CVEs published September 28, 2018
62 CVEs were published on September 28, 2018: 1 critical, 3 high.
- Published
- 62
- Critical
- 1
- High
- 3
- Medium
- 6
- Low
- 0
- Unrated
- 52
- Now in CISA KEV
- 0
- Fix available
- 10
Most affected products
- Lenovo Group Iomega StorCenter · Lenovo Group LenovoEMC +1
- 9
- Dell EMC Unity · Dell EMC UnityVSA
- 3
- FreeBSD
- 3
- RSA Authentication Manager
- 3
- [UNKNOWN] 389-ds-base:
- 1
- DELL EMC ESRS Policy Manager
- 1
- IBM Platform Symphony · IBM Spectrum Symphony
- 1
- IBM Spectrum Symphony · IBM Platform Symphony
- 1
- jekyll
- 1
- org.grails.plugins:asset-pipeline
- 1
Critical 1
High 3
- CVE-2018-1251Dell EMC Unity and UnityVSA versions prior to 4.3.1.1525703027 contains a URL Redirection vulnerability.Dell EMC Unity · Dell EMC UnityVSA
- CVE-2018-14648A flaw was found in 389 Directory Server.[UNKNOWN] 389-ds-base:
- CVE-2018-1702IBM Platform Symphony 7.1 Fix Pack 1 and 7.1.1 and IBM Spectrum Symphony 7.1.2 and 7.2.0.2 are vulnerable to a XML External Entity InjectionIBM Spectrum Symphony · IBM Platform Symphony
Medium, low and unrated 58
- CVE-2018-17776PCProtect Anti-Virus v4.8.35 has "Everyone: (F)" permission for %PROGRAMFILES(X86)%\PCProtect, which allows local users to gain privileges b
- CVE-2018-9074Iomega and LenovoEMC NAS Web UI VulnerabilitiesLenovo Group Iomega StorCenter · Lenovo Group LenovoEMC +1
- CVE-2018-9075Iomega and LenovoEMC NAS Web UI VulnerabilitiesLenovo Group Iomega StorCenter · Lenovo Group LenovoEMC +1
- CVE-2018-9076Iomega and LenovoEMC NAS Web UI VulnerabilitiesLenovo Group Iomega StorCenter · Lenovo Group LenovoEMC +1
- CVE-2018-9077Iomega and LenovoEMC NAS Web UI VulnerabilitiesLenovo Group Iomega StorCenter · Lenovo Group LenovoEMC +1
- CVE-2018-9078Iomega and LenovoEMC NAS Web UI VulnerabilitiesLenovo Group Iomega StorCenter · Lenovo Group LenovoEMC +1
- CVE-2018-9079Iomega and LenovoEMC NAS Web UI VulnerabilitiesLenovo Group Iomega StorCenter · Lenovo Group LenovoEMC +1
- CVE-2018-9080Iomega and LenovoEMC NAS Web UI VulnerabilitiesLenovo Group Iomega StorCenter · Lenovo Group LenovoEMC +1
- CVE-2018-9081Iomega and LenovoEMC NAS Web UI VulnerabilitiesLenovo Group Iomega StorCenter · Lenovo Group LenovoEMC +1
- CVE-2018-9082Iomega and LenovoEMC NAS Web UI VulnerabilitiesLenovo Group Iomega StorCenter · Lenovo Group LenovoEMC +1
- CVE-2018-11073DSA-2018-152: RSA® Authentication Manager Multiple VulnerabilitiesRSA Authentication Manager
- CVE-2018-11074DSA-2018-152: RSA® Authentication Manager Multiple VulnerabilitiesRSA Authentication Manager
- CVE-2018-11075DSA-2018-152: RSA® Authentication Manager Multiple VulnerabilitiesRSA Authentication Manager
- CVE-2018-1246Dell EMC Unity and UnityVSA contains reflected cross-site scripting vulnerability.Dell EMC Unity · Dell EMC UnityVSA
- CVE-2018-1250Dell EMC Unity and UnityVSA versions prior to 4.3.1.1525703027 contains an Authorization Bypass vulnerability.Dell EMC Unity · Dell EMC UnityVSA
- CVE-2018-15365A Reflected Cross-Site Scripting (XSS) vulnerability in Trend Micro Deep Discovery Inspector 3.85 and below could allow an attacker to bypasTrend Micro Deep Discovery Inspector
- CVE-2018-5393TP-Link EAP Controller versions 2.5.3 and earlier lack RMI authenticationTP-LINK EAP Controller
- CVE-2018-1704IBM Platform Symphony 7.1 Fix Pack 1 and 7.1.1 and IBM Spectrum Symphony 7.1.2 and 7.2.0.2 could allow a remote attacker to conduct phishingIBM Platform Symphony · IBM Spectrum Symphony
- CVE-2018-17154In FreeBSD before 11.2-STABLE(r338987), 11.2-RELEASE-p4, and 11.1-RELEASE-p15, due to insufficient memory checking in the freebsd4_getfsstatFreeBSD
- CVE-2018-17155In FreeBSD before 11.2-STABLE(r338983), 11.2-RELEASE-p4, 11.1-RELEASE-p15, 10.4-STABLE(r338984), and 10.4-RELEASE-p13, due to insufficient iFreeBSD
- CVE-2018-6925In FreeBSD before 11.2-STABLE(r338986), 11.2-RELEASE-p4, 11.1-RELEASE-p15, 10.4-STABLE(r338985), and 10.4-RELEASE-p13, due to improper maintFreeBSD
- CVE-2018-17613Telegram Desktop (aka tdesktop) 1.3.16 alpha, when "Use proxy" is enabled, sends credentials and application data in cleartext over the SOCK
- CVE-2018-17574An issue was discovered in YMFE YApi 1.3.23.yapi-vendor
- CVE-2018-17575SWA SWA.JACAD 3.1.37 Build 024 has SQL Injection via the /academico/aluno/esqueci-minha-senha/ studentId parameter.
