# CVEs published 2018-09-19

57 CVEs were published on September 19, 2018: 1 critical, 7 high. Days are UTC.

- [CVE-2018-17229](https://cve.now/CVE-2018-17229.md): Exiv2::d2Data in types.cpp in Exiv2 v0.26 allows remote attackers to cause a denial of service (heap-based buffer overflow) via a crafted im (no CVSS)
- [CVE-2018-17230](https://cve.now/CVE-2018-17230.md): Exiv2::ul2Data in types.cpp in Exiv2 v0.26 allows remote attackers to cause a denial of service (heap-based buffer overflow) via a crafted i (no CVSS)
- [CVE-2018-17231](https://cve.now/CVE-2018-17231.md): Telegram Desktop (aka tdesktop) 1.3.14 might allow attackers to cause a denial of service (assertion failure and application exit) via an "E (no CVSS)
- [CVE-2018-17228](https://cve.now/CVE-2018-17228.md): nmap4j 1.1.0 allows attackers to execute arbitrary commands via shell metacharacters in an includeHosts call. (no CVSS)
- [CVE-2018-8889](https://cve.now/CVE-2018-8889.md): A directory traversal vulnerability in the Connect Service of the BlackBerry Enterprise Mobility Server (BEMS) 2.8.17.29 and earlier could a (no CVSS, BlackBerry Enterprise Mobility Server)
- [CVE-2018-3823](https://cve.now/CVE-2018-3823.md): X-Pack Machine Learning versions before 6.2.4 and 5.6.9 had a cross-site scripting (XSS) vulnerability. (no CVSS, Elasticsearch X-Pack Machine Learning)
- [CVE-2018-3824](https://cve.now/CVE-2018-3824.md): X-Pack Machine Learning versions before 6.2.4 and 5.6.9 had a cross-site scripting (XSS) vulnerability. (no CVSS, Elasticsearch X-Pack Machine Learning · org.elasticsearch:e…)
- [CVE-2018-3825](https://cve.now/CVE-2018-3825.md): In Elastic Cloud Enterprise (ECE) versions prior to 1.1.4 a default master encryption key is used in the process of granting ZooKeeper acces (no CVSS, Elastic Cloud Enterprise)
- [CVE-2018-3826](https://cve.now/CVE-2018-3826.md): In Elasticsearch versions 6.0.0-beta1 to 6.2.4 a disclosure flaw was found in the \_snapshot API. (no CVSS, Elasticsearch)
- [CVE-2018-3827](https://cve.now/CVE-2018-3827.md): A sensitive data disclosure flaw was found in the Elasticsearch repository-azure (formerly elasticsearch-cloud-azure) plugin. (no CVSS, Elasticsearch)
- [CVE-2018-3828](https://cve.now/CVE-2018-3828.md): Elastic Cloud Enterprise (ECE) versions prior to 1.1.4 contain an information exposure vulnerability. (no CVSS, Elastic Cloud Enterprise)
- [CVE-2018-3829](https://cve.now/CVE-2018-3829.md): In Elastic Cloud Enterprise (ECE) versions prior to 1.1.4 it was discovered that a user could scale out allocators on new hosts with an inva (no CVSS, Elastic Cloud Enterprise)
- [CVE-2018-3830](https://cve.now/CVE-2018-3830.md): Kibana versions 5.3.0 to 6.4.1 had a cross-site scripting (XSS) vulnerability via the source field formatter that could allow an attacker to (no CVSS, Elastic Kibana)
- [CVE-2018-3831](https://cve.now/CVE-2018-3831.md): Elasticsearch Alerting and Monitoring in versions before 6.4.1 or 5.6.12 have an information disclosure issue when secrets are configured vi (no CVSS, Elasticsearch · org.elasticsearch:elasticsearch)
- [CVE-2017-2873](https://cve.now/CVE-2017-2873.md): An exploitable command injection vulnerability exists in the web management interface used by the Foscam C1 Indoor HD Camera running applica (CVSS 8.8, Foscam C1 Indoor HD Camera)
- [CVE-2017-2876](https://cve.now/CVE-2017-2876.md): An exploitable buffer overflow vulnerability exists in the Multi-Camera interface used by the Foscam C1 Indoor HD Camera running application (CVSS 8.8, Foscam C1 Indoor HD Camera)
- [CVE-2017-2877](https://cve.now/CVE-2017-2877.md): A missing error check exists in the Multi-Camera interface used by the Foscam C1 Indoor HD Camera running application firmware 2.52.2.43. (CVSS 9.8, Foscam C1 Indoor HD Camera)
- [CVE-2018-17208](https://cve.now/CVE-2018-17208.md): Linksys Velop 1.1.2.187020 devices allow unauthenticated command injection, providing an attacker with full root access, via cgi-bin/zbtest. (no CVSS)
- [CVE-2017-2855](https://cve.now/CVE-2017-2855.md): An exploitable buffer overflow vulnerability exists in the DDNS client used by the Foscam C1 Indoor HD Camera running application firmware 2 (CVSS 8.1, Foscam C1 Indoor HD Camera)
