# CVEs published 2018-09-28

62 CVEs were published on September 28, 2018: 1 critical, 3 high. Days are UTC.

- [CVE-2018-17776](https://cve.now/CVE-2018-17776.md): PCProtect Anti-Virus v4.8.35 has "Everyone: (F)" permission for %PROGRAMFILES(X86)%\\PCProtect, which allows local users to gain privileges b (no CVSS)
- [CVE-2018-9074](https://cve.now/CVE-2018-9074.md): Iomega and LenovoEMC NAS Web UI Vulnerabilities (no CVSS, Lenovo Group Iomega StorCenter · Lenovo Group LenovoEMC +1)
- [CVE-2018-9075](https://cve.now/CVE-2018-9075.md): Iomega and LenovoEMC NAS Web UI Vulnerabilities (no CVSS, Lenovo Group Iomega StorCenter · Lenovo Group LenovoEMC +1)
- [CVE-2018-9076](https://cve.now/CVE-2018-9076.md): Iomega and LenovoEMC NAS Web UI Vulnerabilities (no CVSS, Lenovo Group Iomega StorCenter · Lenovo Group LenovoEMC +1)
- [CVE-2018-9077](https://cve.now/CVE-2018-9077.md): Iomega and LenovoEMC NAS Web UI Vulnerabilities (no CVSS, Lenovo Group Iomega StorCenter · Lenovo Group LenovoEMC +1)
- [CVE-2018-9078](https://cve.now/CVE-2018-9078.md): Iomega and LenovoEMC NAS Web UI Vulnerabilities (no CVSS, Lenovo Group Iomega StorCenter · Lenovo Group LenovoEMC +1)
- [CVE-2018-9079](https://cve.now/CVE-2018-9079.md): Iomega and LenovoEMC NAS Web UI Vulnerabilities (no CVSS, Lenovo Group Iomega StorCenter · Lenovo Group LenovoEMC +1)
- [CVE-2018-9080](https://cve.now/CVE-2018-9080.md): Iomega and LenovoEMC NAS Web UI Vulnerabilities (no CVSS, Lenovo Group Iomega StorCenter · Lenovo Group LenovoEMC +1)
- [CVE-2018-9081](https://cve.now/CVE-2018-9081.md): Iomega and LenovoEMC NAS Web UI Vulnerabilities (no CVSS, Lenovo Group Iomega StorCenter · Lenovo Group LenovoEMC +1)
- [CVE-2018-9082](https://cve.now/CVE-2018-9082.md): Iomega and LenovoEMC NAS Web UI Vulnerabilities (no CVSS, Lenovo Group Iomega StorCenter · Lenovo Group LenovoEMC +1)
- [CVE-2018-11073](https://cve.now/CVE-2018-11073.md): DSA-2018-152: RSA® Authentication Manager Multiple Vulnerabilities (CVSS 6.5, RSA Authentication Manager)
- [CVE-2018-11074](https://cve.now/CVE-2018-11074.md): DSA-2018-152: RSA® Authentication Manager Multiple Vulnerabilities (CVSS 6.1, RSA Authentication Manager)
- [CVE-2018-11075](https://cve.now/CVE-2018-11075.md): DSA-2018-152: RSA® Authentication Manager Multiple Vulnerabilities (CVSS 5.8, RSA Authentication Manager)
- [CVE-2018-1246](https://cve.now/CVE-2018-1246.md): Dell EMC Unity and UnityVSA contains reflected cross-site scripting vulnerability. (CVSS 4.7, Dell EMC Unity · Dell EMC UnityVSA)
- [CVE-2018-1250](https://cve.now/CVE-2018-1250.md): Dell EMC Unity and UnityVSA versions prior to 4.3.1.1525703027 contains an Authorization Bypass vulnerability. (CVSS 6.5, Dell EMC Unity · Dell EMC UnityVSA)
- [CVE-2018-1251](https://cve.now/CVE-2018-1251.md): Dell EMC Unity and UnityVSA versions prior to 4.3.1.1525703027 contains a URL Redirection vulnerability. (CVSS 8.3, Dell EMC Unity · Dell EMC UnityVSA)
- [CVE-2018-15764](https://cve.now/CVE-2018-15764.md): Dell EMC ESRS Policy Manager versions 6.8 and prior contain a remote code execution vulnerability due to improper configurations of triggere (CVSS 9.8, DELL EMC ESRS Policy Manager)
- [CVE-2018-15365](https://cve.now/CVE-2018-15365.md): A Reflected Cross-Site Scripting (XSS) vulnerability in Trend Micro Deep Discovery Inspector 3.85 and below could allow an attacker to bypas (no CVSS, Trend Micro Deep Discovery Inspector)
- [CVE-2018-5393](https://cve.now/CVE-2018-5393.md): TP-Link EAP Controller versions 2.5.3 and earlier lack RMI authentication (no CVSS, TP-LINK EAP Controller)
- [CVE-2018-14648](https://cve.now/CVE-2018-14648.md): A flaw was found in 389 Directory Server. (CVSS 7.5, \[UNKNOWN\] 389-ds-base:)
- [CVE-2018-1702](https://cve.now/CVE-2018-1702.md): IBM Platform Symphony 7.1 Fix Pack 1 and 7.1.1 and IBM Spectrum Symphony 7.1.2 and 7.2.0.2 are vulnerable to a XML External Entity Injection (CVSS 7.1, IBM Spectrum Symphony · IBM Platform Symphony)
