CVEs published September 13, 2018
104 CVEs were published on September 13, 2018: 0 critical, 1 high. 1 is now in CISA KEV.
- Published
- 104
- Critical
- 0
- High
- 1
- Medium
- 1
- Low
- 0
- Unrated
- 102
- Now in CISA KEV
- 1
- Fix available
- 14
Most affected products
- Microsoft Windows
- 21
- Microsoft Edge · Microsoft ChakraCore +1
- 7
- Microsoft Windows Server · Microsoft Windows
- 6
- Microsoft Edge
- 5
- Microsoft Windows Server 2012 R2 · Microsoft Windows RT +2
- 4
- F5 Networks BIG-IP APM
- 3
- Microsoft Internet Explorer
- 3
- Microsoft ChakraCore · Microsoft Internet Explorer +2
- 2
- Microsoft SharePoint Server · Microsoft SharePoint
- 2
- Apache Software Foundation Apache Mesos · org.apache.mesos:…
- 1
High 1
Medium, low and unrated 103
- CVE-2018-10637A maliciously crafted project file may cause a buffer overflow, which may allow the attacker to execute arbitrary code that affects Fuji EleFuji Electric V-Server Lite
- CVE-2018-17024admin/index.php in Monstra CMS 3.0.4 allows XSS via the page_meta_title parameter in an add_page action.
- CVE-2018-17025admin/index.php in Monstra CMS 3.0.4 allows XSS via the page_meta_title parameter in an edit_page action for a page with no special role.
- CVE-2018-17026admin/index.php in Monstra CMS 3.0.4 allows XSS via the page_meta_title parameter in an edit_page&name=error404 action, a different vulnerab
- CVE-2018-1330When parsing a malformed JSON payload, libprocess in Apache Mesos versions 1.4.0 to 1.5.0 might crash due to an uncaught exception.Apache Software Foundation Apache Mesos · org.apache.mesos:…
- CVE-2018-17019In Bro through 2.5.5, there is a DoS in IRC protocol names command parsing in analyzer/protocol/irc/IRC.cc.
- CVE-2018-17020ASUS GT-AC5300 devices with firmware through 3.0.0.4.384_32738 allow remote attackers to cause a denial of service via a single "GET / HTTP/
- CVE-2018-17021Cross-site scripting (XSS) vulnerability on ASUS GT-AC5300 devices with firmware through 3.0.0.4.384_32738 allows remote attackers to inject
- CVE-2018-17022Stack-based buffer overflow on the ASUS GT-AC5300 router through 3.0.0.4.384_32738 allows remote attackers to cause a denial of service (dev
- CVE-2018-17023Cross-site request forgery (CSRF) vulnerability on ASUS GT-AC5300 routers with firmware through 3.0.0.4.384_32738 allows remote attackers to
- CVE-2018-17004An issue was discovered on TP-Link TL-WR886N 6.0 2.3.4 and TL-WR886N 7.0 1.1.0 devices.
- CVE-2018-17005An issue was discovered on TP-Link TL-WR886N 6.0 2.3.4 and TL-WR886N 7.0 1.1.0 devices.
- CVE-2018-17006An issue was discovered on TP-Link TL-WR886N 6.0 2.3.4 and TL-WR886N 7.0 1.1.0 devices.
- CVE-2018-17007An issue was discovered on TP-Link TL-WR886N 6.0 2.3.4 and TL-WR886N 7.0 1.1.0 devices.
- CVE-2018-17008An issue was discovered on TP-Link TL-WR886N 6.0 2.3.4 and TL-WR886N 7.0 1.1.0 devices.
- CVE-2018-17009An issue was discovered on TP-Link TL-WR886N 6.0 2.3.4 and TL-WR886N 7.0 1.1.0 devices.
- CVE-2018-17010An issue was discovered on TP-Link TL-WR886N 6.0 2.3.4 and TL-WR886N 7.0 1.1.0 devices.
- CVE-2018-17011An issue was discovered on TP-Link TL-WR886N 6.0 2.3.4 and TL-WR886N 7.0 1.1.0 devices.
- CVE-2018-17012An issue was discovered on TP-Link TL-WR886N 6.0 2.3.4 and TL-WR886N 7.0 1.1.0 devices.
- CVE-2018-17013An issue was discovered on TP-Link TL-WR886N 6.0 2.3.4 and TL-WR886N 7.0 1.1.0 devices.
- CVE-2018-17014An issue was discovered on TP-Link TL-WR886N 6.0 2.3.4 and TL-WR886N 7.0 1.1.0 devices.
- CVE-2018-17015An issue was discovered on TP-Link TL-WR886N 6.0 2.3.4 and TL-WR886N 7.0 1.1.0 devices.
