# CVEs published 2018-09-26

63 CVEs were published on September 26, 2018: 1 critical, 2 high. Days are UTC.

- [CVE-2018-14327](https://cve.now/CVE-2018-14327.md): The installer for the Alcatel OSPREY3\_MINI Modem component on EE EE40VB 4G mobile broadband modems with firmware before EE40\_00\_02.00\_45 set (no CVSS)
- [CVE-2018-15531](https://cve.now/CVE-2018-15531.md): JavaMelody before 1.74.0 has XXE via parseSoapMethodName in bull/javamelody/PayloadNameRequestWrapper.java. (no CVSS, net.bull.javamelody:javamelody-core)
- [CVE-2018-16055](https://cve.now/CVE-2018-16055.md): An authenticated command injection vulnerability exists in status\_interfaces.php via dhcp\_relinquish\_lease() in pfSense before 2.4.4 due to (no CVSS)
- [CVE-2018-16588](https://cve.now/CVE-2018-16588.md): Privilege escalation can occur in the SUSE useradd.c code in useradd, as distributed in the SUSE shadow package through 4.2.1-27.9.1 for SUS (no CVSS)
- [CVE-2018-16711](https://cve.now/CVE-2018-16711.md): IObit Advanced SystemCare, which includes Monitor\_win10\_x64.sys or Monitor\_win7\_x64.sys, 1.2.0.5 (and possibly earlier versions) allows a us (no CVSS)
- [CVE-2018-16712](https://cve.now/CVE-2018-16712.md): IObit Advanced SystemCare, which includes Monitor\_win10\_x64.sys or Monitor\_win7\_x64.sys, 1.2.0.5 (and possibly earlier versions) allows a us (no CVSS)
- [CVE-2018-16713](https://cve.now/CVE-2018-16713.md): IObit Advanced SystemCare, which includes Monitor\_win10\_x64.sys or Monitor\_win7\_x64.sys, 1.2.0.5 (and possibly earlier versions) allows a us (no CVSS)
- [CVE-2018-17309](https://cve.now/CVE-2018-17309.md): On the RICOH MP C406Z printer, HTML Injection and Stored XSS vulnerabilities have been discovered in the area of adding addresses via the en (no CVSS)
- [CVE-2018-17310](https://cve.now/CVE-2018-17310.md): On the RICOH MP C1803 JPN printer, HTML Injection and Stored XSS vulnerabilities have been discovered in the area of adding addresses via th (no CVSS)
- [CVE-2018-17311](https://cve.now/CVE-2018-17311.md): On the RICOH MP C6503 Plus printer, HTML Injection and Stored XSS vulnerabilities have been discovered in the area of adding addresses via t (no CVSS)
- [CVE-2018-17312](https://cve.now/CVE-2018-17312.md): On the RICOH Aficio MP 301 printer, HTML Injection and Stored XSS vulnerabilities have been discovered in the area of adding addresses via t (no CVSS)
- [CVE-2018-17313](https://cve.now/CVE-2018-17313.md): On the RICOH MP C307 printer, HTML Injection and Stored XSS vulnerabilities have been discovered in the area of adding addresses via the ent (no CVSS)
- [CVE-2018-17314](https://cve.now/CVE-2018-17314.md): On the RICOH Aficio MP 305+ printer, HTML Injection and Stored XSS vulnerabilities have been discovered in the area of adding addresses via (no CVSS)
- [CVE-2018-17315](https://cve.now/CVE-2018-17315.md): On the RICOH MP C2003 printer, HTML Injection and Stored XSS vulnerabilities have been discovered in the area of adding addresses via the en (no CVSS)
- [CVE-2018-17316](https://cve.now/CVE-2018-17316.md): On the RICOH MP C6003 printer, HTML Injection and Stored XSS vulnerabilities have been discovered in the area of adding addresses via the en (no CVSS)
- [CVE-2018-17411](https://cve.now/CVE-2018-17411.md): An XML External Entity (XXE) vulnerability exists in iWay Data Quality Suite Web Console 10.6.1.ga-2016-11-20. (no CVSS)
- [CVE-2018-17568](https://cve.now/CVE-2018-17568.md): utils/ut\_rpc.c in ViaBTC Exchange Server before 2018-08-21 has an integer overflow leading to memory corruption. (no CVSS)
- [CVE-2018-17569](https://cve.now/CVE-2018-17569.md): network/nw\_buf.c in ViaBTC Exchange Server before 2018-08-21 has an integer overflow leading to memory corruption. (no CVSS)
- [CVE-2018-17570](https://cve.now/CVE-2018-17570.md): utils/ut\_ws\_svr.c in ViaBTC Exchange Server before 2018-08-21 has an integer overflow leading to memory corruption. (no CVSS)
- [CVE-2017-15608](https://cve.now/CVE-2017-15608.md): Inedo ProGet before 5.0 Beta5 has CSRF, allowing an attacker to change advanced settings. (no CVSS)
- [CVE-2018-15836](https://cve.now/CVE-2018-15836.md): In verify\_signed\_hash() in lib/liboswkeys/signatures.c in Openswan before 2.6.50.1, the RSA implementation does not verify the value of padd (no CVSS)
