CVEs published October 2, 2018
78 CVEs were published on October 2, 2018: 0 critical, 8 high.
- Published
- 78
- Critical
- 0
- High
- 8
- Medium
- 15
- Low
- 3
- Unrated
- 52
- Now in CISA KEV
- 0
- Fix available
- 1
Most affected products
- Google Android
- 25
- IBM Rational Quality Manager
- 13
- Foxit PDF Reader
- 8
- Entes EMG12
- 2
- IBM Security Guardium
- 2
- Nvidia GeForce Experience
- 2
- Dell EMC Dell Digital Delivery
- 1
- django
- 1
- GE Communicator
- 1
- IBM Multi-Cloud Data Encryption
- 1
High 8
- CVE-2018-3943An exploitable use-after-free vulnerability exists in the JavaScript engine of Foxit Software's PDF Reader, version 9.1.0.5096.Foxit PDF Reader
- CVE-2018-3944An exploitable use-after-free vulnerability exists in the JavaScript engine of Foxit Software's PDF Reader, version 9.1.0.5096.Foxit PDF Reader
- CVE-2018-3957A use-after-free vulnerability exists in the JavaScript engine of Foxit Software's Foxit PDF Reader version 9.1.0.5096.Foxit PDF Reader
- CVE-2018-3958A use-after-free vulnerability exists in the JavaScript engine of Foxit Software's Foxit PDF Reader version 9.1.0.5096.Foxit PDF Reader
- CVE-2018-3959A use-after-free vulnerability exists in the JavaScript engine of Foxit Software's Foxit PDF Reader version 9.1.0.5096.Foxit PDF Reader
- CVE-2018-3960A use-after-free vulnerability exists in the JavaScript engine of Foxit Software's Foxit PDF Reader version 9.1.0.5096.Foxit PDF Reader
- CVE-2018-3961A use-after-free vulnerability exists in the JavaScript engine of Foxit Software's Foxit PDF Reader version 9.1.0.5096.Foxit PDF Reader
- CVE-2018-3962A use-after-free vulnerability exists in the JavaScript engine of Foxit Software's Foxit PDF Reader version 9.1.0.5096.Foxit PDF Reader
Medium, low and unrated 70
- CVE-2017-7908A heap-based buffer overflow exists in the third-party product Gigasoft, v5 and prior, included in GE Communicator 3.15 and prior.GE Communicator
- CVE-2018-14822Entes EMG12 versions 2.57 and prior an information exposure through query strings vulnerability in the web interface has been identified, whEntes EMG12
- CVE-2018-14826Entes EMG12 versions 2.57 and prior The application uses a web interface where it is possible for an attacker to bypass authentication with Entes EMG12
- CVE-2018-11748Previous releases of the Puppet device_manager module creates configuration files containing credentials that are world readable.
- CVE-2018-11750Previous releases of the Puppet cisco_ios module did not validate a host's identity before starting a SSH connection.
- CVE-2018-11752Previous releases of the Puppet cisco_ios module output SSH session debug information including login credentials to a world readable file o
- CVE-2018-9452In getOffsetForHorizontal of Layout.java, there is a possible application hang due to a slow width calculation.Google Android
- CVE-2018-9473In ihevcd_parse_sei_payload of ihevcd_parse_headers.c, there is a possible out-of-bounds write due to an integer overflow.Google Android
- CVE-2018-9476In avrc_pars_browsing_cmd of avrc_pars_tg.cc, there is a possible use-after-free due to improper locking.Google Android
- CVE-2018-9490In CollectValuesOrEntriesImpl of elements.cc, there is possible remote code execution due to type confusion.Google Android
- CVE-2018-9491In AMediaCodecCryptoInfo_new of NdkMediaCodec.cpp, there is a possible out-of-bounds write due to an integer overflow.Google Android
- CVE-2018-9492In checkGrantUriPermissionLocked of ActivityManagerService.java, there is a possible permissions bypass.Google Android
- CVE-2018-9493In the content provider of the download manager, there is a possible SQL injection due to improper input validation.Google Android
- CVE-2018-9496In ixheaacd_real_synth_fft_p3 of ixheaacd_esbr_fft.c there is a possible out of bounds write due to a missing bounds check.Google Android
- CVE-2018-9497In impeg2_fmt_conv_yuv420p_to_yuv420sp_uv_av8 of impeg2_format_conv.s there is a possible out of bounds write due to missing bounds check.Google Android
- CVE-2018-9498In SkSampler::Fill of SkSampler.cpp, there is a possible out of bounds write due to an integer overflow.Google Android
- CVE-2018-9499In readVector of iCrypto.cpp, there is a possible invalid read due to uninitialized data.Google Android
- CVE-2018-9501In the SetupWizard, there is a possible Factory Reset Protection bypass due to a permissions bypass.Google Android
- CVE-2018-9502In rfc_process_mx_message of rfc_ts_frames.cc, there is a possible out-of-bounds read due to a missing bounds check.Google Android
- CVE-2018-9503In rfc_process_mx_message of rfc_ts_frames.cc, there is a possible out of bounds read due to a missing bounds check.Google Android
- CVE-2018-9504In sdp_copy_raw_data of sdp_discovery.cc, there is a possible out of bounds write due to an incorrect bounds check.Google Android
- CVE-2018-9505In mca_ccb_hdl_req of mca_cact.cc, there is a possible out of bounds read due to a missing bounds check.Google Android
- CVE-2018-9506In avrc_msg_cback of avrc_api.cc, there is a possible out-of-bound read due to a missing bounds check.Google Android
- CVE-2018-9507In bta_av_proc_meta_cmd of bta_av_act.cc, there is a possible out of bounds read due to an incorrect bounds check.Google Android
- CVE-2018-9508In smp_process_keypress_notification of smp_act.cc, there is a possible out of bounds read due to an incorrect bounds check.Google Android
- CVE-2018-9509In smp_proc_master_id of smp_act.cc, there is a possible out of bounds read due to a missing bounds check.Google Android
- CVE-2018-9510In smp_proc_enc_info of smp_act.cc, there is a possible out of bounds read due to a missing bounds check.Google Android
- CVE-2018-9511In ipSecSetEncapSocketOwner of XfrmController.cpp, there is a possible failure to initialize a security feature due to uninitialized data.Google Android
- CVE-2018-9513In copy_process of fork.c, there is possible memory corruption due to a double free.Google Android
- CVE-2018-9514In sdcardfs_open of file.c, there is a possible Use After Free due to an unusual root cause.Google Android
- CVE-2018-9515In sdcardfs_create and sdcardfs_mkdir of inode.c, there is a possible memory corruption due to improper locking.Google Android
- CVE-2018-15563_core/admin/pages/add/ in Subrion CMS 4.2.1 has XSS via the titles[en] parameter.intelliants/subrion
- CVE-2018-15752An issue was discovered in the MensaMax (aka com.breustedt.mensamax) application 4.3 for Android.
