Exploited and new serious CVEs: August 2018

The host name verification when using TLS with the WebSocket client was missing.

• Pre-auth
• Weak crypto

apache · tomcatAug 1, 2018

An exploitable use-after-free vulnerability exists in the JavaScript engine of Foxit Software's Foxit PDF Reader version 9.1.5096.

• RCE
• Memory safety

foxitsoftware · foxit readerAug 1, 2018

MikroTik RouterOS through 6.42 allows unauthenticated remote attackers to read arbitrary files and remote authenticated attackers to write a

• Pre-auth
• Path traversal

mikrotik · routerosAug 2, 2018

Apache Axis 1.x up to and including 1.4 is vulnerable to a cross-site scripting (XSS) attack in the default servlet/services.

• Pre-auth
• XSS

apache · axisAug 2, 2018

An improper handing of overflow in the UTF-8 decoder with supplementary characters can lead to an infinite loop in the decoder causing a Den

• Pre-auth
• Denial of service

apache · tomcatAug 2, 2018

If an async request was completed by the application at the same time as the container triggered the async timeout, a race condition existed

• Pre-auth
• Race condition

apache · tomcatAug 2, 2018

In Universal Media Server (UMS) 7.1.0, the XML parsing engine for SSDP/UPnP functionality is vulnerable to an XML External Entity Processing

• pre-auth RCE
• XXE

spirton · universal media serverAug 3, 2018

django.middleware.common.CommonMiddleware in Django 1.11.x before 1.11.15 and 2.0.x before 2.0.8 has an Open Redirect.

• Pre-auth
• Open redirect

djangoproject · djangoAug 3, 2018

An issue was discovered in Http Foundation in Symfony 2.7.0 through 2.7.48, 2.8.0 through 2.8.43, 3.3.0 through 3.3.17, 3.4.0 through 3.4.13

sensiolabs · symfonyAug 3, 2018

upload.php in Responsive FileManager 9.13.1 allows SSRF via the url parameter.

• Pre-auth
• SSRF

tecrail · responsive filemanagerAug 3, 2018

report_viewer.do in ServiceNow Release Jakarta Patch 8 and earlier allows remote attackers to execute arbitrary code via '${xyz}' Glide Scri

• RCE

servicenow · servicenowAug 3, 2018

cgit_clone_objects in CGit before 1.2.1 has a directory traversal vulnerability when `enable-http-clone=1` is not turned off, as demonstrate

• Pre-auth
• Path traversal

cgit project · cgitAug 3, 2018

A command injection vulnerability was found in the web administration console in SoftNAS Cloud before 4.0.3.

• pre-auth RCE
• Command injection

softnas · cloudAug 3, 2018

upgrade_handle.php on NUUO NVRmini devices allows Remote Command Execution via shell metacharacters in the uploaddir parameter for a writeup

• pre-auth RCE
• Command injection

nuuo · nvrmini firmwareAug 4, 2018

Drupal core 8 before versions 8.3.4 allows remote attackers to execute arbitrary code due to the PECL YAML parser not handling PHP objects s

• pre-auth RCE

drupal · drupalAug 6, 2018

A remote code execution security vulnerability has been identified in all versions of the HP ArcSight WINC Connector prior to v7.3.0.

• pre-auth RCE

hp · arcsight winc connectorAug 6, 2018

A security vulnerability was identified in the Filter SDK component of HP KeyView earlier than v11.2.

• Pre-auth
• Memory safety

hp · keyviewAug 6, 2018

A security vulnerability was identified in the Filter SDK component of HP KeyView earlier than v11.2.

• Pre-auth
• Memory safety

hp · keyviewAug 6, 2018

A security vulnerability was identified in the Filter SDK component of HP KeyView earlier than v11.2.

• Pre-auth
• Memory safety

hp · keyviewAug 6, 2018

Aruba Airwave all versions up to, but not including, 8.2.3.1 is vulnerable to an XML external entities (XXE).