- [CVE-2018-16151](https://cve.now/CVE-2018-16151.md): In verify\_emsa\_pkcs1\_signature() in gmp\_rsa\_public\_key.c in the gmp plugin in strongSwan 4.x and 5.x before 5.7.0, the RSA implementation ba (CVSS 7.5)
- [CVE-2018-16152](https://cve.now/CVE-2018-16152.md): In verify\_emsa\_pkcs1\_signature() in gmp\_rsa\_public\_key.c in the gmp plugin in strongSwan 4.x and 5.x before 5.7.0, the RSA implementation ba (CVSS 7.5)
- [CVE-2018-16364](https://cve.now/CVE-2018-16364.md): A serialization vulnerability in Zoho ManageEngine Applications Manager before build 13740 allows for remote code execution on Windows via a (no CVSS)
- [CVE-2018-16968](https://cve.now/CVE-2018-16968.md): Citrix ShareFile StorageZones Controller before 5.4.2 allows Directory Traversal. (no CVSS)
- [CVE-2018-16969](https://cve.now/CVE-2018-16969.md): Citrix ShareFile StorageZones Controller before 5.4.2 has Information Exposure Through an Error Message. (no CVSS)
- [CVE-2018-17081](https://cve.now/CVE-2018-17081.md): e107 2.1.9 allows CSRF via e107\_admin/wmessage.php?mode=&action=inline&ajax\_used=1&id= for changing the title of an arbitrary page. (no CVSS)
- [CVE-2018-17215](https://cve.now/CVE-2018-17215.md): An information-disclosure issue was discovered in Postman through 6.3.0. (no CVSS)
- [CVE-2018-17365](https://cve.now/CVE-2018-17365.md): SeaCMS 6.64 and 7.2 allows remote attackers to delete arbitrary files via the filedir parameter. (no CVSS)
- [CVE-2018-17410](https://cve.now/CVE-2018-17410.md): Horus CMS allows SQL Injection, as demonstrated by a request to the /busca or /home URI. (no CVSS)
- [CVE-2018-17566](https://cve.now/CVE-2018-17566.md): In ThinkPHP 5.1.24, the inner function delete can be used for SQL injection when its WHERE condition's value can be controlled by a user's r (no CVSS, topthink/framework)
- [CVE-2018-14809](https://cve.now/CVE-2018-14809.md): Fuji Electric V-Server 4.0.3.0 and prior, A use after free vulnerability has been identified, which may allow remote code execution. (no CVSS, Fuji Electric V-Server)
- [CVE-2018-14811](https://cve.now/CVE-2018-14811.md): Fuji Electric V-Server 4.0.3.0 and prior, Multiple untrusted pointer dereference vulnerabilities have been identified, which may allow remot (no CVSS, Fuji Electric V-Server)
- [CVE-2018-14813](https://cve.now/CVE-2018-14813.md): Fuji Electric V-Server 4.0.3.0 and prior, A heap-based buffer overflow vulnerability has been identified, which may allow remote code execut (no CVSS, Fuji Electric V-Server)
- [CVE-2018-14815](https://cve.now/CVE-2018-14815.md): Fuji Electric V-Server 4.0.3.0 and prior, Several out-of-bounds write vulnerabilities have been identified, which may allow remote code exec (no CVSS)
- [CVE-2018-14817](https://cve.now/CVE-2018-14817.md): Fuji Electric V-Server 4.0.3.0 and prior, An integer underflow vulnerability has been identified, which may allow remote code execution. (no CVSS, Fuji Electric V-Server)
- [CVE-2018-14819](https://cve.now/CVE-2018-14819.md): Fuji Electric V-Server 4.0.3.0 and prior, An out-of-bounds read vulnerability has been identified, which may allow remote code execution. (no CVSS, Fuji Electric V-Server)
- [CVE-2018-14823](https://cve.now/CVE-2018-14823.md): Fuji Electric V-Server 4.0.3.0 and prior, A stack-based buffer overflow vulnerability has been identified, which may allow remote code execu (no CVSS, Fuji Electric V-Server)
- [CVE-2018-17555](https://cve.now/CVE-2018-17555.md): The web component on ARRIS TG2492LG-NA 061213 devices allows remote attackers to obtain sensitive information via the /snmpGet oids paramete (no CVSS)
- [CVE-2018-17556](https://cve.now/CVE-2018-17556.md): MODX Revolution v2.6.5-pl allows stored XSS via a Create New Media Source action. (no CVSS)
- [CVE-2018-14803](https://cve.now/CVE-2018-14803.md): Philips e-Alert Unit (non-medical device), Version R2.1 and prior. (no CVSS, Philips e-Alert Unit)
- [CVE-2018-8842](https://cve.now/CVE-2018-8842.md): Philips e-Alert Unit (non-medical device), Version R2.1 and prior. (no CVSS, Philips e-Alert Unit)
