# CVEs published 2018-09-07

65 CVEs were published on September 7, 2018: 1 critical, 7 high. Days are UTC.

- [CVE-2017-17691](https://cve.now/CVE-2017-17691.md): Homeputer CL Studio fur HomeMatic 4.0 Rel 160808 and earlier uses cleartext to exchange the username and password between server and client (no CVSS)
- [CVE-2018-12897](https://cve.now/CVE-2018-12897.md): SolarWinds DameWare Mini Remote Control before 12.1 has a Buffer Overflow. (no CVSS)
- [CVE-2018-14396](https://cve.now/CVE-2018-14396.md): An issue was discovered in Creme CRM 1.6.12. (no CVSS)
- [CVE-2018-14397](https://cve.now/CVE-2018-14397.md): An issue was discovered in Creme CRM 1.6.12. (no CVSS)
- [CVE-2018-14398](https://cve.now/CVE-2018-14398.md): An issue was discovered in Creme CRM 1.6.12. (no CVSS)
- [CVE-2018-15474](https://cve.now/CVE-2018-15474.md): CSV Injection (aka Excel Macro Injection or Formula Injection) in /lib/plugins/usermanager/admin.php in DokuWiki 2018-04-22a and earlier all (no CVSS)
- [CVE-2018-15483](https://cve.now/CVE-2018-15483.md): An issue was discovered on KONE Group Controller (KGC) devices before 4.6.5. (no CVSS)
- [CVE-2018-15484](https://cve.now/CVE-2018-15484.md): An issue was discovered on KONE Group Controller (KGC) devices before 4.6.5. (no CVSS)
- [CVE-2018-15485](https://cve.now/CVE-2018-15485.md): An issue was discovered on KONE Group Controller (KGC) devices before 4.6.5. (no CVSS)
- [CVE-2018-15486](https://cve.now/CVE-2018-15486.md): An issue was discovered on KONE Group Controller (KGC) devices before 4.6.5. (no CVSS)
- [CVE-2018-15552](https://cve.now/CVE-2018-15552.md): The "PayWinner" function of a simplelottery smart contract implementation for The Ethereum Lottery, an Ethereum gambling game, generates a r (no CVSS)
- [CVE-2018-16059](https://cve.now/CVE-2018-16059.md): Endress+Hauser WirelessHART Fieldgate SWG70 3.x devices allow Directory Traversal via the fcgi-bin/wgsetcgi filename parameter. (no CVSS)
- [CVE-2018-16363](https://cve.now/CVE-2018-16363.md): The mndpsingh287 File Manager plugin V2.9 for WordPress has XSS via the lang parameter in a wp-admin/admin.php?page=wp\_file\_manager request (no CVSS)
- [CVE-2018-16454](https://cve.now/CVE-2018-16454.md): PHP Scripts Mall Currency Converter Script 2.0.5 allows remote attackers to cause a denial of service (web-interface change) via an inverted (no CVSS)
- [CVE-2018-9283](https://cve.now/CVE-2018-9283.md): An XSS issue was discovered in CremeCRM 1.6.12. (no CVSS)
- [CVE-2018-16460](https://cve.now/CVE-2018-16460.md): A command Injection in ps package versions \<1.0.0 for Node.js allowed arbitrary commands to be executed when attacker controls the PID. (no CVSS, https://github.com/UmbraEngineering ps · ps)
- [CVE-2018-16709](https://cve.now/CVE-2018-16709.md): Fuji Xerox DocuCentre-V 3065, ApeosPort-VI C3371, ApeosPort-V C4475, ApeosPort-V C3375, DocuCentre-VI C2271, ApeosPort-V C5576, DocuCentre-I (no CVSS)
- [CVE-2018-16710](https://cve.now/CVE-2018-16710.md): OctoPrint through 1.3.9 allows remote attackers to obtain sensitive information or cause a denial of service via HTTP requests on port 8081. (no CVSS)