• XXE

hp · airwaveAug 6, 2018

Aruba Airwave all versions up to, but not including, 8.2.3.1 is vulnerable to a reflected cross-site scripting (XSS).

• Pre-auth
• XSS

hp · airwaveAug 6, 2018

A remote code execution vulnerability was identified in HPE Intelligent Management Center (iMC) Wireless Service Manager (WSM) Software earl

• pre-auth RCE

hp · imc wireless service managerAug 6, 2018

A Server Side Template Injection (SSTI) was discovered in the SEOmatic plugin before 3.1.4 for Craft CMS, because requests that don't match

• pre-auth RCE
• SSTI

nystudio107 · seomaticAug 6, 2018

Linux kernel versions 4.9+ can be forced to make very expensive calls to tcp_collapse_ofo_queue() and tcp_prune_ofo_queue() for every incoming packet which can

• Pre-auth
• Denial of service

linux · linux kernelAug 6, 2018

A remote code execution vulnerability was identified in HPE Intelligent Management Center (iMC) PLAT 7.3 E0506P07.

• pre-auth RCE

hp · intelligent management centerAug 6, 2018

A potential security vulnerability has been identified in HPE Intelligent Management Center Platform (IMC Plat) 7.3 E0506P09.

• Pre-auth
• Path traversal

hp · intelligent management centerAug 6, 2018

CeLa Link CLR-M20 devices allow unauthorized users to upload any file (e.g., asp, aspx, cfm, html, jhtml, jsp, or shtml), which causes remot

• pre-auth RCE
• File upload

cela link · clr-m20 firmwareAug 7, 2018

In Laravel Framework through 5.5.40 and 5.6.x through 5.6.29, remote code execution might occur as a result of an unserialize call on a pote

• pre-auth RCE
• Deserialization

laravel · laravelAug 9, 2018

It was found that cobbler 2.6.x exposed all functions from its CobblerXMLRPCInterface class over XMLRPC.

• Pre-auth

cobbler project · cobblerAug 9, 2018

ASUS HG100 devices allow denial of service via an IPv4 packet flood.

• Pre-auth
• Denial of service

asus · hg100 firmwareAug 10, 2018

In WordPress 4.9.7, plugins uploaded via the admin area are not verified as being ZIP files.

• File upload

wordpress · wordpressAug 10, 2018

For Crestron TSW-X60 version prior to 2.001.0037.001 and MC3 version prior to 1.502.0047.001, The devices are shipped with authentication di

• Pre-auth
• Broken access control (IDOR)

crestron · tsw-x60 firmwareAug 10, 2018

A security vulnerability has been identified with certain HP Inkjet printers.

• pre-auth RCE
• Memory safety

hp · t8x44 firmwareAug 13, 2018

From version 1.3.0 onward, Apache Spark's standalone master exposes a REST API for job submission, in addition to the submission mechanism u

• Auth bypass

apache · sparkAug 13, 2018

In Plex Media Server 1.13.2.5154, the XML parsing engine for SSDP/UPnP functionality is vulnerable to an XML External Entity Processing (XXE

• pre-auth RCE
• XXE

plex · media serverAug 13, 2018

In Vuze Bittorrent Client 5.7.6.0, the XML parsing engine for SSDP/UPnP functionality is vulnerable to an XML External Entity Processing (XX

• pre-auth RCE
• XXE

vuze · bittorrent clientAug 13, 2018

Unrestricted file upload in interface/super/manage_site_files.php in versions of OpenEMR before 5.0.1.4 allows a remote authenticated attack

• RCE
• File upload

open-emr · openemrAug 13, 2018

Directory traversal in portal/import_template.php in versions of OpenEMR before 5.0.1.4 allows a remote attacker authenticated in the patien

• Path traversal

open-emr · openemrAug 13, 2018

Directory traversal in portal/import_template.php in versions of OpenEMR before 5.0.1.4 allows a remote attacker authenticated in the patien

• Path traversal

open-emr · openemrAug 13, 2018

Directory traversal in portal/import_template.php in versions of OpenEMR before 5.0.1.4 allows a remote attacker authenticated in the patien

• RCE
• Path traversal

open-emr · openemrAug 13, 2018

mod_userdir CRLF injection

• Pre-auth

apache · http serverAug 14, 2018

Ericsson-LG iPECS NMS 30M allows directory traversal via ipecs-cm/download?filename=../ URIs.

