CVEs published September 7, 2018
65 CVEs were published on September 7, 2018: 1 critical, 7 high.
- Published
- 65
- Critical
- 1
- High
- 7
- Medium
- 4
- Low
- 0
- Unrated
- 53
- Now in CISA KEV
- 0
- Fix available
- 2
Most affected products
- WESEEK GROWI
- 4
- I-O DATA DEVICE Multiple I-O DATA network camera products
- 3
- Antenna House DMC HTMLFilter
- 2
- GMO Payment Gateway EC-CUBE Payment Module and GMO-PG Payme…
- 2
- HiBARA Software AttacheCase
- 2
- IBM Campaign
- 2
- IBM Security Identity Governance and Intelligence
- 2
- ORCA Management Organization Co. Ubuntu14.04 ORCA(Online Re…
- 2
- Yayoi Co. Multiple Yayoi 17 Series products
- 2
- ASUS Japan WL-330NUL
- 1
Critical 1
High 7
- CVE-2016-9044An exploitable command execution vulnerability exists in Information Builders WebFOCUS Business Intelligence Portal 8.1 .Information Builders WebFOCUS
- CVE-2017-2792An exploitable heap corruption vulnerability exists in the iBldDirInfo functionality of Antenna House DMC HTMLFilter used by MarkLogic 8.0-6Antenna House DMC HTMLFilter
- CVE-2017-2795An exploitable heap corruption vulnerability exists in the Txo functionality of Antenna House DMC HTMLFilter as used by MarkLogic 8.0-6.Antenna House DMC HTMLFilter
- CVE-2018-1756IBM Security Identity Governance and Intelligence 5.2.3.2 and 5.2.4 is vulnerable to SQL injection.IBM Security Identity Governance and Intelligence
- CVE-2018-1789IBM API Connect v2018.1.0 through v2018.3.4 could allow an attacker to send a specially crafted request to conduct a server side request forIBM API Connect
- CVE-2018-3952An exploitable code execution vulnerability exists in the connect functionality of NordVPN 6.14.28.0.Talos NordVPN
- CVE-2018-4010An exploitable code execution vulnerability exists in the connect functionality of ProtonVPN VPN client 1.5.1.Talos ProtonVPN
Medium, low and unrated 57
- CVE-2017-17691Homeputer CL Studio fur HomeMatic 4.0 Rel 160808 and earlier uses cleartext to exchange the username and password between server and client
- CVE-2018-12897SolarWinds DameWare Mini Remote Control before 12.1 has a Buffer Overflow.
- CVE-2018-14396An issue was discovered in Creme CRM 1.6.12.
- CVE-2018-14397An issue was discovered in Creme CRM 1.6.12.
- CVE-2018-14398An issue was discovered in Creme CRM 1.6.12.
- CVE-2018-15474CSV Injection (aka Excel Macro Injection or Formula Injection) in /lib/plugins/usermanager/admin.php in DokuWiki 2018-04-22a and earlier all
- CVE-2018-15483An issue was discovered on KONE Group Controller (KGC) devices before 4.6.5.
- CVE-2018-15484An issue was discovered on KONE Group Controller (KGC) devices before 4.6.5.
- CVE-2018-15485An issue was discovered on KONE Group Controller (KGC) devices before 4.6.5.
- CVE-2018-15486An issue was discovered on KONE Group Controller (KGC) devices before 4.6.5.
- CVE-2018-15552The "PayWinner" function of a simplelottery smart contract implementation for The Ethereum Lottery, an Ethereum gambling game, generates a r
- CVE-2018-16059Endress+Hauser WirelessHART Fieldgate SWG70 3.x devices allow Directory Traversal via the fcgi-bin/wgsetcgi filename parameter.
- CVE-2018-16363The mndpsingh287 File Manager plugin V2.9 for WordPress has XSS via the lang parameter in a wp-admin/admin.php?page=wp_file_manager request
- CVE-2018-16454PHP Scripts Mall Currency Converter Script 2.0.5 allows remote attackers to cause a denial of service (web-interface change) via an inverted
- CVE-2018-9283An XSS issue was discovered in CremeCRM 1.6.12.
