CVEs published August 30, 2018
56 CVEs were published on August 30, 2018: 0 critical, 3 high.
- Published
- 56
- Critical
- 0
- High
- 3
- Medium
- 4
- Low
- 2
- Unrated
- 47
- Now in CISA KEV
- 0
- Fix available
- 3
Most affected products
- CA Technologies PPM
- 5
- CA Technologies Unified Infrastructure Management
- 3
- Trend Micro Security
- 3
- [UNKNOWN] libtirpc
- 2
- [UNKNOWN] kernel
- 1
- [UNKNOWN] PostgreSQL · org.postgresql:pgjdbc-aggregate
- 1
- CA Technologies Release Automation
- 1
- com.typesafe.akka:akka-http-core_2.12 · com.typesafe.akka:a…
- 1
- Foxit Reader
- 1
- IBM Cloud Orchestrator
- 1
High 3
- CVE-2018-6498Micro Focus Container Deployment Foundation (CDF), Remote Code ExecutionMicro Focus Network Operations Management (NOM) Suite CD… +3
- CVE-2018-6499Remote Code Execution in the following products Hybrid Cloud Management Containerized Suite HCM2017.11, HCM2018.02, HCM2018.05, Operations BMicro Focus Network Operations Management (NOM) Suite CD… +6
- CVE-2018-10936A weakness was found in postgresql-jdbc before version 42.2.5.[UNKNOWN] PostgreSQL · org.postgresql:pgjdbc-aggregate
Medium, low and unrated 53
- CVE-2018-16231Michael Roth Software Personal FTP Server (PFTP) through 8.4f allows remote attackers to cause a denial of service (daemon crash) via an uns
- CVE-2018-16233MiniCMS V1.10 has XSS via the mc-admin/post-edit.php tags parameter.
- CVE-2018-16234MorningStar WhatWeb 0.4.9 has XSS via JSON report files.
- CVE-2018-16236cPanel through 74 allows XSS via a crafted filename in the logs subdirectory of a user account, because the filename is mishandled during fr
- CVE-2018-16237An issue was discovered in damiCMS V6.0.1.
- CVE-2018-16238An issue was discovered in damiCMS V6.0.1.
- CVE-2018-16239An issue was discovered in damiCMS V6.0.1.
- CVE-2018-10513A Deserialization of Untrusted Data Privilege Escalation vulnerability in Trend Micro Security 2018 (Consumer) products could allow a local Trend Micro Security
- CVE-2018-10514A Missing Impersonation Privilege Escalation vulnerability in Trend Micro Security 2018 (Consumer) products could allow a local attacker to Trend Micro Security
- CVE-2018-15363An Out-of-Bounds Read Privilege Escalation vulnerability in Trend Micro Security 2018 (Consumer) products could allow a local attacker to esTrend Micro Security
- CVE-2018-15364A Named Pipe Request Processing Out-of-Bounds Read Information Disclosure vulnerability in Trend Micro OfficeScan XG (12.0) could allow a loTrend Micro OfficeScan
- CVE-2018-14899On the EPSON WF-2750 printer with firmware JP02I2, the Web interface AirPrint Setup page is vulnerable to HTML Injection that can redirect u
- CVE-2018-14900On EPSON WF-2750 printers with firmware JP02I2, there is no filtering of print jobs.
- CVE-2018-14901The EPSON iPrint application 6.6.3 for Android contains hard-coded API and Secret keys for the Dropbox, Box, Evernote and OneDrive services.
- CVE-2018-14902The ContentProvider in the EPSON iPrint application 6.6.3 for Android does not properly restrict data access.
- CVE-2018-14903EPSON WF-2750 printers with firmware JP02I2 do not properly validate files before running updates, which allows remote attackers to cause a
- CVE-2018-15476An issue was discovered in myStrom WiFi Switch V1 before 2.66, WiFi Switch V2 before 3.80, WiFi Switch EU before 3.80, WiFi Bulb before 2.58
- CVE-2018-15477myStrom WiFi Switch V1 devices before 2.66 did not sanitize a parameter received from the cloud that was used in an OS command.
- CVE-2018-15478An issue was discovered in myStrom WiFi Switch V1 before 2.66, WiFi Switch V2 before 3.80, WiFi Switch EU before 3.80, WiFi Bulb before 2.58
- CVE-2018-15479An issue was discovered in myStrom WiFi Switch V1 before 2.66, WiFi Switch V2 before 3.80, WiFi Switch EU before 3.80, WiFi Bulb before 2.58
- CVE-2018-15480An issue was discovered in myStrom WiFi Switch V1 before 2.66, WiFi Switch V2 before 3.80, WiFi Switch EU before 3.80, WiFi Bulb before 2.58
- CVE-2018-15745Argus Surveillance DVR 4.0.0.0 devices allow Unauthenticated Directory Traversal, leading to File Disclosure via a ..%2F in the WEBACCOUNT.C
- CVE-2016-0205A vulnerability has been identified in IBM Cloud Orchestrator 2.3, 2.3.0.1, 2.4, and 2.4.0.1 that could allow an attacker after authenticatiIBM Cloud Orchestrator
- CVE-2016-0234IBM OpenPages GRC Platform 7.1, 7.2, and 7.3 could allow a local user to obtain sensitive information when a previous user has logged out ofIBM OpenPages GRC Platform
- CVE-2016-0373IBM UrbanCode Deploy 6.0 through 6.2.2.1 could allow an authenticated user to read sensitive information due to UCD REST endpoints not propeIBM UrbanCode Deploy
- CVE-2018-11718Xovis PC2, PC2R, and PC3 devices through 3.6.0 allow CSRF.
