# CVEs published 2018-09-11

39 CVEs were published on September 11, 2018: 0 critical, 4 high. Days are UTC.

- [CVE-2018-15898](https://cve.now/CVE-2018-15898.md): The Subsonic Music Streamer application 4.4 for Android has Improper Certificate Validation of the Subsonic server certificate, which might (no CVSS)
- [CVE-2018-11068](https://cve.now/CVE-2018-11068.md): RSA BSAFE SSL-J versions prior to 6.2.4 contain a Heap Inspection vulnerability that could allow an attacker with physical access to the sys (CVSS 3.9, Dell EMC RSA BSAFE SSL-J)
- [CVE-2018-11069](https://cve.now/CVE-2018-11069.md): RSA BSAFE SSL-J versions prior to 6.2.4 contain a Covert Timing Channel vulnerability during RSA decryption, also known as a Bleichenbacher (CVSS 5.9, Dell EMC RSA BSAFE SSL-J)
- [CVE-2018-11070](https://cve.now/CVE-2018-11070.md): RSA BSAFE Crypto-J versions prior to 6.2.4 and RSA BSAFE SSL-J versions prior to 6.2.4 contain a Covert Timing Channel vulnerability during (CVSS 5.9, Dell EMC RSA BSAFE Crypto-J · Dell EMC RSA BSAFE SSL-J)
- [CVE-2018-11078](https://cve.now/CVE-2018-11078.md): Dell EMC VPlex GeoSynchrony, versions prior to 6.1, contains an Insecure File Permissions vulnerability. (CVSS 4.0, DELL EMC VPlex Software: GeoSynchrony)
- [CVE-2016-0715](https://cve.now/CVE-2016-0715.md): Pivotal Cloud Foundry Elastic Runtime version 1.4.0 through 1.4.5, 1.5.0 through 1.5.11 and 1.6.0 through 1.6.11 is vulnerable to a remote i (no CVSS, Pivotal Cloud Foundry Elastic Runtime)
- [CVE-2018-10937](https://cve.now/CVE-2018-10937.md): A cross site scripting flaw exists in the tetonic-console component of Openshift Container Platform 3.11. (CVSS 4.6, Red Hat Openshift Container Platform)
- [CVE-2018-16836](https://cve.now/CVE-2018-16836.md): Rubedo through 3.4.0 contains a Directory Traversal vulnerability in the theme component, allowing unauthenticated attackers to read and exe (no CVSS)
- [CVE-2018-10893](https://cve.now/CVE-2018-10893.md): Multiple integer overflow and buffer overflow issues were discovered in spice-client's handling of LZ compressed frames. (CVSS 7.6, Red Hat spice-client)
- [CVE-2018-10935](https://cve.now/CVE-2018-10935.md): A flaw was found in the 389 Directory Server that allows users to cause a crash in the LDAP server using ldapsearch with server side sort. (CVSS 6.5, Red Hat 389-ds-base)
- [CVE-2018-1114](https://cve.now/CVE-2018-1114.md): It was found that URLResource.getLastModified() in Undertow closes the file descriptors only when they are finalized which can cause file de (CVSS 6.5, Red Hat undertow · io.undertow:undertow-core)
- [CVE-2018-1127](https://cve.now/CVE-2018-1127.md): Tendrl API in Red Hat Gluster Storage before 3.4.0 does not immediately remove session tokens after a user logs out. (CVSS 4.2, Red Hat Gluster Storage)
- [CVE-2018-2452](https://cve.now/CVE-2018-2452.md): The logon application of SAP NetWeaver AS Java 7.10 to 7.11, 7.20, 7.30, 7.31, 7.40, 7.50 does not sufficiently encode user-controlled input (no CVSS, SAP NetWeaver AS Java)
- [CVE-2018-2454](https://cve.now/CVE-2018-2454.md): SAP Enterprise Financial Services, versions 6.05, 6.06, 6.16, 6.17, 6.18, 8.0 (in business function EAFS\_BCA\_BUSOPR\_2) does not perform nece (no CVSS, SAP Enterprise Financial Services)
- [CVE-2018-2455](https://cve.now/CVE-2018-2455.md): SAP Enterprise Financial Services, versions 6.05, 6.06, 6.16, 6.17, 6.18, 8.0 (in business function EAFS\_BCA\_BUSOPR\_SEPA) does not perform n (no CVSS, SAP Enterprise Financial Services)
- [CVE-2018-2457](https://cve.now/CVE-2018-2457.md): Under certain conditions SAP Adaptive Server Enterprise, version 16.0, allows some privileged users to access information which would otherw (no CVSS, SAP Adaptive Server Enterprise)
- [CVE-2018-2458](https://cve.now/CVE-2018-2458.md): Under certain conditions, Crystal Report using SAP Business One, versions 9.2 and 9.3, connection type allows an attacker to access informat (no CVSS, SAP Business One)
- [CVE-2018-2459](https://cve.now/CVE-2018-2459.md): Users of an SAP Mobile Platform (version 3.0) Offline OData application, which uses Offline OData-supplied delta tokens (which is on by defa (no CVSS, SAP Mobile Platform)
- [CVE-2018-2460](https://cve.now/CVE-2018-2460.md): SAP Business One Android application, version 1.2, does not verify the certificate properly for HTTPS connection. (no CVSS, SAP Business One Android application)
