# CVEs published 2018-08-29

45 CVEs were published on August 29, 2018: 2 critical, 1 high. Days are UTC.

- [CVE-2018-16115](https://cve.now/CVE-2018-16115.md): Lightbend Akka 2.5.x before 2.5.16 allows message disclosure and modification because of an RNG error. (no CVSS, com.typesafe.akka:akka-actor\_2.11 · com.typesafe.akka:akka-…)
- [CVE-2018-16132](https://cve.now/CVE-2018-16132.md): The image rendering component (createGenericPreview) of the Open Whisper Signal app through 2.29.0 for iOS fails to check for unreasonably l (no CVSS)
- [CVE-2018-16133](https://cve.now/CVE-2018-16133.md): Cybrotech CyBroHttpServer 1.0.3 allows Directory Traversal via a ../ in the URI. (no CVSS)
- [CVE-2018-16134](https://cve.now/CVE-2018-16134.md): Cybrotech CyBroHttpServer 1.0.3 allows XSS via a URI. (no CVSS)
- [CVE-2018-7790](https://cve.now/CVE-2018-7790.md): An Information Management Error vulnerability exists in Schneider Electric's Modicon M221 product (all references, all versions prior to fir (CVSS 9.8, Schneider Electric SE Modicon M221, all references, all ver…)
- [CVE-2018-7791](https://cve.now/CVE-2018-7791.md): A Permissions, Privileges, and Access Control vulnerability exists in Schneider Electric's Modicon M221 product (all references, all version (CVSS 9.8, Schneider Electric SE Modicon M221, all references, all ver…)
- [CVE-2018-7792](https://cve.now/CVE-2018-7792.md): A Permissions, Privileges, and Access Control vulnerability exists in Schneider Electric's Modicon M221 product (all references, all version (CVSS 7.5, Schneider Electric SE Modicon M221, all references, all ver…)
- [CVE-2018-12240](https://cve.now/CVE-2018-12240.md): The Norton Identity Safe product prior to 5.3.0.976 may be susceptible to a privilege escalation issue via a hard coded IV, which is a type (no CVSS, Symantec Norton Identity Safe for Android)
- [CVE-2018-7789](https://cve.now/CVE-2018-7789.md): An Improper Check for Unusual or Exceptional Conditions vulnerability exists in Schneider Electric's Modicon M221 product (all references, a (CVSS 4.8, Schneider Electric SE Modicon M221, all references, all ver…)
- [CVE-2018-7795](https://cve.now/CVE-2018-7795.md): A Cross Protocol Injection vulnerability exists in Schneider Electric's PowerLogic (PM5560 prior to FW version 2.5.4) product. (CVSS 5.4, Schneider Electric SE PowerLogic - PM5560 prior to FW)
- [CVE-2017-17762](https://cve.now/CVE-2017-17762.md): XML external entity (XXE) vulnerability in Episerver 7 patch 4 and earlier allows remote attackers to read arbitrary files via a crafted DTD (no CVSS)
- [CVE-2018-12710](https://cve.now/CVE-2018-12710.md): An issue was discovered on D-Link DIR-601 2.02NA devices. (no CVSS)
- [CVE-2018-14768](https://cve.now/CVE-2018-14768.md): Various VIVOTEK FD8\*, FD9\*, FE9\*, IB8\*, IB9\*, IP9\*, IZ9\*, MS9\*, SD9\*, and other devices before XXXXXX-VVTK-xx06a allow remote attackers to e (no CVSS)
- [CVE-2018-15562](https://cve.now/CVE-2018-15562.md): CMS ISWEB 3.5.3 has XSS via the ordineRis, sezioneRicerca, or oggettiRicerca parameter to index.php. (no CVSS)
- [CVE-2018-15746](https://cve.now/CVE-2018-15746.md): qemu-seccomp.c in QEMU might allow local OS guest users to cause a denial of service (guest crash) by leveraging mishandling of the seccomp (no CVSS)
