# CVEs published 2018-09-25

54 CVEs were published on September 25, 2018: 5 critical, 6 high. 2 are now in CISA KEV. Days are UTC.

- [CVE-2018-11763](https://cve.now/CVE-2018-11763.md): In Apache HTTP Server 2.4.17 to 2.4.34, by sending continuous, large SETTINGS frames a client can occupy a connection, server thread and CPU (no CVSS, Apache Software Foundation Apache HTTP Server)
- [CVE-2018-14634](https://cve.now/CVE-2018-14634.md): An integer overflow flaw was found in the Linux kernel's create\_elf\_tables() function. (CVSS 7.8, KEV, The Linux Foundation kernel)
- [CVE-2018-1539](https://cve.now/CVE-2018-1539.md): IBM Rational Engineering Lifecycle Manager 5.0 through 5.02 and 6.0 through 6.0.6 could allow remote attackers to bypass authentication via (CVSS 5.4, IBM Rational Engineering Lifecycle Manager)
- [CVE-2018-1560](https://cve.now/CVE-2018-1560.md): IBM Rational Engineering Lifecycle Manager 5.0 through 5.02 and 6.0 through 6.0.6 is vulnerable to cross-site scripting. (CVSS 5.4, IBM Rational Engineering Lifecycle Manager)
- [CVE-2018-1588](https://cve.now/CVE-2018-1588.md): IBM Jazz Foundation (IBM Rational Engineering Lifecycle Manager 5.0 through 5.02 and 6.0 through 6.0.6) is vulnerable to a XML External Enti (CVSS 7.1, IBM Rational Engineering Lifecycle Manager)
- [CVE-2018-1607](https://cve.now/CVE-2018-1607.md): IBM Rational Engineering Lifecycle Manager 5.0 through 5.02 and 6.0 through 6.0.6 is vulnerable to a XML External Entity Injection (XXE) att (CVSS 7.1, IBM Rational Engineering Lifecycle Manager)
- [CVE-2018-1659](https://cve.now/CVE-2018-1659.md): IBM Rational Engineering Lifecycle Manager 5.0 through 5.02 and 6.0 through 6.0.6 is vulnerable to cross-site scripting. (CVSS 5.4, IBM Rational Engineering Lifecycle Manager)
- [CVE-2018-1664](https://cve.now/CVE-2018-1664.md): IBM DataPower Gateway 7.1.0.0 - 7.1.0.23, 7.2.0.0 - 7.2.0.21, 7.5.0.0 - 7.5.0.16, 7.5.1.0 - 7.5.1.15, 7.5.2.0 - 7.5.2.15, and 7.6.0.0 - 7.6. (CVSS 6.2, IBM DataPower Gateway CD · IBM DataPower Gateways)
- [CVE-2018-1669](https://cve.now/CVE-2018-1669.md): IBM DataPower Gateway 7.1.0.0 - 7.1.0.23, 7.2.0.0 - 7.2.0.21, 7.5.0.0 - 7.5.0.16, 7.5.1.0 - 7.5.1.15, 7.5.2.0 - 7.5.2.15, and 7.6.0.0 - 7.6. (CVSS 7.1, IBM DataPower Gateways · IBM DataPower Gateway CD)
- [CVE-2018-6031](https://cve.now/CVE-2018-6031.md): Use after free in PDFium in Google Chrome prior to 64.0.3282.119 allowed a remote attacker to potentially exploit heap corruption via a craf (no CVSS, Google Chrome)
- [CVE-2018-6032](https://cve.now/CVE-2018-6032.md): Insufficient policy enforcement in Blink in Google Chrome prior to 64.0.3282.119 allowed a remote attacker to potentially leak user cross-or (no CVSS, Google Chrome)
- [CVE-2018-6033](https://cve.now/CVE-2018-6033.md): Insufficient data validation in Downloads in Google Chrome prior to 64.0.3282.119 allowed a remote attacker to potentially run arbitrary cod (no CVSS, Google Chrome)
- [CVE-2018-6034](https://cve.now/CVE-2018-6034.md): Insufficient data validation in WebGL in Google Chrome prior to 64.0.3282.119 allowed a remote attacker to perform an out of bounds memory r (no CVSS, Google Chrome)
- [CVE-2018-6035](https://cve.now/CVE-2018-6035.md): Insufficient policy enforcement in DevTools in Google Chrome prior to 64.0.3282.119 allowed a remote attacker to potentially leak user local (no CVSS, Google Chrome)
- [CVE-2018-6036](https://cve.now/CVE-2018-6036.md): Insufficient data validation in V8 in Google Chrome prior to 64.0.3282.119 allowed a remote attacker to potentially leak user data via a cra (no CVSS, Google Chrome)
- [CVE-2018-6037](https://cve.now/CVE-2018-6037.md): Inappropriate implementation in autofill in Google Chrome prior to 64.0.3282.119 allowed a remote attacker to obtain autofill data with insu (no CVSS, Google Chrome)
- [CVE-2018-6038](https://cve.now/CVE-2018-6038.md): Heap buffer overflow in WebGL in Google Chrome prior to 64.0.3282.119 allowed a remote attacker to perform an out of bounds memory read via (no CVSS, Google Chrome)
