CVEs published September 17, 2018
38 CVEs were published on September 17, 2018: 2 critical, 8 high.
- Published
- 38
- Critical
- 2
- High
- 8
- Medium
- 0
- Low
- 0
- Unrated
- 28
- Now in CISA KEV
- 0
- Fix available
- 9
Most affected products
- Foscam Indoor IP Camera C1 Series
- 5
- Apache Software Foundation Apache SpamAssassin
- 3
- [UNKNOWN] moodle · moodle/moodle
- 2
- golang.org/x/net
- 2
- Pivotal Application Service
- 2
- Apache Software Foundation Apache Camel · org.apache.camel:…
- 1
- Cloud Foundry Container Runtime
- 1
- Iceni Argus
- 1
- Pivotal Cloud Cache
- 1
- PoDoFo PoDoFo
- 1
Critical 2
High 8
- CVE-2017-2854An exploitable buffer overflow vulnerability exists in the DDNS client used by the Foscam C1 Indoor HD Camera running application firmware 2Foscam Indoor IP Camera C1 Series
- CVE-2017-2856An exploitable buffer overflow vulnerability exists in the DDNS client used by the Foscam C1 Indoor HD Camera running application firmware 2Foscam Indoor IP Camera C1 Series
- CVE-2017-2857An exploitable buffer overflow vulnerability exists in the DDNS client used by the Foscam C1 Indoor HD Camera running application firmware 2Foscam Indoor IP Camera C1 Series
- CVE-2018-14631moodle before versions 3.5.2, 3.4.5, 3.3.8 is vulnerable to a boost theme - blog search GET parameter insufficiently filtered.[UNKNOWN] moodle · moodle/moodle
- CVE-2017-2874An information disclosure vulnerability exists in the Multi-Camera interface used by the Foscam C1 Indoor HD Camera running application firmFoscam Indoor IP Camera C1 Series
- CVE-2018-14630moodle before versions 3.5.2, 3.4.5, 3.3.8, 3.1.14 is vulnerable to an XML import of ddwtos could lead to intentional remote code execution.[UNKNOWN] moodle · moodle/moodle
- CVE-2017-2777An exploitable heap overflow vulnerability exists in the ipStringCreate function of Iceni Argus Version 6.6.05.Iceni Argus
- CVE-2016-9045A code execution vulnerability exists in ProcessMaker Enterprise Core 3.0.1.7-community.ProcessMaker Enterprise
Medium, low and unrated 28
- CVE-2018-14320This vulnerability allows remote attackers to disclose sensitive information on vulnerable installations of PoDoFo.PoDoFo PoDoFo
- CVE-2018-11086Pivotal Usage Service in Pivotal Application Service, versions 2.0 prior to 2.0.21 and 2.1 prior to 2.1.13 and 2.2 prior to 2.2.5, contains Pivotal Application Service
- CVE-2018-11088Pivotal Applications Manager in Pivotal Application Service, versions 2.0 prior to 2.0.21 and 2.1 prior to 2.1.13 and 2.2 prior to 2.2.5, coPivotal Application Service
- CVE-2018-1198Pivotal Cloud Cache, versions prior to 1.3.1, prints a superuser password in plain text during BOSH deployment logs.Pivotal Cloud Cache
- CVE-2018-1223Cloud Foundry Container Runtime (kubo-release), versions prior to 0.14.0, may leak UAA and vCenter credentials to application logs.Cloud Foundry Container Runtime
- CVE-2017-15705A denial of service vulnerability was identified that exists in Apache SpamAssassin before 3.4.2.Apache Software Foundation Apache SpamAssassin
- CVE-2018-11780A potential Remote Code Execution bug exists with the PDFInfo plugin in Apache SpamAssassin before 3.4.2.Apache Software Foundation Apache SpamAssassin
- CVE-2018-11781Apache SpamAssassin 3.4.2 fixes a local user code injection in the meta rule syntax.Apache Software Foundation Apache SpamAssassin
- CVE-2018-17142The html package (aka x/net/html) through 2018-09-17 in Go mishandles <math><template><mo><template>, leading to a "panic: runtime error" ingolang.org/x/net
- CVE-2018-17143The html package (aka x/net/html) through 2018-09-17 in Go mishandles <template><tBody><isindex/action=0>, leading to a "panic: runtime errogolang.org/x/net
- CVE-2018-8041Apache Camel's Mail 2.20.0 through 2.20.3, 2.21.0 through 2.21.1 and 2.22.0 is vulnerable to path traversal.Apache Software Foundation Apache Camel · org.apache.camel:…
- CVE-2018-17136zzcms 8.3 contains a SQL Injection vulnerability in /user/check.php via a Client-Ip HTTP header.
- CVE-2018-17137Prezi Next 1.3.101.11 has a documented purpose of creating HTML5 presentations but has SE_DEBUG_PRIVILEGE on Windows, which might allow atta
- CVE-2018-17138The Jibu Pro plugin through 1.7 for WordPress is prone to Stored XSS via the wp-content/plugins/jibu-pro/quiz_action.php name (aka Quiz Name
- CVE-2018-17139UltimatePOS 2.5 allows users to upload arbitrary files, which leads to remote command execution by posting to a /products URI with PHP code
- CVE-2018-17140The Quizlord plugin through 2.0 for WordPress is prone to Stored XSS via the title parameter in a ql_insert action to wp-admin/admin.php.
- CVE-2018-17110Simple POS 4.0.24 allows SQL Injection via a products/get_products/ columns[0][search][value] parameter in the management panel, as demonstr
- CVE-2018-17113App/Modules/Admin/Tpl/default/Public/dwz/uploadify/scripts/uploadify.swf in EasyCMS 1.5 has XSS via the uploadifyID or movieName parameter,
- CVE-2018-17125CScms 4.1 allows arbitrary directory deletion via a dir=..\\ substring to plugins\sys\admin\Plugins.php.
- CVE-2018-17126CScms 4.1 allows remote code execution, as demonstrated by 1');eval($_POST[cmd]);# in Web Name to upload\plugins\sys\Install.php.
- CVE-2018-17127blocking_request.cgi on ASUS GT-AC5300 devices through 3.0.0.4.384_32738 allows remote attackers to cause a denial of service (NULL pointer
- CVE-2018-17128A Persistent XSS issue was discovered in the Visual Editor in MyBB before 1.8.19 via a Video MyCode.
- CVE-2018-17129MetInfo 6.1.0 has SQL injection in doexport() in app/system/feedback/admin/feedback_admin.class.php via the class1 field.
- CVE-2018-17130PHPMyWind 5.5 has XSS in member.php via an HTTP Referer header,
- CVE-2018-17131admin/web_config.php in PHPMyWind 5.5 allows Admin users to execute arbitrary code via the varvalue field.
- CVE-2018-17132admin/goods_update.php in PHPMyWind 5.5 allows Admin users to execute arbitrary code via the attrvalue[] array parameter.
- CVE-2018-17133admin/web_config.php in PHPMyWind 5.5 allows Admin users to execute arbitrary code via the rewrite url setting.
- CVE-2018-17134admin/web_config.php in PHPMyWind 5.5 allows Admin users to execute arbitrary code via the cfg_author field in conjunction with a crafted cf