# CVEs published 2018-09-20

43 CVEs were published on September 20, 2018: 2 critical, 3 high. Days are UTC.

- [CVE-2018-14592](https://cve.now/CVE-2018-14592.md): The CWJoomla CW Article Attachments PRO extension before 2.0.7 and CW Article Attachments FREE extension before 1.0.6 for Joomla! allow SQL (no CVSS)
- [CVE-2018-14821](https://cve.now/CVE-2018-14821.md): Rockwell Automation RSLinx Classic Versions 4.00.01 and prior. (no CVSS, Rockwell Automation RSLinx Classic)
- [CVE-2018-14827](https://cve.now/CVE-2018-14827.md): Rockwell Automation RSLinx Classic Versions 4.00.01 and prior. (no CVSS, Rockwell Automation RSLinx Classic)
- [CVE-2018-14829](https://cve.now/CVE-2018-14829.md): Rockwell Automation RSLinx Classic Versions 4.00.01 and prior. (no CVSS, Rockwell Automation RSLinx Classic)
- [CVE-2018-15832](https://cve.now/CVE-2018-15832.md): upc.exe in Ubisoft Uplay Desktop Client versions 63.0.5699.0 allows remote attackers to execute arbitrary code. (no CVSS)
- [CVE-2018-16282](https://cve.now/CVE-2018-16282.md): A command injection vulnerability in the web server functionality of Moxa EDR-810 V4.2 build 18041013 allows remote attackers to execute arb (no CVSS)
- [CVE-2018-16752](https://cve.now/CVE-2018-16752.md): LINK-NET LW-N605R devices with firmware 12.20.2.1486 allow Remote Code Execution via shell metacharacters in the HOST field of the ping feat (no CVSS)
- [CVE-2018-17282](https://cve.now/CVE-2018-17282.md): An issue was discovered in Exiv2 v0.26. (no CVSS)
- [CVE-2018-14796](https://cve.now/CVE-2018-14796.md): Tec4Data SmartCooler, all versions prior to firmware 180806, the device responds to a remote unauthenticated reboot command that may be used (no CVSS, Tec4Data SmartCooler)
- [CVE-2018-6502](https://cve.now/CVE-2018-6502.md): MFSBGN03824 rev.1 - ArcSight Management Center, Insufficient Access Control, Reflected Cross Site Scripting, Access Control vulnerability, Cross-Site Request Forgery (CSRF), Unauthenticated File Download, Directory Traversal Vulnerability (CVSS 6.5, Micro Focus ArcSight Management Center)
- [CVE-2018-6503](https://cve.now/CVE-2018-6503.md): MFSBGN03824 rev.1 - ArcSight Management Center, Insufficient Access Control, Reflected Cross Site Scripting, Access Control vulnerability, Cross-Site Request Forgery (CSRF), Unauthenticated File Download, Directory Traversal Vulnerability (CVSS 6.5, Micro Focus ArcSight Management Center)
- [CVE-2018-6504](https://cve.now/CVE-2018-6504.md): MFSBGN03824 rev.1 - ArcSight Management Center, Insufficient Access Control, Reflected Cross Site Scripting, Access Control vulnerability, Cross-Site Request Forgery (CSRF), Unauthenticated File Download, Directory Traversal Vulnerability (CVSS 8.8, Micro Focus ArcSight Management Center)
- [CVE-2018-6505](https://cve.now/CVE-2018-6505.md): MFSBGN03824 rev.1 - ArcSight Management Center, Insufficient Access Control, Reflected Cross Site Scripting, Access Control vulnerability, Cross-Site Request Forgery (CSRF), Unauthenticated File Download, Directory Traversal Vulnerability (CVSS 7.5, Micro Focus ArcSight Management Center)
- [CVE-2018-6500](https://cve.now/CVE-2018-6500.md): MFSBGN03824 rev.1 - ArcSight Management Center, Insufficient Access Control, Reflected Cross Site Scripting, Access Control vulnerability, Cross-Site Request Forgery (CSRF), Unauthenticated File Download, Directory Traversal Vulnerability (CVSS 7.5, Micro Focus ArcSight Management Center)