- [CVE-2018-6039](https://cve.now/CVE-2018-6039.md): Insufficient data validation in DevTools in Google Chrome prior to 64.0.3282.119 allowed a remote attacker to potentially leak user cross-or (no CVSS, Google Chrome)
- [CVE-2018-6040](https://cve.now/CVE-2018-6040.md): Insufficient policy enforcement in Blink in Google Chrome prior to 64.0.3282.119 allowed a remote attacker to potentially bypass content sec (no CVSS, Google Chrome)
- [CVE-2018-6041](https://cve.now/CVE-2018-6041.md): Incorrect security UI in navigation in Google Chrome prior to 64.0.3282.119 allowed a remote attacker to spoof the contents of the Omnibox ( (no CVSS, Google Chrome)
- [CVE-2018-6042](https://cve.now/CVE-2018-6042.md): Incorrect security UI in Omnibox in Google Chrome prior to 64.0.3282.119 allowed a remote attacker to spoof the contents of the Omnibox (URL (no CVSS, Google Chrome)
- [CVE-2018-6043](https://cve.now/CVE-2018-6043.md): Insufficient data validation in External Protocol Handler in Google Chrome prior to 64.0.3282.119 allowed a remote attacker to potentially e (no CVSS, Google Chrome)
- [CVE-2018-6045](https://cve.now/CVE-2018-6045.md): Insufficient policy enforcement in DevTools in Google Chrome prior to 64.0.3282.119 allowed a remote attacker to potentially leak user local (no CVSS)
- [CVE-2018-6046](https://cve.now/CVE-2018-6046.md): Insufficient data validation in DevTools in Google Chrome prior to 64.0.3282.119 allowed a remote attacker to potentially leak user cross-or (no CVSS, Google Chrome)
- [CVE-2018-6047](https://cve.now/CVE-2018-6047.md): Insufficient policy enforcement in WebGL in Google Chrome prior to 64.0.3282.119 allowed a remote attacker to potentially leak user redirect (no CVSS, Google Chrome)
- [CVE-2018-6048](https://cve.now/CVE-2018-6048.md): Insufficient policy enforcement in Blink in Google Chrome prior to 64.0.3282.119 allowed a remote attacker to potentially leak referrer info (no CVSS, Google Chrome)
- [CVE-2018-6049](https://cve.now/CVE-2018-6049.md): Incorrect security UI in permissions prompt in Google Chrome prior to 64.0.3282.119 allowed a remote attacker to spoof the origin to which p (no CVSS, Google Chrome)
- [CVE-2018-6050](https://cve.now/CVE-2018-6050.md): Incorrect security UI in Omnibox in Google Chrome prior to 64.0.3282.119 allowed a remote attacker to spoof the contents of the Omnibox (URL (no CVSS, Google Chrome)
- [CVE-2018-6051](https://cve.now/CVE-2018-6051.md): XSS Auditor in Google Chrome prior to 64.0.3282.119, did not ensure the reporting URL was in the same origin as the page it was on, which al (no CVSS, Google Chrome)
- [CVE-2018-6052](https://cve.now/CVE-2018-6052.md): Lack of support for a non standard no-referrer policy value in Blink in Google Chrome prior to 64.0.3282.119 allowed a remote attacker to ob (no CVSS, Google Chrome)
- [CVE-2018-6053](https://cve.now/CVE-2018-6053.md): Inappropriate implementation in New Tab Page in Google Chrome prior to 64.0.3282.119 allowed a local attacker to view website thumbnail imag (no CVSS, Google Chrome)
- [CVE-2018-6054](https://cve.now/CVE-2018-6054.md): Use after free in WebUI in Google Chrome prior to 64.0.3282.119 allowed a remote attacker to potentially exploit heap corruption via a craft (no CVSS, Google Chrome)
- [CVE-2018-6055](https://cve.now/CVE-2018-6055.md): Insufficient policy enforcement in Catalog Service in Google Chrome prior to 64.0.3282.119 allowed a remote attacker to potentially run arbi (no CVSS, Google Chrome)
- [CVE-2018-6119](https://cve.now/CVE-2018-6119.md): Incorrect security UI in Omnibox in Google Chrome prior to 64.0.3282.119 allowed a remote attacker to spoof the contents of the Omnibox (URL (no CVSS, Google Chrome)
- [CVE-2018-12775](https://cve.now/CVE-2018-12775.md): Adobe Acrobat and Reader versions 2018.011.20058 and earlier, 2017.011.30099 and earlier, and 2015.006.30448 and earlier have an out-of-boun (no CVSS, Adobe Acrobat and Reader)
- [CVE-2018-12778](https://cve.now/CVE-2018-12778.md): Adobe Acrobat and Reader versions 2018.011.20058 and earlier, 2017.011.30099 and earlier, and 2015.006.30448 and earlier have an out-of-boun (no CVSS, Adobe Acrobat and Reader)
