# CVEs published 2018-08-30

56 CVEs were published on August 30, 2018: 0 critical, 3 high. Days are UTC.

- [CVE-2018-16231](https://cve.now/CVE-2018-16231.md): Michael Roth Software Personal FTP Server (PFTP) through 8.4f allows remote attackers to cause a denial of service (daemon crash) via an uns (no CVSS)
- [CVE-2018-16233](https://cve.now/CVE-2018-16233.md): MiniCMS V1.10 has XSS via the mc-admin/post-edit.php tags parameter. (no CVSS)
- [CVE-2018-16234](https://cve.now/CVE-2018-16234.md): MorningStar WhatWeb 0.4.9 has XSS via JSON report files. (no CVSS)
- [CVE-2018-16236](https://cve.now/CVE-2018-16236.md): cPanel through 74 allows XSS via a crafted filename in the logs subdirectory of a user account, because the filename is mishandled during fr (no CVSS)
- [CVE-2018-16237](https://cve.now/CVE-2018-16237.md): An issue was discovered in damiCMS V6.0.1. (no CVSS)
- [CVE-2018-16238](https://cve.now/CVE-2018-16238.md): An issue was discovered in damiCMS V6.0.1. (no CVSS)
- [CVE-2018-16239](https://cve.now/CVE-2018-16239.md): An issue was discovered in damiCMS V6.0.1. (no CVSS)
- [CVE-2018-6498](https://cve.now/CVE-2018-6498.md): Micro Focus Container Deployment Foundation (CDF), Remote Code Execution (CVSS 8.8, Micro Focus Network Operations Management (NOM) Suite CD… +3)
- [CVE-2018-6499](https://cve.now/CVE-2018-6499.md): Remote Code Execution in the following products Hybrid Cloud Management Containerized Suite HCM2017.11, HCM2018.02, HCM2018.05, Operations B (CVSS 7.1, Micro Focus Network Operations Management (NOM) Suite CD… +6)
- [CVE-2018-10513](https://cve.now/CVE-2018-10513.md): A Deserialization of Untrusted Data Privilege Escalation vulnerability in Trend Micro Security 2018 (Consumer) products could allow a local (no CVSS, Trend Micro Security)
- [CVE-2018-10514](https://cve.now/CVE-2018-10514.md): A Missing Impersonation Privilege Escalation vulnerability in Trend Micro Security 2018 (Consumer) products could allow a local attacker to (no CVSS, Trend Micro Security)
- [CVE-2018-15363](https://cve.now/CVE-2018-15363.md): An Out-of-Bounds Read Privilege Escalation vulnerability in Trend Micro Security 2018 (Consumer) products could allow a local attacker to es (no CVSS, Trend Micro Security)
- [CVE-2018-15364](https://cve.now/CVE-2018-15364.md): A Named Pipe Request Processing Out-of-Bounds Read Information Disclosure vulnerability in Trend Micro OfficeScan XG (12.0) could allow a lo (no CVSS, Trend Micro OfficeScan)
- [CVE-2018-14899](https://cve.now/CVE-2018-14899.md): On the EPSON WF-2750 printer with firmware JP02I2, the Web interface AirPrint Setup page is vulnerable to HTML Injection that can redirect u (no CVSS)
- [CVE-2018-14900](https://cve.now/CVE-2018-14900.md): On EPSON WF-2750 printers with firmware JP02I2, there is no filtering of print jobs. (no CVSS)
- [CVE-2018-14901](https://cve.now/CVE-2018-14901.md): The EPSON iPrint application 6.6.3 for Android contains hard-coded API and Secret keys for the Dropbox, Box, Evernote and OneDrive services. (no CVSS)
- [CVE-2018-14902](https://cve.now/CVE-2018-14902.md): The ContentProvider in the EPSON iPrint application 6.6.3 for Android does not properly restrict data access. (no CVSS)
- [CVE-2018-14903](https://cve.now/CVE-2018-14903.md): EPSON WF-2750 printers with firmware JP02I2 do not properly validate files before running updates, which allows remote attackers to cause a (no CVSS)
- [CVE-2018-15476](https://cve.now/CVE-2018-15476.md): An issue was discovered in myStrom WiFi Switch V1 before 2.66, WiFi Switch V2 before 3.80, WiFi Switch EU before 3.80, WiFi Bulb before 2.58 (no CVSS)
- [CVE-2018-15477](https://cve.now/CVE-2018-15477.md): myStrom WiFi Switch V1 devices before 2.66 did not sanitize a parameter received from the cloud that was used in an OS command. (no CVSS)