- CVE-2018-17016An issue was discovered on TP-Link TL-WR886N 6.0 2.3.4 and TL-WR886N 7.0 1.1.0 devices.
- CVE-2018-17017An issue was discovered on TP-Link TL-WR886N 6.0 2.3.4 and TL-WR886N 7.0 1.1.0 devices.
- CVE-2018-17018An issue was discovered on TP-Link TL-WR886N 6.0 2.3.4 and TL-WR886N 7.0 1.1.0 devices.
- CVE-2018-16741An issue was discovered in mgetty before 1.2.1.
- CVE-2018-16742An issue was discovered in mgetty before 1.2.1.
- CVE-2018-16743An issue was discovered in mgetty before 1.2.1.
- CVE-2018-16744An issue was discovered in mgetty before 1.2.1.
- CVE-2018-16745An issue was discovered in mgetty before 1.2.1.
- CVE-2018-16796HiScout GRC Suite before 3.1.5 allows Unrestricted Upload of Files with Dangerous Types.
- CVE-2018-16999Netwide Assembler (NASM) 2.14rc15 has an invalid memory write (segmentation fault) in expand_smacro in preproc.c, which allows attackers to
- CVE-2018-17000A NULL pointer dereference in the function _TIFFmemcmp at tif_unix.c (called from TIFFWriteDirectoryTagTransferfunction) in LibTIFF 4.0.9 al
- CVE-2018-1698IBM Maximo Asset Management 7.6 through 7.6.3 could allow an unauthenticated attacker to obtain sensitive information from error messages.IBM Maximo Asset Management
- CVE-2018-16987Squash TM through 1.18.0 presents the cleartext passwords of external services in the administration panel, as demonstrated by a ta-server-p
- CVE-2018-15310A vulnerability in BIG-IP APM portal access 11.5.1-11.5.7, 11.6.0-11.6.3, and 12.1.0-12.1.3 discloses the BIG-IP software version in rewrittF5 Networks BIG-IP APM
- CVE-2018-16985In Lizard (formerly LZ5) 2.0, use of an invalid memory address was discovered in LZ5_compress_continue in lz5_compress.c, related to LZ5_com
- CVE-2018-5545On F5 WebSafe Alert Server 1.0.0-4.2.6, a malicious, authenticated user can execute code on the alert server by using a maliciously crafted F5 Networks F5 WebSafe Alert Server
- CVE-2018-5548On BIG-IP APM 11.6.0-11.6.3, an insecure AES ECB mode is used for orig_uri parameter in an undisclosed /vdesk link of APM virtual server conF5 Networks BIG-IP APM
- CVE-2018-5549On BIG-IP APM 11.6.0-11.6.3.1, 12.1.0-12.1.3.3, 13.0.0, and 13.1.0-13.1.0.3, APMD may core when processing SAML Assertion or response contaiF5 Networks BIG-IP APM
- CVE-2018-16983NoScript Classic before 5.1.8.7, as used in Tor Browser 7.x and other products, allows attackers to bypass script blocking via the text/html
- CVE-2018-16982Open Chinese Convert (OpenCC) 1.0.5 allows attackers to cause a denial of service (segmentation fault) because BinaryDict::NewFromFile in Biopencc
- CVE-2018-0965A remote code execution vulnerability exists when Windows Hyper-V on a host server fails to properly validate input from an authenticated usMicrosoft Windows Server · Microsoft Windows
- CVE-2018-8269A denial of service vulnerability exists when OData Library improperly handles web requests, aka "OData Denial of Service Vulnerability." ThMicrosoft.Data.OData · Microsoft.AspNetCore.DataProtecti… +1
- CVE-2018-8271An information disclosure vulnerability exists in Windows when the Windows bowser.sys kernel-mode driver fails to properly handle objects inMicrosoft Windows
- CVE-2018-8315An information disclosure vulnerability exists when the browser scripting engine improperly handle object types, aka "Microsoft Scripting EnMicrosoft ChakraCore · Microsoft Internet Explorer +2
- CVE-2018-8331A remote code execution vulnerability exists in Microsoft Excel software when the software fails to properly handle objects in memory, aka "Microsoft Office
- CVE-2018-8332A remote code execution vulnerability exists when the Windows font library improperly handles specially crafted embedded fonts, aka "Win32k Microsoft Windows · Microsoft Office
- CVE-2018-8335A denial of service vulnerability exists in the Microsoft Server Block Message (SMB) when an attacker sends specially crafted requests to thMicrosoft Windows Server 2012 R2 · Microsoft Windows RT +2
- CVE-2018-8336An information disclosure vulnerability exists when the Windows kernel improperly handles objects in memory, aka "Windows Kernel InformationMicrosoft Windows Server · Microsoft Windows
- CVE-2018-8337A security feature bypass vulnerability exists when Windows Subsystem for Linux improperly handles case sensitivity, aka "Windows Subsystem Microsoft Windows
- CVE-2018-8354A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Microsoft Edge, aka "ScriptinMicrosoft Edge · Microsoft ChakraCore +1
