# CVEs published 2018-08-28

54 CVEs were published on August 28, 2018: 2 critical, 1 high. Days are UTC.

- [CVE-2018-15896](https://cve.now/CVE-2018-15896.md): PHP Scripts Mall Website Seller Script 2.0.5 has XSS via Personal Address or Company Name. (no CVSS)
- [CVE-2018-15897](https://cve.now/CVE-2018-15897.md): PHP Scripts Mall Website Seller Script 2.0.5 allows remote attackers to cause a denial of service via crafted JavaScript code in the First N (no CVSS)
- [CVE-2017-15396](https://cve.now/CVE-2017-15396.md): A stack buffer overflow in NumberingSystem in International Components for Unicode (ICU) for C/C++ before 60.2, as used in V8 in Google Chro (no CVSS, Google Chrome prior to 62.0.3202.75 unknown)
- [CVE-2017-15398](https://cve.now/CVE-2017-15398.md): A stack buffer overflow in the QUIC networking stack in Google Chrome prior to 62.0.3202.89 allowed a remote attacker to gain code execution (no CVSS, Google Chrome prior to 62.0.3202.89 unknown)
- [CVE-2017-15399](https://cve.now/CVE-2017-15399.md): A use after free in V8 in Google Chrome prior to 62.0.3202.89 allowed a remote attacker to potentially exploit heap corruption via a crafted (no CVSS, Google Chrome prior to 62.0.3202.89 unknown)
- [CVE-2017-15406](https://cve.now/CVE-2017-15406.md): A stack buffer overflow in V8 in Google Chrome prior to 62.0.3202.75 allowed a remote attacker to perform an out of bounds memory read via a (no CVSS, Google Chrome prior to 62.0.3202.75 unknown)
- [CVE-2017-15429](https://cve.now/CVE-2017-15429.md): Inappropriate implementation in V8 WebAssembly JS bindings in Google Chrome prior to 63.0.3239.108 allowed a remote attacker to inject arbit (no CVSS, Google Chrome prior to 63.0.3239.108 unknown)
- [CVE-2018-3916](https://cve.now/CVE-2018-3916.md): An exploitable stack-based buffer overflow vulnerability exists in the retrieval of database fields in the video-core HTTP server of the Sam (CVSS 7.5, Samsung)
- [CVE-2017-15407](https://cve.now/CVE-2017-15407.md): Out-of-bounds Write in the QUIC networking stack in Google Chrome prior to 63.0.3239.84 allowed a remote attacker to gain code execution via (no CVSS, Google Chrome prior to 63.0.3239.84 unknown)
- [CVE-2017-15408](https://cve.now/CVE-2017-15408.md): Heap buffer overflow in Omnibox in Google Chrome prior to 63.0.3239.84 allowed a remote attacker to potentially exploit heap corruption via (no CVSS, Google Chrome prior to 63.0.3239.84 unknown)
- [CVE-2017-15409](https://cve.now/CVE-2017-15409.md): Heap buffer overflow in Skia in Google Chrome prior to 63.0.3239.84 allowed a remote attacker to potentially exploit heap corruption via a c (no CVSS, Google Chrome prior to 63.0.3239.84 unknown)
- [CVE-2017-15410](https://cve.now/CVE-2017-15410.md): Use after free in PDFium in Google Chrome prior to 63.0.3239.84 allowed a remote attacker to potentially exploit heap corruption via a craft (no CVSS, Google Chrome prior to 63.0.3239.84 unknown)
- [CVE-2017-15411](https://cve.now/CVE-2017-15411.md): Use after free in PDFium in Google Chrome prior to 63.0.3239.84 allowed a remote attacker to potentially exploit heap corruption via a craft (no CVSS, Google Chrome prior to 63.0.3239.84 unknown)
- [CVE-2017-15412](https://cve.now/CVE-2017-15412.md): Use after free in libxml2 before 2.9.5, as used in Google Chrome prior to 63.0.3239.84 and other products, allowed a remote attacker to pote (no CVSS, Google Chrome prior to 63.0.3239.84 unknown · nokogiri)
- [CVE-2017-15413](https://cve.now/CVE-2017-15413.md): Type confusion in WebAssembly in V8 in Google Chrome prior to 63.0.3239.84 allowed a remote attacker to potentially exploit heap corruption (no CVSS, Google Chrome prior to 63.0.3239.84 unknown)
- [CVE-2017-15415](https://cve.now/CVE-2017-15415.md): Incorrect serialization in IPC in Google Chrome prior to 63.0.3239.84 allowed a remote attacker to leak the value of a pointer via a crafted (no CVSS, Google Chrome prior to 63.0.3239.84 unknown)
