CVEs published September 6, 2018
51 CVEs were published on September 6, 2018: 0 critical, 3 high.
- Published
- 51
- Critical
- 0
- High
- 3
- Medium
- 0
- Low
- 0
- Unrated
- 48
- Now in CISA KEV
- 0
- Fix available
- 3
Most affected products
- Ice Qube Thermal Management Center
- 2
- [UNKNOWN] 389-ds-base
- 1
- Adobe Experience Manager
- 1
- https://github.com/guyonroche exceljs · exceljs
- 1
- IBM WebSphere Application Server
- 1
- Linux Kernel
- 1
- org.dojotoolkit:dojo
- 1
- Qualcomm Android for MSM, Firefox OS for MSM, QRD Android
- 1
- Red Hat atomic-openshift · github.com/evanphx/json-patch
- 1
- Strongswan
- 1
High 3
- CVE-2018-1695IBM WebSphere Application Server 7.0, 8.0, and 8.5.5 installations using Form Login could allow a remote attacker to conduct spoofing attackIBM WebSphere Application Server
- CVE-2018-14624A vulnerability was discovered in 389-ds-base through versions 1.3.7.10, 1.3.8.8 and 1.4.0.16.[UNKNOWN] 389-ds-base
- CVE-2018-14632An out of bound write can occur when patching an Openshift object using the 'oc patch' functionality in OpenShift Container Platform before Red Hat atomic-openshift · github.com/evanphx/json-patch
Medium, low and unrated 48
- CVE-2018-12234A Reflected Cross Site Scripting (XSS) Vulnerability was discovered in Adrenalin 5.4.0 HRMS Software.
- CVE-2018-14366download.cgi in Pulse Secure Pulse Connect Secure 8.1RX before 8.1R13 and 8.3RX before 8.3R4 and Pulse Policy Secure through 5.2RX before 5.
- CVE-2018-15726The Pulse Secure Desktop (macOS) 5.3RX before 5.3R5 and 9.0R1 has a Privilege Escalation Vulnerability.
- CVE-2018-15749The Pulse Secure Desktop (macOS) 5.3RX before 5.3R5 and 9.0R1 has a Format String Vulnerability.
- CVE-2018-15865The Pulse Secure Desktop (macOS) has a Privilege Escalation Vulnerability.
- CVE-2018-16261In Pulse Secure Pulse Desktop Client 5.3RX before 5.3R5 and 9.0R1, there is a Privilege Escalation Vulnerability with Dynamic Certificate Tr
- CVE-2018-16285The UserPro plugin through 4.9.23 for WordPress allows XSS via the shortcode parameter in a userpro_shortcode_template action to wp-admin/ad
- CVE-2018-16310Technicolor TG588V V2 devices allow remote attackers to cause a denial of service (networking outage) via a flood of random MAC addresses, a
- CVE-2018-16517asm/labels.c in Netwide Assembler (NASM) is prone to NULL Pointer Dereference, which allows the attacker to cause a denial of service via a
- CVE-2018-16590FURUNO FELCOM 250 and 500 devices use only client-side JavaScript in login.js for authentication.
- CVE-2018-16646In Poppler 0.68.0, the Parser::getObj() function in Parser.cc may cause infinite recursion via a crafted file.
- CVE-2018-16647In Artifex MuPDF 1.13.0, the pdf_get_xref_entry function in pdf/pdf-xref.c allows remote attackers to cause a denial of service (segmentatio
- CVE-2018-16648In Artifex MuPDF 1.13.0, the fz_append_byte function in fitz/buffer.c allows remote attackers to cause a denial of service (segmentation fau
- CVE-2018-6320A vulnerability has been discovered in login.cgi in Pulse Secure Pulse Connect Secure (PCS) 8.1RX before 8.1R12 and 8.3RX before 8.3R2 and P
- CVE-2018-16640ImageMagick 7.0.8-5 has a memory leak vulnerability in the function ReadOneJNGImage in coders/png.c.
- CVE-2018-16641ImageMagick 7.0.8-6 has a memory leak vulnerability in the TIFFWritePhotoshopLayers function in coders/tiff.c.
