CVEs published September 26, 2018
63 CVEs were published on September 26, 2018: 1 critical, 2 high.
- Published
- 63
- Critical
- 1
- High
- 2
- Medium
- 5
- Low
- 1
- Unrated
- 54
- Now in CISA KEV
- 0
- Fix available
- 1
Most affected products
- Philips e-Alert Unit
- 9
- Fuji Electric V-Server
- 6
- IBM Spectrum Protect
- 3
- WECON Technology Co. LeviStudioU
- 2
- https://github.com/sabelnikov Epee
- 1
- Huawei Technologies Co. Agassi-L09,Agassi-W09,Baggio2-U01A,…
- 1
- IBM Rational DOORS Next Generation
- 1
- IBM Spectrum Protect Plus
- 1
- IBM WebSphere Application Server
- 1
- net.bull.javamelody:javamelody-core
- 1
Critical 1
High 2
- CVE-2018-16151In verify_emsa_pkcs1_signature() in gmp_rsa_public_key.c in the gmp plugin in strongSwan 4.x and 5.x before 5.7.0, the RSA implementation ba
- CVE-2018-16152In verify_emsa_pkcs1_signature() in gmp_rsa_public_key.c in the gmp plugin in strongSwan 4.x and 5.x before 5.7.0, the RSA implementation ba
Medium, low and unrated 60
- CVE-2018-14327The installer for the Alcatel OSPREY3_MINI Modem component on EE EE40VB 4G mobile broadband modems with firmware before EE40_00_02.00_45 set
- CVE-2018-15531JavaMelody before 1.74.0 has XXE via parseSoapMethodName in bull/javamelody/PayloadNameRequestWrapper.java.net.bull.javamelody:javamelody-core
- CVE-2018-16055An authenticated command injection vulnerability exists in status_interfaces.php via dhcp_relinquish_lease() in pfSense before 2.4.4 due to
- CVE-2018-16588Privilege escalation can occur in the SUSE useradd.c code in useradd, as distributed in the SUSE shadow package through 4.2.1-27.9.1 for SUS
- CVE-2018-16711IObit Advanced SystemCare, which includes Monitor_win10_x64.sys or Monitor_win7_x64.sys, 1.2.0.5 (and possibly earlier versions) allows a us
- CVE-2018-16712IObit Advanced SystemCare, which includes Monitor_win10_x64.sys or Monitor_win7_x64.sys, 1.2.0.5 (and possibly earlier versions) allows a us
- CVE-2018-16713IObit Advanced SystemCare, which includes Monitor_win10_x64.sys or Monitor_win7_x64.sys, 1.2.0.5 (and possibly earlier versions) allows a us
- CVE-2018-17309On the RICOH MP C406Z printer, HTML Injection and Stored XSS vulnerabilities have been discovered in the area of adding addresses via the en
- CVE-2018-17310On the RICOH MP C1803 JPN printer, HTML Injection and Stored XSS vulnerabilities have been discovered in the area of adding addresses via th
- CVE-2018-17311On the RICOH MP C6503 Plus printer, HTML Injection and Stored XSS vulnerabilities have been discovered in the area of adding addresses via t
- CVE-2018-17312On the RICOH Aficio MP 301 printer, HTML Injection and Stored XSS vulnerabilities have been discovered in the area of adding addresses via t
- CVE-2018-17313On the RICOH MP C307 printer, HTML Injection and Stored XSS vulnerabilities have been discovered in the area of adding addresses via the ent
- CVE-2018-17314On the RICOH Aficio MP 305+ printer, HTML Injection and Stored XSS vulnerabilities have been discovered in the area of adding addresses via
- CVE-2018-17315On the RICOH MP C2003 printer, HTML Injection and Stored XSS vulnerabilities have been discovered in the area of adding addresses via the en
- CVE-2018-17316On the RICOH MP C6003 printer, HTML Injection and Stored XSS vulnerabilities have been discovered in the area of adding addresses via the en
- CVE-2018-17411An XML External Entity (XXE) vulnerability exists in iWay Data Quality Suite Web Console 10.6.1.ga-2016-11-20.
- CVE-2018-17568utils/ut_rpc.c in ViaBTC Exchange Server before 2018-08-21 has an integer overflow leading to memory corruption.
- CVE-2018-17569network/nw_buf.c in ViaBTC Exchange Server before 2018-08-21 has an integer overflow leading to memory corruption.
- CVE-2018-17570utils/ut_ws_svr.c in ViaBTC Exchange Server before 2018-08-21 has an integer overflow leading to memory corruption.
- CVE-2017-15608Inedo ProGet before 5.0 Beta5 has CSRF, allowing an attacker to change advanced settings.
- CVE-2018-15836In verify_signed_hash() in lib/liboswkeys/signatures.c in Openswan before 2.6.50.1, the RSA implementation does not verify the value of padd
- CVE-2018-16364A serialization vulnerability in Zoho ManageEngine Applications Manager before build 13740 allows for remote code execution on Windows via a
- CVE-2018-16968Citrix ShareFile StorageZones Controller before 5.4.2 allows Directory Traversal.
- CVE-2018-16969Citrix ShareFile StorageZones Controller before 5.4.2 has Information Exposure Through an Error Message.
- CVE-2018-17081e107 2.1.9 allows CSRF via e107_admin/wmessage.php?mode=&action=inline&ajax_used=1&id= for changing the title of an arbitrary page.
- CVE-2018-17215An information-disclosure issue was discovered in Postman through 6.3.0.
- CVE-2018-17365SeaCMS 6.64 and 7.2 allows remote attackers to delete arbitrary files via the filedir parameter.
