CVEs published September 19, 2018
57 CVEs were published on September 19, 2018: 1 critical, 7 high.
- Published
- 57
- Critical
- 1
- High
- 7
- Medium
- 1
- Low
- 0
- Unrated
- 48
- Now in CISA KEV
- 0
- Fix available
- 5
Most affected products
- Qualcomm Android for MSM, Firefox OS for MSM, QRD Android
- 13
- Foscam C1 Indoor HD Camera
- 7
- Apache Software Foundation Apache Tika · org.apache.tika:ti…
- 3
- Elastic Cloud Enterprise
- 3
- Elasticsearch
- 2
- NUUO NVRMini2
- 2
- Symantec Messaging Gateway
- 2
- BlackBerry Enterprise Mobility Server
- 1
- Elastic Kibana
- 1
- Elasticsearch · org.elasticsearch:elasticsearch
- 1
Critical 1
High 7
- CVE-2017-2873An exploitable command injection vulnerability exists in the web management interface used by the Foscam C1 Indoor HD Camera running applicaFoscam C1 Indoor HD Camera
- CVE-2017-2876An exploitable buffer overflow vulnerability exists in the Multi-Camera interface used by the Foscam C1 Indoor HD Camera running applicationFoscam C1 Indoor HD Camera
- CVE-2017-2855An exploitable buffer overflow vulnerability exists in the DDNS client used by the Foscam C1 Indoor HD Camera running application firmware 2Foscam C1 Indoor HD Camera
- CVE-2017-2875An exploitable buffer overflow vulnerability exists in the Multi-Camera interface used by the Foscam C1 Indoor HD Camera running applicationFoscam C1 Indoor HD Camera
- CVE-2017-2878An exploitable buffer overflow vulnerability exists in the web management interface used by the Foscam C1 Indoor HD Camera running applicatiFoscam C1 Indoor HD Camera
- CVE-2017-2879An exploitable buffer overflow vulnerability exists in the UPnP implementation used by the Foscam C1 Indoor HD Camera running application fiFoscam C1 Indoor HD Camera
- CVE-2017-1794IBM Tivoli Monitoring 6.2.3 through 6.2.3.5 and 6.3.0 through 6.3.0.7 are vulnerable to both TEPS user privilege escalation and possible denIBM Tivoli Monitoring
Medium, low and unrated 49
- CVE-2018-17229Exiv2::d2Data in types.cpp in Exiv2 v0.26 allows remote attackers to cause a denial of service (heap-based buffer overflow) via a crafted im
- CVE-2018-17230Exiv2::ul2Data in types.cpp in Exiv2 v0.26 allows remote attackers to cause a denial of service (heap-based buffer overflow) via a crafted i
- CVE-2018-17231Telegram Desktop (aka tdesktop) 1.3.14 might allow attackers to cause a denial of service (assertion failure and application exit) via an "E
- CVE-2018-17228nmap4j 1.1.0 allows attackers to execute arbitrary commands via shell metacharacters in an includeHosts call.