- [CVE-2017-15416](https://cve.now/CVE-2017-15416.md): Heap buffer overflow in Blob API in Google Chrome prior to 63.0.3239.84 allowed a remote attacker to potentially exploit heap corruption via (no CVSS, Google Chrome prior to 63.0.3239.84 unknown)
- [CVE-2017-15417](https://cve.now/CVE-2017-15417.md): Inappropriate implementation in Skia canvas composite operations in Google Chrome prior to 63.0.3239.84 allowed a remote attacker to leak cr (no CVSS, Google Chrome prior to 63.0.3239.84 unknown)
- [CVE-2017-15418](https://cve.now/CVE-2017-15418.md): Use of uninitialized memory in Skia in Google Chrome prior to 63.0.3239.84 allowed a remote attacker to obtain potentially sensitive informa (no CVSS, Google Chrome prior to 63.0.3239.84 unknown)
- [CVE-2017-15419](https://cve.now/CVE-2017-15419.md): Insufficient policy enforcement in Resource Timing API in Google Chrome prior to 63.0.3239.84 allowed a remote attacker to infer browsing hi (no CVSS, Google Chrome prior to 63.0.3239.84 unknown)
- [CVE-2017-15420](https://cve.now/CVE-2017-15420.md): Incorrect handling of back navigations in error pages in Navigation in Google Chrome prior to 63.0.3239.84 allowed a remote attacker to spoo (no CVSS, Google Chrome)
- [CVE-2017-15422](https://cve.now/CVE-2017-15422.md): Integer overflow in international date handling in International Components for Unicode (ICU) for C/C++ before 60.1, as used in V8 in Google (no CVSS, Google Chrome prior to 63.0.3239.84 unknown)
- [CVE-2017-15423](https://cve.now/CVE-2017-15423.md): Inappropriate implementation in BoringSSL SPAKE2 in Google Chrome prior to 63.0.3239.84 allowed a remote attacker to leak the low-order bits (no CVSS, Google Chrome prior to 63.0.3239.84 unknown)
- [CVE-2017-15424](https://cve.now/CVE-2017-15424.md): Insufficient policy enforcement in Omnibox in Google Chrome prior to 63.0.3239.84 allowed a remote attacker to perform domain spoofing via I (no CVSS, Google Chrome prior to 63.0.3239.84 unknown)
- [CVE-2017-15425](https://cve.now/CVE-2017-15425.md): Insufficient policy enforcement in Omnibox in Google Chrome prior to 63.0.3239.84 allowed a remote attacker to perform domain spoofing via I (no CVSS, Google Chrome prior to 63.0.3239.84 unknown)
- [CVE-2017-15426](https://cve.now/CVE-2017-15426.md): Insufficient policy enforcement in Omnibox in Google Chrome prior to 63.0.3239.84 allowed a remote attacker to perform domain spoofing via I (no CVSS, Google Chrome prior to 63.0.3239.84 unknown)
- [CVE-2017-15427](https://cve.now/CVE-2017-15427.md): Insufficient policy enforcement in Omnibox in Google Chrome prior to 63.0.3239.84 allowed a socially engineered user to XSS themselves by dr (no CVSS, Google Chrome prior to 63.0.3239.84 unknown)
- [CVE-2017-15430](https://cve.now/CVE-2017-15430.md): Insufficient data validation in Chromecast plugin in Google Chrome prior to 63.0.3239.84 allowed a remote attacker to inject arbitrary scrip (no CVSS, Google Chrome)
- [CVE-2018-14572](https://cve.now/CVE-2018-14572.md): In conference-scheduler-cli, a pickle.load call on imported data allows remote attackers to execute arbitrary code via a crafted .pickle fil (no CVSS, conference-scheduler-cli)
- [CVE-2018-15596](https://cve.now/CVE-2018-15596.md): An issue was discovered in inc/class\_feedgeneration.php in MyBB 1.8.17. (no CVSS)
- [CVE-2018-15608](https://cve.now/CVE-2018-15608.md): Zoho ManageEngine ADManager Plus 6.5.7 allows HTML Injection on the "AD Delegation" "Help Desk Technicians" screen. (no CVSS)
- [CVE-2018-15740](https://cve.now/CVE-2018-15740.md): Zoho ManageEngine ADManager Plus 6.5.7 has XSS on the "Workflow Delegation" "Requester Roles" screen. (no CVSS)
- [CVE-2018-15873](https://cve.now/CVE-2018-15873.md): A SQL Injection issue was discovered in Sentrifugo 3.2 via the deptid parameter. (no CVSS)
- [CVE-2018-15884](https://cve.now/CVE-2018-15884.md): RICOH MP C4504ex devices allow HTML Injection via the /web/entry/en/address/adrsSetUserWizard.cgi entryNameIn parameter. (no CVSS)
