CVEs published October 1, 2018
51 CVEs were published on October 1, 2018: 0 critical, 9 high.
- Published
- 51
- Critical
- 0
- High
- 9
- Medium
- 2
- Low
- 0
- Unrated
- 40
- Now in CISA KEV
- 0
- Fix available
- 3
Most affected products
- The Atlantis Word Processor Team Atlantis Word Processor
- 7
- Fuji Electric FRENIC LOADER of FRENIC-Mini (C1), FRENIC-Min…
- 3
- golang.org/x/net
- 3
- TP-Link TL-WRN841N
- 3
- Emerson AMS Device Manager
- 2
- Fuji Electric Alpha5 Smart Loader
- 2
- IBM WebSphere Portal
- 2
- Martem TELEM-GW6/GWM
- 1
- Talos ACD Systems
- 1
High 9
- CVE-2018-3975An exploitable uninitialized variable vulnerability exists in the RTF-parsing functionality of Atlantis Word Processor 3.2.6 version.The Atlantis Word Processor Team Atlantis Word Processor
- CVE-2018-3978An exploitable out-of-bounds write vulnerability exists in the Word Document parser of the Atlantis Word Processor 3.0.2.3, 3.0.2.5.The Atlantis Word Processor Team Atlantis Word Processor
- CVE-2018-3981An exploitable out-of-bounds write exists in the TIFF-parsing functionality of Canvas Draw version 5.0.0.Talos ACD Systems
- CVE-2018-3982An exploitable arbitrary write vulnerability exists in the Word document parser of the Atlantis Word Processor 3.0.2.3 and 3.0.2.5.The Atlantis Word Processor Team Atlantis Word Processor
- CVE-2018-3984An exploitable uninitialized length vulnerability exists within the Word document-parser of the Atlantis Word Processor 3.0.2.3 and 3.0.2.5.The Atlantis Word Processor Team Atlantis Word Processor
- CVE-2018-3998An exploitable heap-based buffer overflow vulnerability exists in the Windows enhanced metafile parser of Atlantis Word Processor, version 3The Atlantis Word Processor Team Atlantis Word Processor
- CVE-2018-3999An exploitable stack-based buffer overflow vulnerability exists in the JPEG parser of Atlantis Word Processor, version 3.2.5.0.The Atlantis Word Processor Team Atlantis Word Processor
- CVE-2018-4000An exploitable double-free vulnerability exists in the Office Open XML parser of Atlantis Word Processor, version 3.2.5.0.The Atlantis Word Processor Team Atlantis Word Processor
- CVE-2018-4001An exploitable uninitialized pointer vulnerability exists in the Office Open XML parser of Atlantis Word Processor, version 3.2.5.0.
Medium, low and unrated 42
- CVE-2015-9269The export/content.php exportarticle feature in the wordpress-mobile-pack plugin before 2.1.3 2015-06-03 for WordPress allows remote attacke
- CVE-2015-9270XSS exists in the the-holiday-calendar plugin before 1.11.3 for WordPress via the thc-month parameter.
- CVE-2018-17867The Port Forwarding functionality on DASAN H660GW devices allows remote attackers to execute arbitrary code via shell metacharacters in the
- CVE-2018-17868DASAN H660GW devices have Stored XSS in the Port Forwarding functionality.
- CVE-2018-17869DASAN H660GW devices do not implement any CSRF protection mechanism.
- CVE-2018-17870An issue was discovered in BTITeam XBTIT 2.5.4.
- CVE-2018-17874ExpressionEngine before 4.3.5 has reflected XSS.
