# CVEs published 2018-09-18 78 CVEs were published on September 18, 2018: 0 critical, 1 high. Days are UTC. - [CVE-2017-3912](https://cve.now/CVE-2017-3912.md): McAfee Application Control and Change Control (MACC) - password management security feature bypass (SFB) leading to an authentication bypass (CVSS 4.4, McAfee Application Control and Change Control) - [CVE-2018-6690](https://cve.now/CVE-2018-6690.md): McAfee Application Control (MAC) - Whitelist bypass using a hard drive solidified by MACC (CVSS 6.1, McAfee Application Control) - [CVE-2018-6693](https://cve.now/CVE-2018-6693.md): Endpoint Security for Linux Threat Prevention (ENSLTP) privilege escalation vulnerability (CVSS 5.6, McAfee Endpoint Security for Linux Threat Prevention) - [CVE-2018-11071](https://cve.now/CVE-2018-11071.md): DSA-2018-147: Dell EMC Isilon OneFS and IsilonSD Edge Remote Process Crash Vulnerability (CVSS 7.5, Dell EMC Isilon OneFS · Dell EMC IsilonSD Edge) - [CVE-2018-11084](https://cve.now/CVE-2018-11084.md): Garden-runC prevents deletion of some app environments (CVSS 6.8, Cloud Foundry Garden-runC) - [CVE-2018-13982](https://cve.now/CVE-2018-13982.md): Smarty\_Security::isTrustedResourceDir() in Smarty before 3.1.33 is prone to a path traversal vulnerability due to insufficient template code (no CVSS, smarty/smarty) - [CVE-2018-15546](https://cve.now/CVE-2018-15546.md): Accusoft PrizmDoc version 13.3 and earlier contains a Stored Cross-Site Scripting issue through a crafted PDF file. (no CVSS) - [CVE-2018-16225](https://cve.now/CVE-2018-16225.md): The QBee MultiSensor Camera through 4.16.4 accepts unencrypted network traffic from clients (such as the QBee Cam application through 1.0.5 (no CVSS) - [CVE-2018-16515](https://cve.now/CVE-2018-16515.md): Matrix Synapse before 0.33.3.1 allows remote attackers to spoof events and possibly have unspecified other impacts by leveraging improper tr (no CVSS, matrix-synapse) - [CVE-2018-16794](https://cve.now/CVE-2018-16794.md): Microsoft ADFS 4.0 Windows Server 2016 and previous (Active Directory Federation Services) has an SSRF vulnerability via the txtBoxEmail par (no CVSS) - [CVE-2018-16819](https://cve.now/CVE-2018-16819.md): admin/index.php in Monstra CMS 3.0.4 allows arbitrary file deletion via id=filesmanager&path=uploads/.......//./.......//./&delete\_file= req (no CVSS) - [CVE-2018-16820](https://cve.now/CVE-2018-16820.md): admin/index.php in Monstra CMS 3.0.4 allows arbitrary directory listing via id=filesmanager&path=uploads/.......//./.......//./ requests. (no CVSS) - [CVE-2018-17071](https://cve.now/CVE-2018-17071.md): The fallback function of a simple lottery smart contract implementation for Lucky9io, an Ethereum gambling game, generates a random value wi (no CVSS) - [CVE-2018-17111](https://cve.now/CVE-2018-17111.md): The onlyOwner modifier of a smart contract implementation for Coinlancer (CL), an Ethereum ERC20 token, has a potential access control vulne (no CVSS) - [CVE-2017-6913](https://cve.now/CVE-2017-6913.md): Cross-site scripting (XSS) vulnerability in the Open-Xchange webmail before 7.6.3-rev28 allows remote attackers to inject arbitrary web scri (no CVSS) - [CVE-2018-16668](https://cve.now/CVE-2018-16668.md): An issue was discovered in CIRCONTROL CirCarLife before 4.3. (no CVSS) - [CVE-2018-16669](https://cve.now/CVE-2018-16669.md): An issue was discovered in CIRCONTROL Open Charge Point Protocol (OCPP) before 1.5.0, as used in CirCarLife, PowerStudio, and other products (no CVSS) - [CVE-2018-16670](https://cve.now/CVE-2018-16670.md): An issue was discovered