- CVE-2018-16460A command Injection in ps package versions <1.0.0 for Node.js allowed arbitrary commands to be executed when attacker controls the PID.https://github.com/UmbraEngineering ps · ps
- CVE-2018-16709Fuji Xerox DocuCentre-V 3065, ApeosPort-VI C3371, ApeosPort-V C4475, ApeosPort-V C3375, DocuCentre-VI C2271, ApeosPort-V C5576, DocuCentre-I
- CVE-2018-16710OctoPrint through 1.3.9 allows remote attackers to obtain sensitive information or cause a denial of service via HTTP requests on port 8081.
- CVE-2018-16663An issue was discovered in Contiki-NG through 4.1.
- CVE-2018-16664An issue was discovered in Contiki-NG through 4.1.
- CVE-2018-16665An issue was discovered in Contiki-NG through 4.1.
- CVE-2018-16666An issue was discovered in Contiki-NG through 4.1.
- CVE-2018-16667An issue was discovered in Contiki-NG through 4.1.
- CVE-2018-16703A vulnerability in the Gleez CMS 1.2.0 login page could allow an unauthenticated, remote attacker to perform multiple user enumerations, whi
- CVE-2018-16704An issue was discovered in Gleez CMS v1.2.0.gleez/cms
- CVE-2017-1114IBM Campaign 9.1, 9.1.2, and 10 is vulnerable to cross-site scripting.IBM Campaign
- CVE-2017-1115IBM Campaign 9.1, 9.1.2, and 10 is vulnerable to HTML injection.IBM Campaign
- CVE-2018-1757IBM Security Identity Governance and Intelligence 5.2.3.2 and 5.2.4 could allow an attacker to obtain sensitive information due to missing aIBM Security Identity Governance and Intelligence
- CVE-2018-0623Untrusted search path vulnerability in Multiple Yayoi 17 Series products (Yayoi Kaikei 17 Series Ver.23.1.1 and earlier, Yayoi Aoiro ShinkokYayoi Co. Multiple Yayoi 17 Series products
- CVE-2018-0624Untrusted search path vulnerability in Multiple Yayoi 17 Series products (Yayoi Kaikei 17 Series Ver.23.1.1 and earlier, Yayoi Aoiro ShinkokYayoi Co. Multiple Yayoi 17 Series products
- CVE-2018-0642Cross-site scripting vulnerability in FV Flowplayer Video Player 6.1.2 to 6.6.4 allows remote attackers to inject arbitrary web script or HTFoliovision FV Flowplayer Video Player
- CVE-2018-0643Ubuntu14.04 ORCA (Online Receipt Computer Advantage) 4.8.0 (panda-server) 1:1.4.9+p41-u4jma1 and earlier allows attacker with administrator ORCA Management Organization Co. Ubuntu14.04 ORCA(Online Re…
- CVE-2018-0644Buffer overflow in Ubuntu14.04 ORCA (Online Receipt Computer Advantage) 4.8.0 (panda-client2) 1:1.4.9+p41-u4jma1 and earlier, Ubuntu14.04 ORORCA Management Organization Co. Ubuntu14.04 ORCA(Online Re…
- CVE-2018-0645MTAppjQuery 1.8.1 and earlier allows remote PHP code execution via unspecified vectors.bit part MTAppjQuery
- CVE-2018-0647Cross-site request forgery (CSRF) vulnerability in WL-330NUL Firmware version prior to 3.0.0.46 allows remote attackers to hijack the authenASUS Japan WL-330NUL
- CVE-2018-0648Untrusted search path vulnerability in installer of ChatWork Desktop App for Windows 2.3.0 and earlier allows an attacker to gain privilegesChatWork Co,. Installer of ChatWork Desktop App for Windows
- CVE-2018-0649Untrusted search path vulnerability in the installers of multiple Canon IT Solutions Inc.The installers of multiple Canon IT Solutions Inc. software…
