# CVEs published 2018-09-01

20 CVEs were published on September 1, 2018: 0 critical, 0 high. Days are UTC.

- [CVE-2018-16325](https://cve.now/CVE-2018-16325.md): There is XSS in GetSimple CMS 3.4.0.9 via the admin/edit.php title field. (no CVSS)
- [CVE-2018-16327](https://cve.now/CVE-2018-16327.md): There is Stored XSS in Subrion 4.2.1 via the admin panel URL configuration. (no CVSS, intelliants/subrion)
- [CVE-2018-16328](https://cve.now/CVE-2018-16328.md): In ImageMagick before 7.0.8-8, a NULL pointer dereference exists in the CheckEventLogging function in MagickCore/log.c. (no CVSS)
- [CVE-2018-16329](https://cve.now/CVE-2018-16329.md): In ImageMagick before 7.0.8-8, a NULL pointer dereference exists in the GetMagickProperty function in MagickCore/property.c. (no CVSS)
- [CVE-2018-16308](https://cve.now/CVE-2018-16308.md): The Ninja Forms plugin before 3.3.14.1 for WordPress allows CSV injection. (no CVSS)
- [CVE-2018-16313](https://cve.now/CVE-2018-16313.md): Bludit 2.3.4 allows XSS via a user name. (no CVSS)
- [CVE-2018-16314](https://cve.now/CVE-2018-16314.md): An issue was discovered in admincp.php in idreamsoft iCMS 7.0.11. (no CVSS)
- [CVE-2018-16315](https://cve.now/CVE-2018-16315.md): In waimai Super Cms 20150505, there is a CSRF vulnerability that can change the configuration via admin.php?m=Config&a=add. (no CVSS)
- [CVE-2018-16316](https://cve.now/CVE-2018-16316.md): A stored Cross-site scripting (XSS) vulnerability in Portainer through 1.19.1 allows remote authenticated users to inject arbitrary JavaScri (no CVSS)
- [CVE-2018-16320](https://cve.now/CVE-2018-16320.md): idreamsoft iCMS 7.0.11 allows admincp.php?app=config Directory Traversal, resulting in execution of arbitrary PHP code from a ZIP file. (no CVSS)
- [CVE-2018-16323](https://cve.now/CVE-2018-16323.md): ReadXBMImage in coders/xbm.c in ImageMagick before 7.0.8-9 leaves data uninitialized when processing an XBM file that has a negative pixel v (no CVSS)
- [CVE-2018-16324](https://cve.now/CVE-2018-16324.md): In IceWarp Server 12.0.3.1 and before, there is XSS in the /webmail/ username field. (no CVSS)
- [CVE-2018-16302](https://cve.now/CVE-2018-16302.md): MediaComm Zip-n-Go before 4.95 has a Buffer Overflow via a crafted file. (no CVSS)
- [CVE-2018-16303](https://cve.now/CVE-2018-16303.md): PDF-XChange Editor through 7.0.326.1 allows remote attackers to cause a denial of service (resource consumption) via a crafted x:xmpmeta str (no CVSS)
- [CVE-2018-15157](https://cve.now/CVE-2018-15157.md): The libfsclfs\_block\_read function in libfsclfs\_block.c in libfsclfs before 2018-07-25 allows remote attackers to cause a heap-based buffer o (no CVSS)
- [CVE-2018-15158](https://cve.now/CVE-2018-15158.md): The libesedb\_page\_read\_values function in libesedb\_page.c in libesedb through 2018-04-01 allows remote attackers to cause a heap-based buffe (no CVSS)
- [CVE-2018-15159](https://cve.now/CVE-2018-15159.md): The libesedb\_page\_read\_tags function in libesedb\_page.c in libesedb through 2018-04-01 allows remote attackers to cause a heap-based buffer (no CVSS)
- [CVE-2018-15160](https://cve.now/CVE-2018-15160.md): The libesedb\_catalog\_definition\_read function in libesedb\_catalog\_definition.c in libesedb through 2018-04-01 allows remote attackers to cau (no CVSS)
- [CVE-2018-15161](https://cve.now/CVE-2018-15161.md): The libesedb\_key\_append\_data function in libesedb\_key.c in libesedb through 2018-04-01 allows remote attackers to cause a heap-based buffer (no CVSS)
- [CVE-2018-15514](https://cve.now/CVE-2018-15514.md): HandleRequestAsync in Docker for Windows before 18.06.0-ce-rc3-win68 (edge) and before 18.06.0-ce-win72 (stable) deserialized requests over (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2018-09-01
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.