CVEs published September 11, 2018
39 CVEs were published on September 11, 2018: 0 critical, 4 high.
- Published
- 39
- Critical
- 0
- High
- 4
- Medium
- 13
- Low
- 1
- Unrated
- 21
- Now in CISA KEV
- 0
- Fix available
- 7
Most affected products
- Open-Xchange pdns
- 3
- Dell EMC RSA BSAFE SSL-J
- 2
- SAP Enterprise Financial Services
- 2
- Dell EMC RSA BSAFE Crypto-J · Dell EMC RSA BSAFE SSL-J
- 1
- DELL EMC VPlex Software: GeoSynchrony
- 1
- IBM QRadar SIEM
- 1
- Linux kernel
- 1
- Open-Xchange dnsdist
- 1
- Pivotal Cloud Foundry Elastic Runtime
- 1
- Red Hat 389-ds-base
- 1
High 4
- CVE-2018-10893Multiple integer overflow and buffer overflow issues were discovered in spice-client's handling of LZ compressed frames.Red Hat spice-client
- CVE-2018-10853A flaw was found in the way Linux kernel KVM hypervisor before 4.18 emulated instructions such as sgdt/sidt/fxsave/fxrstor.Linux kernel
- CVE-2016-7070A privilege escalation flaw was found in the Ansible Tower.Red Hat Ansible Tower
- CVE-2018-1571IBM QRadar 7.2 and 7.3 could allow a remote authenticated attacker to execute arbitrary commands on the system.IBM QRadar SIEM
Medium, low and unrated 35
- CVE-2018-15898The Subsonic Music Streamer application 4.4 for Android has Improper Certificate Validation of the Subsonic server certificate, which might
- CVE-2018-11068RSA BSAFE SSL-J versions prior to 6.2.4 contain a Heap Inspection vulnerability that could allow an attacker with physical access to the sysDell EMC RSA BSAFE SSL-J
- CVE-2018-11069RSA BSAFE SSL-J versions prior to 6.2.4 contain a Covert Timing Channel vulnerability during RSA decryption, also known as a Bleichenbacher Dell EMC RSA BSAFE SSL-J
- CVE-2018-11070RSA BSAFE Crypto-J versions prior to 6.2.4 and RSA BSAFE SSL-J versions prior to 6.2.4 contain a Covert Timing Channel vulnerability during Dell EMC RSA BSAFE Crypto-J · Dell EMC RSA BSAFE SSL-J
- CVE-2018-11078Dell EMC VPlex GeoSynchrony, versions prior to 6.1, contains an Insecure File Permissions vulnerability.DELL EMC VPlex Software: GeoSynchrony
- CVE-2016-0715Pivotal Cloud Foundry Elastic Runtime version 1.4.0 through 1.4.5, 1.5.0 through 1.5.11 and 1.6.0 through 1.6.11 is vulnerable to a remote iPivotal Cloud Foundry Elastic Runtime
- CVE-2018-10937A cross site scripting flaw exists in the tetonic-console component of Openshift Container Platform 3.11.Red Hat Openshift Container Platform
- CVE-2018-16836Rubedo through 3.4.0 contains a Directory Traversal vulnerability in the theme component, allowing unauthenticated attackers to read and exe
- CVE-2018-10935A flaw was found in the 389 Directory Server that allows users to cause a crash in the LDAP server using ldapsearch with server side sort.Red Hat 389-ds-base
- CVE-2018-1114It was found that URLResource.getLastModified() in Undertow closes the file descriptors only when they are finalized which can cause file deRed Hat undertow · io.undertow:undertow-core
- CVE-2018-1127Tendrl API in Red Hat Gluster Storage before 3.4.0 does not immediately remove session tokens after a user logs out.Red Hat Gluster Storage
- CVE-2018-2452The logon application of SAP NetWeaver AS Java 7.10 to 7.11, 7.20, 7.30, 7.31, 7.40, 7.50 does not sufficiently encode user-controlled inputSAP NetWeaver AS Java
- CVE-2018-2454SAP Enterprise Financial Services, versions 6.05, 6.06, 6.16, 6.17, 6.18, 8.0 (in business function EAFS_BCA_BUSOPR_2) does not perform neceSAP Enterprise Financial Services
- CVE-2018-2455SAP Enterprise Financial Services, versions 6.05, 6.06, 6.16, 6.17, 6.18, 8.0 (in business function EAFS_BCA_BUSOPR_SEPA) does not perform nSAP Enterprise Financial Services
