# CVEs published 2018-10-01 51 CVEs were published on October 1, 2018: 0 critical, 9 high. Days are UTC. - [CVE-2015-9269](https://cve.now/CVE-2015-9269.md): The export/content.php exportarticle feature in the wordpress-mobile-pack plugin before 2.1.3 2015-06-03 for WordPress allows remote attacke (no CVSS) - [CVE-2015-9270](https://cve.now/CVE-2015-9270.md): XSS exists in the the-holiday-calendar plugin before 1.11.3 for WordPress via the thc-month parameter. (no CVSS) - [CVE-2018-17867](https://cve.now/CVE-2018-17867.md): The Port Forwarding functionality on DASAN H660GW devices allows remote attackers to execute arbitrary code via shell metacharacters in the (no CVSS) - [CVE-2018-17868](https://cve.now/CVE-2018-17868.md): DASAN H660GW devices have Stored XSS in the Port Forwarding functionality. (no CVSS) - [CVE-2018-17869](https://cve.now/CVE-2018-17869.md): DASAN H660GW devices do not implement any CSRF protection mechanism. (no CVSS) - [CVE-2018-17870](https://cve.now/CVE-2018-17870.md): An issue was discovered in BTITeam XBTIT 2.5.4. (no CVSS) - [CVE-2018-17874](https://cve.now/CVE-2018-17874.md): ExpressionEngine before 4.3.5 has reflected XSS. (no CVSS) - [CVE-2018-15700](https://cve.now/CVE-2018-15700.md): The web interface in TP-Link TL-WRN841N 0.9.1 4.16 v0348.0 is vulnerable to a denial of service when an unauthenticated LAN user sends a cra (no CVSS, TP-Link TL-WRN841N) - [CVE-2018-15701](https://cve.now/CVE-2018-15701.md): The web interface in TP-Link TL-WRN841N 0.9.1 4.16 v0348.0 is vulnerable to a denial of service when an unauthenticated LAN user sends a cra (no CVSS, TP-Link TL-WRN841N) - [CVE-2018-15702](https://cve.now/CVE-2018-15702.md): The web interface in TP-Link TL-WRN841N 0.9.1 4.16 v0348.0 is vulnerable to CSRF due to insufficient validation of the referer field. (no CVSS, TP-Link TL-WRN841N) - [CVE-2018-3975](https://cve.now/CVE-2018-3975.md): An exploitable uninitialized variable vulnerability exists in the RTF-parsing functionality of Atlantis Word Processor 3.2.6 version. (CVSS 7.5, The Atlantis Word Processor Team Atlantis Word Processor) - [CVE-2018-3978](https://cve.now/CVE-2018-3978.md): An exploitable out-of-bounds write vulnerability exists in the Word Document parser of the Atlantis Word Processor 3.0.2.3, 3.0.2.5. (CVSS 8.8, The Atlantis Word Processor Team Atlantis Word Processor) - [CVE-2018-3981](https://cve.now/CVE-2018-3981.md): An exploitable out-of-bounds write exists in the TIFF-parsing functionality of Canvas Draw version 5.0.0. (CVSS 8.8, Talos ACD Systems) - [CVE-2018-3982](https://cve.now/CVE-2018-3982.md): An exploitable arbitrary write vulnerability exists in the Word document parser of the Atlantis Word Processor 3.0.2.3 and 3.0.2.5. (CVSS 8.8, The Atlantis Word Processor Team Atlantis Word Processor) - [CVE-2018-3984](https://cve.now/CVE-2018-3984.md): An exploitable uninitialized length vulnerability exists within the Word document-parser of the Atlantis Word Processor 3.0.2.3 and 3.0.2.5. (CVSS 8.8, The Atlantis Word Processor Team Atlantis Word Processor) - [CVE-2018-3998](https://cve.now/CVE-2018-3998.md): An exploitable heap-based buffer overflow vulnerability exists in the Windows enhanced metafile parser of Atlantis Word