CVEs published August 28, 2018
54 CVEs were published on August 28, 2018: 2 critical, 1 high.
- Published
- 54
- Critical
- 2
- High
- 1
- Medium
- 3
- Low
- 0
- Unrated
- 48
- Now in CISA KEV
- 0
- Fix available
- 5
Most affected products
- Google Chrome prior to 63.0.3239.84 unknown
- 17
- Samsung
- 3
- Atlassian Jira
- 2
- Google Chrome
- 2
- Google Chrome prior to 62.0.3202.75 unknown
- 2
- Google Chrome prior to 62.0.3202.89 unknown
- 2
- conference-scheduler-cli
- 1
- Google Chrome prior to 63.0.3239.108 unknown
- 1
- Google Chrome prior to 63.0.3239.84 unknown · nokogiri
- 1
- IBM Platform Symphony · IBM Spectrum Symphony
- 1
Critical 2
- CVE-2018-3895An exploitable buffer overflow vulnerability exists in the /cameras/XXXX/clips handler of video-core's HTTP server of Samsung SmartThings HuSamsung
- CVE-2018-3908An exploitable vulnerability exists in the REST parser of video-core's HTTP server of the Samsung SmartThings Hub STH-ETH-250-Firmware versiSamsung
High 1
Medium, low and unrated 51
- CVE-2018-15896PHP Scripts Mall Website Seller Script 2.0.5 has XSS via Personal Address or Company Name.
- CVE-2018-15897PHP Scripts Mall Website Seller Script 2.0.5 allows remote attackers to cause a denial of service via crafted JavaScript code in the First N
- CVE-2017-15396A stack buffer overflow in NumberingSystem in International Components for Unicode (ICU) for C/C++ before 60.2, as used in V8 in Google ChroGoogle Chrome prior to 62.0.3202.75 unknown
- CVE-2017-15398A stack buffer overflow in the QUIC networking stack in Google Chrome prior to 62.0.3202.89 allowed a remote attacker to gain code executionGoogle Chrome prior to 62.0.3202.89 unknown
- CVE-2017-15399A use after free in V8 in Google Chrome prior to 62.0.3202.89 allowed a remote attacker to potentially exploit heap corruption via a craftedGoogle Chrome prior to 62.0.3202.89 unknown
- CVE-2017-15406A stack buffer overflow in V8 in Google Chrome prior to 62.0.3202.75 allowed a remote attacker to perform an out of bounds memory read via aGoogle Chrome prior to 62.0.3202.75 unknown
- CVE-2017-15429Inappropriate implementation in V8 WebAssembly JS bindings in Google Chrome prior to 63.0.3239.108 allowed a remote attacker to inject arbitGoogle Chrome prior to 63.0.3239.108 unknown
- CVE-2017-15407Out-of-bounds Write in the QUIC networking stack in Google Chrome prior to 63.0.3239.84 allowed a remote attacker to gain code execution viaGoogle Chrome prior to 63.0.3239.84 unknown
- CVE-2017-15408Heap buffer overflow in Omnibox in Google Chrome prior to 63.0.3239.84 allowed a remote attacker to potentially exploit heap corruption via Google Chrome prior to 63.0.3239.84 unknown
- CVE-2017-15409Heap buffer overflow in Skia in Google Chrome prior to 63.0.3239.84 allowed a remote attacker to potentially exploit heap corruption via a cGoogle Chrome prior to 63.0.3239.84 unknown
- CVE-2017-15410Use after free in PDFium in Google Chrome prior to 63.0.3239.84 allowed a remote attacker to potentially exploit heap corruption via a craftGoogle Chrome prior to 63.0.3239.84 unknown
- CVE-2017-15411Use after free in PDFium in Google Chrome prior to 63.0.3239.84 allowed a remote attacker to potentially exploit heap corruption via a craftGoogle Chrome prior to 63.0.3239.84 unknown
- CVE-2017-15412Use after free in libxml2 before 2.9.5, as used in Google Chrome prior to 63.0.3239.84 and other products, allowed a remote attacker to poteGoogle Chrome prior to 63.0.3239.84 unknown · nokogiri
- CVE-2017-15413Type confusion in WebAssembly in V8 in Google Chrome prior to 63.0.3239.84 allowed a remote attacker to potentially exploit heap corruption Google Chrome prior to 63.0.3239.84 unknown
- CVE-2017-15415Incorrect serialization in IPC in Google Chrome prior to 63.0.3239.84 allowed a remote attacker to leak the value of a pointer via a craftedGoogle Chrome prior to 63.0.3239.84 unknown
- CVE-2017-15416Heap buffer overflow in Blob API in Google Chrome prior to 63.0.3239.84 allowed a remote attacker to potentially exploit heap corruption viaGoogle Chrome prior to 63.0.3239.84 unknown
- CVE-2017-15417Inappropriate implementation in Skia canvas composite operations in Google Chrome prior to 63.0.3239.84 allowed a remote attacker to leak crGoogle Chrome prior to 63.0.3239.84 unknown
- CVE-2017-15418Use of uninitialized memory in Skia in Google Chrome prior to 63.0.3239.84 allowed a remote attacker to obtain potentially sensitive informaGoogle Chrome prior to 63.0.3239.84 unknown
- CVE-2017-15419Insufficient policy enforcement in Resource Timing API in Google Chrome prior to 63.0.3239.84 allowed a remote attacker to infer browsing hiGoogle Chrome prior to 63.0.3239.84 unknown
- CVE-2017-15420Incorrect handling of back navigations in error pages in Navigation in Google Chrome prior to 63.0.3239.84 allowed a remote attacker to spooGoogle Chrome