- [CVE-2018-1704](https://cve.now/CVE-2018-1704.md): IBM Platform Symphony 7.1 Fix Pack 1 and 7.1.1 and IBM Spectrum Symphony 7.1.2 and 7.2.0.2 could allow a remote attacker to conduct phishing (CVSS 6.8, IBM Platform Symphony · IBM Spectrum Symphony)
- [CVE-2018-17154](https://cve.now/CVE-2018-17154.md): In FreeBSD before 11.2-STABLE(r338987), 11.2-RELEASE-p4, and 11.1-RELEASE-p15, due to insufficient memory checking in the freebsd4\_getfsstat (no CVSS, FreeBSD)
- [CVE-2018-17155](https://cve.now/CVE-2018-17155.md): In FreeBSD before 11.2-STABLE(r338983), 11.2-RELEASE-p4, 11.1-RELEASE-p15, 10.4-STABLE(r338984), and 10.4-RELEASE-p13, due to insufficient i (no CVSS, FreeBSD)
- [CVE-2018-6925](https://cve.now/CVE-2018-6925.md): In FreeBSD before 11.2-STABLE(r338986), 11.2-RELEASE-p4, 11.1-RELEASE-p15, 10.4-STABLE(r338985), and 10.4-RELEASE-p13, due to improper maint (no CVSS, FreeBSD)
- [CVE-2018-17613](https://cve.now/CVE-2018-17613.md): Telegram Desktop (aka tdesktop) 1.3.16 alpha, when "Use proxy" is enabled, sends credentials and application data in cleartext over the SOCK (no CVSS)
- [CVE-2018-17574](https://cve.now/CVE-2018-17574.md): An issue was discovered in YMFE YApi 1.3.23. (no CVSS, yapi-vendor)
- [CVE-2018-17575](https://cve.now/CVE-2018-17575.md): SWA SWA.JACAD 3.1.37 Build 024 has SQL Injection via the /academico/aluno/esqueci-minha-senha/ studentId parameter. (no CVSS)
- [CVE-2018-17580](https://cve.now/CVE-2018-17580.md): A heap-based buffer over-read exists in the function fast\_edit\_packet() in the file send\_packets.c of Tcpreplay v4.3.0 beta1. (no CVSS)
- [CVE-2018-17582](https://cve.now/CVE-2018-17582.md): Tcpreplay v4.3.0 beta1 contains a heap-based buffer over-read. (no CVSS)
- [CVE-2018-17605](https://cve.now/CVE-2018-17605.md): An issue was discovered in the Asset Pipeline plugin before 3.0.4 for Grails. (no CVSS, org.grails.plugins:asset-pipeline)
- [CVE-2018-17607](https://cve.now/CVE-2018-17607.md): Foxit PhantomPDF and Reader before 9.3 allow remote attackers to execute arbitrary code or cause a denial of service (use-after-free) becaus (no CVSS)
- [CVE-2018-17608](https://cve.now/CVE-2018-17608.md): Foxit PhantomPDF and Reader before 9.3 allow remote attackers to execute arbitrary code or cause a denial of service (use-after-free) becaus (no CVSS)
- [CVE-2018-17609](https://cve.now/CVE-2018-17609.md): Foxit PhantomPDF and Reader before 9.3 allow remote attackers to execute arbitrary code or cause a denial of service (use-after-free) becaus (no CVSS)
- [CVE-2018-17610](https://cve.now/CVE-2018-17610.md): Foxit PhantomPDF and Reader before 9.3 allow remote attackers to execute arbitrary code or cause a denial of service (use-after-free) becaus (no CVSS)
- [CVE-2018-17611](https://cve.now/CVE-2018-17611.md): Foxit PhantomPDF and Reader before 9.3 allow remote attackers to execute arbitrary code or cause a denial of service (use-after-free) becaus (no CVSS)
- [CVE-2018-17571](https://cve.now/CVE-2018-17571.md): Vanilla before 2.6.1 allows XSS via the email field of a profile. (no CVSS)
- [CVE-2018-17573](https://cve.now/CVE-2018-17573.md): The Wp-Insert plugin through 2.4.2 for WordPress allows upload of arbitrary PHP code because of the exposure and configuration of FCKeditor (no CVSS)
- [CVE-2018-14037](https://cve.now/CVE-2018-14037.md): Cross-site scripting (XSS) vulnerability in Progress Kendo UI Editor v2018.1.221 allows remote attackers to inject arbitrary JavaScript into (no CVSS)
- [CVE-2018-14956](https://cve.now/CVE-2018-14956.md): CMS ISWEB 3.5.3 is vulnerable to multiple SQL injection flaws. (no CVSS)
- [CVE-2018-14957](https://cve.now/CVE-2018-14957.md): CMS ISWEB 3.5.3 is vulnerable to directory traversal and local file download, as demonstrated by moduli/downloadFile.php?file=oggetto\_docume (no CVSS)