- [CVE-2018-15901](https://cve.now/CVE-2018-15901.md): e107 2.1.8 has CSRF in 'usersettings.php' with an impact of changing details such as passwords of users including administrators. (no CVSS)
- [CVE-2018-3895](https://cve.now/CVE-2018-3895.md): An exploitable buffer overflow vulnerability exists in the /cameras/XXXX/clips handler of video-core's HTTP server of Samsung SmartThings Hu (CVSS 9.9, Samsung)
- [CVE-2018-3908](https://cve.now/CVE-2018-3908.md): An exploitable vulnerability exists in the REST parser of video-core's HTTP server of the Samsung SmartThings Hub STH-ETH-250-Firmware versi (CVSS 9.1, Samsung)
- [CVE-2018-6643](https://cve.now/CVE-2018-6643.md): Infoblox NetMRI 7.1.1 has Reflected Cross-Site Scripting via the /api/docs/index.php query parameter. (no CVSS)
- [CVE-2014-4932](https://cve.now/CVE-2014-4932.md): Cross-site scripting (XSS) vulnerability in the Wordfence Security plugin before 5.1.5 for WordPress allows remote attackers to inject arbit (no CVSS)
- [CVE-2014-6045](https://cve.now/CVE-2014-6045.md): SQL injection vulnerability in phpMyFAQ before 2.8.13 allows remote authenticated users with certain permissions to execute arbitrary SQL co (no CVSS)
- [CVE-2014-6046](https://cve.now/CVE-2014-6046.md): Multiple cross-site request forgery (CSRF) vulnerabilities in phpMyFAQ before 2.8.13 allow remote attackers to hijack the authentication of (no CVSS)
- [CVE-2014-6047](https://cve.now/CVE-2014-6047.md): phpMyFAQ before 2.8.13 allows remote authenticated users with certain permissions to read arbitrary attachments by leveraging incorrect "dow (no CVSS)
- [CVE-2014-6048](https://cve.now/CVE-2014-6048.md): phpMyFAQ before 2.8.13 allows remote attackers to read arbitrary attachments via a direct request. (no CVSS)
- [CVE-2014-6049](https://cve.now/CVE-2014-6049.md): phpMyFAQ before 2.8.13 allows remote authenticated users with admin privileges to bypass authorization via a crafted instance ID parameter. (no CVSS)
- [CVE-2014-6050](https://cve.now/CVE-2014-6050.md): phpMyFAQ before 2.8.13 allows remote attackers to bypass the CAPTCHA protection mechanism by replaying the request. (no CVSS)
- [CVE-2018-15529](https://cve.now/CVE-2018-15529.md): A command injection vulnerability in maintenance.cgi in Mutiny "Monitoring Appliance" before 6.1.0-5263 allows authenticated users, with acc (no CVSS)
- [CVE-2018-15571](https://cve.now/CVE-2018-15571.md): The Export Users to CSV plugin through 1.1.1 for WordPress allows CSV injection. (no CVSS)
- [CVE-2018-15839](https://cve.now/CVE-2018-15839.md): D-Link DIR-615 devices have a buffer overflow via a long Authorization HTTP header. (no CVSS)
- [CVE-2018-3926](https://cve.now/CVE-2018-3926.md): An exploitable integer underflow vulnerability exists in the ZigBee firmware update routine of the hubCore binary of the Samsung SmartThings (CVSS 5.3, Talos Samsung)
- [CVE-2018-13391](https://cve.now/CVE-2018-13391.md): The ProfileLinkUserFormat component of Jira Server before version 7.6.8, from version 7.7.0 before version 7.7.5, from version 7.8.0 before (no CVSS, Atlassian Jira)
- [CVE-2018-13395](https://cve.now/CVE-2018-13395.md): Various resources in Atlassian Jira before version 7.6.8, from version 7.7.0 before version 7.7.5, from version 7.8.0 before version 7.8.5, (no CVSS, Atlassian Jira)
- [CVE-2018-1705](https://cve.now/CVE-2018-1705.md): IBM Platform Symphony 7.1 Fix Pack 1 and 7.1.1 and IBM Spectrum Symphony 7.1.2 and 7.2.0.2 contain an information disclosure vulnerability t (CVSS 6.5, IBM Platform Symphony · IBM Spectrum Symphony)
- [CVE-2018-15919](https://cve.now/CVE-2018-15919.md): Remotely observable behaviour in auth-gss2.c in OpenSSH through 7.8 could be used by remote attackers to detect existence of users on a targ (CVSS 5.3)
- [CVE-2018-15911](https://cve.now/CVE-2018-15911.md): In Artifex Ghostscript 9.23 before 2018-08-24, attackers able to supply crafted PostScript could use uninitialized memory access in the aesd (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2018-08-28
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.