- [CVE-2018-12801](https://cve.now/CVE-2018-12801.md): Adobe Acrobat and Reader versions 2018.011.20058 and earlier, 2017.011.30099 and earlier, and 2015.006.30448 and earlier have an out-of-boun (no CVSS, Adobe Acrobat and Reader)
- [CVE-2018-12840](https://cve.now/CVE-2018-12840.md): Adobe Acrobat and Reader versions 2018.011.20058 and earlier, 2017.011.30099 and earlier, and 2015.006.30448 and earlier have an out-of-boun (no CVSS)
- [CVE-2018-12848](https://cve.now/CVE-2018-12848.md): Adobe Acrobat and Reader versions 2018.011.20058 and earlier, 2017.011.30099 and earlier, and 2015.006.30448 and earlier have an out-of-boun (no CVSS, Adobe Acrobat and Reader)
- [CVE-2018-12849](https://cve.now/CVE-2018-12849.md): Adobe Acrobat and Reader versions 2018.011.20058 and earlier, 2017.011.30099 and earlier, and 2015.006.30448 and earlier have an out-of-boun (no CVSS, Adobe Acrobat and Reader)
- [CVE-2018-12850](https://cve.now/CVE-2018-12850.md): Adobe Acrobat and Reader versions 2018.011.20058 and earlier, 2017.011.30099 and earlier, and 2015.006.30448 and earlier have an out-of-boun (no CVSS, Adobe Acrobat and Reader)
- [CVE-2018-15957](https://cve.now/CVE-2018-15957.md): Adobe ColdFusion versions July 12 release (2018.0.0.310739), Update 6 and earlier, and Update 14 and earlier have a deserialization of untru (CVSS 9.8, Adobe ColdFusion)
- [CVE-2018-15958](https://cve.now/CVE-2018-15958.md): Adobe ColdFusion versions July 12 release (2018.0.0.310739), Update 6 and earlier, and Update 14 and earlier have a deserialization of untru (CVSS 9.8, Adobe ColdFusion)
- [CVE-2018-15959](https://cve.now/CVE-2018-15959.md): Adobe ColdFusion versions July 12 release (2018.0.0.310739), Update 6 and earlier, and Update 14 and earlier have a deserialization of untru (CVSS 9.8, Adobe ColdFusion)
- [CVE-2018-15960](https://cve.now/CVE-2018-15960.md): Adobe ColdFusion versions July 12 release (2018.0.0.310739), Update 6 and earlier, and Update 14 and earlier have a use of a component with (no CVSS, Adobe ColdFusion)
- [CVE-2018-15961](https://cve.now/CVE-2018-15961.md): Adobe ColdFusion versions July 12 release (2018.0.0.310739), Update 6 and earlier, and Update 14 and earlier have an unrestricted file uploa (CVSS 9.8, KEV, Adobe ColdFusion)
- [CVE-2018-15962](https://cve.now/CVE-2018-15962.md): Adobe ColdFusion versions July 12 release (2018.0.0.310739), Update 6 and earlier, and Update 14 and earlier have a directory listing vulner (CVSS 5.3, Adobe ColdFusion)
- [CVE-2018-15963](https://cve.now/CVE-2018-15963.md): Adobe ColdFusion versions July 12 release (2018.0.0.310739), Update 6 and earlier, and Update 14 and earlier have a security bypass vulnerab (CVSS 5.3, Adobe ColdFusion)
- [CVE-2018-15964](https://cve.now/CVE-2018-15964.md): Adobe ColdFusion versions July 12 release (2018.0.0.310739), Update 6 and earlier, and Update 14 and earlier have a use of a component with (CVSS 7.5, Adobe ColdFusion)
- [CVE-2018-15965](https://cve.now/CVE-2018-15965.md): Adobe ColdFusion versions July 12 release (2018.0.0.310739), Update 6 and earlier, and Update 14 and earlier have a deserialization of untru (CVSS 9.8, Adobe ColdFusion)
- [CVE-2018-15967](https://cve.now/CVE-2018-15967.md): Adobe Flash Player versions 30.0.0.154 and earlier have a privilege escalation vulnerability. (no CVSS, Adobe Flash Player)
- [CVE-2018-14318](https://cve.now/CVE-2018-14318.md): This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Samsung Galaxy S8 G950FXXU1AQL5. (no CVSS, Samsung Galaxy S8)
- [CVE-2018-14633](https://cve.now/CVE-2018-14633.md): A security flaw was found in the chap\_server\_compute\_md5() function in the ISCSI target code in the Linux kernel in a way an authentication (CVSS 7.0, The Linux Foundation kernel)
- [CVE-2018-14647](https://cve.now/CVE-2018-14647.md): Python's elementtree C accelerator failed to initialise Expat's hash salt during initialization. (CVSS 5.3, The Python Project Python)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2018-09-25
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.