- CVE-2018-15700The web interface in TP-Link TL-WRN841N 0.9.1 4.16 v0348.0 is vulnerable to a denial of service when an unauthenticated LAN user sends a craTP-Link TL-WRN841N
- CVE-2018-15701The web interface in TP-Link TL-WRN841N 0.9.1 4.16 v0348.0 is vulnerable to a denial of service when an unauthenticated LAN user sends a craTP-Link TL-WRN841N
- CVE-2018-15702The web interface in TP-Link TL-WRN841N 0.9.1 4.16 v0348.0 is vulnerable to CSRF due to insufficient validation of the referer field.TP-Link TL-WRN841N
- CVE-2018-10605Martem TELEM GW6/GWM versions prior to 2.0.87-4018403-k4 may allow unprivileged users to modify/upload a new system configuration or take thMartem TELEM-GW6/GWM
- CVE-2018-14804Emerson AMS Device Manager v12.0 to v13.5.Emerson AMS Device Manager
- CVE-2018-14808Emerson AMS Device Manager v12.0 to v13.5.Emerson AMS Device Manager
- CVE-2018-1420IBM WebSphere Portal 7.0, 8.0, 8.5, and 9.0 resets access control settings to the out of the box configuration during Combined Cumulative FiIBM WebSphere Portal
- CVE-2018-1672IBM WebSphere Portal 7.0, 8.0, 8.5, and 9.0 may fail to set the correct user context in certain impersonation scenarios, which can allow a uIBM WebSphere Portal
- CVE-2018-14788Fuji Electric Alpha5 Smart Loader Versions 3.7 and prior.Fuji Electric Alpha5 Smart Loader
- CVE-2018-14790Fuji Electric FRENIC LOADER v3.3 v7.3.4.1a of FRENIC-Mini (C1), FRENIC-Mini (C2), FRENIC-Eco, FRENIC-Multi, FRENIC-MEGA, FRENIC-Ace.Fuji Electric FRENIC LOADER of FRENIC-Mini (C1), FRENIC-Min…
- CVE-2018-14794Fuji Electric Alpha5 Smart Loader Versions 3.7 and prior.Fuji Electric Alpha5 Smart Loader
- CVE-2018-14798Fuji Electric FRENIC LOADER v3.3 v7.3.4.1a of FRENIC-Mini (C1), FRENIC-Mini (C2), FRENIC-Eco, FRENIC-Multi, FRENIC-MEGA, FRENIC-Ace.Fuji Electric FRENIC LOADER of FRENIC-Mini (C1), FRENIC-Min…
- CVE-2018-14802Fuji Electric FRENIC LOADER v3.3 v7.3.4.1a of FRENIC-Mini (C1), FRENIC-Mini (C2), FRENIC-Eco, FRENIC-Multi, FRENIC-MEGA, FRENIC-Ace.Fuji Electric FRENIC LOADER of FRENIC-Mini (C1), FRENIC-Min…
- CVE-2015-9267Nullsoft Scriptable Install System (NSIS) before 2.49 uses temporary folder locations that allow unprivileged local users to overwrite files
- CVE-2015-9268Nullsoft Scriptable Install System (NSIS) before 2.49 has unsafe implicit linking against Version.dll.
- CVE-2018-17427SIMDComp before 0.1.0 allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash) because it ca
- CVE-2018-17825An issue was discovered in AdPlug 2.3.1.
- CVE-2018-17826HisiPHP 1.0.8 allows CSRF via admin.php/admin/user/adduser.html to add an administrator account.
- CVE-2018-17827HisiPHP 1.0.8 allows remote attackers to execute arbitrary PHP code by editing a plugin's name to contain that code.
- CVE-2018-17828Directory traversal vulnerability in ZZIPlib 0.13.69 allows attackers to overwrite arbitrary files via a ..
- CVE-2018-17830The $args variable in addons/mediapool/pages/index.php in REDAXO 5.6.2 is not effectively filtered, because names are not restricted (only v
- CVE-2018-17831In REDAXO before 5.6.3, a critical SQL injection vulnerability has been discovered in the rex_list class because of the prepareQuery functio
- CVE-2018-17832XSS exists in WUZHI CMS 2.0 via the index.php v or f parameter.
- CVE-2018-17835An issue was discovered in GetSimple CMS 3.3.15.
- CVE-2018-17836An issue was discovered in JTBC(PHP) 3.0.1.6.
- CVE-2018-17837An issue was discovered in JTBC(PHP) 3.0.1.6.
- CVE-2018-17838An issue was discovered in JTBC(PHP) 3.0.1.6.
- CVE-2018-17846The html package (aka x/net/html) through 2018-09-25 in Go mishandles <table><math><select><mi><select></table>, leading to an infinite loopgolang.org/x/net
- CVE-2018-17847The html package (aka x/net/html) through 2018-09-25 in Go mishandles <svg><template><desc><t><svg></template>, leading to a "panic: runtimegolang.org/x/net
- CVE-2018-17848The html package (aka x/net/html) through 2018-09-25 in Go mishandles <math><template><mn><b></template>, leading to a "panic: runtime errorgolang.org/x/net
- CVE-2018-17852A SQL injection was discovered in WUZHI CMS 4.1.0 in coreframe/app/coupon/admin/card.php via the groupname parameter to the /index.php?m=cou
- CVE-2018-17854SIMDComp before 0.1.1 allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash) because it ca
- CVE-2018-17216An issue was discovered in PTC ThingWorx Platform 6.5 through 8.2.
- CVE-2018-17217An issue was discovered in PTC ThingWorx Platform 6.5 through 8.2.
- CVE-2018-17218An issue was discovered in PTC ThingWorx Platform 6.5 through 8.2.