- CVE-2018-17410Horus CMS allows SQL Injection, as demonstrated by a request to the /busca or /home URI.
- CVE-2018-17566In ThinkPHP 5.1.24, the inner function delete can be used for SQL injection when its WHERE condition's value can be controlled by a user's rtopthink/framework
- CVE-2018-14809Fuji Electric V-Server 4.0.3.0 and prior, A use after free vulnerability has been identified, which may allow remote code execution.Fuji Electric V-Server
- CVE-2018-14811Fuji Electric V-Server 4.0.3.0 and prior, Multiple untrusted pointer dereference vulnerabilities have been identified, which may allow remotFuji Electric V-Server
- CVE-2018-14813Fuji Electric V-Server 4.0.3.0 and prior, A heap-based buffer overflow vulnerability has been identified, which may allow remote code executFuji Electric V-Server
- CVE-2018-14815Fuji Electric V-Server 4.0.3.0 and prior, Several out-of-bounds write vulnerabilities have been identified, which may allow remote code exec
- CVE-2018-14817Fuji Electric V-Server 4.0.3.0 and prior, An integer underflow vulnerability has been identified, which may allow remote code execution.Fuji Electric V-Server
- CVE-2018-14819Fuji Electric V-Server 4.0.3.0 and prior, An out-of-bounds read vulnerability has been identified, which may allow remote code execution.Fuji Electric V-Server
- CVE-2018-14823Fuji Electric V-Server 4.0.3.0 and prior, A stack-based buffer overflow vulnerability has been identified, which may allow remote code execuFuji Electric V-Server
- CVE-2018-17555The web component on ARRIS TG2492LG-NA 061213 devices allows remote attackers to obtain sensitive information via the /snmpGet oids paramete
- CVE-2018-17556MODX Revolution v2.6.5-pl allows stored XSS via a Create New Media Source action.
- CVE-2018-14803Philips e-Alert Unit (non-medical device), Version R2.1 and prior.Philips e-Alert Unit
- CVE-2018-8842Philips e-Alert Unit (non-medical device), Version R2.1 and prior.Philips e-Alert Unit
- CVE-2018-8844Philips e-Alert Unit (non-medical device), Version R2.1 and prior.Philips e-Alert Unit
- CVE-2018-8846Philips e-Alert Unit (non-medical device), Version R2.1 and prior.Philips e-Alert Unit
- CVE-2018-8848Philips e-Alert Unit (non-medical device), Version R2.1 and prior.Philips e-Alert Unit
- CVE-2018-8850Philips e-Alert Unit (non-medical device), Version R2.1 and prior.Philips e-Alert Unit
- CVE-2018-8852Philips e-Alert Unit (non-medical device), Version R2.1 and prior.Philips e-Alert Unit
- CVE-2018-8854Philips e-Alert Unit (non-medical device), Version R2.1 and prior.Philips e-Alert Unit
- CVE-2018-8856Philips e-Alert Unit (non-medical device), Version R2.1 and prior.Philips e-Alert Unit
- CVE-2018-10602WECON LeviStudio Versions 1.8.29 and 1.8.44 have multiple stack-based buffer overflow vulnerabilities that can be exploited when the applicaWECON Technology Co. LeviStudioU
- CVE-2018-10606WECON LeviStudio Versions 1.8.29 and 1.8.44 have multiple heap-based buffer overflow vulnerabilities that can be exploited when the applicatWECON Technology Co. LeviStudioU
- CVE-2018-15606An XSS issue was discovered in SalesAgility SuiteCRM 7.x before 7.8.21 and 7.10.x before 7.10.8, related to phishing an error message.
- CVE-2018-16672An issue was discovered in CIRCONTROL CirCarLife before 4.3.
- CVE-2018-7355All versions up to V1.0.0B05 of ZTE MF65 and all versions up to V1.0.0B02 of ZTE MF65M1 are impacted by cross-site scripting vulnerability.ZTE MF65 · ZTE MF65M1
- CVE-2018-1545IBM Tivoli Storage Manager (IBM Spectrum Protect 7.1 and 8.1) uses weaker than expected cryptographic algorithms that could allow an attackeIBM Spectrum Protect
- CVE-2018-1550IBM Spectrum Protect 7.1 and 8.1 could allow a local user to corrupt or delete highly sensitive information that would cause a denial of serIBM Spectrum Protect
- CVE-2018-1610IBM Rational DOORS Next Generation 5.0 through 5.0.2 and 6.0 through 6.0.6 are vulnerable to cross-site scripting.IBM Rational DOORS Next Generation
- CVE-2018-1683IBM WebSphere Application Server Liberty could allow a remote attacker to obtain sensitive information, caused by the failure to encrypt ORBIBM WebSphere Application Server
- CVE-2018-1768IBM Spectrum Protect Plus 10.1.0 and 10.1.1 could disclose sensitive information when an authorized user executes a test operation, the userIBM Spectrum Protect Plus
- CVE-2018-1785IBM Tivoli Storage Manager (IBM Spectrum Protect 7.1 and 8.1) uses weaker than expected cryptographic algorithms that could allow an attackeIBM Spectrum Protect
- CVE-2018-7907Some Huawei products Agassi-L09 AGS-L09C100B257CUSTC100D001, AGS-L09C170B253CUSTC170D001, AGS-L09C199B251CUSTC199D001, AGS-L09C229B003CUSTC2Huawei Technologies Co. Agassi-L09,Agassi-W09,Baggio2-U01A,…
- CVE-2018-17538Axon (formerly TASER International) Evidence Sync 3.15.89 is vulnerable to process injection.