in CIRCONTROL CirCarLife before 4.3. (no CVSS) - [CVE-2018-16671](https://cve.now/CVE-2018-16671.md): An issue was discovered in CIRCONTROL CirCarLife before 4.3. (no CVSS) - [CVE-2017-15818](https://cve.now/CVE-2017-15818.md): In all android releases (Android for MSM, Firefox OS for MSM, QRD Android) from CAF using the linux kernel, while loading a user application (no CVSS, Qualcomm Android for MSM, Firefox OS for MSM, QRD Android) - [CVE-2017-15825](https://cve.now/CVE-2017-15825.md): In all android releases (Android for MSM, Firefox OS for MSM, QRD Android) from CAF using the linux kernel, while processing a gpt update, a (no CVSS, Qualcomm Android for MSM, Firefox OS for MSM, QRD Android) - [CVE-2017-15828](https://cve.now/CVE-2017-15828.md): In all android releases (Android for MSM, Firefox OS for MSM, QRD Android) from CAF using the linux kernel, while accessing the keystore in (no CVSS, Qualcomm Android for MSM, Firefox OS for MSM, QRD Android) - [CVE-2017-15844](https://cve.now/CVE-2017-15844.md): In all android releases (Android for MSM, Firefox OS for MSM, QRD Android) from CAF using the linux kernel, while processing the function fo (no CVSS, Qualcomm Android for MSM, Firefox OS for MSM, QRD Android) - [CVE-2018-11265](https://cve.now/CVE-2018-11265.md): In all android releases (Android for MSM, Firefox OS for MSM, QRD Android) from CAF using the linux kernel, possible buffer overflow while i (no CVSS, Qualcomm Android for MSM, Firefox OS for MSM, QRD Android) - [CVE-2018-11270](https://cve.now/CVE-2018-11270.md): In all android releases (Android for MSM, Firefox OS for MSM, QRD Android) from CAF using the linux kernel, memory allocated with devm\_kzall (no CVSS, Qualcomm Android for MSM, Firefox OS for MSM, QRD Android) - [CVE-2018-11273](https://cve.now/CVE-2018-11273.md): In all android releases (Android for MSM, Firefox OS for MSM, QRD Android) from CAF using the linux kernel, 'voice\_svc\_dev' is allocated as (no CVSS) - [CVE-2018-11274](https://cve.now/CVE-2018-11274.md): In all android releases (Android for MSM, Firefox OS for MSM, QRD Android) from CAF using the linux kernel, buffer overflow may occur when p (no CVSS, Qualcomm Android for MSM, Firefox OS for MSM, QRD Android) - [CVE-2018-11275](https://cve.now/CVE-2018-11275.md): In all android releases (Android for MSM, Firefox OS for MSM, QRD Android) from CAF using the linux kernel, when flashing image using Fastbo (no CVSS, Qualcomm Android for MSM, Firefox OS for MSM, QRD Android) - [CVE-2018-11276](https://cve.now/CVE-2018-11276.md): In all android releases (Android for MSM, Firefox OS for MSM, QRD Android) from CAF using the linux kernel, double free of memory allocation (no CVSS, Qualcomm Android for MSM, Firefox OS for MSM, QRD Android) - [CVE-2018-11278](https://cve.now/CVE-2018-11278.md): In all android releases (Android for MSM, Firefox OS for MSM, QRD Android) from CAF using the linux kernel, Venus HW searches for start code (no CVSS, Qualcomm Android for MSM, Firefox OS for MSM, QRD Android) - [CVE-2018-11280](https://cve.now/CVE-2018-11280.md): In all android releases (Android for MSM, Firefox OS for MSM, QRD Android) from CAF using the linux kernel, while processing user-space ther (no CVSS, Qualcomm Android for MSM, Firefox OS for MSM, QRD Android) - [CVE-2018-11281](https://cve.now/CVE-2018-11281.md): In all android releases (Android for MSM, Firefox OS for MSM, QRD Android) from CAF using the linux kernel, while calling IPA\_IOC\_MDFY\_RT\_RU (no CVSS, Qualcomm Android for MSM, Firefox OS for MSM, QRD