Processor, version 3 (CVSS 8.8, The Atlantis Word Processor Team Atlantis Word Processor) - [CVE-2018-3999](https://cve.now/CVE-2018-3999.md): An exploitable stack-based buffer overflow vulnerability exists in the JPEG parser of Atlantis Word Processor, version 3.2.5.0. (CVSS 8.8, The Atlantis Word Processor Team Atlantis Word Processor) - [CVE-2018-4000](https://cve.now/CVE-2018-4000.md): An exploitable double-free vulnerability exists in the Office Open XML parser of Atlantis Word Processor, version 3.2.5.0. (CVSS 8.8, The Atlantis Word Processor Team Atlantis Word Processor) - [CVE-2018-4001](https://cve.now/CVE-2018-4001.md): An exploitable uninitialized pointer vulnerability exists in the Office Open XML parser of Atlantis Word Processor, version 3.2.5.0. (CVSS 8.8) - [CVE-2018-10605](https://cve.now/CVE-2018-10605.md): Martem TELEM GW6/GWM versions prior to 2.0.87-4018403-k4 may allow unprivileged users to modify/upload a new system configuration or take th (no CVSS, Martem TELEM-GW6/GWM) - [CVE-2018-14804](https://cve.now/CVE-2018-14804.md): Emerson AMS Device Manager v12.0 to v13.5. (no CVSS, Emerson AMS Device Manager) - [CVE-2018-14808](https://cve.now/CVE-2018-14808.md): Emerson AMS Device Manager v12.0 to v13.5. (no CVSS, Emerson AMS Device Manager) - [CVE-2018-1420](https://cve.now/CVE-2018-1420.md): IBM WebSphere Portal 7.0, 8.0, 8.5, and 9.0 resets access control settings to the out of the box configuration during Combined Cumulative Fi (CVSS 5.3, IBM WebSphere Portal) - [CVE-2018-1672](https://cve.now/CVE-2018-1672.md): IBM WebSphere Portal 7.0, 8.0, 8.5, and 9.0 may fail to set the correct user context in certain impersonation scenarios, which can allow a u (CVSS 5.0, IBM WebSphere Portal) - [CVE-2018-14788](https://cve.now/CVE-2018-14788.md): Fuji Electric Alpha5 Smart Loader Versions 3.7 and prior. (no CVSS, Fuji Electric Alpha5 Smart Loader) - [CVE-2018-14790](https://cve.now/CVE-2018-14790.md): Fuji Electric FRENIC LOADER v3.3 v7.3.4.1a of FRENIC-Mini (C1), FRENIC-Mini (C2), FRENIC-Eco, FRENIC-Multi, FRENIC-MEGA, FRENIC-Ace. (no CVSS, Fuji Electric FRENIC LOADER of FRENIC-Mini (C1), FRENIC-Min…) - [CVE-2018-14794](https://cve.now/CVE-2018-14794.md): Fuji Electric Alpha5 Smart Loader Versions 3.7 and prior. (no CVSS, Fuji Electric Alpha5 Smart Loader) - [CVE-2018-14798](https://cve.now/CVE-2018-14798.md): Fuji Electric FRENIC LOADER v3.3 v7.3.4.1a of FRENIC-Mini (C1), FRENIC-Mini (C2), FRENIC-Eco, FRENIC-Multi, FRENIC-MEGA, FRENIC-Ace. (no CVSS, Fuji Electric FRENIC LOADER of FRENIC-Mini (C1), FRENIC-Min…) - [CVE-2018-14802](https://cve.now/CVE-2018-14802.md): Fuji Electric FRENIC LOADER v3.3 v7.3.4.1a of FRENIC-Mini (C1), FRENIC-Mini (C2), FRENIC-Eco, FRENIC-Multi, FRENIC-MEGA, FRENIC-Ace. (no CVSS, Fuji Electric FRENIC LOADER of FRENIC-Mini (C1), FRENIC-Min…) - [CVE-2015-9267](https://cve.now/CVE-2015-9267.md): Nullsoft Scriptable Install System (NSIS) before 2.49 uses temporary folder locations that allow unprivileged local users to overwrite files (no CVSS) - [CVE-2015-9268](https://cve.now/CVE-2015-9268.md): Nullsoft Scriptable Install System (NSIS) before 2.49 has unsafe implicit linking against Version.dll. (no CVSS) - [CVE-2018-17427](https://cve.now/CVE-2018-17427.md): SIMDComp