- [CVE-2018-16277](https://cve.now/CVE-2018-16277.md): The Image Import function in XWiki through 10.7 has XSS. (no CVSS, org.xwiki.platform:xwiki-platform)
- [CVE-2018-16586](https://cve.now/CVE-2018-16586.md): In Open Ticket Request System (OTRS) 4.0.x before 4.0.32, 5.0.x before 5.0.30, and 6.0.x before 6.0.11, an attacker could send a malicious e (no CVSS)
- [CVE-2018-16587](https://cve.now/CVE-2018-16587.md): In Open Ticket Request System (OTRS) 4.0.x before 4.0.32, 5.0.x before 5.0.30, and 6.0.x before 6.0.11, an attacker could send a malicious e (no CVSS)
- [CVE-2018-16659](https://cve.now/CVE-2018-16659.md): An issue was discovered in Rausoft ID.prove 2.95. (no CVSS)
- [CVE-2018-17055](https://cve.now/CVE-2018-17055.md): An arbitrary file upload vulnerability in Progress Sitefinity CMS versions 4.0 through 11.0 related to image uploads. (no CVSS)
- [CVE-2018-17056](https://cve.now/CVE-2018-17056.md): Cross-site scripting (XSS) vulnerability in ServiceStack in Progress Sitefinity CMS versions 10.2 through 11.0 allows remote attackers to in (no CVSS)
- [CVE-2018-17375](https://cve.now/CVE-2018-17375.md): SQL Injection exists in the Music Collection 3.0.3 component for Joomla! via the id parameter. (no CVSS)
- [CVE-2018-17376](https://cve.now/CVE-2018-17376.md): SQL Injection exists in the Reverse Auction Factory 4.3.8 component for Joomla! via the filter\_order\_Dir, cat, or filter\_letter parameter. (no CVSS)
- [CVE-2018-17377](https://cve.now/CVE-2018-17377.md): SQL Injection exists in the Questions 1.4.3 component for Joomla! via the term, userid, users, or groups parameter. (no CVSS)
- [CVE-2018-17378](https://cve.now/CVE-2018-17378.md): SQL Injection exists in the Penny Auction Factory 2.0.4 component for Joomla! via the filter\_order\_Dir or filter\_order parameter. (no CVSS)
- [CVE-2018-17379](https://cve.now/CVE-2018-17379.md): SQL Injection exists in the Raffle Factory 3.5.2 component for Joomla! via the filter\_order\_Dir or filter\_order parameter. (no CVSS)
- [CVE-2018-17380](https://cve.now/CVE-2018-17380.md): SQL Injection exists in the Article Factory Manager 4.3.9 component for Joomla! via the start\_date, m\_start\_date, or m\_end\_date parameter. (no CVSS)
- [CVE-2018-17382](https://cve.now/CVE-2018-17382.md): SQL Injection exists in the Jobs Factory 2.0.4 component for Joomla! via the filter\_letter parameter. (no CVSS)
- [CVE-2018-17383](https://cve.now/CVE-2018-17383.md): SQL Injection exists in the Collection Factory 4.1.9 component for Joomla! via the filter\_order or filter\_order\_Dir parameter. (no CVSS)
- [CVE-2018-17384](https://cve.now/CVE-2018-17384.md): SQL Injection exists in the Swap Factory 2.2.1 component for Joomla! via the filter\_order\_Dir or filter\_order parameter. (no CVSS)
- [CVE-2018-17385](https://cve.now/CVE-2018-17385.md): SQL Injection exists in the Social Factory 3.8.3 component for Joomla! via the radius\[lat\], radius\[lng\], or radius\[radius\] parameter. (no CVSS)
- [CVE-2018-17391](https://cve.now/CVE-2018-17391.md): SQL Injection exists in authors\_post.php in Super Cms Blog Pro 1.0 via the author parameter. (no CVSS)
- [CVE-2018-17394](https://cve.now/CVE-2018-17394.md): SQL Injection exists in the Timetable Schedule 3.6.8 component for Joomla! via the eid parameter. (no CVSS)
- [CVE-2018-17397](https://cve.now/CVE-2018-17397.md): SQL Injection exists in the AlphaIndex Dictionaries 1.0 component for Joomla! via the letter parameter. (no CVSS)
- [CVE-2018-17567](https://cve.now/CVE-2018-17567.md): Jekyll through 3.6.2, 3.7.x through 3.7.3, and 3.8.x through 3.8.3 allows attackers to access arbitrary files by specifying a symlink in the (no CVSS, jekyll)
- [CVE-2018-17581](https://cve.now/CVE-2018-17581.md): CiffDirectory::readDirectory() at crwimage\_int.cpp in Exiv2 0.26 has excessive stack consumption due to a recursive function, leading to Den (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2018-09-28
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.