# CVEs published 2018-10-08

48 CVEs were published on October 8, 2018: 4 critical, 9 high. Days are UTC.

- [CVE-2018-14656](https://cve.now/CVE-2018-14656.md): A missing address check in the callers of the show\_opcodes() in the Linux kernel allows an attacker to dump the kernel memory at an… (CVSS 7.0, \[UNKNOWN\] kernel)
- [CVE-2018-18069](https://cve.now/CVE-2018-18069.md): process\_forms in the WPML (aka sitepress-multilingual-cms) plugin through 3.6.3 for WordPress has XSS via any locale\_file\_name\_ parameter… (no CVSS)
- [CVE-2016-7475](https://cve.now/CVE-2016-7475.md): Under some circumstances on BIG-IP 12.0.0-12.1.0, 11.6.0-11.6.1, or 11.4.0-11.5.4 HF1, the Traffic Management Microkernel (TMM) may not… (no CVSS, F5 Networks BIG-IP)
- [CVE-2018-18064](https://cve.now/CVE-2018-18064.md): cairo through 1.15.14 has an out-of-bounds stack-memory write during processing of a crafted document by WebKitGTK+ because of the… (no CVSS)
- [CVE-2018-18065](https://cve.now/CVE-2018-18065.md): \_set\_key in agent/helpers/table\_container.c in Net-SNMP before 5.8 has a NULL Pointer Exception bug that can be used by an authenticated… (no CVSS)
- [CVE-2018-18066](https://cve.now/CVE-2018-18066.md): snmp\_oid\_compare in snmplib/snmp\_api.c in Net-SNMP before 5.8 has a NULL Pointer Exception bug that can be used by an unauthenticated… (CVSS 7.5)
- [CVE-2018-15903](https://cve.now/CVE-2018-15903.md): The Discuss v1.2.1 module in Claromentis 8.2.2 is vulnerable to stored Cross Site Scripting (XSS). (no CVSS)
- [CVE-2018-17775](https://cve.now/CVE-2018-17775.md): Seqrite End Point Security v7.4 has "Everyone: (F)" permission for %PROGRAMFILES%\\Seqrite\\Seqrite, which allows local users to gain… (no CVSS)
- [CVE-2018-17977](https://cve.now/CVE-2018-17977.md): The Linux kernel 4.14.67 mishandles certain interaction among XFRM Netlink messages, IPPROTO\_AH packets, and IPPROTO\_IP packets, which… (no CVSS)
- [CVE-2018-16291](https://cve.now/CVE-2018-16291.md): An exploitable use-after-free vulnerability exists in the JavaScript engine of Foxit Reader before 9.3 and PhantomPDF before 9.3, a… (no CVSS)
- [CVE-2018-16292](https://cve.now/CVE-2018-16292.md): An exploitable use-after-free vulnerability exists in the JavaScript engine of Foxit Reader before 9.3 and PhantomPDF before 9.3, a… (no CVSS)
- [CVE-2018-16293](https://cve.now/CVE-2018-16293.md): An exploitable use-after-free vulnerability exists in the JavaScript engine of Foxit Reader before 9.3 and PhantomPDF before 9.3, a… (no CVSS)
- [CVE-2018-16294](https://cve.now/CVE-2018-16294.md): An exploitable use-after-free vulnerability exists in the JavaScript engine of Foxit Reader before 9.3 and PhantomPDF before 9.3, a… (no CVSS)
- [CVE-2018-16295](https://cve.now/CVE-2018-16295.md): An exploitable use-after-free vulnerability exists in the JavaScript engine of Foxit Reader before 9.3 and PhantomPDF before 9.3, a… (no CVSS)
- [CVE-2018-16296](https://cve.now/CVE-2018-16296.md): An exploitable use-after-free vulnerability exists in the JavaScript engine of Foxit Reader before 9.3 and PhantomPDF before 9.3, a… (no CVSS)
- [CVE-2018-16297](https://cve.now/CVE-2018-16297.md): An exploitable use-after-free vulnerability exists in the JavaScript engine of Foxit Reader before 9.3 and PhantomPDF before 9.3, a… (no CVSS)