- [CVE-2016-9044](https://cve.now/CVE-2016-9044.md): An exploitable command execution vulnerability exists in Information Builders WebFOCUS Business Intelligence Portal 8.1 . (CVSS 8.8, Information Builders WebFOCUS)
- [CVE-2018-16663](https://cve.now/CVE-2018-16663.md): An issue was discovered in Contiki-NG through 4.1. (no CVSS)
- [CVE-2018-16664](https://cve.now/CVE-2018-16664.md): An issue was discovered in Contiki-NG through 4.1. (no CVSS)
- [CVE-2018-16665](https://cve.now/CVE-2018-16665.md): An issue was discovered in Contiki-NG through 4.1. (no CVSS)
- [CVE-2018-16666](https://cve.now/CVE-2018-16666.md): An issue was discovered in Contiki-NG through 4.1. (no CVSS)
- [CVE-2018-16667](https://cve.now/CVE-2018-16667.md): An issue was discovered in Contiki-NG through 4.1. (no CVSS)
- [CVE-2018-16703](https://cve.now/CVE-2018-16703.md): A vulnerability in the Gleez CMS 1.2.0 login page could allow an unauthenticated, remote attacker to perform multiple user enumerations, whi (no CVSS)
- [CVE-2018-16704](https://cve.now/CVE-2018-16704.md): An issue was discovered in Gleez CMS v1.2.0. (no CVSS, gleez/cms)
- [CVE-2017-1114](https://cve.now/CVE-2017-1114.md): IBM Campaign 9.1, 9.1.2, and 10 is vulnerable to cross-site scripting. (CVSS 5.4, IBM Campaign)
- [CVE-2017-1115](https://cve.now/CVE-2017-1115.md): IBM Campaign 9.1, 9.1.2, and 10 is vulnerable to HTML injection. (CVSS 5.4, IBM Campaign)
- [CVE-2017-2792](https://cve.now/CVE-2017-2792.md): An exploitable heap corruption vulnerability exists in the iBldDirInfo functionality of Antenna House DMC HTMLFilter used by MarkLogic 8.0-6 (CVSS 8.3, Antenna House DMC HTMLFilter)
- [CVE-2017-2795](https://cve.now/CVE-2017-2795.md): An exploitable heap corruption vulnerability exists in the Txo functionality of Antenna House DMC HTMLFilter as used by MarkLogic 8.0-6. (CVSS 8.3, Antenna House DMC HTMLFilter)
- [CVE-2018-1567](https://cve.now/CVE-2018-1567.md): IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 could allow remote attackers to execute arbitrary Java code through the SOAP connect (CVSS 9.8, IBM WebSphere Application Server)
- [CVE-2018-1756](https://cve.now/CVE-2018-1756.md): IBM Security Identity Governance and Intelligence 5.2.3.2 and 5.2.4 is vulnerable to SQL injection. (CVSS 7.5, IBM Security Identity Governance and Intelligence)
- [CVE-2018-1757](https://cve.now/CVE-2018-1757.md): IBM Security Identity Governance and Intelligence 5.2.3.2 and 5.2.4 could allow an attacker to obtain sensitive information due to missing a (CVSS 5.3, IBM Security Identity Governance and Intelligence)
- [CVE-2018-1789](https://cve.now/CVE-2018-1789.md): IBM API Connect v2018.1.0 through v2018.3.4 could allow an attacker to send a specially crafted request to conduct a server side request for (CVSS 8.4, IBM API Connect)
- [CVE-2018-3952](https://cve.now/CVE-2018-3952.md): An exploitable code execution vulnerability exists in the connect functionality of NordVPN 6.14.28.0. (CVSS 8.8, Talos NordVPN)
- [CVE-2018-4010](https://cve.now/CVE-2018-4010.md): An exploitable code execution vulnerability exists in the connect functionality of ProtonVPN VPN client 1.5.1. (CVSS 8.8, Talos ProtonVPN)