• Pre-auth
• Path traversal

ericssonlg · ipecs nmsAug 15, 2018

Authentication bypass vulnerability in portal/account/register.php in versions of OpenEMR before 5.0.1.4 allows a remote attacker to access

• Pre-auth
• Auth bypass

open-emr · openemrAug 15, 2018

OS command injection occurring in versions of OpenEMR before 5.0.1.4 allows a remote authenticated attacker to execute arbitrary commands by

• RCE
• Command injection

open-emr · openemrAug 15, 2018

OS command injection occurring in versions of OpenEMR before 5.0.1.4 allows a remote authenticated attacker to execute arbitrary commands by

• RCE
• Command injection

open-emr · openemrAug 15, 2018

OS command injection occurring in versions of OpenEMR before 5.0.1.4 allows a remote authenticated attacker to execute arbitrary commands by

• RCE
• Command injection

open-emr · openemrAug 15, 2018

OS command injection occurring in versions of OpenEMR before 5.0.1.4 allows a remote authenticated attacker to execute arbitrary commands by

• RCE
• Command injection

open-emr · openemrAug 15, 2018

A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka "C

• pre-auth RCE
• Memory safety

microsoft · chakracoreAug 15, 2018

A buffer overflow vulnerability exists in the Microsoft SQL Server that could allow remote code execution on an affected system, aka "Micros

• pre-auth RCE
• Memory safety

microsoft · sql serverAug 15, 2018

A remote code execution vulnerability exists in Microsoft Exchange software when the software fails to properly handle objects in memory, ak

• pre-auth RCE
• Memory safety

microsoft · exchange serverAug 15, 2018

A remote code execution vulnerability exists when Internet Explorer improperly validates hyperlinks before loading executable libraries, aka

• pre-auth RCE

microsoft · internet explorerAug 15, 2018

A remote code execution vulnerability exists when the Windows font library improperly handles specially crafted embedded fonts, aka "Microso

• pre-auth RCE

microsoft · windows 10Aug 15, 2018

A remote code execution vulnerability exists in Microsoft Windows that could allow remote code execution if a .LNK file is processed, aka "L

• pre-auth RCE

microsoft · windows 10Aug 15, 2018

A remote code execution vulnerability exists in Microsoft Windows that could allow remote code execution if a .LNK file is processed, aka "L

• pre-auth RCE

microsoft · windows 7Aug 15, 2018

A remote code execution vulnerability exists in "Microsoft COM for Windows" when it fails to properly handle serialized objects, aka "Micros

• pre-auth RCE
• Deserialization

microsoft · windows 10Aug 15, 2018

A remote code execution vulnerability exists when Microsoft Windows PDF Library improperly handles objects in memory, aka "Windows PDF Remot

• pre-auth RCE

microsoft · windows 10Aug 15, 2018

A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Internet Explorer, aka "Scrip

• pre-auth RCE
• Memory safety

microsoft · internet explorerAug 15, 2018

A remote code execution vulnerability exists in the way the scripting engine handles objects in memory in Microsoft browsers, aka "Scripting

• pre-auth RCE
• Memory safety

microsoft · internet explorerAug 15, 2018

A remote code execution vulnerability exists in the way that the ChakraCore scripting engine handles objects in memory, aka "Scripting Engin

• pre-auth RCE
• Memory safety

microsoft · chakracoreAug 15, 2018

A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Internet Explorer, aka "Scrip