- CVE-2018-17580A heap-based buffer over-read exists in the function fast_edit_packet() in the file send_packets.c of Tcpreplay v4.3.0 beta1.
- CVE-2018-17582Tcpreplay v4.3.0 beta1 contains a heap-based buffer over-read.
- CVE-2018-17605An issue was discovered in the Asset Pipeline plugin before 3.0.4 for Grails.org.grails.plugins:asset-pipeline
- CVE-2018-17607Foxit PhantomPDF and Reader before 9.3 allow remote attackers to execute arbitrary code or cause a denial of service (use-after-free) becaus
- CVE-2018-17608Foxit PhantomPDF and Reader before 9.3 allow remote attackers to execute arbitrary code or cause a denial of service (use-after-free) becaus
- CVE-2018-17609Foxit PhantomPDF and Reader before 9.3 allow remote attackers to execute arbitrary code or cause a denial of service (use-after-free) becaus
- CVE-2018-17610Foxit PhantomPDF and Reader before 9.3 allow remote attackers to execute arbitrary code or cause a denial of service (use-after-free) becaus
- CVE-2018-17611Foxit PhantomPDF and Reader before 9.3 allow remote attackers to execute arbitrary code or cause a denial of service (use-after-free) becaus
- CVE-2018-17571Vanilla before 2.6.1 allows XSS via the email field of a profile.
- CVE-2018-17573The Wp-Insert plugin through 2.4.2 for WordPress allows upload of arbitrary PHP code because of the exposure and configuration of FCKeditor
- CVE-2018-14037Cross-site scripting (XSS) vulnerability in Progress Kendo UI Editor v2018.1.221 allows remote attackers to inject arbitrary JavaScript into
- CVE-2018-14956CMS ISWEB 3.5.3 is vulnerable to multiple SQL injection flaws.
- CVE-2018-14957CMS ISWEB 3.5.3 is vulnerable to directory traversal and local file download, as demonstrated by moduli/downloadFile.php?file=oggetto_docume
- CVE-2018-16277The Image Import function in XWiki through 10.7 has XSS.org.xwiki.platform:xwiki-platform
- CVE-2018-16586In Open Ticket Request System (OTRS) 4.0.x before 4.0.32, 5.0.x before 5.0.30, and 6.0.x before 6.0.11, an attacker could send a malicious e
- CVE-2018-16587In Open Ticket Request System (OTRS) 4.0.x before 4.0.32, 5.0.x before 5.0.30, and 6.0.x before 6.0.11, an attacker could send a malicious e
- CVE-2018-16659An issue was discovered in Rausoft ID.prove 2.95.
- CVE-2018-17055An arbitrary file upload vulnerability in Progress Sitefinity CMS versions 4.0 through 11.0 related to image uploads.
- CVE-2018-17056Cross-site scripting (XSS) vulnerability in ServiceStack in Progress Sitefinity CMS versions 10.2 through 11.0 allows remote attackers to in
- CVE-2018-17375SQL Injection exists in the Music Collection 3.0.3 component for Joomla! via the id parameter.
- CVE-2018-17376SQL Injection exists in the Reverse Auction Factory 4.3.8 component for Joomla! via the filter_order_Dir, cat, or filter_letter parameter.
- CVE-2018-17377SQL Injection exists in the Questions 1.4.3 component for Joomla! via the term, userid, users, or groups parameter.
- CVE-2018-17378SQL Injection exists in the Penny Auction Factory 2.0.4 component for Joomla! via the filter_order_Dir or filter_order parameter.
- CVE-2018-17379SQL Injection exists in the Raffle Factory 3.5.2 component for Joomla! via the filter_order_Dir or filter_order parameter.
- CVE-2018-17380SQL Injection exists in the Article Factory Manager 4.3.9 component for Joomla! via the start_date, m_start_date, or m_end_date parameter.
- CVE-2018-17382SQL Injection exists in the Jobs Factory 2.0.4 component for Joomla! via the filter_letter parameter.
- CVE-2018-17383SQL Injection exists in the Collection Factory 4.1.9 component for Joomla! via the filter_order or filter_order_Dir parameter.
- CVE-2018-17384SQL Injection exists in the Swap Factory 2.2.1 component for Joomla! via the filter_order_Dir or filter_order parameter.
- CVE-2018-17385SQL Injection exists in the Social Factory 3.8.3 component for Joomla! via the radius[lat], radius[lng], or radius[radius] parameter.
- CVE-2018-17391SQL Injection exists in authors_post.php in Super Cms Blog Pro 1.0 via the author parameter.
- CVE-2018-17394SQL Injection exists in the Timetable Schedule 3.6.8 component for Joomla! via the eid parameter.
- CVE-2018-17397SQL Injection exists in the AlphaIndex Dictionaries 1.0 component for Joomla! via the letter parameter.
- CVE-2018-17567Jekyll through 3.6.2, 3.7.x through 3.7.3, and 3.8.x through 3.8.3 allows attackers to access arbitrary files by specifying a symlink in thejekyll
- CVE-2018-17581CiffDirectory::readDirectory() at crwimage_int.cpp in Exiv2 0.26 has excessive stack consumption due to a recursive function, leading to Den