- CVE-2018-11719Xovis PC2, PC2R, and PC3 devices through 3.6.0 allow XXE.
- CVE-2018-11720Xovis PC2, PC2R, and PC3 devices through 3.6.0 allow Directory Traversal.
- CVE-2018-16159The Gift Vouchers plugin through 2.0.1 for WordPress allows SQL Injection via the template_id parameter in a wp-admin/admin-ajax.php wpgv_do
- CVE-2018-13819A hardcoded secret key, in CA Unified Infrastructure Management 8.5.1, 8.5, and 8.4.7, allows attackers to access sensitive information.CA Technologies Unified Infrastructure Management
- CVE-2018-13820A hardcoded passphrase, in CA Unified Infrastructure Management 8.5.1, 8.5, and 8.4.7, allows attackers to access sensitive information.CA Technologies Unified Infrastructure Management
- CVE-2018-13821A lack of authentication, in CA Unified Infrastructure Management 8.5.1, 8.5, and 8.4.7, allows remote attackers to conduct a variety of attCA Technologies Unified Infrastructure Management
- CVE-2018-13822Unprotected storage of credentials in CA PPM 14.3 and below, 14.4, 15.1, 15.2 CP5 and below, and 15.3 CP2 and below, allows attackers to accCA Technologies PPM
- CVE-2018-13823An XML external entity vulnerability in the XOG functionality, in CA PPM 14.3 and below, 14.4, 15.1, 15.2 CP5 and below, and 15.3 CP2 and beCA Technologies PPM
- CVE-2018-13824Insufficient input sanitization of two parameters in CA PPM 14.3 and below, 14.4, 15.1, 15.2 CP5 and below, and 15.3 CP2 and below, allows rCA Technologies PPM
- CVE-2018-13825Insufficient input validation in the gridExcelExport functionality, in CA PPM 14.3 and below, 14.4, 15.1, 15.2 CP5 and below, and 15.3 CP2 aCA Technologies PPM
- CVE-2018-13826An XML external entity vulnerability in the XOG functionality, in CA PPM 14.3 and below, 14.4, 15.1, 15.2 CP5 and below, and 15.3 CP2 and beCA Technologies PPM
- CVE-2018-15691Insecure deserialization of a specially crafted serialized object, in CA Release Automation 6.5 and earlier, allows attackers to potentiallyCA Technologies Release Automation
- CVE-2018-14621An infinite loop vulnerability was found in libtirpc before version 1.0.2-rc2.[UNKNOWN] libtirpc
- CVE-2018-14622A null-pointer dereference vulnerability was found in libtirpc before version 0.3.3-rc3.[UNKNOWN] libtirpc
- CVE-2018-16131The decodeRequest and decodeRequestWith directives in Lightbend Akka HTTP 10.1.x through 10.1.4 and 10.0.x through 10.0.13 allow remote attacom.typesafe.akka:akka-http-core_2.12 · com.typesafe.akka:a…
- CVE-2018-16157waimai Super Cms 20150505 has a logic flaw allowing attackers to modify a price, before form submission, by observing data in a packet captu
- CVE-2018-11615This vulnerability allows remote attackers to deny service on vulnerable installations of npm mosca 2.8.1.npm mosca · mosca
- CVE-2018-11616This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Tencent Foxmail 7.2.9.115.Tencent Foxmail
- CVE-2018-14317This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 9.1.0.5096.Foxit Reader
- CVE-2018-14619A flaw was found in the crypto subsystem of the Linux kernel before version kernel-4.15-rc4.[UNKNOWN] kernel
- CVE-2018-16141ThinkCMF X2.2.3 has an arbitrary file deletion vulnerability in do_avatar in \application\User\Controller\ProfileController.class.php via an
- CVE-2018-16142PHPOK 4.8.278 has a Reflected XSS vulnerability in framework/www/login_control.php via the _back parameter to the ok_f function.
- CVE-2018-16158Eaton Power Xpert Meter 4000, 6000, and 8000 devices before 13.4.0.10 have a single SSH private key across different customers' installation
- CVE-2018-16056In Wireshark 2.6.0 to 2.6.2, 2.4.0 to 2.4.8, and 2.2.0 to 2.2.16, the Bluetooth Attribute Protocol dissector could crash.
- CVE-2018-16057In Wireshark 2.6.0 to 2.6.2, 2.4.0 to 2.4.8, and 2.2.0 to 2.2.16, the Radiotap dissector could crash.
- CVE-2018-16058In Wireshark 2.6.0 to 2.6.2, 2.4.0 to 2.4.8, and 2.2.0 to 2.2.16, the Bluetooth AVDTP dissector could crash.
- CVE-2018-16140A buffer underwrite vulnerability in get_line() (read.c) in fig2dev 3.2.7a allows an attacker to write prior to the beginning of the buffer