- [CVE-2018-17060](https://cve.now/CVE-2018-17060.md): Telerik Extensions for ASP.NET MVC (all versions) does not whitelist requests, which can allow a remote attacker to access files inside… (no CVSS, TelerikMvcExtensions)
- [CVE-2018-17440](https://cve.now/CVE-2018-17440.md): An issue was discovered on D-Link Central WiFi Manager before v 1.03r0100-Beta1. (no CVSS)
- [CVE-2018-17441](https://cve.now/CVE-2018-17441.md): An issue was discovered on D-Link Central WiFi Manager before v 1.03r0100-Beta1. (no CVSS)
- [CVE-2018-17442](https://cve.now/CVE-2018-17442.md): An issue was discovered on D-Link Central WiFi Manager before v 1.03r0100-Beta1. (no CVSS)
- [CVE-2018-17443](https://cve.now/CVE-2018-17443.md): An issue was discovered on D-Link Central WiFi Manager before v 1.03r0100-Beta1. (no CVSS)
- [CVE-2018-3940](https://cve.now/CVE-2018-3940.md): An exploitable use-after-free vulnerability exists in the JavaScript engine of Foxit Software's PDF Reader, version 9.1.0.5096. (CVSS 8.0, Foxit Software Foxit PDF Reader)
- [CVE-2018-3941](https://cve.now/CVE-2018-3941.md): An exploitable use-after-free vulnerability exists in the JavaScript engine of Foxit Software's Foxit PDF Reader version 9.1.0.5096. (CVSS 8.0, Foxit Software Foxit PDF Reader)
- [CVE-2018-3942](https://cve.now/CVE-2018-3942.md): An exploitable use-after-free vulnerability exists in the JavaScript engine of Foxit Software's PDF Reader, version 9.1.0.5096. (CVSS 8.0, Foxit Software Foxit PDF Reader)
- [CVE-2018-3945](https://cve.now/CVE-2018-3945.md): An exploitable use-after-free vulnerability exists in the JavaScript engine of Foxit Software's Foxit PDF Reader version 9.1.0.5096. (CVSS 8.0, Foxit Software Foxit PDF Reader)
- [CVE-2018-3992](https://cve.now/CVE-2018-3992.md): An exploitable use-after-free vulnerability exists in the JavaScript engine of Foxit Software's Foxit PDF Reader, version 9.2.0.9297. (CVSS 8.0, Foxit Software Foxit PDF Reader)
- [CVE-2018-3996](https://cve.now/CVE-2018-3996.md): An exploitable use-after-free vulnerability exists in the JavaScript engine of Foxit Software's PDF Reader, version 9.2.0.9297. (CVSS 8.0, Foxit Software Foxit PDF Reader)
- [CVE-2018-3997](https://cve.now/CVE-2018-3997.md): An exploitable use-after-free vulnerability exists in the JavaScript engine of Foxit Software's Foxit PDF Reader, version 9.2.0.9297. (CVSS 8.0, Foxit Software Foxit PDF Reader)
- [CVE-2018-1000803](https://cve.now/CVE-2018-1000803.md): Gitea version prior to version 1.5.1 contains a CWE-200 vulnerability that can result in Exposure of users private email addresses. (no CVSS, github.com/go-gitea/gitea)
- [CVE-2018-1000804](https://cve.now/CVE-2018-1000804.md): contiki-ng version 4 contains a Buffer Overflow vulnerability in AQL (Antelope Query Language) database engine that can result in Attacker… (no CVSS)
- [CVE-2018-1000805](https://cve.now/CVE-2018-1000805.md): Paramiko version 2.4.1, 2.3.2, 2.2.3, 2.1.5, 2.0.8, 1.18.5, 1.17.6 contains a Incorrect Access Control vulnerability in SSH server that… (no CVSS, paramiko)
- [CVE-2018-1000808](https://cve.now/CVE-2018-1000808.md): Python Cryptographic Authority pyopenssl version Before 17.5.0 contains a CWE - 401 : Failure to Release Memory Before Removing Last… (no CVSS, pyopenssl)
- [CVE-2018-1000809](https://cve.now/CVE-2018-1000809.md): privacyIDEA version 2.23.1 and earlier contains a Improper Input Validation vulnerability in token validation api that can result in… (no CVSS, privacyidea)