- CVE-2018-2457Under certain conditions SAP Adaptive Server Enterprise, version 16.0, allows some privileged users to access information which would otherwSAP Adaptive Server Enterprise
- CVE-2018-2458Under certain conditions, Crystal Report using SAP Business One, versions 9.2 and 9.3, connection type allows an attacker to access informatSAP Business One
- CVE-2018-2459Users of an SAP Mobile Platform (version 3.0) Offline OData application, which uses Offline OData-supplied delta tokens (which is on by defaSAP Mobile Platform
- CVE-2018-2460SAP Business One Android application, version 1.2, does not verify the certificate properly for HTTPS connection.SAP Business One Android application
- CVE-2018-2461Missing authorization check in SAP HCM Fiori "People Profile" (GBX01 HR version 6.0) for an authenticated user which may result in an escalaSAP GBX01 HR
- CVE-2018-2462In certain cases, BEx Web Java Runtime Export Web Service in SAP NetWeaver BI 7.30, 7.31.SAP NetWeaver BI
- CVE-2018-2463The Omni Commerce Connect API (OCC) of SAP Hybris Commerce, versions 6.*, is vulnerable to server-side request forgery (SSRF) attacks.SAP Hybris Commerce
- CVE-2018-2464SAP WebDynpro Java, versions 7.20, 7.30, 7.31, 7.40, 7.50, does not sufficiently encode user-controlled inputs, resulting in a stored Cross-SAP WebDynpro
- CVE-2018-2465SAP HANA (versions 1.0 and 2.0) Extended Application Services classic model OData parser does not sufficiently validate XML.SAP HANA
- CVE-2018-6975The AirWatch Agent for iOS prior to 5.8.1 contains a data protection vulnerability whereby the files and keychain entries in the Agent are nVMware AirWatch Agent for iOS prior to
- CVE-2018-6976The VMware Content Locker for iOS prior to 4.14 contains a data protection vulnerability in the SQLite database.VMware Content Locker for iOS
- CVE-2016-7066It was found that the improper default permissions on /tmp/auth directory in JBoss Enterprise Application Platform before 7.1.0 can allow anRed Hat JBoss Enterprise Application Platform
- CVE-2016-0750The hotrod java client in infinispan before 9.1.0.Final automatically deserializes bytearray message contents in certain events.Red Hat Infinispan · org.infinispan:infinispan-core
- CVE-2016-7047A flaw was found in the CloudForms API before 5.6.3.0, 5.7.3.1 and 5.8.1.2.Red Hat cfme
- CVE-2016-7068An issue has been found in PowerDNS before 3.4.11 and 4.0.2, and PowerDNS recursor before 3.7.4 and 4.0.4, allowing a remote, unauthenticateOpen-Xchange pdns
- CVE-2016-7069An issue has been found in dnsdist before 1.2.0 in the way EDNS0 OPT records are handled when parsing responses from a backend.Open-Xchange dnsdist
- CVE-2016-7073An issue has been found in PowerDNS before 3.4.11 and 4.0.2, and PowerDNS recursor before 4.0.4, allowing an attacker in position of man-in-Open-Xchange pdns
- CVE-2016-7074An issue has been found in PowerDNS before 3.4.11 and 4.0.2, and PowerDNS recursor before 4.0.4, allowing an attacker in position of man-in-Open-Xchange pdns
- CVE-2018-16831Smarty before 3.1.33-dev-4 allows attackers to bypass the trusted_dir protection mechanism via a file:./../ substring in an include statemensmarty/smarty
- CVE-2018-16832CSRF in the anti-csrf decorator in xunfeng 0.2.0 allows an attacker to modify the configuration via a Flash file because views/lib/AntiCSRF.
- CVE-2018-16807In Bro through 2.5.5, there is a memory leak potentially leading to DoS in scripts/base/protocols/krb/main.bro in the Kerberos protocol pars