Android) - [CVE-2018-11286](https://cve.now/CVE-2018-11286.md): In all android releases (Android for MSM, Firefox OS for MSM, QRD Android) from CAF using the linux kernel, while accessing global variable (no CVSS) - [CVE-2018-11293](https://cve.now/CVE-2018-11293.md): In all android releases (Android for MSM, Firefox OS for MSM, QRD Android) from CAF using the linux kernel, in wma\_ndp\_confirm\_event\_handler (no CVSS, Qualcomm Android for MSM, Firefox OS for MSM, QRD Android) - [CVE-2018-11294](https://cve.now/CVE-2018-11294.md): In all android releases (Android for MSM, Firefox OS for MSM, QRD Android) from CAF using the linux kernel, WLAN handler indication from the (no CVSS, Qualcomm Android for MSM, Firefox OS for MSM, QRD Android) - [CVE-2018-11295](https://cve.now/CVE-2018-11295.md): In all android releases (Android for MSM, Firefox OS for MSM, QRD Android) from CAF using the linux kernel, WMA handler carries a fixed even (no CVSS, Qualcomm Android for MSM, Firefox OS for MSM, QRD Android) - [CVE-2018-11296](https://cve.now/CVE-2018-11296.md): In all android releases (Android for MSM, Firefox OS for MSM, QRD Android) from CAF using the linux kernel, while processing a message from (no CVSS, Qualcomm Android for MSM, Firefox OS for MSM, QRD Android) - [CVE-2018-11297](https://cve.now/CVE-2018-11297.md): In all android releases (Android for MSM, Firefox OS for MSM, QRD Android) from CAF using the linux kernel, a buffer over-read can occur In (no CVSS, Qualcomm Android for MSM, Firefox OS for MSM, QRD Android) - [CVE-2018-11298](https://cve.now/CVE-2018-11298.md): In all android releases (Android for MSM, Firefox OS for MSM, QRD Android) from CAF using the linux kernel, while processing SET\_PASSPOINT\_L (no CVSS, Qualcomm Android for MSM, Firefox OS for MSM, QRD Android) - [CVE-2018-11299](https://cve.now/CVE-2018-11299.md): In all android releases (Android for MSM, Firefox OS for MSM, QRD Android) from CAF using the linux kernel, when WLAN FW has not filled the (no CVSS, Qualcomm Android for MSM, Firefox OS for MSM, QRD Android) - [CVE-2018-11300](https://cve.now/CVE-2018-11300.md): In all android releases (Android for MSM, Firefox OS for MSM, QRD Android) from CAF using the linux kernel, callback executed from the other (no CVSS) - [CVE-2018-11301](https://cve.now/CVE-2018-11301.md): In all android releases (Android for MSM, Firefox OS for MSM, QRD Android) from CAF using the linux kernel, lack of check on buffer length w (no CVSS, Qualcomm Android for MSM, Firefox OS for MSM, QRD Android) - [CVE-2018-11302](https://cve.now/CVE-2018-11302.md): In all android releases (Android for MSM, Firefox OS for MSM, QRD Android) from CAF using the linux kernel, lack of check of input received (no CVSS, Qualcomm Android for MSM, Firefox OS for MSM, QRD Android) - [CVE-2018-11818](https://cve.now/CVE-2018-11818.md): In all android releases (Android for MSM, Firefox OS for MSM, QRD Android) from CAF using the linux kernel, LUT configuration is passed down (no CVSS, Qualcomm Android for MSM, Firefox OS for MSM, QRD Android) - [CVE-2018-11826](https://cve.now/CVE-2018-11826.md): In all android releases (Android for MSM, Firefox OS for MSM, QRD Android) from CAF using the linux kernel, lack of check on integer overflo (no CVSS, Qualcomm Android for MSM, Firefox OS for MSM, QRD Android) - [CVE-2018-11827](https://cve.now/CVE-2018-11827.md): In all android releases (Android for MSM, Firefox OS for MSM, QRD Android) from CAF using the linux kernel, improper validation of array ind (no CVSS, Qualcomm Android for MSM, Firefox OS for MSM, QRD