- [CVE-2017-2875](https://cve.now/CVE-2017-2875.md): An exploitable buffer overflow vulnerability exists in the Multi-Camera interface used by the Foscam C1 Indoor HD Camera running application (CVSS 8.8, Foscam C1 Indoor HD Camera)
- [CVE-2017-2878](https://cve.now/CVE-2017-2878.md): An exploitable buffer overflow vulnerability exists in the web management interface used by the Foscam C1 Indoor HD Camera running applicati (CVSS 8.8, Foscam C1 Indoor HD Camera)
- [CVE-2017-2879](https://cve.now/CVE-2017-2879.md): An exploitable buffer overflow vulnerability exists in the UPnP implementation used by the Foscam C1 Indoor HD Camera running application fi (CVSS 7.5, Foscam C1 Indoor HD Camera)
- [CVE-2018-17204](https://cve.now/CVE-2018-17204.md): An issue was discovered in Open vSwitch (OvS) 2.7.x through 2.7.6, affecting parse\_group\_prop\_ntr\_selection\_method in lib/ofp-util.c. (no CVSS)
- [CVE-2018-17205](https://cve.now/CVE-2018-17205.md): An issue was discovered in Open vSwitch (OvS) 2.7.x through 2.7.6, affecting ofproto\_rule\_insert\_\_ in ofproto/ofproto.c. (no CVSS)
- [CVE-2018-17206](https://cve.now/CVE-2018-17206.md): An issue was discovered in Open vSwitch (OvS) 2.7.x through 2.7.6. (no CVSS)
- [CVE-2018-17207](https://cve.now/CVE-2018-17207.md): An issue was discovered in Snap Creek Duplicator before 1.2.42. (no CVSS)
- [CVE-2017-1794](https://cve.now/CVE-2017-1794.md): IBM Tivoli Monitoring 6.2.3 through 6.2.3.5 and 6.3.0 through 6.3.0.7 are vulnerable to both TEPS user privilege escalation and possible den (CVSS 7.5, IBM Tivoli Monitoring)
- [CVE-2018-1149](https://cve.now/CVE-2018-1149.md): cgi\_system in NUUO's NVRMini2 3.8.0 and below allows remote attackers to execute arbitrary code via crafted HTTP requests. (no CVSS, NUUO NVRMini2)
- [CVE-2018-1150](https://cve.now/CVE-2018-1150.md): NUUO's NVRMini2 3.8.0 and below contains a backdoor that would allow an unauthenticated remote attacker to take over user accounts if the fi (no CVSS, NUUO NVRMini2)
- [CVE-2018-12242](https://cve.now/CVE-2018-12242.md): The Symantec Messaging Gateway product prior to 10.6.6 may be susceptible to an authentication bypass exploit, which is a type of issue that (no CVSS, Symantec Messaging Gateway)
- [CVE-2018-12243](https://cve.now/CVE-2018-12243.md): The Symantec Messaging Gateway product prior to 10.6.6 may be susceptible to a XML external entity (XXE) exploit, which is a type of issue w (no CVSS, Symantec Messaging Gateway)
- [CVE-2018-14792](https://cve.now/CVE-2018-14792.md): WECON PLC Editor version 1.3.3U may allow an attacker to execute code under the current process when processing project files. (no CVSS, WECON PLC Editor)
- [CVE-2018-16607](https://cve.now/CVE-2018-16607.md): Cross-site scripting (XSS) vulnerability in the Orgs Page in Open-AudIT Professional edition in 2.2.7 allows remote attackers to inject arbi (no CVSS)
- [CVE-2018-16785](https://cve.now/CVE-2018-16785.md): XML injection vulnerability exists in the file of DedeCMS V5.7 SP2 version, which can be utilized by attackers to create script file to obta (no CVSS)
- [CVE-2018-17183](https://cve.now/CVE-2018-17183.md): Artifex Ghostscript before 9.25 allowed a user-writable error exception table, which could be used by remote attackers able to supply crafte (no CVSS)
- [CVE-2018-1782](https://cve.now/CVE-2018-1782.md): IBM GPFS (IBM Spectrum Scale 5.0.1.0 and 5.0.1.1) allows a local, unprivileged user to cause a kernel panic on a node running GPFS by access (CVSS 6.5, IBM Spectrum Scale)
- [CVE-2018-11761](https://cve.now/CVE-2018-11761.md): In Apache Tika 0.1 to 1.18, the XML parsers were not configured to limit entity expansion. (no CVSS, Apache Software Foundation Apache Tika · org.apache.tika:ti…)
- [CVE-2018-11762](https://cve.now/CVE-2018-11762.md): In Apache Tika 0.9 to 1.18, in a rare edge case where a user does not specify an extract directory on the commandline (--extract-dir=) and t (no CVSS, Apache Software Foundation Apache Tika · org.apache.tika:ti…)
- [CVE-2018-11878](https://cve.now/CVE-2018-11878.md): In all android releases (Android for MSM, Firefox OS for MSM, QRD Android) from CAF using the linux kernel, possibility of invalid memory ac (no CVSS, Qualcomm Android for MSM, Firefox OS for MSM, QRD Android)
- [CVE-2018-11883](https://cve.now/CVE-2018-11883.md): In all android releases (Android for MSM, Firefox OS for MSM, QRD Android) from CAF using the linux kernel, in policy mgr unit test if mode (no CVSS, Qualcomm Android for MSM, Firefox OS for MSM, QRD Android)