before 0.1.0 allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash) because it ca (no CVSS) - [CVE-2018-17825](https://cve.now/CVE-2018-17825.md): An issue was discovered in AdPlug 2.3.1. (no CVSS) - [CVE-2018-17826](https://cve.now/CVE-2018-17826.md): HisiPHP 1.0.8 allows CSRF via admin.php/admin/user/adduser.html to add an administrator account. (no CVSS) - [CVE-2018-17827](https://cve.now/CVE-2018-17827.md): HisiPHP 1.0.8 allows remote attackers to execute arbitrary PHP code by editing a plugin's name to contain that code. (no CVSS) - [CVE-2018-17828](https://cve.now/CVE-2018-17828.md): Directory traversal vulnerability in ZZIPlib 0.13.69 allows attackers to overwrite arbitrary files via a .. (no CVSS) - [CVE-2018-17830](https://cve.now/CVE-2018-17830.md): The $args variable in addons/mediapool/pages/index.php in REDAXO 5.6.2 is not effectively filtered, because names are not restricted (only v (no CVSS) - [CVE-2018-17831](https://cve.now/CVE-2018-17831.md): In REDAXO before 5.6.3, a critical SQL injection vulnerability has been discovered in the rex\_list class because of the prepareQuery functio (no CVSS) - [CVE-2018-17832](https://cve.now/CVE-2018-17832.md): XSS exists in WUZHI CMS 2.0 via the index.php v or f parameter. (no CVSS) - [CVE-2018-17835](https://cve.now/CVE-2018-17835.md): An issue was discovered in GetSimple CMS 3.3.15. (no CVSS) - [CVE-2018-17836](https://cve.now/CVE-2018-17836.md): An issue was discovered in JTBC(PHP) 3.0.1.6. (no CVSS) - [CVE-2018-17837](https://cve.now/CVE-2018-17837.md): An issue was discovered in JTBC(PHP) 3.0.1.6. (no CVSS) - [CVE-2018-17838](https://cve.now/CVE-2018-17838.md): An issue was discovered in JTBC(PHP) 3.0.1.6. (no CVSS) - [CVE-2018-17846](https://cve.now/CVE-2018-17846.md): The html package (aka x/net/html) through 2018-09-25 in Go mishandles \\\\\\, leading to an infinite loop (no CVSS, golang.org/x/net) - [CVE-2018-17847](https://cve.now/CVE-2018-17847.md): The html package (aka x/net/html) through 2018-09-25 in Go mishandles \\\\\\, leading to a "panic: runtime (no CVSS, golang.org/x/net) - [CVE-2018-17848](https://cve.now/CVE-2018-17848.md): The html package (aka x/net/html) through 2018-09-25 in Go mishandles \\\\\, leading to a "panic: runtime error (no CVSS, golang.org/x/net) - [CVE-2018-17852](https://cve.now/CVE-2018-17852.md): A SQL injection was discovered in WUZHI CMS 4.1.0 in coreframe/app/coupon/admin/card.php via the groupname parameter to the /index.php?m=cou (no CVSS) - [CVE-2018-17854](https://cve.now/CVE-2018-17854.md): SIMDComp before 0.1.1 allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash) because it ca (no CVSS) - [CVE-2018-17216](https://cve.now/CVE-2018-17216.md): An issue was discovered in PTC ThingWorx Platform 6.5 through 8.2. (no CVSS) - [CVE-2018-17217](https://cve.now/CVE-2018-17217.md): An issue was discovered in PTC ThingWorx Platform 6.5 through 8.2. (no CVSS) - [CVE-2018-17218](https://cve.now/CVE-2018-17218.md): An issue was discovered in PTC ThingWorx Platform 6.5 through 8.2. (no CVSS) --- Source: cve.now, built and run by Sazabi (AI-native observability and security) Page: https://cve.now/daily/2018-10-01 Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.