- [CVE-2018-1000810](https://cve.now/CVE-2018-1000810.md): The Rust Programming Language Standard Library version 1.29.0, 1.28.0, 1.27.2, 1.27.1, 127.0, 126.2, 126.1, 126.0 contains a CWE-680… (no CVSS)
- [CVE-2018-1741](https://cve.now/CVE-2018-1741.md): IBM Tivoli Key Lifecycle Manager 2.6, 2.7, and 3.0 does not properly limit the number or frequency of interaction which could be used to… (CVSS 6.5, IBM Security Key Lifecycle Manager)
- [CVE-2018-1742](https://cve.now/CVE-2018-1742.md): IBM Tivoli Key Lifecycle Manager 2.6, 2.7, and 3.0 contains hard-coded credentials, such as a password or cryptographic key, which it uses… (CVSS 5.9, IBM Security Key Lifecycle Manager)
- [CVE-2018-1743](https://cve.now/CVE-2018-1743.md): IBM Tivoli Key Lifecycle Manager 2.6, 2.7, and 3.0 discloses sensitive information to unauthorized users. (CVSS 5.3, IBM Security Key Lifecycle Manager)
- [CVE-2018-1749](https://cve.now/CVE-2018-1749.md): IBM Tivoli Key Lifecycle Manager 2.6, 2.7, and 3.0 uses incomplete blacklisting for input validation which allows attackers to bypass… (CVSS 4.3, IBM Security Key Lifecycle Manager)
- [CVE-2018-1750](https://cve.now/CVE-2018-1750.md): IBM Security Key Lifecycle Manager 3.0 specifies permissions for a security-critical resource in a way that allows that resource to be… (CVSS 4.2, IBM Security Key Lifecycle Manager)
- [CVE-2018-1753](https://cve.now/CVE-2018-1753.md): IBM Tivoli Key Lifecycle Manager 2.6, 2.7, and 3.0 generates an error message that includes sensitive information about its environment… (CVSS 4.3, IBM Security Key Lifecycle Manager)
- [CVE-2018-5399](https://cve.now/CVE-2018-5399.md): The Auto-Maskin DCU 210E firmware contains an undocumented Dropbear SSH server, v2015.55, configured to listen on Port 22 while the DCU is… (CVSS 9.4, Auto-Maskin DCU-210E · Auto-Maskin RP-210E)
- [CVE-2018-5400](https://cve.now/CVE-2018-5400.md): The Auto-Maskin DCU 210E, RP-210E, and Marine Pro Observer Android App utilize an undocumented custom protocol to set up Modbus… (CVSS 9.1, Auto-Maskin DCU-210E · Auto-Maskin RP-210E +1)
- [CVE-2018-5401](https://cve.now/CVE-2018-5401.md): The Auto-Maskin DCU 210E, RP-210E, and Marine Pro Observer Android App transmit sensitive or security-critical data in cleartext in a… (CVSS 9.1, Auto-Maskin DCU-210E · Auto-Maskin RP-210E +1)
- [CVE-2018-5402](https://cve.now/CVE-2018-5402.md): The Auto-Maskin DCU 210E, RP-210E, and Marine Pro Observer Android App use an embedded webserver that uses unencrypted plaintext for the… (CVSS 9.1, Auto-Maskin DCU-210E · Auto-Maskin RP-210E)
- [CVE-2018-14810](https://cve.now/CVE-2018-14810.md): WECON Technology Co., Ltd. (no CVSS, WECON PI Studio HMI · WECON PI Studio)
- [CVE-2018-14818](https://cve.now/CVE-2018-14818.md): WECON Technology Co., Ltd. (no CVSS, WECON PI Studio HMI · WECON PI Studio)
- [CVE-2018-17889](https://cve.now/CVE-2018-17889.md): In WECON Technology Co., Ltd. (no CVSS, WECON PI Studio HMI · WECON PI Studio)
- [CVE-2018-1000807](https://cve.now/CVE-2018-1000807.md): Python Cryptographic Authority pyopenssl version prior to version 17.5.0 contains a CWE-416: Use After Free vulnerability in X509 object… (no CVSS, pyopenssl)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/archive/2018-10-08
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.