- [CVE-2018-11886](https://cve.now/CVE-2018-11886.md): In all android releases (Android for MSM, Firefox OS for MSM, QRD Android) from CAF using the linux kernel, lack of check while calculating (no CVSS, Qualcomm Android for MSM, Firefox OS for MSM, QRD Android)
- [CVE-2018-11889](https://cve.now/CVE-2018-11889.md): In all android releases (Android for MSM, Firefox OS for MSM, QRD Android) from CAF using the linux kernel, when requesting rssi timeout, ac (no CVSS)
- [CVE-2018-11891](https://cve.now/CVE-2018-11891.md): In all android releases (Android for MSM, Firefox OS for MSM, QRD Android) from CAF using the linux kernel, lack of check on the length of a (no CVSS, Qualcomm Android for MSM, Firefox OS for MSM, QRD Android)
- [CVE-2018-11893](https://cve.now/CVE-2018-11893.md): In all android releases (Android for MSM, Firefox OS for MSM, QRD Android) from CAF using the linux kernel, while processing vendor scan req (no CVSS)
- [CVE-2018-11894](https://cve.now/CVE-2018-11894.md): In all android releases (Android for MSM, Firefox OS for MSM, QRD Android) from CAF using the linux kernel, while processing preferred netwo (no CVSS, Qualcomm Android for MSM, Firefox OS for MSM, QRD Android)
- [CVE-2018-11895](https://cve.now/CVE-2018-11895.md): In all android releases (Android for MSM, Firefox OS for MSM, QRD Android) from CAF using the linux kernel, improper length check Validation (no CVSS, Qualcomm Android for MSM, Firefox OS for MSM, QRD Android)
- [CVE-2018-11897](https://cve.now/CVE-2018-11897.md): In all android releases (Android for MSM, Firefox OS for MSM, QRD Android) from CAF using the linux kernel, while processing diag event afte (no CVSS, Qualcomm Android for MSM, Firefox OS for MSM, QRD Android)
- [CVE-2018-11898](https://cve.now/CVE-2018-11898.md): In all android releases (Android for MSM, Firefox OS for MSM, QRD Android) from CAF using the linux kernel, while processing start bss reque (no CVSS, Qualcomm Android for MSM, Firefox OS for MSM, QRD Android)
- [CVE-2018-11902](https://cve.now/CVE-2018-11902.md): In all android releases (Android for MSM, Firefox OS for MSM, QRD Android) from CAF using the linux kernel, lack of length validation check (no CVSS, Qualcomm Android for MSM, Firefox OS for MSM, QRD Android)
- [CVE-2018-11903](https://cve.now/CVE-2018-11903.md): In all android releases (Android for MSM, Firefox OS for MSM, QRD Android) from CAF using the linux kernel, lack of length validation check (no CVSS, Qualcomm Android for MSM, Firefox OS for MSM, QRD Android)
- [CVE-2018-11904](https://cve.now/CVE-2018-11904.md): In all android releases (Android for MSM, Firefox OS for MSM, QRD Android) from CAF using the linux kernel, asynchronous callbacks received (no CVSS, Qualcomm Android for MSM, Firefox OS for MSM, QRD Android)
- [CVE-2018-3573](https://cve.now/CVE-2018-3573.md): In all android releases (Android for MSM, Firefox OS for MSM, QRD Android) from CAF using the linux kernel, while relocating kernel images w (no CVSS, Qualcomm Android for MSM, Firefox OS for MSM, QRD Android)
- [CVE-2018-3574](https://cve.now/CVE-2018-3574.md): In all android releases (Android for MSM, Firefox OS for MSM, QRD Android) from CAF using the linux kernel, userspace can request ION cache (no CVSS, Qualcomm Android for MSM, Firefox OS for MSM, QRD Android)
- [CVE-2018-5905](https://cve.now/CVE-2018-5905.md): In all android releases (Android for MSM, Firefox OS for MSM, QRD Android) from CAF using the linux kernel, a race condition while accessing (no CVSS)
- [CVE-2018-8017](https://cve.now/CVE-2018-8017.md): In Apache Tika 1.2 to 1.18, a carefully crafted file can trigger an infinite loop in the IptcAnpaParser. (no CVSS, Apache Software Foundation Apache Tika · org.apache.tika:ti…)
- [CVE-2018-17182](https://cve.now/CVE-2018-17182.md): An issue was discovered in the Linux kernel through 4.18.8. (no CVSS)
- [CVE-2018-17144](https://cve.now/CVE-2018-17144.md): Bitcoin Core 0.14.x before 0.14.3, 0.15.x before 0.15.2, and 0.16.x before 0.16.3 and Bitcoin Knots 0.14.x through 0.16.x before 0.16.3 allo (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2018-09-19
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.