Android) - [CVE-2018-11832](https://cve.now/CVE-2018-11832.md): In all android releases (Android for MSM, Firefox OS for MSM, QRD Android) from CAF using the linux kernel, lack of input size validation be (no CVSS, Qualcomm Android for MSM, Firefox OS for MSM, QRD Android) - [CVE-2018-11836](https://cve.now/CVE-2018-11836.md): In all android releases (Android for MSM, Firefox OS for MSM, QRD Android) from CAF using the linux kernel, improper length check can lead t (no CVSS, Qualcomm Android for MSM, Firefox OS for MSM, QRD Android) - [CVE-2018-11840](https://cve.now/CVE-2018-11840.md): In all android releases (Android for MSM, Firefox OS for MSM, QRD Android) from CAF using the linux kernel, while processing the WLAN driver (no CVSS, Qualcomm Android for MSM, Firefox OS for MSM, QRD Android) - [CVE-2018-11842](https://cve.now/CVE-2018-11842.md): In all android releases (Android for MSM, Firefox OS for MSM, QRD Android) from CAF using the linux kernel, during wlan association, driver (no CVSS, Qualcomm Android for MSM, Firefox OS for MSM, QRD Android) - [CVE-2018-11843](https://cve.now/CVE-2018-11843.md): In all android releases (Android for MSM, Firefox OS for MSM, QRD Android) from CAF using the linux kernel, lack fo check on return value in (no CVSS, Qualcomm Android for MSM, Firefox OS for MSM, QRD Android) - [CVE-2018-11851](https://cve.now/CVE-2018-11851.md): In all android releases (Android for MSM, Firefox OS for MSM, QRD Android) from CAF using the linux kernel, lack of check on input received (no CVSS, Qualcomm Android for MSM, Firefox OS for MSM, QRD Android) - [CVE-2018-11852](https://cve.now/CVE-2018-11852.md): In all android releases (Android for MSM, Firefox OS for MSM, QRD Android) from CAF using the linux kernel, improper check In the WMA API fo (no CVSS, Qualcomm Android for MSM, Firefox OS for MSM, QRD Android) - [CVE-2018-11860](https://cve.now/CVE-2018-11860.md): In all android releases (Android for MSM, Firefox OS for MSM, QRD Android) from CAF using the linux kernel, a potential buffer over flow cou (no CVSS, Qualcomm Android for MSM, Firefox OS for MSM, QRD Android) - [CVE-2018-11863](https://cve.now/CVE-2018-11863.md): In all android releases (Android for MSM, Firefox OS for MSM, QRD Android) from CAF using the linux kernel, lack of check of input received (no CVSS, Qualcomm Android for MSM, Firefox OS for MSM, QRD Android) - [CVE-2018-11868](https://cve.now/CVE-2018-11868.md): In all android releases (Android for MSM, Firefox OS for MSM, QRD Android) from CAF using the linux kernel, lack of length validation check (no CVSS, Qualcomm Android for MSM, Firefox OS for MSM, QRD Android) - [CVE-2018-11869](https://cve.now/CVE-2018-11869.md): In all android releases (Android for MSM, Firefox OS for MSM, QRD Android) from CAF using the linux kernel, lack of length validation check (no CVSS, Qualcomm Android for MSM, Firefox OS for MSM, QRD Android) - [CVE-2018-17176](https://cve.now/CVE-2018-17176.md): A replay issue was discovered on Neato Botvac Connected 2.2.0 devices. (no CVSS) - [CVE-2018-17177](https://cve.now/CVE-2018-17177.md): An issue was discovered on Neato Botvac Connected 2.2.0 and Botvac 85 1.2.1 devices. (no CVSS) - [CVE-2018-17178](https://cve.now/CVE-2018-17178.md): An issue was discovered on Neato Botvac Connected 2.2.0 devices. (no CVSS) - [CVE-2018-17175](https://cve.now/CVE-2018-17175.md): In the marshmallow library before 2.15.1 and 3.x before 3.0.0b9 for Python, the schema "only" option treats an empty list as implying no "on (no CVSS, marshmallow) - [CVE-2018-11786](https://cve.now/CVE-2018-11786.md): In