# CVEs published 2018-09-24

27 CVEs were published on September 24, 2018: 0 critical, 2 high. Days are UTC.

- [CVE-2018-10496](https://cve.now/CVE-2018-10496.md): This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Samsung Internet Browser Fixed in versio (no CVSS, Samsung Internet Browser)
- [CVE-2018-10497](https://cve.now/CVE-2018-10497.md): This vulnerability allows local attackers to escalate privileges on vulnerable installations of Samsung Email Fixed in version 5.0.02.16. (no CVSS, Samsung Email)
- [CVE-2018-10498](https://cve.now/CVE-2018-10498.md): This vulnerability allows local attackers to disclose sensitive information on vulnerable installations of Samsung Email Fixed in version 5. (no CVSS, Samsung Email)
- [CVE-2018-10499](https://cve.now/CVE-2018-10499.md): This vulnerability allows local attackers to execute arbitrary code on vulnerable installations of Samsung Galaxy Apps Fixed in version 6.4. (no CVSS, Samsung Galaxy Apps)
- [CVE-2018-10500](https://cve.now/CVE-2018-10500.md): This vulnerability allows local attackers to escalate privileges on vulnerable installations of Samsung Galaxy Apps Fixed in version 6.4.0.1 (no CVSS, Samsung Galaxy Apps)
- [CVE-2018-10501](https://cve.now/CVE-2018-10501.md): This vulnerability allows local attackers to escalate privileges on vulnerable installations of Samsung Notes Fixed in version 2.0.02.31. (no CVSS, Samsung Notes)
- [CVE-2018-10502](https://cve.now/CVE-2018-10502.md): This vulnerability allows local attackers to escalate privileges on vulnerable installations of Samsung Galaxy Apps Fixed in version 4.2.18. (no CVSS, Samsung Galaxy Apps)
- [CVE-2018-11614](https://cve.now/CVE-2018-11614.md): This vulnerability allows remote attackers to escalate privileges on vulnerable installations of Samsung Members Fixed in version 2.4.25. (no CVSS, Samsung Members)
- [CVE-2018-12975](https://cve.now/CVE-2018-12975.md): The random() function of the smart contract implementation for CryptoSaga, an Ethereum game, generates a random value with publicly readable (no CVSS)
- [CVE-2018-13140](https://cve.now/CVE-2018-13140.md): Druide Antidote through 9.5.1 on Windows and Linux allows remote code execution through the update mechanism by leveraging use of HTTP to do (no CVSS)
- [CVE-2018-16283](https://cve.now/CVE-2018-16283.md): The Wechat Broadcast plugin 1.2.0 and earlier for WordPress allows Directory Traversal via the Image.php url parameter. (no CVSS)
- [CVE-2018-16299](https://cve.now/CVE-2018-16299.md): The Localize My Post plugin 1.0 for WordPress allows Directory Traversal via the ajax/include.php file parameter. (no CVSS)
- [CVE-2018-17107](https://cve.now/CVE-2018-17107.md): In Tgstation tgstation-server 3.2.4.0 through 3.2.1.0 (fixed in 3.2.5.0), active logins would be cached, allowing subsequent logins to succe (no CVSS, TGServiceInterface)
- [CVE-2018-17281](https://cve.now/CVE-2018-17281.md): There is a stack consumption vulnerability in the res\_http\_websocket.so module of Asterisk through 13.23.0, 14.7.x through 14.7.7, and 15.x (no CVSS)
- [CVE-2018-14825](https://cve.now/CVE-2018-14825.md): On Honeywell Mobile Computers (CT60 running Android OS 7.1, CN80 running Android OS 7.1, CT40 running Android OS 7.1, CK75 running Android O (no CVSS, Honeywell Mobile Computers)
- [CVE-2015-8298](https://cve.now/CVE-2015-8298.md): Multiple SQL injection vulnerabilities in the login page in RXTEC RXAdmin UPDATE 06 / 2012 allow remote attackers to execute arbitrary SQL c (no CVSS)
- [CVE-2018-17432](https://cve.now/CVE-2018-17432.md): A NULL pointer dereference in H5O\_sdspace\_encode() in H5Osdspace.c in the HDF HDF5 through 1.10.3 library allows attackers to cause a denial (no CVSS)
- [CVE-2018-17433](https://cve.now/CVE-2018-17433.md): A heap-based buffer overflow in ReadGifImageDesc() in gifread.c in the HDF HDF5 through 1.10.3 library allows attackers to cause a denial of (no CVSS)
- [CVE-2018-17435](https://cve.now/CVE-2018-17435.md): A heap-based buffer over-read in H5O\_attr\_decode() in H5Oattr.c in the HDF HDF5 through 1.10.3 library allows attackers to cause a denial of (no CVSS)
- [CVE-2018-17436](https://cve.now/CVE-2018-17436.md): ReadCode() in decompress.c in the HDF HDF5 through 1.10.3 library allows attackers to cause a denial of service (invalid write access) via a (no CVSS)
- [CVE-2018-17438](https://cve.now/CVE-2018-17438.md): A SIGFPE signal is raised in the function H5D\_\_select\_io() of H5Dselect.c in the HDF HDF5 through 1.10.3 library during an attempted parse o (no CVSS)
- [CVE-2018-17439](https://cve.now/CVE-2018-17439.md): An issue was discovered in the HDF HDF5 1.10.3 library. (no CVSS)
- [CVE-2018-15615](https://cve.now/CVE-2018-15615.md): CMS Supervisor Information Disclosure (CVSS 7.2, Avaya Call Management System Supervisor)
- [CVE-2018-6700](https://cve.now/CVE-2018-6700.md): True Key (TK) - DLL Search Order Hijacking vulnerability (CVSS 7.5, McAfee True Key)
- [CVE-2018-6682](https://cve.now/CVE-2018-6682.md): True Key (TK) - Cross Site Scripting Exposure (CVSS 5.9, McAfee True Key)
- [CVE-2018-17434](https://cve.now/CVE-2018-17434.md): A SIGFPE signal is raised in the function apply\_filters() of h5repack\_filters.c in the HDF HDF5 through 1.10.3 library during an attempted p (no CVSS)
- [CVE-2018-17437](https://cve.now/CVE-2018-17437.md): Memory leak in the H5O\_dtype\_decode\_helper() function in H5Odtype.c in the HDF HDF5 through 1.10.3 library allows attackers to cause a denia (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2018-09-24
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.