- CVE-2018-0650The LINE MUSIC for Android version 3.1.0 to versions prior to 3.6.5 does not verify X.509 certificates from SSL servers, which allows man-inLINE MUSIC for Android
- CVE-2018-0652Cross-site scripting vulnerability in GROWI v.3.1.11 and earlier allows remote authenticated attackers to inject arbitrary web script or HTMWESEEK GROWI
- CVE-2018-0653Cross-site scripting vulnerability in GROWI v.3.1.11 and earlier allows remote attackers to inject arbitrary web script or HTML via Wiki pagWESEEK GROWI
- CVE-2018-0654Cross-site scripting vulnerability in GROWI v.3.1.11 and earlier allows remote attackers to inject arbitrary web script or HTML via the modaWESEEK GROWI
- CVE-2018-0655Cross-site scripting vulnerability in GROWI v.3.1.11 and earlier allows remote authenticated attackers to inject arbitrary web script or HTMWESEEK GROWI
- CVE-2018-0657Cross-site scripting vulnerability in EC-CUBE Payment Module and GMO-PG Payment Module (PG Multi-Payment Service) for EC-CUBE (EC-CUBE PaymeGMO Payment Gateway EC-CUBE Payment Module and GMO-PG Payme…
- CVE-2018-0658Input validation issue in EC-CUBE Payment Module (2.12) version 3.5.23 and earlier, EC-CUBE Payment Module (2.11) version 2.3.17 and earlierGMO Payment Gateway EC-CUBE Payment Module and GMO-PG Payme…
- CVE-2018-0659Directory traversal vulnerability in ver.2.8.4.0 and earlier and ver.3.3.0.0 and earlier allows an attacker to create or overwrite existing HiBARA Software AttacheCase
- CVE-2018-0660Directory traversal vulnerability in ver.2.8.4.0 and earlier and ver.3.3.0.0 and earlier allows an attacker to create arbitrary files via spHiBARA Software AttacheCase
- CVE-2018-0661Multiple I-O DATA network camera products (TS-WRLP firmware Ver.1.09.04 and earlier, TS-WRLA firmware Ver.1.09.04 and earlier, TS-WRLP/E firI-O DATA DEVICE Multiple I-O DATA network camera products
- CVE-2018-0662Multiple I-O DATA network camera products (TS-WRLP firmware Ver.1.09.04 and earlier, TS-WRLA firmware Ver.1.09.04 and earlier, TS-WRLP/E firI-O DATA DEVICE Multiple I-O DATA network camera products
- CVE-2018-0663Multiple I-O DATA network camera products (TS-WRLP firmware Ver.1.09.04 and earlier, TS-WRLA firmware Ver.1.09.04 and earlier, TS-WRLP/E firI-O DATA DEVICE Multiple I-O DATA network camera products
- CVE-2018-16657In Kamailio before 5.0.7 and 5.1.x before 5.1.4, a crafted SIP message with an invalid Via header causes a segmentation fault and crashes Ka
- CVE-2018-16658An issue was discovered in the Linux kernel before 4.18.6.
- CVE-2016-9040An exploitable denial of service exists in the the Joyent SmartOS OS 20161110T013148Z Hyprlofs file system.Joyent SmartOS
- CVE-2018-16650phpMyFAQ before 2.9.11 allows CSRF.thorsten/phpmyfaq
- CVE-2018-16651The admin backend in phpMyFAQ before 2.9.11 allows CSV injection in reports.
- CVE-2018-16653rejucms 2.1 has XSS via the ucenter/cms_user_add.php u_name parameter.
- CVE-2018-16654Zurmo 3.2.4 Stable allows XSS via app/index.php/accounts/default/details?id=2&kanbanBoard=1&openToTaskId=1.
- CVE-2018-16655Gxlcms 1.0 has XSS via the PATH_INFO to gx/lib/ThinkPHP/Tpl/ThinkException.tpl.php.