- [CVE-2018-15907](https://cve.now/CVE-2018-15907.md): Technicolor (formerly RCA) TC8305C devices allow remote attackers to cause a denial of service (networking outage) via a flood of random MAC (no CVSS)
- [CVE-2018-15912](https://cve.now/CVE-2018-15912.md): An issue was discovered in manjaro-update-system.sh in manjaro-system 20180716-1 on Manjaro Linux. (no CVSS)
- [CVE-2018-6597](https://cve.now/CVE-2018-6597.md): The Alcatel A30 device with a build fingerprint of TCL/5046G/MICKEY6US:7.0/NRD90M/J63:user/release-keys contains a hidden privilege escalati (no CVSS)
- [CVE-2018-6598](https://cve.now/CVE-2018-6598.md): An issue was discovered on Orbic Wonder Orbic/RC555L/RC555L:7.1.2/N2G47H/329100b:user/release-keys devices. (no CVSS)
- [CVE-2018-6599](https://cve.now/CVE-2018-6599.md): An issue was discovered on Orbic Wonder Orbic/RC555L/RC555L:7.1.2/N2G47H/329100b:user/release-keys devices, allowing attackers to obtain sen (no CVSS)
- [CVE-2018-14805](https://cve.now/CVE-2018-14805.md): ABB eSOMS version 6.0.2 may allow unauthorized access to the system when LDAP is set to allow anonymous authentication, and specific key val (no CVSS, ICS-CERT ABB eSOMS)
- [CVE-2018-15727](https://cve.now/CVE-2018-15727.md): Grafana 2.x, 3.x, and 4.x before 4.6.4 and 5.x before 5.2.3 allows authentication bypass because an attacker can generate a valid "remember (no CVSS, github.com/grafana/grafana)
- [CVE-2018-12799](https://cve.now/CVE-2018-12799.md): Adobe Acrobat and Reader versions 2018.011.20055 and earlier, 2017.011.30096 and earlier, and 2015.006.30434 and earlier have an untrusted p (no CVSS, Adobe Acrobat and Reader versions 2018.011.20055 and earlie…)
- [CVE-2018-12806](https://cve.now/CVE-2018-12806.md): Adobe Experience Manager versions 6.4, 6.3, 6.2, 6.1, and 6.0 have a reflected cross-site scripting vulnerability. (no CVSS, Adobe Experience Manager versions 6.4, 6.3, 6.2, 6.1, and)
- [CVE-2018-12807](https://cve.now/CVE-2018-12807.md): Adobe Experience Manager versions 6.4, 6.3, 6.2, 6.1, and 6.0 have an input validation bypass vulnerability. (no CVSS, Adobe Experience Manager versions 6.4, 6.3, 6.2, 6.1, and)
- [CVE-2018-12808](https://cve.now/CVE-2018-12808.md): Adobe Acrobat and Reader versions 2018.011.20055 and earlier, 2017.011.30096 and earlier, and 2015.006.30434 and earlier have an out-of-boun (no CVSS, Adobe Acrobat and Reader versions 2018.011.20055 and earlie…)
- [CVE-2018-12810](https://cve.now/CVE-2018-12810.md): Adobe Photoshop CC 2018 before 19.1.6 and Photoshop CC 2017 before 18.1.6 have a memory corruption vulnerability. (no CVSS, Adobe Photoshop CC 2018 before 19.1.6 and Photoshop CC 2017…)
- [CVE-2018-12811](https://cve.now/CVE-2018-12811.md): Adobe Photoshop CC 2018 before 19.1.6 and Photoshop CC 2017 before 18.1.6 have a memory corruption vulnerability. (no CVSS, Adobe Photoshop CC 2018 before 19.1.6 and Photoshop CC 2017…)
- [CVE-2018-12824](https://cve.now/CVE-2018-12824.md): Adobe Flash Player 30.0.0.134 and earlier have an out-of-bounds read vulnerability. (no CVSS, Adobe Flash Player 30.0.0.134 and earlier)