- [CVE-2018-15478](https://cve.now/CVE-2018-15478.md): An issue was discovered in myStrom WiFi Switch V1 before 2.66, WiFi Switch V2 before 3.80, WiFi Switch EU before 3.80, WiFi Bulb before 2.58 (no CVSS)
- [CVE-2018-15479](https://cve.now/CVE-2018-15479.md): An issue was discovered in myStrom WiFi Switch V1 before 2.66, WiFi Switch V2 before 3.80, WiFi Switch EU before 3.80, WiFi Bulb before 2.58 (no CVSS)
- [CVE-2018-15480](https://cve.now/CVE-2018-15480.md): An issue was discovered in myStrom WiFi Switch V1 before 2.66, WiFi Switch V2 before 3.80, WiFi Switch EU before 3.80, WiFi Bulb before 2.58 (no CVSS)
- [CVE-2018-15745](https://cve.now/CVE-2018-15745.md): Argus Surveillance DVR 4.0.0.0 devices allow Unauthenticated Directory Traversal, leading to File Disclosure via a ..%2F in the WEBACCOUNT.C (no CVSS)
- [CVE-2016-0205](https://cve.now/CVE-2016-0205.md): A vulnerability has been identified in IBM Cloud Orchestrator 2.3, 2.3.0.1, 2.4, and 2.4.0.1 that could allow an attacker after authenticati (CVSS 3.3, IBM Cloud Orchestrator)
- [CVE-2016-0234](https://cve.now/CVE-2016-0234.md): IBM OpenPages GRC Platform 7.1, 7.2, and 7.3 could allow a local user to obtain sensitive information when a previous user has logged out of (CVSS 4.0, IBM OpenPages GRC Platform)
- [CVE-2016-0373](https://cve.now/CVE-2016-0373.md): IBM UrbanCode Deploy 6.0 through 6.2.2.1 could allow an authenticated user to read sensitive information due to UCD REST endpoints not prope (CVSS 3.1, IBM UrbanCode Deploy)
- [CVE-2018-11718](https://cve.now/CVE-2018-11718.md): Xovis PC2, PC2R, and PC3 devices through 3.6.0 allow CSRF. (no CVSS)
- [CVE-2018-11719](https://cve.now/CVE-2018-11719.md): Xovis PC2, PC2R, and PC3 devices through 3.6.0 allow XXE. (no CVSS)
- [CVE-2018-11720](https://cve.now/CVE-2018-11720.md): Xovis PC2, PC2R, and PC3 devices through 3.6.0 allow Directory Traversal. (no CVSS)
- [CVE-2018-16159](https://cve.now/CVE-2018-16159.md): The Gift Vouchers plugin through 2.0.1 for WordPress allows SQL Injection via the template\_id parameter in a wp-admin/admin-ajax.php wpgv\_do (no CVSS)
- [CVE-2018-13819](https://cve.now/CVE-2018-13819.md): A hardcoded secret key, in CA Unified Infrastructure Management 8.5.1, 8.5, and 8.4.7, allows attackers to access sensitive information. (no CVSS, CA Technologies Unified Infrastructure Management)
- [CVE-2018-13820](https://cve.now/CVE-2018-13820.md): A hardcoded passphrase, in CA Unified Infrastructure Management 8.5.1, 8.5, and 8.4.7, allows attackers to access sensitive information. (no CVSS, CA Technologies Unified Infrastructure Management)
- [CVE-2018-13821](https://cve.now/CVE-2018-13821.md): A lack of authentication, in CA Unified Infrastructure Management 8.5.1, 8.5, and 8.4.7, allows remote attackers to conduct a variety of att (no CVSS, CA Technologies Unified Infrastructure Management)
- [CVE-2018-13822](https://cve.now/CVE-2018-13822.md): Unprotected storage of credentials in CA PPM 14.3 and below, 14.4, 15.1, 15.2 CP5 and below, and 15.3 CP2 and below, allows attackers to acc (no CVSS, CA Technologies PPM)
- [CVE-2018-13823](https://cve.now/CVE-2018-13823.md): An XML external entity vulnerability in the XOG functionality, in CA PPM 14.3 and below, 14.4, 15.1, 15.2 CP5 and below, and 15.3 CP2 and be (no CVSS, CA Technologies PPM)
- [CVE-2018-13824](https://cve.now/CVE-2018-13824.md): Insufficient input sanitization of two parameters in CA PPM 14.3 and below, 14.4, 15.1, 15.2 CP5 and below, and 15.3 CP2 and below, allows r (no CVSS, CA Technologies PPM)
