CVEs published September 25, 2018
54 CVEs were published on September 25, 2018: 5 critical, 6 high. 2 are now in CISA KEV.
- Published
- 54
- Critical
- 5
- High
- 6
- Medium
- 7
- Low
- 0
- Unrated
- 36
- Now in CISA KEV
- 2
- Fix available
- 24
Most affected products
- Google Chrome
- 24
- Adobe ColdFusion
- 9
- Adobe Acrobat and Reader
- 6
- IBM Rational Engineering Lifecycle Manager
- 5
- The Linux Foundation kernel
- 2
- Adobe Flash Player
- 1
- Apache Software Foundation Apache HTTP Server
- 1
- IBM DataPower Gateway CD · IBM DataPower Gateways
- 1
- IBM DataPower Gateways · IBM DataPower Gateway CD
- 1
- Samsung Galaxy S8
- 1
Critical 5
- CVE-2018-15957Adobe ColdFusion versions July 12 release (2018.0.0.310739), Update 6 and earlier, and Update 14 and earlier have a deserialization of untruAdobe ColdFusion
- CVE-2018-15958Adobe ColdFusion versions July 12 release (2018.0.0.310739), Update 6 and earlier, and Update 14 and earlier have a deserialization of untruAdobe ColdFusion
- CVE-2018-15959Adobe ColdFusion versions July 12 release (2018.0.0.310739), Update 6 and earlier, and Update 14 and earlier have a deserialization of untruAdobe ColdFusion
- CVE-2018-15961Adobe ColdFusion versions July 12 release (2018.0.0.310739), Update 6 and earlier, and Update 14 and earlier have an unrestricted file uploaAdobe ColdFusion
- CVE-2018-15965Adobe ColdFusion versions July 12 release (2018.0.0.310739), Update 6 and earlier, and Update 14 and earlier have a deserialization of untruAdobe ColdFusion
High 6
- CVE-2018-14634An integer overflow flaw was found in the Linux kernel's create_elf_tables() function.The Linux Foundation kernel
- CVE-2018-1588IBM Jazz Foundation (IBM Rational Engineering Lifecycle Manager 5.0 through 5.02 and 6.0 through 6.0.6) is vulnerable to a XML External EntiIBM Rational Engineering Lifecycle Manager
- CVE-2018-1607IBM Rational Engineering Lifecycle Manager 5.0 through 5.02 and 6.0 through 6.0.6 is vulnerable to a XML External Entity Injection (XXE) attIBM Rational Engineering Lifecycle Manager
- CVE-2018-1669IBM DataPower Gateway 7.1.0.0 - 7.1.0.23, 7.2.0.0 - 7.2.0.21, 7.5.0.0 - 7.5.0.16, 7.5.1.0 - 7.5.1.15, 7.5.2.0 - 7.5.2.15, and 7.6.0.0 - 7.6.IBM DataPower Gateways · IBM DataPower Gateway CD
- CVE-2018-15964Adobe ColdFusion versions July 12 release (2018.0.0.310739), Update 6 and earlier, and Update 14 and earlier have a use of a component with Adobe ColdFusion
- CVE-2018-14633A security flaw was found in the chap_server_compute_md5() function in the ISCSI target code in the Linux kernel in a way an authentication The Linux Foundation kernel
Medium, low and unrated 43
- CVE-2018-11763In Apache HTTP Server 2.4.17 to 2.4.34, by sending continuous, large SETTINGS frames a client can occupy a connection, server thread and CPUApache Software Foundation Apache HTTP Server
- CVE-2018-1539IBM Rational Engineering Lifecycle Manager 5.0 through 5.02 and 6.0 through 6.0.6 could allow remote attackers to bypass authentication via IBM Rational Engineering Lifecycle Manager
- CVE-2018-1560IBM Rational Engineering Lifecycle Manager 5.0 through 5.02 and 6.0 through 6.0.6 is vulnerable to cross-site scripting.IBM Rational Engineering Lifecycle Manager
- CVE-2018-1659IBM Rational Engineering Lifecycle Manager 5.0 through 5.02 and 6.0 through 6.0.6 is vulnerable to cross-site scripting.IBM Rational Engineering Lifecycle Manager