- CVE-2018-8889A directory traversal vulnerability in the Connect Service of the BlackBerry Enterprise Mobility Server (BEMS) 2.8.17.29 and earlier could aBlackBerry Enterprise Mobility Server
- CVE-2018-3823X-Pack Machine Learning versions before 6.2.4 and 5.6.9 had a cross-site scripting (XSS) vulnerability.Elasticsearch X-Pack Machine Learning
- CVE-2018-3824X-Pack Machine Learning versions before 6.2.4 and 5.6.9 had a cross-site scripting (XSS) vulnerability.Elasticsearch X-Pack Machine Learning · org.elasticsearch:e…
- CVE-2018-3825In Elastic Cloud Enterprise (ECE) versions prior to 1.1.4 a default master encryption key is used in the process of granting ZooKeeper accesElastic Cloud Enterprise
- CVE-2018-3826In Elasticsearch versions 6.0.0-beta1 to 6.2.4 a disclosure flaw was found in the _snapshot API.Elasticsearch
- CVE-2018-3827A sensitive data disclosure flaw was found in the Elasticsearch repository-azure (formerly elasticsearch-cloud-azure) plugin.Elasticsearch
- CVE-2018-3828Elastic Cloud Enterprise (ECE) versions prior to 1.1.4 contain an information exposure vulnerability.Elastic Cloud Enterprise
- CVE-2018-3829In Elastic Cloud Enterprise (ECE) versions prior to 1.1.4 it was discovered that a user could scale out allocators on new hosts with an invaElastic Cloud Enterprise
- CVE-2018-3830Kibana versions 5.3.0 to 6.4.1 had a cross-site scripting (XSS) vulnerability via the source field formatter that could allow an attacker toElastic Kibana
- CVE-2018-3831Elasticsearch Alerting and Monitoring in versions before 6.4.1 or 5.6.12 have an information disclosure issue when secrets are configured viElasticsearch · org.elasticsearch:elasticsearch
- CVE-2018-17208Linksys Velop 1.1.2.187020 devices allow unauthenticated command injection, providing an attacker with full root access, via cgi-bin/zbtest.
- CVE-2018-17204An issue was discovered in Open vSwitch (OvS) 2.7.x through 2.7.6, affecting parse_group_prop_ntr_selection_method in lib/ofp-util.c.
- CVE-2018-17205An issue was discovered in Open vSwitch (OvS) 2.7.x through 2.7.6, affecting ofproto_rule_insert__ in ofproto/ofproto.c.
- CVE-2018-17206An issue was discovered in Open vSwitch (OvS) 2.7.x through 2.7.6.
- CVE-2018-17207An issue was discovered in Snap Creek Duplicator before 1.2.42.
- CVE-2018-1149cgi_system in NUUO's NVRMini2 3.8.0 and below allows remote attackers to execute arbitrary code via crafted HTTP requests.NUUO NVRMini2
- CVE-2018-1150NUUO's NVRMini2 3.8.0 and below contains a backdoor that would allow an unauthenticated remote attacker to take over user accounts if the fiNUUO NVRMini2
- CVE-2018-12242The Symantec Messaging Gateway product prior to 10.6.6 may be susceptible to an authentication bypass exploit, which is a type of issue thatSymantec Messaging Gateway
- CVE-2018-12243The Symantec Messaging Gateway product prior to 10.6.6 may be susceptible to a XML external entity (XXE) exploit, which is a type of issue wSymantec Messaging Gateway
- CVE-2018-14792WECON PLC Editor version 1.3.3U may allow an attacker to execute code under the current process when processing project files.WECON PLC Editor
- CVE-2018-16607Cross-site scripting (XSS) vulnerability in the Orgs Page in Open-AudIT Professional edition in 2.2.7 allows remote attackers to inject arbi
- CVE-2018-16785XML injection vulnerability exists in the file of DedeCMS V5.7 SP2 version, which can be utilized by attackers to create script file to obta
- CVE-2018-17183Artifex Ghostscript before 9.25 allowed a user-writable error exception table, which could be used by remote attackers able to supply crafte
- CVE-2018-1782IBM GPFS (IBM Spectrum Scale 5.0.1.0 and 5.0.1.1) allows a local, unprivileged user to cause a kernel panic on a node running GPFS by accessIBM Spectrum Scale
- CVE-2018-11761In Apache Tika 0.1 to 1.18, the XML parsers were not configured to limit entity expansion.Apache Software Foundation Apache Tika · org.apache.tika:ti…