• pre-auth RCE
• Memory safety

microsoft · internet explorerAug 15, 2018

A remote code execution vulnerability exists in the way the scripting engine handles objects in memory in Microsoft browsers, aka "Scripting

• pre-auth RCE
• Memory safety

microsoft · internet explorerAug 15, 2018

A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Internet Explorer, aka "Scrip

• pre-auth RCE
• Memory safety

microsoft · internet explorerAug 15, 2018

A remote code execution vulnerability exists in Microsoft Excel software when the software fails to properly handle objects in memory, aka "

• RCE

microsoft · excelAug 15, 2018

A remote code execution vulnerability exists in Microsoft PowerPoint software when the software fails to properly handle objects in memory,

• pre-auth RCE

microsoft · powerpointAug 15, 2018

A remote code execution vulnerability exists when Microsoft Edge improperly accesses objects in memory, aka "Microsoft Edge Memory Corruptio

• pre-auth RCE
• Memory safety

microsoft · edgeAug 15, 2018

A remote code execution vulnerability exists in Microsoft Excel software when the software fails to properly handle objects in memory, aka "

• RCE

microsoft · excelAug 15, 2018

A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka "C

• pre-auth RCE
• Memory safety

microsoft · chakracoreAug 15, 2018

A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka "C

• pre-auth RCE
• Memory safety

microsoft · chakracoreAug 15, 2018

An information disclosure vulnerability exists when Microsoft Excel improperly discloses the contents of its memory, aka "Microsoft Excel In

• Info leak

microsoft · excelAug 15, 2018

A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka "C

• pre-auth RCE

microsoft · chakracoreAug 15, 2018

A remote code execution vulnerability exists in the way the scripting engine handles objects in memory in Microsoft browsers, aka "Scripting

• pre-auth RCE
• Memory safety

microsoft · internet explorerAug 15, 2018

A remote code execution vulnerability exists when Microsoft Edge improperly accesses objects in memory, aka "Microsoft Edge Memory Corruptio

• pre-auth RCE
• Memory safety

microsoft · edgeAug 15, 2018

A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Internet Explorer, aka "Scrip

• pre-auth RCE
• Memory safety

microsoft · internet explorerAug 15, 2018

A remote code execution vulnerability exists in the way that the ChakraCore scripting engine handles objects in memory, aka "Scripting Engin

• pre-auth RCE
• Memory safety

microsoft · chakracoreAug 15, 2018

A remote code execution vulnerability exists in the way that the Windows Graphics Device Interface (GDI) handles objects in the memory, aka

• pre-auth RCE

microsoft · windows 7Aug 15, 2018

A remote code execution vulnerability exists in the way that Microsoft browsers access objects in memory, aka "Microsoft Browser Memory Corr

• pre-auth RCE
• Memory safety

microsoft · internet explorerAug 15, 2018

An elevation of privilege vulnerability exists when the DirectX Graphics Kernel (DXGKRNL) driver improperly handles objects in memory, aka "

• Local privilege escalation

microsoft · windows 10 1507Aug 15, 2018

An elevation of privilege vulnerability exists when the DirectX Graphics Kernel (DXGKRNL) driver improperly handles objects in memory, aka "

• Local privilege escalation

microsoft · windows 10 1507Aug 15, 2018

A remote code execution vulnerability exists when the Windows Shell does not properly validate file paths, aka "Windows Shell Remote Code Ex

• pre-auth RCE

microsoft · windows 10 1703Aug 15, 2018

Citrix XenServer 7.1 and newer allows Directory Traversal.

• Pre-auth
• Path traversal

citrix · xenserverAug 15, 2018

ASUSTOR ADM 3.1.0.RFQ3 uses the same default root:admin username and password as it does for the NAS itself for applications that are instal

• Pre-auth
• Hard-coded credentials

asustor · asustor data masterAug 16, 2018

The tree list functionality in the photo gallery application in ASUSTOR ADM 3.1.0.RFQ3 has a SQL injection vulnerability that affects the 'a

• Pre-auth
• SQL injection

asustor · asustor data masterAug 16, 2018

Pimcore before 5.3.0 allows SQL Injection via the REST web service API.