- [CVE-2018-2461](https://cve.now/CVE-2018-2461.md): Missing authorization check in SAP HCM Fiori "People Profile" (GBX01 HR version 6.0) for an authenticated user which may result in an escala (no CVSS, SAP GBX01 HR)
- [CVE-2018-2462](https://cve.now/CVE-2018-2462.md): In certain cases, BEx Web Java Runtime Export Web Service in SAP NetWeaver BI 7.30, 7.31. (no CVSS, SAP NetWeaver BI)
- [CVE-2018-2463](https://cve.now/CVE-2018-2463.md): The Omni Commerce Connect API (OCC) of SAP Hybris Commerce, versions 6.\*, is vulnerable to server-side request forgery (SSRF) attacks. (no CVSS, SAP Hybris Commerce)
- [CVE-2018-2464](https://cve.now/CVE-2018-2464.md): SAP WebDynpro Java, versions 7.20, 7.30, 7.31, 7.40, 7.50, does not sufficiently encode user-controlled inputs, resulting in a stored Cross- (no CVSS, SAP WebDynpro)
- [CVE-2018-2465](https://cve.now/CVE-2018-2465.md): SAP HANA (versions 1.0 and 2.0) Extended Application Services classic model OData parser does not sufficiently validate XML. (no CVSS, SAP HANA)
- [CVE-2018-6975](https://cve.now/CVE-2018-6975.md): The AirWatch Agent for iOS prior to 5.8.1 contains a data protection vulnerability whereby the files and keychain entries in the Agent are n (no CVSS, VMware AirWatch Agent for iOS prior to)
- [CVE-2018-6976](https://cve.now/CVE-2018-6976.md): The VMware Content Locker for iOS prior to 4.14 contains a data protection vulnerability in the SQLite database. (no CVSS, VMware Content Locker for iOS)
- [CVE-2016-7066](https://cve.now/CVE-2016-7066.md): It was found that the improper default permissions on /tmp/auth directory in JBoss Enterprise Application Platform before 7.1.0 can allow an (no CVSS, Red Hat JBoss Enterprise Application Platform)
- [CVE-2018-10853](https://cve.now/CVE-2018-10853.md): A flaw was found in the way Linux kernel KVM hypervisor before 4.18 emulated instructions such as sgdt/sidt/fxsave/fxrstor. (CVSS 7.0, Linux kernel)
- [CVE-2016-0750](https://cve.now/CVE-2016-0750.md): The hotrod java client in infinispan before 9.1.0.Final automatically deserializes bytearray message contents in certain events. (CVSS 4.2, Red Hat Infinispan · org.infinispan:infinispan-core)
- [CVE-2016-7047](https://cve.now/CVE-2016-7047.md): A flaw was found in the CloudForms API before 5.6.3.0, 5.7.3.1 and 5.8.1.2. (CVSS 4.3, Red Hat cfme)
- [CVE-2016-7068](https://cve.now/CVE-2016-7068.md): An issue has been found in PowerDNS before 3.4.11 and 4.0.2, and PowerDNS recursor before 3.7.4 and 4.0.4, allowing a remote, unauthenticate (CVSS 5.3, Open-Xchange pdns)
- [CVE-2016-7069](https://cve.now/CVE-2016-7069.md): An issue has been found in dnsdist before 1.2.0 in the way EDNS0 OPT records are handled when parsing responses from a backend. (CVSS 5.9, Open-Xchange dnsdist)
- [CVE-2016-7070](https://cve.now/CVE-2016-7070.md): A privilege escalation flaw was found in the Ansible Tower. (CVSS 8.0, Red Hat Ansible Tower)
- [CVE-2016-7073](https://cve.now/CVE-2016-7073.md): An issue has been found in PowerDNS before 3.4.11 and 4.0.2, and PowerDNS recursor before 4.0.4, allowing an attacker in position of man-in- (CVSS 5.3, Open-Xchange pdns)
- [CVE-2016-7074](https://cve.now/CVE-2016-7074.md): An issue has been found in PowerDNS before 3.4.11 and 4.0.2, and PowerDNS recursor before 4.0.4, allowing an attacker in position of man-in- (CVSS 5.3, Open-Xchange pdns)
- [CVE-2018-16831](https://cve.now/CVE-2018-16831.md): Smarty before 3.1.33-dev-4 allows attackers to bypass the trusted\_dir protection mechanism via a file:./../ substring in an include statemen (no CVSS, smarty/smarty)
- [CVE-2018-16832](https://cve.now/CVE-2018-16832.md): CSRF in the anti-csrf decorator in xunfeng 0.2.0 allows an attacker to modify the configuration via a Flash file because views/lib/AntiCSRF. (no CVSS)
- [CVE-2018-1571](https://cve.now/CVE-2018-1571.md): IBM QRadar 7.2 and 7.3 could allow a remote authenticated attacker to execute arbitrary commands on the system. (CVSS 8.8, IBM QRadar SIEM)
- [CVE-2018-16807](https://cve.now/CVE-2018-16807.md): In Bro through 2.5.5, there is a memory leak potentially leading to DoS in scripts/base/protocols/krb/main.bro in the Kerberos protocol pars (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2018-09-11
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.