- [CVE-2018-0623](https://cve.now/CVE-2018-0623.md): Untrusted search path vulnerability in Multiple Yayoi 17 Series products (Yayoi Kaikei 17 Series Ver.23.1.1 and earlier, Yayoi Aoiro Shinkok (no CVSS, Yayoi Co. Multiple Yayoi 17 Series products)
- [CVE-2018-0624](https://cve.now/CVE-2018-0624.md): Untrusted search path vulnerability in Multiple Yayoi 17 Series products (Yayoi Kaikei 17 Series Ver.23.1.1 and earlier, Yayoi Aoiro Shinkok (no CVSS, Yayoi Co. Multiple Yayoi 17 Series products)
- [CVE-2018-0642](https://cve.now/CVE-2018-0642.md): Cross-site scripting vulnerability in FV Flowplayer Video Player 6.1.2 to 6.6.4 allows remote attackers to inject arbitrary web script or HT (no CVSS, Foliovision FV Flowplayer Video Player)
- [CVE-2018-0643](https://cve.now/CVE-2018-0643.md): Ubuntu14.04 ORCA (Online Receipt Computer Advantage) 4.8.0 (panda-server) 1:1.4.9+p41-u4jma1 and earlier allows attacker with administrator (no CVSS, ORCA Management Organization Co. Ubuntu14.04 ORCA(Online Re…)
- [CVE-2018-0644](https://cve.now/CVE-2018-0644.md): Buffer overflow in Ubuntu14.04 ORCA (Online Receipt Computer Advantage) 4.8.0 (panda-client2) 1:1.4.9+p41-u4jma1 and earlier, Ubuntu14.04 OR (no CVSS, ORCA Management Organization Co. Ubuntu14.04 ORCA(Online Re…)
- [CVE-2018-0645](https://cve.now/CVE-2018-0645.md): MTAppjQuery 1.8.1 and earlier allows remote PHP code execution via unspecified vectors. (no CVSS, bit part MTAppjQuery)
- [CVE-2018-0647](https://cve.now/CVE-2018-0647.md): Cross-site request forgery (CSRF) vulnerability in WL-330NUL Firmware version prior to 3.0.0.46 allows remote attackers to hijack the authen (no CVSS, ASUS Japan WL-330NUL)
- [CVE-2018-0648](https://cve.now/CVE-2018-0648.md): Untrusted search path vulnerability in installer of ChatWork Desktop App for Windows 2.3.0 and earlier allows an attacker to gain privileges (no CVSS, ChatWork Co,. Installer of ChatWork Desktop App for Windows)
- [CVE-2018-0649](https://cve.now/CVE-2018-0649.md): Untrusted search path vulnerability in the installers of multiple Canon IT Solutions Inc. (no CVSS, The installers of multiple Canon IT Solutions Inc. software…)
- [CVE-2018-0650](https://cve.now/CVE-2018-0650.md): The LINE MUSIC for Android version 3.1.0 to versions prior to 3.6.5 does not verify X.509 certificates from SSL servers, which allows man-in (no CVSS, LINE MUSIC for Android)
- [CVE-2018-0652](https://cve.now/CVE-2018-0652.md): Cross-site scripting vulnerability in GROWI v.3.1.11 and earlier allows remote authenticated attackers to inject arbitrary web script or HTM (no CVSS, WESEEK GROWI)
- [CVE-2018-0653](https://cve.now/CVE-2018-0653.md): Cross-site scripting vulnerability in GROWI v.3.1.11 and earlier allows remote attackers to inject arbitrary web script or HTML via Wiki pag (no CVSS, WESEEK GROWI)
- [CVE-2018-0654](https://cve.now/CVE-2018-0654.md): Cross-site scripting vulnerability in GROWI v.3.1.11 and earlier allows remote attackers to inject arbitrary web script or HTML via the moda (no CVSS, WESEEK GROWI)
- [CVE-2018-0655](https://cve.now/CVE-2018-0655.md): Cross-site scripting vulnerability in GROWI v.3.1.11 and earlier allows remote authenticated attackers to inject arbitrary web script or HTM (no CVSS, WESEEK GROWI)