- CVE-2018-11762In Apache Tika 0.9 to 1.18, in a rare edge case where a user does not specify an extract directory on the commandline (--extract-dir=) and tApache Software Foundation Apache Tika · org.apache.tika:ti…
- CVE-2018-11878In all android releases (Android for MSM, Firefox OS for MSM, QRD Android) from CAF using the linux kernel, possibility of invalid memory acQualcomm Android for MSM, Firefox OS for MSM, QRD Android
- CVE-2018-11883In all android releases (Android for MSM, Firefox OS for MSM, QRD Android) from CAF using the linux kernel, in policy mgr unit test if mode Qualcomm Android for MSM, Firefox OS for MSM, QRD Android
- CVE-2018-11886In all android releases (Android for MSM, Firefox OS for MSM, QRD Android) from CAF using the linux kernel, lack of check while calculating Qualcomm Android for MSM, Firefox OS for MSM, QRD Android
- CVE-2018-11889In all android releases (Android for MSM, Firefox OS for MSM, QRD Android) from CAF using the linux kernel, when requesting rssi timeout, ac
- CVE-2018-11891In all android releases (Android for MSM, Firefox OS for MSM, QRD Android) from CAF using the linux kernel, lack of check on the length of aQualcomm Android for MSM, Firefox OS for MSM, QRD Android
- CVE-2018-11893In all android releases (Android for MSM, Firefox OS for MSM, QRD Android) from CAF using the linux kernel, while processing vendor scan req
- CVE-2018-11894In all android releases (Android for MSM, Firefox OS for MSM, QRD Android) from CAF using the linux kernel, while processing preferred netwoQualcomm Android for MSM, Firefox OS for MSM, QRD Android
- CVE-2018-11895In all android releases (Android for MSM, Firefox OS for MSM, QRD Android) from CAF using the linux kernel, improper length check ValidationQualcomm Android for MSM, Firefox OS for MSM, QRD Android
- CVE-2018-11897In all android releases (Android for MSM, Firefox OS for MSM, QRD Android) from CAF using the linux kernel, while processing diag event afteQualcomm Android for MSM, Firefox OS for MSM, QRD Android
- CVE-2018-11898In all android releases (Android for MSM, Firefox OS for MSM, QRD Android) from CAF using the linux kernel, while processing start bss requeQualcomm Android for MSM, Firefox OS for MSM, QRD Android
- CVE-2018-11902In all android releases (Android for MSM, Firefox OS for MSM, QRD Android) from CAF using the linux kernel, lack of length validation check Qualcomm Android for MSM, Firefox OS for MSM, QRD Android
- CVE-2018-11903In all android releases (Android for MSM, Firefox OS for MSM, QRD Android) from CAF using the linux kernel, lack of length validation check Qualcomm Android for MSM, Firefox OS for MSM, QRD Android
- CVE-2018-11904In all android releases (Android for MSM, Firefox OS for MSM, QRD Android) from CAF using the linux kernel, asynchronous callbacks received Qualcomm Android for MSM, Firefox OS for MSM, QRD Android
- CVE-2018-3573In all android releases (Android for MSM, Firefox OS for MSM, QRD Android) from CAF using the linux kernel, while relocating kernel images wQualcomm Android for MSM, Firefox OS for MSM, QRD Android
- CVE-2018-3574In all android releases (Android for MSM, Firefox OS for MSM, QRD Android) from CAF using the linux kernel, userspace can request ION cache Qualcomm Android for MSM, Firefox OS for MSM, QRD Android
- CVE-2018-5905In all android releases (Android for MSM, Firefox OS for MSM, QRD Android) from CAF using the linux kernel, a race condition while accessing
- CVE-2018-8017In Apache Tika 1.2 to 1.18, a carefully crafted file can trigger an infinite loop in the IptcAnpaParser.Apache Software Foundation Apache Tika · org.apache.tika:ti…
- CVE-2018-17182An issue was discovered in the Linux kernel through 4.18.8.
- CVE-2018-17144Bitcoin Core 0.14.x before 0.14.3, 0.15.x before 0.15.2, and 0.16.x before 0.16.3 and Bitcoin Knots 0.14.x through 0.16.x before 0.16.3 allo