Apache Karaf prior to 4.2.0 release, if the sshd service in Karaf is left on so an administrator can manage the running instance, any use (no CVSS, Apache Software Foundation Apache Karaf · org.apache.karaf:…) - [CVE-2018-11787](https://cve.now/CVE-2018-11787.md): In Apache Karaf version prior to 3.0.9, 4.0.9, 4.1.1, when the webconsole feature is installed in Karaf, it is available at .../system/conso (no CVSS, Apache Software Foundation Apache Karaf · org.apache.karaf:…) - [CVE-2018-13398](https://cve.now/CVE-2018-13398.md): The administrative smart-commits resource in Atlassian Fisheye and Crucible before version 4.5.4 allows remote attackers to modify smart-com (no CVSS, Atlassian Fisheye and Crucible) - [CVE-2018-14641](https://cve.now/CVE-2018-14641.md): A security flaw was found in the ip\_frag\_reasm() function in net/ipv4/ip\_fragment.c in the Linux kernel from 4.19-rc1 to 4.19-rc3 inclusive, (CVSS 6.5, The Linux Foundation kernel) - [CVE-2018-14642](https://cve.now/CVE-2018-14642.md): An information leak vulnerability was found in Undertow. (CVSS 5.3, Red Hat undertow · io.undertow:undertow-core) - [CVE-2018-7929](https://cve.now/CVE-2018-7929.md): Huawei Mate RS smartphones with the versions before NEO-AL00D 8.1.0.167(C786) have a lock-screen bypass vulnerability. (no CVSS, Huawei Technologies Co. Mate RS) - [CVE-2018-7991](https://cve.now/CVE-2018-7991.md): Huawei smartphones Mate10 with versions earlier before ALP-AL00B 8.0.0.110(C00) have a Factory Reset Protection (FRP) bypass vulnerability. (no CVSS, Huawei Technologies Co. Mate10) - [CVE-2018-16952](https://cve.now/CVE-2018-16952.md): The Oracle WebCenter Interaction Portal 10.3.3 does not implement protection against Cross-site Request Forgery in its design. (no CVSS) - [CVE-2018-16953](https://cve.now/CVE-2018-16953.md): The AjaxView::DisplayResponse() function of the portalpages.dll assembly in Oracle WebCenter Interaction Portal 10.3.3 is vulnerable to refl (no CVSS) - [CVE-2018-16954](https://cve.now/CVE-2018-16954.md): An issue was discovered in Oracle WebCenter Interaction Portal 10.3.3. (no CVSS) - [CVE-2018-16955](https://cve.now/CVE-2018-16955.md): The login function of Oracle WebCenter Interaction Portal 10.3.3 is vulnerable to reflected cross-site scripting (XSS). (no CVSS) - [CVE-2018-16956](https://cve.now/CVE-2018-16956.md): The AjaxControl component of Oracle WebCenter Interaction Portal 10.3.3 does not validate the names of pages when processing page rename req (no CVSS) - [CVE-2018-16957](https://cve.now/CVE-2018-16957.md): The Oracle WebCenter Interaction 10.3.3 search service queryd.exe binary is compiled with the i1g2s3c4 hardcoded password. (no CVSS) - [CVE-2018-16958](https://cve.now/CVE-2018-16958.md): An issue was discovered in Oracle WebCenter Interaction Portal 10.3.3. (no CVSS) - [CVE-2018-16959](https://cve.now/CVE-2018-16959.md): An issue was discovered in Oracle WebCenter Interaction Portal 10.3.3. (no CVSS) - [CVE-2018-1000802](https://cve.now/CVE-2018-1000802.md): Python Software Foundation Python (CPython) version 2.7 contains a CWE-77: Improper Neutralization of Special Elements used in a Command ('C (no CVSS) - [CVE-2018-17153](https://cve.now/CVE-2018-17153.md): It was discovered that the Western Digital My Cloud device before 2.30.196 is affected by an authentication bypass vulnerability. (no CVSS) --- Source: cve.now, built and run by Sazabi (AI-native observability and security) Page: https://cve.now/daily/2018-09-18 Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.