- [CVE-2018-13825](https://cve.now/CVE-2018-13825.md): Insufficient input validation in the gridExcelExport functionality, in CA PPM 14.3 and below, 14.4, 15.1, 15.2 CP5 and below, and 15.3 CP2 a (no CVSS, CA Technologies PPM)
- [CVE-2018-13826](https://cve.now/CVE-2018-13826.md): An XML external entity vulnerability in the XOG functionality, in CA PPM 14.3 and below, 14.4, 15.1, 15.2 CP5 and below, and 15.3 CP2 and be (no CVSS, CA Technologies PPM)
- [CVE-2018-15691](https://cve.now/CVE-2018-15691.md): Insecure deserialization of a specially crafted serialized object, in CA Release Automation 6.5 and earlier, allows attackers to potentially (no CVSS, CA Technologies Release Automation)
- [CVE-2018-10936](https://cve.now/CVE-2018-10936.md): A weakness was found in postgresql-jdbc before version 42.2.5. (CVSS 8.1, \[UNKNOWN\] PostgreSQL · org.postgresql:pgjdbc-aggregate)
- [CVE-2018-14621](https://cve.now/CVE-2018-14621.md): An infinite loop vulnerability was found in libtirpc before version 1.0.2-rc2. (CVSS 5.3, \[UNKNOWN\] libtirpc)
- [CVE-2018-14622](https://cve.now/CVE-2018-14622.md): A null-pointer dereference vulnerability was found in libtirpc before version 0.3.3-rc3. (CVSS 5.3, \[UNKNOWN\] libtirpc)
- [CVE-2018-16131](https://cve.now/CVE-2018-16131.md): The decodeRequest and decodeRequestWith directives in Lightbend Akka HTTP 10.1.x through 10.1.4 and 10.0.x through 10.0.13 allow remote atta (no CVSS, com.typesafe.akka:akka-http-core\_2.12 · com.typesafe.akka:a…)
- [CVE-2018-16157](https://cve.now/CVE-2018-16157.md): waimai Super Cms 20150505 has a logic flaw allowing attackers to modify a price, before form submission, by observing data in a packet captu (no CVSS)
- [CVE-2018-11615](https://cve.now/CVE-2018-11615.md): This vulnerability allows remote attackers to deny service on vulnerable installations of npm mosca 2.8.1. (no CVSS, npm mosca · mosca)
- [CVE-2018-11616](https://cve.now/CVE-2018-11616.md): This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Tencent Foxmail 7.2.9.115. (no CVSS, Tencent Foxmail)
- [CVE-2018-14317](https://cve.now/CVE-2018-14317.md): This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 9.1.0.5096. (no CVSS, Foxit Reader)
- [CVE-2018-14619](https://cve.now/CVE-2018-14619.md): A flaw was found in the crypto subsystem of the Linux kernel before version kernel-4.15-rc4. (CVSS 6.2, \[UNKNOWN\] kernel)
- [CVE-2018-16141](https://cve.now/CVE-2018-16141.md): ThinkCMF X2.2.3 has an arbitrary file deletion vulnerability in do\_avatar in \\application\\User\\Controller\\ProfileController.class.php via an (no CVSS)
- [CVE-2018-16142](https://cve.now/CVE-2018-16142.md): PHPOK 4.8.278 has a Reflected XSS vulnerability in framework/www/login\_control.php via the \_back parameter to the ok\_f function. (no CVSS)
- [CVE-2018-16158](https://cve.now/CVE-2018-16158.md): Eaton Power Xpert Meter 4000, 6000, and 8000 devices before 13.4.0.10 have a single SSH private key across different customers' installation (no CVSS)
- [CVE-2018-16056](https://cve.now/CVE-2018-16056.md): In Wireshark 2.6.0 to 2.6.2, 2.4.0 to 2.4.8, and 2.2.0 to 2.2.16, the Bluetooth Attribute Protocol dissector could crash. (no CVSS)
- [CVE-2018-16057](https://cve.now/CVE-2018-16057.md): In Wireshark 2.6.0 to 2.6.2, 2.4.0 to 2.4.8, and 2.2.0 to 2.2.16, the Radiotap dissector could crash. (no CVSS)
- [CVE-2018-16058](https://cve.now/CVE-2018-16058.md): In Wireshark 2.6.0 to 2.6.2, 2.4.0 to 2.4.8, and 2.2.0 to 2.2.16, the Bluetooth AVDTP dissector could crash. (no CVSS)
- [CVE-2018-16140](https://cve.now/CVE-2018-16140.md): A buffer underwrite vulnerability in get\_line() (read.c) in fig2dev 3.2.7a allows an attacker to write prior to the beginning of the buffer (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2018-08-30
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.