CVEs published September 10, 2018
47 CVEs were published on September 10, 2018: 3 critical, 4 high.
- Published
- 47
- Critical
- 3
- High
- 4
- Medium
- 11
- Low
- 1
- Unrated
- 28
- Now in CISA KEV
- 0
- Fix available
- 4
Most affected products
- Samsung SmartThings Hub STH-ETH-250
- 3
- foreman
- 2
- The Openstack Project openstack-neutron · neutron
- 2
- [UNKNOWN] kernel
- 1
- Apache Software Foundation Apache ActiveMQ · org.apache.act…
- 1
- ClusterLabs pacemaker
- 1
- github.com/docker/docker
- 1
- IBM OpenPages GRC Platform
- 1
- Open-Xchange pdns
- 1
- ProcessMaker Enterprise
- 1
Critical 3
- CVE-2018-3875An exploitable buffer overflow vulnerability exists in the credentials handler of video-core's HTTP server of Samsung SmartThings Hub STH-ETSamsung SmartThings Hub STH-ETH-250
- CVE-2018-3896An exploitable buffer overflow vulnerabilities exist in the /cameras/XXXX/clips handler of video-core's HTTP server of Samsung SmartThings HSamsung SmartThings Hub STH-ETH-250
- CVE-2018-3897An exploitable buffer overflow vulnerabilities exist in the /cameras/XXXX/clips handler of video-core's HTTP server of Samsung SmartThings HSamsung SmartThings Hub STH-ETH-250
High 4
- CVE-2016-7035An authorization flaw was found in Pacemaker before 1.1.16, where it did not properly guard its IPC interface.ClusterLabs pacemaker
- CVE-2016-9048Multiple exploitable SQL Injection vulnerabilities exists in ProcessMaker Enterprise Core 3.0.1.7-community.ProcessMaker Enterprise
- CVE-2016-7071It was found that the CloudForms before 5.6.2.2, and 5.7.0.7 did not properly apply permissions controls to VM IDs passed by users.Red Hat CFME
- CVE-2016-7075It was found that Kubernetes as used by Openshift Enterprise 3 did not correctly validate X.509 client intermediate certificate host name fiRed Hat OpenShift
Medium, low and unrated 40
- CVE-2018-16805In b3log Solo 2.9.3, XSS in the Input page under the Publish Articles menu, with an ID of linkAddress stored in the link JSON field, allows
- CVE-2018-16806A Pektron Passive Keyless Entry and Start (PKES) system, as used on the Tesla Model S and possibly other vehicles, relies on the DST40 ciphe
- CVE-2018-11775TLS hostname verification when using the Apache ActiveMQ Client before 5.15.6 was missing which could make the client vulnerable to a MITM aApache Software Foundation Apache ActiveMQ · org.apache.act…
- CVE-2018-14620The OpenStack RabbitMQ container image insecurely retrieves the rabbitmq_clusterer component over HTTP during the build stage.Red Hat openstack-rabbitmq-container
- CVE-2018-14635When using the Linux bridge ml2 driver, non-privileged tenants are able to create and attach ports without specifying an IP address, bypassiThe Openstack Project openstack-neutron · neutron
- CVE-2018-14636Live-migrated instances are briefly able to inspect traffic for other instances on the same hypervisor.The Openstack Project openstack-neutron · neutron
- CVE-2016-7072An issue has been found in PowerDNS Authoritative Server before 3.4.11 and 4.0.2 allowing a remote, unauthenticated attacker to cause a deniOpen-Xchange pdns
- CVE-2018-12608An issue was discovered in Docker Moby before 17.06.0.github.com/docker/docker
- CVE-2018-16591FURUNO FELCOM 250 and 500 devices allow unauthenticated users to change the password for the Admin, Log and Service accounts, as well as the
- CVE-2018-16705FURUNO FELCOM 250 and 500 devices allow unauthenticated access to the xml/permission.xml file containing all of the system's usernames and p
- CVE-2016-7041Drools Workbench contains a path traversal vulnerability.Red Hat Drools Workbench
- CVE-2016-7056A timing attack flaw was found in OpenSSL 1.0.1u and before that could allow a malicious user with local access to recover ECDSA P-256 privaThe OpenSSL Project openssl
- CVE-2016-7061An information disclosure vulnerability was found in JBoss Enterprise Application Platform before 7.0.4.Red Hat EAP
- CVE-2018-16802An issue was discovered in Artifex Ghostscript before 9.25.