- CVE-2018-1664IBM DataPower Gateway 7.1.0.0 - 7.1.0.23, 7.2.0.0 - 7.2.0.21, 7.5.0.0 - 7.5.0.16, 7.5.1.0 - 7.5.1.15, 7.5.2.0 - 7.5.2.15, and 7.6.0.0 - 7.6.IBM DataPower Gateway CD · IBM DataPower Gateways
- CVE-2018-6031Use after free in PDFium in Google Chrome prior to 64.0.3282.119 allowed a remote attacker to potentially exploit heap corruption via a crafGoogle Chrome
- CVE-2018-6032Insufficient policy enforcement in Blink in Google Chrome prior to 64.0.3282.119 allowed a remote attacker to potentially leak user cross-orGoogle Chrome
- CVE-2018-6033Insufficient data validation in Downloads in Google Chrome prior to 64.0.3282.119 allowed a remote attacker to potentially run arbitrary codGoogle Chrome
- CVE-2018-6034Insufficient data validation in WebGL in Google Chrome prior to 64.0.3282.119 allowed a remote attacker to perform an out of bounds memory rGoogle Chrome
- CVE-2018-6035Insufficient policy enforcement in DevTools in Google Chrome prior to 64.0.3282.119 allowed a remote attacker to potentially leak user localGoogle Chrome
- CVE-2018-6036Insufficient data validation in V8 in Google Chrome prior to 64.0.3282.119 allowed a remote attacker to potentially leak user data via a craGoogle Chrome
- CVE-2018-6037Inappropriate implementation in autofill in Google Chrome prior to 64.0.3282.119 allowed a remote attacker to obtain autofill data with insuGoogle Chrome
- CVE-2018-6038Heap buffer overflow in WebGL in Google Chrome prior to 64.0.3282.119 allowed a remote attacker to perform an out of bounds memory read via Google Chrome
- CVE-2018-6039Insufficient data validation in DevTools in Google Chrome prior to 64.0.3282.119 allowed a remote attacker to potentially leak user cross-orGoogle Chrome
- CVE-2018-6040Insufficient policy enforcement in Blink in Google Chrome prior to 64.0.3282.119 allowed a remote attacker to potentially bypass content secGoogle Chrome
- CVE-2018-6041Incorrect security UI in navigation in Google Chrome prior to 64.0.3282.119 allowed a remote attacker to spoof the contents of the Omnibox (Google Chrome
- CVE-2018-6042Incorrect security UI in Omnibox in Google Chrome prior to 64.0.3282.119 allowed a remote attacker to spoof the contents of the Omnibox (URLGoogle Chrome
- CVE-2018-6043Insufficient data validation in External Protocol Handler in Google Chrome prior to 64.0.3282.119 allowed a remote attacker to potentially eGoogle Chrome
- CVE-2018-6045Insufficient policy enforcement in DevTools in Google Chrome prior to 64.0.3282.119 allowed a remote attacker to potentially leak user local
- CVE-2018-6046Insufficient data validation in DevTools in Google Chrome prior to 64.0.3282.119 allowed a remote attacker to potentially leak user cross-orGoogle Chrome
- CVE-2018-6047Insufficient policy enforcement in WebGL in Google Chrome prior to 64.0.3282.119 allowed a remote attacker to potentially leak user redirectGoogle Chrome
- CVE-2018-6048Insufficient policy enforcement in Blink in Google Chrome prior to 64.0.3282.119 allowed a remote attacker to potentially leak referrer infoGoogle Chrome
- CVE-2018-6049Incorrect security UI in permissions prompt in Google Chrome prior to 64.0.3282.119 allowed a remote attacker to spoof the origin to which pGoogle Chrome
