# CVEs published 2018-09-05

53 CVEs were published on September 5, 2018: 1 critical, 1 high. Days are UTC.

- [CVE-2018-16550](https://cve.now/CVE-2018-16550.md): TeamViewer 10.x through 13.x allows remote attackers to bypass the brute-force authentication protection mechanism by skipping the "Cancel" (no CVSS)
- [CVE-2018-16551](https://cve.now/CVE-2018-16551.md): LavaLite 5.5 has XSS via a /edit URI, as demonstrated by client/job/job/Zy8PWBekrJ/edit. (no CVSS, lavalite/cms)
- [CVE-2018-16552](https://cve.now/CVE-2018-16552.md): MicroPyramid Django-CRM 0.2 allows CSRF for /users/create/, /users/##/edit/, and /accounts/##/delete/ URIs. (no CVSS, django-crm)
- [CVE-2015-9266](https://cve.now/CVE-2015-9266.md): Ubiquiti airOS HTTP(S) unauthenticated arbitrary file upload (CVSS 9.8)
- [CVE-2018-14769](https://cve.now/CVE-2018-14769.md): VIVOTEK FD8177 devices before XXXXXX-VVTK-xx06a allow CSRF. (no CVSS)
- [CVE-2018-14770](https://cve.now/CVE-2018-14770.md): VIVOTEK FD8177 devices before XXXXXX-VVTK-xx06a allow remote attackers to execute arbitrary code (issue 1 of 2) via the ONVIF interface, (/o (no CVSS)
- [CVE-2018-14771](https://cve.now/CVE-2018-14771.md): VIVOTEK FD8177 devices before XXXXXX-VVTK-xx06a allow remote attackers to execute arbitrary code (issue 2 of 2) via eventscript.cgi. (no CVSS)
- [CVE-2018-15676](https://cve.now/CVE-2018-15676.md): An issue was discovered in BTITeam XBTIT. (no CVSS)
- [CVE-2018-15677](https://cve.now/CVE-2018-15677.md): The newsfeed (aka /index.php?page=viewnews) in BTITeam XBTIT 2.5.4 has stored XSS via the title of a news item. (no CVSS)
- [CVE-2018-15678](https://cve.now/CVE-2018-15678.md): An issue was discovered in BTITeam XBTIT 2.5.4. (no CVSS)
- [CVE-2018-15679](https://cve.now/CVE-2018-15679.md): An issue was discovered in BTITeam XBTIT 2.5.4. (no CVSS)
- [CVE-2018-15680](https://cve.now/CVE-2018-15680.md): An issue was discovered in BTITeam XBTIT 2.5.4. (no CVSS)
- [CVE-2018-15681](https://cve.now/CVE-2018-15681.md): An issue was discovered in BTITeam XBTIT 2.5.4. (no CVSS)
- [CVE-2018-15682](https://cve.now/CVE-2018-15682.md): An issue was discovered in BTITeam XBTIT. (no CVSS)
- [CVE-2018-15683](https://cve.now/CVE-2018-15683.md): An issue was discovered in BTITeam XBTIT. (no CVSS)
- [CVE-2018-15684](https://cve.now/CVE-2018-15684.md): An issue was discovered in BTITeam XBTIT. (no CVSS)
- [CVE-2018-15917](https://cve.now/CVE-2018-15917.md): Persistent cross-site scripting (XSS) issues in Jorani 0.6.5 allow remote attackers to inject arbitrary web script or HTML via the language (no CVSS)
- [CVE-2018-15918](https://cve.now/CVE-2018-15918.md): An issue was discovered in Jorani 0.6.5. (no CVSS)
- [CVE-2018-16144](https://cve.now/CVE-2018-16144.md): The test connection functionality in the NetAudit section of Opsview Monitor before 5.3.1 and 5.4.x before 5.4.2 is vulnerable to command in (no CVSS)
- [CVE-2018-16145](https://cve.now/CVE-2018-16145.md): The /etc/init.d/opsview-reporting-module script that runs at boot time in Opsview Monitor before 5.3.1 and 5.4.x before 5.4.2 invokes a file (no CVSS)
- [CVE-2018-16146](https://cve.now/CVE-2018-16146.md): The web management console of Opsview Monitor 5.4.x before 5.4.2 provides functionality accessible by an authenticated administrator to test (no CVSS)
- [CVE-2018-16147](https://cve.now/CVE-2018-16147.md): The data parameter of the /settings/api/router endpoint in Opsview Monitor before 5.3.1 and 5.4.x before 5.4.2 is vulnerable to Cross-Site S (no CVSS)
- [CVE-2018-16148](https://cve.now/CVE-2018-16148.md): The diagnosticsb2ksy parameter of the /rest endpoint in Opsview Monitor before 5.3.1 and 5.4.x before 5.4.2 is vulnerable to Cross-Site Scri (no CVSS)
- [CVE-2018-16252](https://cve.now/CVE-2018-16252.md): FsPro Labs Event Log Explorer 4.6.1.2115 has ".elx" FileType XML External Entity Injection. (no CVSS)
- [CVE-2018-16307](https://cve.now/CVE-2018-16307.md): An "Out-of-band resource load" issue was discovered on Xiaomi MIWiFi Xiaomi\_55DD Version 2.8.50 devices. (no CVSS)
- [CVE-2018-16361](https://cve.now/CVE-2018-16361.md): An issue was discovered in BTITeam XBTIT 2.5.4. (no CVSS)
- [CVE-2018-16381](https://cve.now/CVE-2018-16381.md): e107 2.1.8 has XSS via the e107\_admin/users.php?mode=main&action=list user\_loginname parameter. (no CVSS)
- [CVE-2018-16548](https://cve.now/CVE-2018-16548.md): An issue was discovered in ZZIPlib through 0.13.69. (no CVSS)
- [CVE-2018-16549](https://cve.now/CVE-2018-16549.md): HScripts PHP File Browser Script v1.0 allows Directory Traversal via the index.php path parameter. (no CVSS)