- CVE-2018-8366An information disclosure vulnerability exists when the Microsoft Edge Fetch API incorrectly handles a filtered response type, aka "MicrosofMicrosoft Edge
- CVE-2018-8367A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka "CMicrosoft Edge · Microsoft ChakraCore +1
- CVE-2018-8391A remote code execution vulnerability exists in the way that the ChakraCore scripting engine handles objects in memory, aka "Scripting EnginMicrosoft ChakraCore · Microsoft.ChakraCore
- CVE-2018-8392A buffer overflow vulnerability exists in the Microsoft JET Database Engine that could allow remote code execution on an affected system, akMicrosoft Windows
- CVE-2018-8393A buffer overflow vulnerability exists in the Microsoft JET Database Engine that could allow remote code execution on an affected system, akMicrosoft Windows
- CVE-2018-8409A denial of service vulnerability exists when System.IO.Pipelines improperly handles requests, aka "System.IO.Pipelines Denial of Service." Microsoft System.IO.Pipelines · Microsoft .NET Core +4
- CVE-2018-8410An elevation of privilege vulnerability exists when the Windows Kernel API improperly handles registry objects in memory, aka "Windows RegisMicrosoft Windows
- CVE-2018-8419An information disclosure vulnerability exists when the Windows kernel fails to properly initialize a memory address, aka "Windows Kernel InMicrosoft Windows
- CVE-2018-8420A remote code execution vulnerability exists when the Microsoft XML Core Services MSXML parser processes user input, aka "MS XML Remote CodeMicrosoft Windows
- CVE-2018-8421A remote code execution vulnerability exists when Microsoft .NET Framework processes untrusted input, aka ".NET Framework Remote Code ExecutMicrosoft .NET Framework
- CVE-2018-8422An information disclosure vulnerability exists when the Windows GDI component improperly discloses the contents of its memory, aka "Windows Microsoft Windows
- CVE-2018-8424An information disclosure vulnerability exists when the Windows GDI component improperly discloses the contents of its memory, aka "Windows Microsoft Windows
- CVE-2018-8425A spoofing vulnerability exists when Microsoft Edge improperly handles specific HTML content, aka "Microsoft Edge Spoofing Vulnerability." TMicrosoft Edge
- CVE-2018-8426A cross-site-scripting (XSS) vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web requesMicrosoft SharePoint Server · Microsoft SharePoint
- CVE-2018-8428An elevation of privilege vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request tMicrosoft SharePoint
- CVE-2018-8429An information disclosure vulnerability exists when Microsoft Excel improperly discloses the contents of its memory, aka "Microsoft Excel InMicrosoft Excel Viewer · Microsoft Office +1
- CVE-2018-8430A remote code execution vulnerability exists in Microsoft Word if a user opens a specially crafted PDF file, aka "Word PDF Remote Code ExecuMicrosoft Word · Microsoft Office
- CVE-2018-8431An elevation of privilege vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request tMicrosoft SharePoint Server · Microsoft SharePoint
- CVE-2018-8433An information disclosure vulnerability exists when the Windows Graphics component improperly handles objects in memory, aka "Microsoft GrapMicrosoft Windows
- CVE-2018-8434An information disclosure vulnerability exists when Windows Hyper-V on a host operating system fails to properly validate input from an authMicrosoft Windows
- CVE-2018-8435A security feature bypass vulnerability exists when Windows Hyper-V BIOS loader fails to provide a high-entropy source, aka "Windows Hyper-VMicrosoft Windows Server · Microsoft Windows
- CVE-2018-8436A denial of service vulnerability exists when Microsoft Hyper-V Network Switch on a host server fails to properly validate input from a privMicrosoft Windows
- CVE-2018-8437A denial of service vulnerability exists when Microsoft Hyper-V Network Switch on a host server fails to properly validate input from a privMicrosoft Windows
- CVE-2018-8438A denial of service vulnerability exists when Microsoft Hyper-V Network Switch on a host server fails to properly validate input from a privMicrosoft Windows Server 2012 R2 · Microsoft Windows RT +2
- CVE-2018-8439A remote code execution vulnerability exists when Windows Hyper-V on a host server fails to properly validate input from an authenticated usMicrosoft Windows Server 2012 R2 · Microsoft Windows RT +2