- [CVE-2018-6501](https://cve.now/CVE-2018-6501.md): Potential security vulnerability of Insufficient Access Controls has been identified in ArcSight Management Center (ArcMC) for versions prio (no CVSS)
- [CVE-2018-1674](https://cve.now/CVE-2018-1674.md): IBM Business Process Manager 8.5 through 8.6 and 18.0.0.0 through 18.0.0.1 are vulnerable to SQL injection. (CVSS 6.3, IBM Business Process Manager)
- [CVE-2018-1800](https://cve.now/CVE-2018-1800.md): IBM Sterling B2B Integrator Standard Edition 5.2.6.0 and 6.2.6.1 could allow a local user to obtain highly sensitive information during a sh (CVSS 5.1, IBM Sterling B2B Integrator)
- [CVE-2018-3864](https://cve.now/CVE-2018-3864.md): An exploitable buffer overflow vulnerability exists in the Samsung WifiScan handler of video-core's HTTP server of Samsung SmartThings Hub S (CVSS 9.9, Samsung SmartThings Hub STH-ETH-250)
- [CVE-2018-3865](https://cve.now/CVE-2018-3865.md): An exploitable buffer overflow vulnerability exists in the Samsung WifiScan handler of video-core's HTTP server of Samsung SmartThings Hub S (CVSS 9.9, Samsung SmartThings Hub STH-ETH-250)
- [CVE-2018-17254](https://cve.now/CVE-2018-17254.md): The JCK Editor component 6.4.4 for Joomla! allows SQL Injection via the jtreelink/dialogs/links.php parent parameter. (no CVSS)
- [CVE-2017-18280](https://cve.now/CVE-2017-18280.md): In Snapdragon (Automobile, Mobile, Wear) in version MDM9607, MSM8909W, MSM8996AU, SD 210/SD 212/SD 205, SD 425, SD 427, SD 430, SD 435, SD 4 (no CVSS, Qualcomm Snapdragon Automobile, Snapdragon Mobile, Snapdrag…)
- [CVE-2017-18301](https://cve.now/CVE-2017-18301.md): In Small Cell SoC and Snapdragon (Automobile, Mobile, Wear) in version FSM9055, FSM9955, MDM9607, MDM9640, MDM9650, MSM8909W, SD 425, SD 427 (no CVSS)
- [CVE-2017-18302](https://cve.now/CVE-2017-18302.md): In Snapdragon (Automobile ,Mobile) in version MSM8996AU, SD 425, SD 427, SD 430, SD 435, SD 450, SD 625, SD 650/52, SD 820, SD 820A, SD 835, (no CVSS, Qualcomm Snapdragon Automobile, Snapdragon Mobile)
- [CVE-2017-18314](https://cve.now/CVE-2017-18314.md): In Snapdragon (Automobile, Mobile, Wear) in version MDM9206, MDM9607, MDM9635M, MDM9640, MDM9645, MDM9650, MDM9655, MSM8909W, MSM8996AU, SD (no CVSS, Qualcomm Snapdragon Automobile, Snapdragon Mobile, Snapdrag…)
- [CVE-2018-11267](https://cve.now/CVE-2018-11267.md): In Snapdragon (Automobile, Mobile, Wear) in version MDM9206, MDM9607, MDM9615, MDM9640, MDM9650, MDM9655, MSM8996AU, SD 210/SD 212/SD 205, S (no CVSS, Qualcomm Snapdragon Automobile, Snapdragon Mobile, Snapdrag…)
- [CVE-2018-11268](https://cve.now/CVE-2018-11268.md): In Snapdragon (Automobile, Mobile, Wear) in version MDM9206, MDM9607, MDM9635M, MDM9640, MDM9645, MDM9650, MDM9655, MSM8909W, MSM8996AU, SD (no CVSS, Qualcomm Snapdragon Automobile, Snapdragon Mobile, Snapdrag…)
- [CVE-2018-11269](https://cve.now/CVE-2018-11269.md): In Snapdragon (Automobile, Mobile, Wear) in version MDM9206, MDM9607, MDM9635M, MDM9640, MDM9645, MDM9650, MDM9655, MSM8909W, MSM8996AU, SD (no CVSS, Qualcomm SSnapdragon Automobile, Snapdragon Mobile, Snapdra…)
- [CVE-2018-11277](https://cve.now/CVE-2018-11277.md): In Snapdragon (Automobile, Mobile, Wear) in version MSM8909W, MSM8996AU, SD 210/SD 212/SD 205, SD 430, SD 450, SD 615/16/SD 415, SD 617, SD (no CVSS, Qualcomm Snapdragon Automobile, Snapdragon Mobile, Snapdrag…)
- [CVE-2018-11285](https://cve.now/CVE-2018-11285.md): In Snapdragon (Automobile, Mobile, Wear) in version MDM9206, MDM9607, MDM9650, MSM8909W, MSM8996AU, SD 210/SD 212/SD 205, SD 425, SD 427, SD (no CVSS, Qualcomm Snapdragon Automobile, Snapdragon Mobile, Snapdrag…)