- CVE-2016-7077foreman before 1.14.0 is vulnerable to an information leak.foreman
- CVE-2016-7078foreman before version 1.15.0 is vulnerable to an information leak through organizations and locations feature.foreman
- CVE-2016-7067Monit before version 5.20.0 is vulnerable to a cross site request forgery attack.Tildeslash monit
- CVE-2017-1679IBM OpenPages GRC Platform 7.2, 7.3, 7.4, and 8.0 could allow an attacker to obtain sensitive information from error log files.IBM OpenPages GRC Platform
- CVE-2018-14625A flaw was found in the Linux Kernel where an attacker may be able to have an uncontrolled read to kernel-memory from within a vm guest.[UNKNOWN] kernel
- CVE-2018-15886Monstra CMS 3.0.4 does not properly restrict modified Snippet content, as demonstrated by the admin/index.php?id=snippets&action=edit_snippe
- CVE-2018-16608In Monstra CMS 3.0.4, an attacker with 'Editor' privileges can change the password of the administrator via an admin/index.php?id=users&acti
- CVE-2018-16797A heap-based buffer overflow in PotPlayerMini.exe in PotPlayer 1.7.8556 allows remote attackers to execute arbitrary code via a .wav file wi
- CVE-2018-16790_bson_iter_next_internal in bson-iter.c in libbson 1.12.0, as used in MongoDB mongo-c-driver and other products, has a heap-based buffer ove
- CVE-2018-16764In WAVM through 2018-07-26, a crafted file sent to the WebAssembly Virtual Machine may cause a denial of service (application crash) or poss
- CVE-2018-16765In WAVM through 2018-07-26, a crafted file sent to the WebAssembly Virtual Machine may cause a denial of service (application crash) or poss
- CVE-2018-16766In WAVM through 2018-07-26, a crafted file sent to the WebAssembly Virtual Machine may cause a denial of service (application crash) or poss
- CVE-2018-16767In WAVM through 2018-07-26, a crafted file sent to the WebAssembly Virtual Machine may cause a denial of service (application crash) or poss
- CVE-2018-16768In WAVM through 2018-07-26, a crafted file sent to the WebAssembly Virtual Machine may cause a denial of service (application crash) or poss
- CVE-2018-16769In WAVM through 2018-07-26, a crafted file sent to the WebAssembly Virtual Machine may cause a denial of service (application crash) or poss
- CVE-2018-16770In WAVM through 2018-07-26, a crafted file sent to the WebAssembly Virtual Machine may cause a denial of service (application crash) or poss
- CVE-2018-16771Hoosk v1.7.0 allows PHP code execution via a SiteUrl that is provided during installation and mishandled in config.php.
- CVE-2018-16772Hoosk v1.7.0 allows XSS via the Navigation Title of a new page entered at admin/pages/new.
- CVE-2018-16773EasyCMS 1.5 allows XSS via the index.php?s=/admin/fields/update/navTabId/listfields/callbackType/closeCurrent content field.
- CVE-2018-16774HongCMS 3.0.0 allows arbitrary file deletion via a ../ in the file parameter to admin/index.php/language/ajax?action=delete.
- CVE-2018-16775An issue was discovered in Victor CMS through 2018-05-10.
- CVE-2018-16776wityCMS 0.6.2 has XSS via the "Site Name" field found in the "Contact" "Configuration" page.
- CVE-2018-16779BlogCMS through 2016-10-25 has XSS via a comment.
- CVE-2018-16780Complete Responsive CMS Blog through 2018-05-20 has XSS via a comment.
- CVE-2018-16781ffjpeg.dll in ffjpeg before 2018-08-22 allows remote attackers to cause a denial of service (FPE signal) via a progressive JPEG file that la
- CVE-2018-16782libimageworsener.a in ImageWorsener 1.3.2 has a buffer overflow in the bmpr_read_rle_internal function in imagew-bmp.c.