- [CVE-2018-0657](https://cve.now/CVE-2018-0657.md): Cross-site scripting vulnerability in EC-CUBE Payment Module and GMO-PG Payment Module (PG Multi-Payment Service) for EC-CUBE (EC-CUBE Payme (no CVSS, GMO Payment Gateway EC-CUBE Payment Module and GMO-PG Payme…)
- [CVE-2018-0658](https://cve.now/CVE-2018-0658.md): Input validation issue in EC-CUBE Payment Module (2.12) version 3.5.23 and earlier, EC-CUBE Payment Module (2.11) version 2.3.17 and earlier (no CVSS, GMO Payment Gateway EC-CUBE Payment Module and GMO-PG Payme…)
- [CVE-2018-0659](https://cve.now/CVE-2018-0659.md): Directory traversal vulnerability in ver.2.8.4.0 and earlier and ver.3.3.0.0 and earlier allows an attacker to create or overwrite existing (no CVSS, HiBARA Software AttacheCase)
- [CVE-2018-0660](https://cve.now/CVE-2018-0660.md): Directory traversal vulnerability in ver.2.8.4.0 and earlier and ver.3.3.0.0 and earlier allows an attacker to create arbitrary files via sp (no CVSS, HiBARA Software AttacheCase)
- [CVE-2018-0661](https://cve.now/CVE-2018-0661.md): Multiple I-O DATA network camera products (TS-WRLP firmware Ver.1.09.04 and earlier, TS-WRLA firmware Ver.1.09.04 and earlier, TS-WRLP/E fir (no CVSS, I-O DATA DEVICE Multiple I-O DATA network camera products)
- [CVE-2018-0662](https://cve.now/CVE-2018-0662.md): Multiple I-O DATA network camera products (TS-WRLP firmware Ver.1.09.04 and earlier, TS-WRLA firmware Ver.1.09.04 and earlier, TS-WRLP/E fir (no CVSS, I-O DATA DEVICE Multiple I-O DATA network camera products)
- [CVE-2018-0663](https://cve.now/CVE-2018-0663.md): Multiple I-O DATA network camera products (TS-WRLP firmware Ver.1.09.04 and earlier, TS-WRLA firmware Ver.1.09.04 and earlier, TS-WRLP/E fir (no CVSS, I-O DATA DEVICE Multiple I-O DATA network camera products)
- [CVE-2018-16657](https://cve.now/CVE-2018-16657.md): In Kamailio before 5.0.7 and 5.1.x before 5.1.4, a crafted SIP message with an invalid Via header causes a segmentation fault and crashes Ka (no CVSS)
- [CVE-2018-16658](https://cve.now/CVE-2018-16658.md): An issue was discovered in the Linux kernel before 4.18.6. (no CVSS)
- [CVE-2016-9040](https://cve.now/CVE-2016-9040.md): An exploitable denial of service exists in the the Joyent SmartOS OS 20161110T013148Z Hyprlofs file system. (CVSS 6.2, Joyent SmartOS)
- [CVE-2018-16650](https://cve.now/CVE-2018-16650.md): phpMyFAQ before 2.9.11 allows CSRF. (no CVSS, thorsten/phpmyfaq)
- [CVE-2018-16651](https://cve.now/CVE-2018-16651.md): The admin backend in phpMyFAQ before 2.9.11 allows CSV injection in reports. (no CVSS)
- [CVE-2018-16653](https://cve.now/CVE-2018-16653.md): rejucms 2.1 has XSS via the ucenter/cms\_user\_add.php u\_name parameter. (no CVSS)
- [CVE-2018-16654](https://cve.now/CVE-2018-16654.md): Zurmo 3.2.4 Stable allows XSS via app/index.php/accounts/default/details?id=2&kanbanBoard=1&openToTaskId=1. (no CVSS)
- [CVE-2018-16655](https://cve.now/CVE-2018-16655.md): Gxlcms 1.0 has XSS via the PATH\_INFO to gx/lib/ThinkPHP/Tpl/ThinkException.tpl.php. (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2018-09-07
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.