• SQL injection

pimcore · pimcoreAug 17, 2018

OpenSSH through 7.7 is prone to a user enumeration vulnerability due to not delaying bailout for an invalid authenticating user until after

• Pre-auth
• Race condition

openbsd · opensshAug 17, 2018

In Dojo Toolkit before 1.14, there is unescaped string injection in dojox/Grid/DataGrid.

• Pre-auth

dojotoolkit · dojoAug 17, 2018

Cobbler version Verified as present in Cobbler versions 2.6.11+, but code inspection suggests at least 2.0.0+ or possibly even older version

• Pre-auth

cobblerd · cobblerAug 20, 2018

Geutebrueck re_porter 16 before 7.8.974.20 has a possibility of unauthenticated access to sensitive information including usernames and hash

• Pre-auth
• Auth bypass
• Info leak

geutebrueck · re porter 16 firmwareAug 21, 2018

Apache Struts versions 2.3 to 2.3.34 and 2.5 to 2.5.16 suffer from possible Remote Code Execution when alwaysSelectFullNamespace is true (ei

• pre-auth RCE

apache · strutsAug 22, 2018

A missing input sanitization flaw was found in the implementation of LDP database used for the LDAP server.

• Pre-auth
• Denial of service

samba · sambaAug 22, 2018

GitHub Electron 1.7.15, 1.8.7, 2.0.7, and 3.0.0-beta.6, in certain scenarios involving IFRAME elements and "nativeWindowOpen: true" or "sand

• pre-auth RCE

electronjs · electronAug 23, 2018

libpango in Pango 1.40.8 through 1.42.3, as used in hexchat and other products, allows remote attackers to cause a denial of service (applic

• Pre-auth
• Memory safety
• Denial of service

gnome · pangoAug 24, 2018

/filemanager/ajax_calls.php in tecrail Responsive FileManager before 9.13.4 uses external input to construct a pathname that should be withi

• Pre-auth
• Path traversal

tecrail · responsive filemanagerAug 24, 2018

A command injection vulnerability in egg-scripts <v2.8.1 allows arbitrary shell command execution through a maliciously crafted command line

• pre-auth RCE
• Command injection

eggjs · egg-scriptsAug 24, 2018

The Plainview Activity Monitor plugin before 20180826 for WordPress is vulnerable to OS command injection via shell metacharacters in the ip

• RCE
• Command injection

plainview activity monitor project · plainview activity monitorAug 26, 2018

An issue was discovered in post2file.php in Up.Time Monitoring Station 7.5.0 (build 16) and 7.4.0 (build 13).

• pre-auth RCE
• File upload

idera · uptime infrastructure monitorAug 27, 2018

D-Link DIR-615 devices have a buffer overflow via a long Authorization HTTP header.

• Pre-auth
• Memory safety

dlink · dir-615 firmwareAug 28, 2018

Adobe Flash Player 30.0.0.134 and earlier have an out-of-bounds read vulnerability.

• Pre-auth
• Memory safety

adobe · flash player desktop runtimeAug 29, 2018

Adobe Flash Player 30.0.0.134 and earlier have an out-of-bounds read vulnerability.

• Pre-auth
• Memory safety

adobe · flash playerAug 29, 2018

Grafana 2.x, 3.x, and 4.x before 4.6.4 and 5.x before 5.2.3 allows authentication bypass because an attacker can generate a valid "remember

• Pre-auth
• Auth bypass

grafana · grafanaAug 29, 2018

An issue was discovered on D-Link DIR-601 2.02NA devices.

• Weak crypto

dlink · dir-601 firmwareAug 29, 2018