- CVE-2018-16642The function InsertRow in coders/cut.c in ImageMagick 7.0.7-37 allows remote attackers to cause a denial of service via a crafted image file
- CVE-2018-16643The functions ReadDCMImage in coders/dcm.c, ReadPWPImage in coders/pwp.c, ReadCALSImage in coders/cals.c, and ReadPICTImage in coders/pict.c
- CVE-2018-16644There is a missing check for length in the functions ReadDCMImage of coders/dcm.c and ReadPICTImage of coders/pict.c in ImageMagick 7.0.8-11
- CVE-2018-16645There is an excessive memory allocation issue in the functions ReadBMPImage of coders/bmp.c and ReadDIBImage of coders/dib.c in ImageMagick
- CVE-2018-5389CVE-2018-5389Strongswan
- CVE-2018-5391The Linux kernel, versions 3.9+, IP implementation is vulnerable to denial of service conditions with low rates of specially modified packetsLinux Kernel
- CVE-2017-14026In Ice Qube Thermal Management Center versions prior to version 4.13, the web application does not properly authenticate users which may allIce Qube Thermal Management Center
- CVE-2017-16714In Ice Qube Thermal Management Center versions prior to version 4.13, passwords are stored in plaintext in a file that is accessible withoutIce Qube Thermal Management Center
- CVE-2018-1000669KOHA Library System version 16.11.x (up until 16.11.13) and 17.05.x (up until 17.05.05) contains a Cross Site Request Forgery (CSRF) vulnera
- CVE-2018-1000670KOHA Library System version 16.11.x (up until 16.11.13) and 17.05.x (up until 17.05.05) contains a Cross Site Scripting (XSS) vulnerability
- CVE-2018-16622Multiple cross-site scripting (XSS) vulnerabilities in /api/content/addOne in DoraCMS v2.0.3 allow remote attackers to inject arbitrary web
- CVE-2018-5005Adobe Experience Manager versions 6.4, 6.3, 6.2, 6.1, and 6.0 have a Cross-site Scripting vulnerability.Adobe Experience Manager
- CVE-2018-1000671sympa version 6.2.16 and later contains a CWE-601: URL Redirection to Untrusted Site ('Open Redirect') vulnerability in The "referer" parame
- CVE-2018-1000801okular version 18.08 and earlier contains a Directory Traversal vulnerability in function "unpackDocumentArchive(...)" in "core/document.cpp
- CVE-2018-1000658LimeSurvey version prior to 3.14.4 contains a file upload vulnerability in upload functionality that can result in an attacker gaining code
- CVE-2018-1000659LimeSurvey version 3.14.4 and earlier contains a directory traversal in file upload that allows upload of webshell vulnerability in file upl
- CVE-2018-1000660TOCK version prior to commit 42f7f36e74088036068d62253e1d8fb26605feed.
- CVE-2018-1000661jsish version 2.4.67 contains a CWE-476: NULL Pointer Dereference vulnerability in Jsi_LogMsg (jsiUtils.c:196) that can result in Crash due
- CVE-2018-1000663jsish version 2.4.70 2.047 contains a Buffer Overflow vulnerability in function _jsi_evalcode from jsiEval.c that can result in Crash due to
- CVE-2018-1000664daneren2005 DSub for Subsonic (Android client) version 5.4.1 contains a CWE-295: Improper Certificate Validation vulnerability in HTTPS Clie
- CVE-2018-1000665Dojo Dojo Objective Harness (DOH) version prior to version 1.14 contains a Cross Site Scripting (XSS) vulnerability in unit.html and testsDOorg.dojotoolkit:dojo
- CVE-2018-1000666GIG Technology NV JumpScale Portal 7 version before commit 15443122ed2b1cbfd7bdefc048bf106f075becdb contains a CWE-78: Improper Neutralizati
- CVE-2018-1000667NASM nasm-2.13.03 nasm- 2.14rc15 version 2.14rc15 and earlier contains a memory corruption (crashed) of nasm when handling a crafted file du
- CVE-2018-1000668jsish version 2.4.70 2.047 contains a CWE-125: Out-of-bounds Read vulnerability in function jsi_ObjArrayLookup (jsiObj.c:274) that can resul
- CVE-2018-1000800zephyr-rtos version 1.12.0 contains a NULL base pointer reference vulnerability in sys_ring_buf_put(), sys_ring_buf_get() that can result in
- CVE-2018-1000773WordPress version 4.9.8 and earlier contains a CWE-20 Input Validation vulnerability in thumbnail processing that can result in remote code
- CVE-2018-16604An issue was discovered in Nibbleblog v4.0.5.
- CVE-2018-16606In ProConf before 6.1, an Insecure Direct Object Reference (IDOR) allows any author to view and grab all submitted papers (Title and Abstrac
- CVE-2018-11263In all Android releases (Android for MSM, Firefox OS for MSM, QRD Android) from CAF using the Linux kernel, radio_id is received from the FWQualcomm Android for MSM, Firefox OS for MSM, QRD Android
- CVE-2018-16459An unescaped payload in exceljs <v1.6 allows a possible XSS via cell value when worksheet is displayed in browser.https://github.com/guyonroche exceljs · exceljs
- CVE-2018-16585An issue was discovered in Artifex Ghostscript before 9.24.
- CVE-2017-1000600WordPress version <4.9 contains a CWE-20 Input Validation vulnerability in thumbnail processing that can result in remote code execution.