- [CVE-2018-12825](https://cve.now/CVE-2018-12825.md): Adobe Flash Player 30.0.0.134 and earlier have a security bypass vulnerability. (no CVSS, Adobe Flash Player 30.0.0.134 and earlier)
- [CVE-2018-12826](https://cve.now/CVE-2018-12826.md): Adobe Flash Player 30.0.0.134 and earlier have an out-of-bounds read vulnerability. (no CVSS, Adobe Flash Player 30.0.0.134 and earlier)
- [CVE-2018-12827](https://cve.now/CVE-2018-12827.md): Adobe Flash Player 30.0.0.134 and earlier have an out-of-bounds read vulnerability. (no CVSS, Adobe Flash Player 30.0.0.134 and earlier)
- [CVE-2018-12828](https://cve.now/CVE-2018-12828.md): Adobe Flash Player 30.0.0.134 and earlier have a "use of a component with a known vulnerability" vulnerability. (no CVSS, Adobe Flash Player 30.0.0.134 and earlier)
- [CVE-2018-12829](https://cve.now/CVE-2018-12829.md): Adobe Creative Cloud Desktop Application before 4.6.1 has an improper certificate validation vulnerability. (no CVSS, Adobe Creative Cloud Desktop Application before)
- [CVE-2018-1318](https://cve.now/CVE-2018-1318.md): Adding method ACLs in remap.config can cause a segfault when the user makes a carefully crafted request. (no CVSS, Apache Software Foundation Apache Traffic Server)
- [CVE-2018-5003](https://cve.now/CVE-2018-5003.md): Adobe Creative Cloud Desktop Application before 4.5.5.342 (installer) has an insecure library loading (dll hijacking) vulnerability. (no CVSS, Adobe Creative Cloud Desktop Application before)
- [CVE-2018-8004](https://cve.now/CVE-2018-8004.md): There are multiple HTTP smuggling and cache poisoning issues when clients making malicious requests interact with Apache Traffic Server (ATS (no CVSS, Apache Software Foundation Apache Traffic Server)
- [CVE-2018-8005](https://cve.now/CVE-2018-8005.md): When there are multiple ranges in a range request, Apache Traffic Server (ATS) will read the entire object from cache. (no CVSS, Apache Software Foundation Apache Traffic Server)
- [CVE-2018-8022](https://cve.now/CVE-2018-8022.md): A carefully crafted invalid TLS handshake can cause Apache Traffic Server (ATS) to segfault. (no CVSS, Apache Software Foundation Apache Traffic Server)
- [CVE-2018-8040](https://cve.now/CVE-2018-8040.md): Pages that are rendered using the ESI plugin can have access to the cookie header when the plugin is configured not to allow access. (no CVSS, Apache Software Foundation Apache Traffic Server)
- [CVE-2018-15121](https://cve.now/CVE-2018-15121.md): An issue was discovered in Auth0 auth0-aspnet and auth0-aspnet-owin. (no CVSS, Auth0-ASPNET-Owin · auth0-aspnet)
- [CVE-2018-15880](https://cve.now/CVE-2018-15880.md): An issue was discovered in Joomla! before 3.8.12. (no CVSS)
- [CVE-2018-15881](https://cve.now/CVE-2018-15881.md): An issue was discovered in Joomla! before 3.8.12. (no CVSS)
- [CVE-2018-15882](https://cve.now/CVE-2018-15882.md): An issue was discovered in Joomla! before 3.8.12. (no CVSS)
- [CVE-2018-16062](https://cve.now/CVE-2018-16062.md): dwarf\_getaranges in dwarf\_getaranges.c in libdw in elfutils before 2018-08-18 allows remote attackers to cause a denial of service (heap-bas (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2018-08-29
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.