4.1.0 via the index.php?m=core&f=copyfrom&v=listing keyword (no CVSS)
- [CVE-2018-15894](https://cve.now/CVE-2018-15894.md): A SQL injection was discovered in /coreframe/app/admin/pay/admin/index.php in WUZHI CMS 4.1.0 via the index.php?m=pay&f=index&v=listing keyV (no CVSS)
- [CVE-2018-15895](https://cve.now/CVE-2018-15895.md): An SSRF vulnerability was discovered in idreamsoft iCMS 7.0.11 because the remote function in app/spider/spider\_tools.class.php does not blo (no CVSS)
- [CVE-2018-15899](https://cve.now/CVE-2018-15899.md): An issue was discovered in MiniCMS 1.10. (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2018-08-27
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.