CVEs published September 5, 2018
53 CVEs were published on September 5, 2018: 1 critical, 1 high.
- Published
- 53
- Critical
- 1
- High
- 1
- Medium
- 0
- Low
- 0
- Unrated
- 51
- Now in CISA KEV
- 0
- Fix available
- 2
Most affected products
- Fortinet FortiOS
- 2
- zsh before
- 2
- [UNKNOWN] curl
- 1
- django-crm
- 1
- flask-admin
- 1
- Fortinet FortiManager
- 1
- lavalite/cms
- 1
- tough-cookie
- 1
Critical 1
High 1
Medium, low and unrated 51
- CVE-2018-16550TeamViewer 10.x through 13.x allows remote attackers to bypass the brute-force authentication protection mechanism by skipping the "Cancel"
- CVE-2018-16551LavaLite 5.5 has XSS via a /edit URI, as demonstrated by client/job/job/Zy8PWBekrJ/edit.lavalite/cms
- CVE-2018-16552MicroPyramid Django-CRM 0.2 allows CSRF for /users/create/, /users/##/edit/, and /accounts/##/delete/ URIs.django-crm
- CVE-2018-14769VIVOTEK FD8177 devices before XXXXXX-VVTK-xx06a allow CSRF.
- CVE-2018-14770VIVOTEK FD8177 devices before XXXXXX-VVTK-xx06a allow remote attackers to execute arbitrary code (issue 1 of 2) via the ONVIF interface, (/o
- CVE-2018-14771VIVOTEK FD8177 devices before XXXXXX-VVTK-xx06a allow remote attackers to execute arbitrary code (issue 2 of 2) via eventscript.cgi.
- CVE-2018-15676An issue was discovered in BTITeam XBTIT.
- CVE-2018-15677The newsfeed (aka /index.php?page=viewnews) in BTITeam XBTIT 2.5.4 has stored XSS via the title of a news item.
- CVE-2018-15678An issue was discovered in BTITeam XBTIT 2.5.4.
- CVE-2018-15679An issue was discovered in BTITeam XBTIT 2.5.4.
- CVE-2018-15680An issue was discovered in BTITeam XBTIT 2.5.4.
- CVE-2018-15681An issue was discovered in BTITeam XBTIT 2.5.4.
- CVE-2018-15682An issue was discovered in BTITeam XBTIT.
- CVE-2018-15683An issue was discovered in BTITeam XBTIT.
- CVE-2018-15684An issue was discovered in BTITeam XBTIT.
- CVE-2018-15917Persistent cross-site scripting (XSS) issues in Jorani 0.6.5 allow remote attackers to inject arbitrary web script or HTML via the language
- CVE-2018-15918An issue was discovered in Jorani 0.6.5.
- CVE-2018-16144The test connection functionality in the NetAudit section of Opsview Monitor before 5.3.1 and 5.4.x before 5.4.2 is vulnerable to command in
- CVE-2018-16145The /etc/init.d/opsview-reporting-module script that runs at boot time in Opsview Monitor before 5.3.1 and 5.4.x before 5.4.2 invokes a file
- CVE-2018-16146The web management console of Opsview Monitor 5.4.x before 5.4.2 provides functionality accessible by an authenticated administrator to test
- CVE-2018-16147The data parameter of the /settings/api/router endpoint in Opsview Monitor before 5.3.1 and 5.4.x before 5.4.2 is vulnerable to Cross-Site S
- CVE-2018-16148The diagnosticsb2ksy parameter of the /rest endpoint in Opsview Monitor before 5.3.1 and 5.4.x before 5.4.2 is vulnerable to Cross-Site Scri
- CVE-2018-16252FsPro Labs Event Log Explorer 4.6.1.2115 has ".elx" FileType XML External Entity Injection.
- CVE-2018-16307An "Out-of-band resource load" issue was discovered on Xiaomi MIWiFi Xiaomi_55DD Version 2.8.50 devices.
- CVE-2018-16361An issue was discovered in BTITeam XBTIT 2.5.4.
- CVE-2018-16381e107 2.1.8 has XSS via the e107_admin/users.php?mode=main&action=list user_loginname parameter.
- CVE-2018-16548An issue was discovered in ZZIPlib through 0.13.69.
- CVE-2018-16549HScripts PHP File Browser Script v1.0 allows Directory Traversal via the index.php path parameter.
- CVE-2018-16436Gxlcms 2.0 before bug fix 20180915 has SQL Injection exploitable by an administrator.
- CVE-2018-16437Gxlcms 2.0 before bug fix 20180915 has Directory Traversal exploitable by an administrator.
- CVE-2018-16546Amcrest networked devices use the same hardcoded SSL private key across different customers' installations, which allows remote attackers to
- CVE-2018-16545Kaizen Asset Manager (Enterprise Edition) and Training Manager (Enterprise Edition) allow a remote attacker to achieve arbitrary code execut
- CVE-2018-16539In Artifex Ghostscript before 9.24, attackers able to supply crafted PostScript files could use incorrect access checking in temp file handl
- CVE-2018-16540In Artifex Ghostscript before 9.24, attackers able to supply crafted PostScript files to the builtin PDF14 converter could use a use-after-f
- CVE-2018-16541In Artifex Ghostscript before 9.24, attackers able to supply crafted PostScript files could use incorrect free logic in pagedevice replaceme
- CVE-2018-16542In Artifex Ghostscript before 9.24, attackers able to supply crafted PostScript files could use insufficient interpreter stack-size checking
- CVE-2018-16543In Artifex Ghostscript before 9.24, gssetresolution and gsgetresolution allow attackers to have an unspecified impact.
- CVE-2016-1000030Pidgin version <2.11.0 contains a vulnerability in X.509 Certificates imports specifically due to improper check of return values from gnutl
- CVE-2016-1000232NodeJS Tough-Cookie version 2.2.2 contains a Regular Expression Parsing vulnerability in HTTP request Cookie Header parsing that can result tough-cookie
- CVE-2018-16518A directory traversal vulnerability with remote code execution in Prim'X Zed! FREE through 1.0 build 186 and Zed! Limited Edition through 6.
- CVE-2018-16521An XML External Entity (XXE) vulnerability exists in HTML Form Entry 3.7.0, as distributed in OpenMRS Reference Application 2.8.0.
- CVE-2018-16516helpers.py in Flask-Admin 1.5.2 has Reflected XSS via a crafted URL.flask-admin
- CVE-2018-1353An information disclosure vulnerability in Fortinet FortiManager 6.0.1 and below versions allows a standard user with adom assignment read tFortinet FortiManager
- CVE-2018-16513In Artifex Ghostscript before 9.24, attackers able to supply crafted PostScript files could use a type confusion in the setcolor function to
- CVE-2018-9192A plaintext recovery of encrypted messages or a Man-in-the-middle (MiTM) attack on RSA PKCS #1 v1.5 encryption may be possible without knowlFortinet FortiOS
- CVE-2018-9194A plaintext recovery of encrypted messages or a Man-in-the-middle (MiTM) attack on RSA PKCS #1 v1.5 encryption may be possible without knowlFortinet FortiOS
- CVE-2018-0502An issue was discovered in zsh before 5.6.zsh before
- CVE-2018-13259An issue was discovered in zsh before 5.6.zsh before
- CVE-2018-16509An issue was discovered in Artifex Ghostscript before 9.24.
- CVE-2018-16510An issue was discovered in Artifex Ghostscript before 9.24.
- CVE-2018-16511An issue was discovered in Artifex Ghostscript before 9.24.