- CVE-2017-15422Integer overflow in international date handling in International Components for Unicode (ICU) for C/C++ before 60.1, as used in V8 in GoogleGoogle Chrome prior to 63.0.3239.84 unknown
- CVE-2017-15423Inappropriate implementation in BoringSSL SPAKE2 in Google Chrome prior to 63.0.3239.84 allowed a remote attacker to leak the low-order bitsGoogle Chrome prior to 63.0.3239.84 unknown
- CVE-2017-15424Insufficient policy enforcement in Omnibox in Google Chrome prior to 63.0.3239.84 allowed a remote attacker to perform domain spoofing via IGoogle Chrome prior to 63.0.3239.84 unknown
- CVE-2017-15425Insufficient policy enforcement in Omnibox in Google Chrome prior to 63.0.3239.84 allowed a remote attacker to perform domain spoofing via IGoogle Chrome prior to 63.0.3239.84 unknown
- CVE-2017-15426Insufficient policy enforcement in Omnibox in Google Chrome prior to 63.0.3239.84 allowed a remote attacker to perform domain spoofing via IGoogle Chrome prior to 63.0.3239.84 unknown
- CVE-2017-15427Insufficient policy enforcement in Omnibox in Google Chrome prior to 63.0.3239.84 allowed a socially engineered user to XSS themselves by drGoogle Chrome prior to 63.0.3239.84 unknown
- CVE-2017-15430Insufficient data validation in Chromecast plugin in Google Chrome prior to 63.0.3239.84 allowed a remote attacker to inject arbitrary scripGoogle Chrome
- CVE-2018-14572In conference-scheduler-cli, a pickle.load call on imported data allows remote attackers to execute arbitrary code via a crafted .pickle filconference-scheduler-cli
- CVE-2018-15596An issue was discovered in inc/class_feedgeneration.php in MyBB 1.8.17.
- CVE-2018-15608Zoho ManageEngine ADManager Plus 6.5.7 allows HTML Injection on the "AD Delegation" "Help Desk Technicians" screen.
- CVE-2018-15740Zoho ManageEngine ADManager Plus 6.5.7 has XSS on the "Workflow Delegation" "Requester Roles" screen.
- CVE-2018-15873A SQL Injection issue was discovered in Sentrifugo 3.2 via the deptid parameter.
- CVE-2018-15884RICOH MP C4504ex devices allow HTML Injection via the /web/entry/en/address/adrsSetUserWizard.cgi entryNameIn parameter.
- CVE-2018-15901e107 2.1.8 has CSRF in 'usersettings.php' with an impact of changing details such as passwords of users including administrators.
- CVE-2018-6643Infoblox NetMRI 7.1.1 has Reflected Cross-Site Scripting via the /api/docs/index.php query parameter.
- CVE-2014-4932Cross-site scripting (XSS) vulnerability in the Wordfence Security plugin before 5.1.5 for WordPress allows remote attackers to inject arbit
- CVE-2014-6045SQL injection vulnerability in phpMyFAQ before 2.8.13 allows remote authenticated users with certain permissions to execute arbitrary SQL co
- CVE-2014-6046Multiple cross-site request forgery (CSRF) vulnerabilities in phpMyFAQ before 2.8.13 allow remote attackers to hijack the authentication of
- CVE-2014-6047phpMyFAQ before 2.8.13 allows remote authenticated users with certain permissions to read arbitrary attachments by leveraging incorrect "dow
- CVE-2014-6048phpMyFAQ before 2.8.13 allows remote attackers to read arbitrary attachments via a direct request.
- CVE-2014-6049phpMyFAQ before 2.8.13 allows remote authenticated users with admin privileges to bypass authorization via a crafted instance ID parameter.
- CVE-2014-6050phpMyFAQ before 2.8.13 allows remote attackers to bypass the CAPTCHA protection mechanism by replaying the request.
- CVE-2018-15529A command injection vulnerability in maintenance.cgi in Mutiny "Monitoring Appliance" before 6.1.0-5263 allows authenticated users, with acc
- CVE-2018-15571The Export Users to CSV plugin through 1.1.1 for WordPress allows CSV injection.
- CVE-2018-15839D-Link DIR-615 devices have a buffer overflow via a long Authorization HTTP header.
- CVE-2018-3926An exploitable integer underflow vulnerability exists in the ZigBee firmware update routine of the hubCore binary of the Samsung SmartThingsTalos Samsung
- CVE-2018-13391The ProfileLinkUserFormat component of Jira Server before version 7.6.8, from version 7.7.0 before version 7.7.5, from version 7.8.0 before Atlassian Jira
- CVE-2018-13395Various resources in Atlassian Jira before version 7.6.8, from version 7.7.0 before version 7.7.5, from version 7.8.0 before version 7.8.5, Atlassian Jira
- CVE-2018-1705IBM Platform Symphony 7.1 Fix Pack 1 and 7.1.1 and IBM Spectrum Symphony 7.1.2 and 7.2.0.2 contain an information disclosure vulnerability tIBM Platform Symphony · IBM Spectrum Symphony
- CVE-2018-15919Remotely observable behaviour in auth-gss2.c in OpenSSH through 7.8 could be used by remote attackers to detect existence of users on a targ
- CVE-2018-15911In Artifex Ghostscript 9.23 before 2018-08-24, attackers able to supply crafted PostScript could use uninitialized memory access in the aesd