- [CVE-2018-16436](https://cve.now/CVE-2018-16436.md): Gxlcms 2.0 before bug fix 20180915 has SQL Injection exploitable by an administrator. (no CVSS)
- [CVE-2018-16437](https://cve.now/CVE-2018-16437.md): Gxlcms 2.0 before bug fix 20180915 has Directory Traversal exploitable by an administrator. (no CVSS)
- [CVE-2018-16546](https://cve.now/CVE-2018-16546.md): Amcrest networked devices use the same hardcoded SSL private key across different customers' installations, which allows remote attackers to (no CVSS)
- [CVE-2018-14618](https://cve.now/CVE-2018-14618.md): curl before version 7.61.1 is vulnerable to a buffer overrun in the NTLM authentication code. (CVSS 7.5, \[UNKNOWN\] curl)
- [CVE-2018-16545](https://cve.now/CVE-2018-16545.md): Kaizen Asset Manager (Enterprise Edition) and Training Manager (Enterprise Edition) allow a remote attacker to achieve arbitrary code execut (no CVSS)
- [CVE-2018-16539](https://cve.now/CVE-2018-16539.md): In Artifex Ghostscript before 9.24, attackers able to supply crafted PostScript files could use incorrect access checking in temp file handl (no CVSS)
- [CVE-2018-16540](https://cve.now/CVE-2018-16540.md): In Artifex Ghostscript before 9.24, attackers able to supply crafted PostScript files to the builtin PDF14 converter could use a use-after-f (no CVSS)
- [CVE-2018-16541](https://cve.now/CVE-2018-16541.md): In Artifex Ghostscript before 9.24, attackers able to supply crafted PostScript files could use incorrect free logic in pagedevice replaceme (no CVSS)
- [CVE-2018-16542](https://cve.now/CVE-2018-16542.md): In Artifex Ghostscript before 9.24, attackers able to supply crafted PostScript files could use insufficient interpreter stack-size checking (no CVSS)
- [CVE-2018-16543](https://cve.now/CVE-2018-16543.md): In Artifex Ghostscript before 9.24, gssetresolution and gsgetresolution allow attackers to have an unspecified impact. (no CVSS)
- [CVE-2016-1000030](https://cve.now/CVE-2016-1000030.md): Pidgin version \<2.11.0 contains a vulnerability in X.509 Certificates imports specifically due to improper check of return values from gnutl (no CVSS)
- [CVE-2016-1000232](https://cve.now/CVE-2016-1000232.md): NodeJS Tough-Cookie version 2.2.2 contains a Regular Expression Parsing vulnerability in HTTP request Cookie Header parsing that can result (no CVSS, tough-cookie)
- [CVE-2018-16518](https://cve.now/CVE-2018-16518.md): A directory traversal vulnerability with remote code execution in Prim'X Zed! FREE through 1.0 build 186 and Zed! Limited Edition through 6. (no CVSS)
- [CVE-2018-16521](https://cve.now/CVE-2018-16521.md): An XML External Entity (XXE) vulnerability exists in HTML Form Entry 3.7.0, as distributed in OpenMRS Reference Application 2.8.0. (no CVSS)
- [CVE-2018-16516](https://cve.now/CVE-2018-16516.md): helpers.py in Flask-Admin 1.5.2 has Reflected XSS via a crafted URL. (no CVSS, flask-admin)
- [CVE-2018-1353](https://cve.now/CVE-2018-1353.md): An information disclosure vulnerability in Fortinet FortiManager 6.0.1 and below versions allows a standard user with adom assignment read t (no CVSS, Fortinet FortiManager)
- [CVE-2018-16513](https://cve.now/CVE-2018-16513.md): In Artifex Ghostscript before 9.24, attackers able to supply crafted PostScript files could use a type confusion in the setcolor function to (no CVSS)
- [CVE-2018-9192](https://cve.now/CVE-2018-9192.md): A plaintext recovery of encrypted messages or a Man-in-the-middle (MiTM) attack on RSA PKCS #1 v1.5 encryption may be possible without knowl (no CVSS, Fortinet FortiOS)
- [CVE-2018-9194](https://cve.now/CVE-2018-9194.md): A plaintext recovery of encrypted messages or a Man-in-the-middle (MiTM) attack on RSA PKCS #1 v1.5 encryption may be possible without knowl (no CVSS, Fortinet FortiOS)
- [CVE-2018-0502](https://cve.now/CVE-2018-0502.md): An issue was discovered in zsh before 5.6. (no CVSS, zsh before)
- [CVE-2018-13259](https://cve.now/CVE-2018-13259.md): An issue was discovered in zsh before 5.6. (no CVSS, zsh before)
- [CVE-2018-16509](https://cve.now/CVE-2018-16509.md): An issue was discovered in Artifex Ghostscript before 9.24. (no CVSS)
- [CVE-2018-16510](https://cve.now/CVE-2018-16510.md): An issue was discovered in Artifex Ghostscript before 9.24. (no CVSS)
- [CVE-2018-16511](https://cve.now/CVE-2018-16511.md): An issue was discovered in Artifex Ghostscript before 9.24. (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2018-09-05
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.