- CVE-2018-8441An elevation of privilege vulnerability exists due to an integer overflow in Windows Subsystem for Linux, aka "Windows Subsystem for Linux EMicrosoft Windows
- CVE-2018-8442An information disclosure vulnerability exists when the Windows kernel improperly handles objects in memory, aka "Windows Kernel InformationMicrosoft Windows
- CVE-2018-8443An information disclosure vulnerability exists when the Windows kernel improperly handles objects in memory, aka "Windows Kernel InformationMicrosoft Windows
- CVE-2018-8444An information disclosure vulnerability exists in the way that the Microsoft Server Message Block 2.0 (SMBv2) server handles certain requestMicrosoft Windows Server · Microsoft Windows
- CVE-2018-8445An information disclosure vulnerability exists when the Windows kernel improperly handles objects in memory, aka "Windows Kernel InformationMicrosoft Windows
- CVE-2018-8446An information disclosure vulnerability exists when the Windows kernel improperly handles objects in memory, aka "Windows Kernel InformationMicrosoft Windows
- CVE-2018-8447A remote code execution vulnerability exists when Internet Explorer improperly accesses objects in memory, aka "Internet Explorer Memory CorMicrosoft Internet Explorer
- CVE-2018-8449A security feature bypass exists when Device Guard incorrectly validates an untrusted file, aka "Device Guard Security Feature Bypass VulnerMicrosoft Windows Server · Microsoft Windows
- CVE-2018-8452An information disclosure vulnerability exists when the scripting engine does not properly handle objects in memory in Microsoft browsers, aMicrosoft ChakraCore · Microsoft Internet Explorer +2
- CVE-2018-8455An elevation of privilege vulnerability exists in the way that the Windows Kernel handles objects in memory, aka "Windows Kernel Elevation oMicrosoft Windows Server 2012 R2 · Microsoft Windows RT +2
- CVE-2018-8456A remote code execution vulnerability exists in the way that the ChakraCore scripting engine handles objects in memory, aka "Scripting EnginMicrosoft Edge · Microsoft ChakraCore +1
- CVE-2018-8457A remote code execution vulnerability exists in the way the scripting engine handles objects in memory in Microsoft browsers, aka "ScriptingMicrosoft Internet Explorer · Microsoft Edge
- CVE-2018-8459A remote code execution vulnerability exists in the way that the ChakraCore scripting engine handles objects in memory, aka "Scripting EnginMicrosoft Edge · Microsoft ChakraCore +1
- CVE-2018-8461A remote code execution vulnerability exists when Internet Explorer improperly accesses objects in memory, aka "Internet Explorer Memory CorMicrosoft Internet Explorer
- CVE-2018-8462An elevation of privilege vulnerability exists when the DirectX Graphics Kernel (DXGKRNL) driver improperly handles objects in memory, aka "Microsoft Windows Server · Microsoft Windows
- CVE-2018-8463An elevation of privilege vulnerability exists in Microsoft Edge that could allow an attacker to escape from the AppContainer sandbox in theMicrosoft Edge
- CVE-2018-8464An remote code execution vulnerability exists when Microsoft Edge PDF Reader improperly handles objects in memory, aka "Microsoft Edge PDF RMicrosoft Edge
- CVE-2018-8465A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka "CMicrosoft Edge · Microsoft ChakraCore +1
- CVE-2018-8466A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka "CMicrosoft Edge · Microsoft ChakraCore +1
- CVE-2018-8467A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka "CMicrosoft Edge · Microsoft ChakraCore +1
- CVE-2018-8468An elevation of privilege vulnerability exists when Windows, allowing a sandbox escape, aka "Windows Elevation of Privilege Vulnerability." Microsoft Windows
- CVE-2018-8469An elevation of privilege vulnerability exists in Microsoft Edge that could allow an attacker to escape from the AppContainer sandbox in theMicrosoft Edge
- CVE-2018-8470A security feature bypass vulnerability exists in Internet Explorer due to how scripts are handled that allows a universal cross-site scriptMicrosoft Internet Explorer
- CVE-2018-8474A security feature bypass vulnerability exists when Lync for Mac 2011 fails to properly sanitize specially crafted messages, aka "Lync for MMicrosoft Lync
- CVE-2018-8475A remote code execution vulnerability exists when Windows does not properly handle specially crafted image files, aka "Windows Remote Code EMicrosoft Windows
- CVE-2018-8479A spoofing vulnerability exists for the Azure IoT Device Provisioning for the C SDK library using the HTTP protocol on Windows platform, akaMicrosoft C SDK