- [CVE-2018-8844](https://cve.now/CVE-2018-8844.md): Philips e-Alert Unit (non-medical device), Version R2.1 and prior. (no CVSS, Philips e-Alert Unit)
- [CVE-2018-8846](https://cve.now/CVE-2018-8846.md): Philips e-Alert Unit (non-medical device), Version R2.1 and prior. (no CVSS, Philips e-Alert Unit)
- [CVE-2018-8848](https://cve.now/CVE-2018-8848.md): Philips e-Alert Unit (non-medical device), Version R2.1 and prior. (no CVSS, Philips e-Alert Unit)
- [CVE-2018-8850](https://cve.now/CVE-2018-8850.md): Philips e-Alert Unit (non-medical device), Version R2.1 and prior. (no CVSS, Philips e-Alert Unit)
- [CVE-2018-8852](https://cve.now/CVE-2018-8852.md): Philips e-Alert Unit (non-medical device), Version R2.1 and prior. (no CVSS, Philips e-Alert Unit)
- [CVE-2018-8854](https://cve.now/CVE-2018-8854.md): Philips e-Alert Unit (non-medical device), Version R2.1 and prior. (no CVSS, Philips e-Alert Unit)
- [CVE-2018-8856](https://cve.now/CVE-2018-8856.md): Philips e-Alert Unit (non-medical device), Version R2.1 and prior. (no CVSS, Philips e-Alert Unit)
- [CVE-2018-10602](https://cve.now/CVE-2018-10602.md): WECON LeviStudio Versions 1.8.29 and 1.8.44 have multiple stack-based buffer overflow vulnerabilities that can be exploited when the applica (no CVSS, WECON Technology Co. LeviStudioU)
- [CVE-2018-10606](https://cve.now/CVE-2018-10606.md): WECON LeviStudio Versions 1.8.29 and 1.8.44 have multiple heap-based buffer overflow vulnerabilities that can be exploited when the applicat (no CVSS, WECON Technology Co. LeviStudioU)
- [CVE-2018-15606](https://cve.now/CVE-2018-15606.md): An XSS issue was discovered in SalesAgility SuiteCRM 7.x before 7.8.21 and 7.10.x before 7.10.8, related to phishing an error message. (no CVSS)
- [CVE-2018-16672](https://cve.now/CVE-2018-16672.md): An issue was discovered in CIRCONTROL CirCarLife before 4.3. (no CVSS)
- [CVE-2018-7355](https://cve.now/CVE-2018-7355.md): All versions up to V1.0.0B05 of ZTE MF65 and all versions up to V1.0.0B02 of ZTE MF65M1 are impacted by cross-site scripting vulnerability. (no CVSS, ZTE MF65 · ZTE MF65M1)
- [CVE-2018-1545](https://cve.now/CVE-2018-1545.md): IBM Tivoli Storage Manager (IBM Spectrum Protect 7.1 and 8.1) uses weaker than expected cryptographic algorithms that could allow an attacke (CVSS 5.9, IBM Spectrum Protect)
- [CVE-2018-1550](https://cve.now/CVE-2018-1550.md): IBM Spectrum Protect 7.1 and 8.1 could allow a local user to corrupt or delete highly sensitive information that would cause a denial of ser (CVSS 6.2, IBM Spectrum Protect)
- [CVE-2018-1610](https://cve.now/CVE-2018-1610.md): IBM Rational DOORS Next Generation 5.0 through 5.0.2 and 6.0 through 6.0.6 are vulnerable to cross-site scripting. (CVSS 5.4, IBM Rational DOORS Next Generation)
- [CVE-2018-1683](https://cve.now/CVE-2018-1683.md): IBM WebSphere Application Server Liberty could allow a remote attacker to obtain sensitive information, caused by the failure to encrypt ORB (CVSS 5.9, IBM WebSphere Application Server)
- [CVE-2018-1768](https://cve.now/CVE-2018-1768.md): IBM Spectrum Protect Plus 10.1.0 and 10.1.1 could disclose sensitive information when an authorized user executes a test operation, the user (CVSS 5.6, IBM Spectrum Protect Plus)
- [CVE-2018-1785](https://cve.now/CVE-2018-1785.md): IBM Tivoli Storage Manager (IBM Spectrum Protect 7.1 and 8.1) uses weaker than expected cryptographic algorithms that could allow an attacke (CVSS 3.7, IBM Spectrum Protect)
- [CVE-2018-3972](https://cve.now/CVE-2018-3972.md): An exploitable code execution vulnerability exists in the Levin deserialization functionality of the Epee library, as used in Monero 'Lithiu (CVSS 10.0, https://github.com/sabelnikov Epee)
- [CVE-2018-7907](https://cve.now/CVE-2018-7907.md): Some Huawei products Agassi-L09 AGS-L09C100B257CUSTC100D001, AGS-L09C170B253CUSTC170D001, AGS-L09C199B251CUSTC199D001, AGS-L09C229B003CUSTC2 (no CVSS, Huawei Technologies Co. Agassi-L09,Agassi-W09,Baggio2-U01A,…)
- [CVE-2018-17538](https://cve.now/CVE-2018-17538.md): Axon (formerly TASER International) Evidence Sync 3.15.89 is vulnerable to process injection. (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2018-09-26
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.