- CVE-2018-6050Incorrect security UI in Omnibox in Google Chrome prior to 64.0.3282.119 allowed a remote attacker to spoof the contents of the Omnibox (URLGoogle Chrome
- CVE-2018-6051XSS Auditor in Google Chrome prior to 64.0.3282.119, did not ensure the reporting URL was in the same origin as the page it was on, which alGoogle Chrome
- CVE-2018-6052Lack of support for a non standard no-referrer policy value in Blink in Google Chrome prior to 64.0.3282.119 allowed a remote attacker to obGoogle Chrome
- CVE-2018-6053Inappropriate implementation in New Tab Page in Google Chrome prior to 64.0.3282.119 allowed a local attacker to view website thumbnail imagGoogle Chrome
- CVE-2018-6054Use after free in WebUI in Google Chrome prior to 64.0.3282.119 allowed a remote attacker to potentially exploit heap corruption via a craftGoogle Chrome
- CVE-2018-6055Insufficient policy enforcement in Catalog Service in Google Chrome prior to 64.0.3282.119 allowed a remote attacker to potentially run arbiGoogle Chrome
- CVE-2018-6119Incorrect security UI in Omnibox in Google Chrome prior to 64.0.3282.119 allowed a remote attacker to spoof the contents of the Omnibox (URLGoogle Chrome
- CVE-2018-12775Adobe Acrobat and Reader versions 2018.011.20058 and earlier, 2017.011.30099 and earlier, and 2015.006.30448 and earlier have an out-of-bounAdobe Acrobat and Reader
- CVE-2018-12778Adobe Acrobat and Reader versions 2018.011.20058 and earlier, 2017.011.30099 and earlier, and 2015.006.30448 and earlier have an out-of-bounAdobe Acrobat and Reader
- CVE-2018-12801Adobe Acrobat and Reader versions 2018.011.20058 and earlier, 2017.011.30099 and earlier, and 2015.006.30448 and earlier have an out-of-bounAdobe Acrobat and Reader
- CVE-2018-12840Adobe Acrobat and Reader versions 2018.011.20058 and earlier, 2017.011.30099 and earlier, and 2015.006.30448 and earlier have an out-of-boun
- CVE-2018-12848Adobe Acrobat and Reader versions 2018.011.20058 and earlier, 2017.011.30099 and earlier, and 2015.006.30448 and earlier have an out-of-bounAdobe Acrobat and Reader
- CVE-2018-12849Adobe Acrobat and Reader versions 2018.011.20058 and earlier, 2017.011.30099 and earlier, and 2015.006.30448 and earlier have an out-of-bounAdobe Acrobat and Reader
- CVE-2018-12850Adobe Acrobat and Reader versions 2018.011.20058 and earlier, 2017.011.30099 and earlier, and 2015.006.30448 and earlier have an out-of-bounAdobe Acrobat and Reader
- CVE-2018-15960Adobe ColdFusion versions July 12 release (2018.0.0.310739), Update 6 and earlier, and Update 14 and earlier have a use of a component with Adobe ColdFusion
- CVE-2018-15962Adobe ColdFusion versions July 12 release (2018.0.0.310739), Update 6 and earlier, and Update 14 and earlier have a directory listing vulnerAdobe ColdFusion
- CVE-2018-15963Adobe ColdFusion versions July 12 release (2018.0.0.310739), Update 6 and earlier, and Update 14 and earlier have a security bypass vulnerabAdobe ColdFusion
- CVE-2018-15967Adobe Flash Player versions 30.0.0.154 and earlier have a privilege escalation vulnerability.Adobe Flash Player
- CVE-2018-14318This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Samsung Galaxy S8 G950FXXU1AQL5.Samsung Galaxy S8
- CVE-2018-14647Python's elementtree C accelerator failed to initialise Expat's hash salt during initialization.The Python Project Python