- [CVE-2018-11287](https://cve.now/CVE-2018-11287.md): In Snapdragon (Automobile, Mobile, Wear) in version MDM9206, MDM9607, MDM9650, MSM8909W, MSM8996AU, SD 210/SD 212/SD 205, SD 425, SD 427, SD (no CVSS, Qualcomm Snapdragon Automobile, Snapdragon Mobile, Snapdrag…)
- [CVE-2018-11290](https://cve.now/CVE-2018-11290.md): In Snapdragon (Automobile, Mobile, Wear) in version MDM9206, MDM9607, MDM9640, MDM9650, MSM8996AU, QCA6574AU, QCA6584, SD 210/SD 212/SD 205, (no CVSS, Qualcomm Snapdragon Automobile, Snapdragon Mobile, Snapdrag…)
- [CVE-2018-11291](https://cve.now/CVE-2018-11291.md): In Snapdragon (Automobile, Mobile, Wear) in version IPQ8074, MDM9206, MDM9607, MDM9640, MDM9650, MSM8996AU, QCA4531, QCA6174A, QCA6564, QCA6 (no CVSS, Qualcomm Snapdragon Automobile, Snapdragon Mobile, Snapdrag…)
- [CVE-2018-11292](https://cve.now/CVE-2018-11292.md): In Snapdragon (Automobile, Mobile, Wear) in version MDM9206, MDM9607, MDM9640, MDM9650, MSM8909W, MSM8996AU, QCA6574AU, QCA6584, SD 210/SD 2 (no CVSS, Qualcomm Snapdragon Automobile, Snapdragon Mobile, Snapdrag…)
- [CVE-2018-11982](https://cve.now/CVE-2018-11982.md): In Snapdragon (Mobile, Wear) in version MDM9206, MDM9607, MDM9635M, MDM9640, MDM9645, MDM9655, MSM8909W, MSM8996AU, SD 210/SD 212/SD 205, SD (no CVSS, Qualcomm Snapdragon Mobile, Snapdragon Wear)
- [CVE-2018-5837](https://cve.now/CVE-2018-5837.md): In Snapdragon (Automobile, Mobile, Wear) in version IPQ8074, MDM9206, MDM9607, MDM9640, MDM9650, MSM8996AU, QCA6574AU, SD 210/SD 212/SD 205, (no CVSS, Qualcomm Snapdragon Automobile, Snapdragon Mobile, Snapdrag…)
- [CVE-2018-5871](https://cve.now/CVE-2018-5871.md): In Snapdragon (Automobile, Mobile, Wear) in version MDM9206, MDM9607, MDM9640, MDM9650, MSM8996AU, QCA6574AU, SD 210/SD 212/SD 205, SD 425, (no CVSS, Qualcomm Snapdragon Automobile, Snapdragon Mobile, Snapdrag…)
- [CVE-2018-17243](https://cve.now/CVE-2018-17243.md): Global Search in Zoho ManageEngine OpManager before 12.3 123205 allows SQL Injection. (no CVSS)
- [CVE-2018-17232](https://cve.now/CVE-2018-17232.md): SQL injection vulnerability in archivebot.py in docmarionum1 Slack ArchiveBot (aka slack-archive-bot) before 2018-09-19 allows remote attack (no CVSS)
- [CVE-2018-17233](https://cve.now/CVE-2018-17233.md): A SIGFPE signal is raised in the function H5D\_\_create\_chunk\_file\_map\_hyper() of H5Dchunk.c in the HDF HDF5 through 1.10.3 library during an (no CVSS)
- [CVE-2018-17234](https://cve.now/CVE-2018-17234.md): Memory leak in the H5O\_\_chunk\_deserialize() function in H5Ocache.c in the HDF HDF5 through 1.10.3 library allows attackers to cause a denial (no CVSS)
- [CVE-2018-17235](https://cve.now/CVE-2018-17235.md): The function mp4v2::impl::MP4Track::FinishSdtp() in mp4track.cpp in libmp4v2 2.1.0 mishandles compatibleBrand while processing a crafted mp4 (no CVSS)
- [CVE-2018-17236](https://cve.now/CVE-2018-17236.md): The function MP4Free() in mp4property.cpp in libmp4v2 2.1.0 internally calls free() on a invalid pointer, raising a SIGABRT signal. (no CVSS)
- [CVE-2018-17237](https://cve.now/CVE-2018-17237.md): A SIGFPE signal is raised in the function H5D\_\_chunk\_set\_info\_real() of H5Dchunk.c in the HDF HDF5 1.10.3 library during an attempted parse (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2018-09-20
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.