- CVE-2018-15753An issue was discovered in the MensaMax (aka com.breustedt.mensamax) application 4.3 for Android.
- CVE-2018-16984An issue was discovered in Django 2.1 before 2.1.2, in which unprivileged users can read the password hashes of arbitrary accounts.django
- CVE-2018-17587AirTies Air 5750 devices with software 1.0.0.18 have XSS via the top.html productboardtype parameter.
- CVE-2018-17588AirTies Air 5021 devices with software 1.0.0.18 have XSS via the top.html productboardtype parameter.
- CVE-2018-17589AirTies Air 5650 devices with software 1.0.0.18 have XSS via the top.html productboardtype parameter.
- CVE-2018-17590AirTies Air 5442 devices with software 1.0.0.18 have XSS via the top.html productboardtype parameter.
- CVE-2018-17591AirTies Air 5343v2 devices with software 1.0.0.18 have XSS via the top.html productboardtype parameter.
- CVE-2018-17593AirTies Air 5453 devices with software 1.0.0.18 have XSS via the top.html productboardtype parameter.
- CVE-2018-17594AirTies Air 5443v2 devices with software 1.0.0.18 have XSS via the top.html productboardtype parameter.
- CVE-2018-17595In the 5.4.0 version of the Fork CMS software, HTML Injection and Stored XSS vulnerabilities were discovered via the /backend/ajax URI.
- CVE-2018-17596In Zoho ManageEngine AssetExplorer, a Stored XSS vulnerability was discovered in the 6.2.0 version via the /AssetDef.do ciName or assetName
- CVE-2018-17786On D-Link DIR-823G devices, ExportSettings.sh, upload_settings.cgi, GetDownLoadSyslog.sh, and upload_firmware.cgi do not require authenticat
- CVE-2018-17787On D-Link DIR-823G devices, the GoAhead configuration allows /HNAP1 Command Injection via shell metacharacters in the POST data, because thi
- CVE-2018-17884XSS exists in admin/gb-dashboard-widget.php in the Gwolle Guestbook (gwolle-gb) plugin before 2.5.4 for WordPress via the PATH_INFO to wp-ad
- CVE-2018-17886An issue was discovered in JEESNS 1.3.
- CVE-2018-6261NVIDIA GeForce Experience prior to 3.15 contains a vulnerability when GameStream is enabled which sets incorrect permissions on a file, whicNvidia GeForce Experience
- CVE-2018-6262NVIDIA GeForce Experience prior to 3.15 contains a vulnerability when GameStream is enabled where limited sensitive user information may be Nvidia GeForce Experience
- CVE-2017-1649IBM Rational Quality Manager (RQM) 5.0 through 5.02 and 6.0 through 6.0.6 are vulnerable to cross-site scripting.IBM Rational Quality Manager
- CVE-2018-12473path traversal in obs-service-tar_scmopenSUSE Open Build Service
- CVE-2018-1395IBM Rational Quality Manager (RQM) 5.0 through 5.02 and 6.0 through 6.0.6 are vulnerable to cross-site scripting.IBM Rational Quality Manager
- CVE-2018-1403IBM Rational Quality Manager (RQM) 5.0 through 5.02 and 6.0 through 6.0.6 are vulnerable to cross-site scripting.IBM Rational Quality Manager
- CVE-2018-1404IBM Rational Quality Manager (RQM) 5.0 through 5.02 and 6.0 through 6.0.6 are vulnerable to cross-site scripting.IBM Rational Quality Manager
- CVE-2018-1405IBM Rational Quality Manager (RQM) 5.0 through 5.02 and 6.0 through 6.0.6 are vulnerable to cross-site scripting.IBM Rational Quality Manager
- CVE-2018-1439IBM Rational Quality Manager (RQM) 5.0 through 5.02 and 6.0 through 6.0.6 are vulnerable to cross-site scripting.IBM Rational Quality Manager
- CVE-2018-1440IBM Rational Quality Manager (RQM) 5.0 through 5.02 and 6.0 through 6.0.6 are vulnerable to cross-site scripting.IBM Rational Quality Manager
- CVE-2018-1498IBM Security Guardium EcoSystem 10.5 stores user credentials in plain in clear text which can be read by a local user.IBM Security Guardium
- CVE-2018-1509IBM Security Guardium EcoSystem 10.5 does not validate, or incorrectly validates, a certificate.This weakness might allow an attacker to spoIBM Security Guardium
- CVE-2018-1522IBM Rational Quality Manager (RQM) 5.0 through 5.02 and 6.0 through 6.0.6 are vulnerable to cross-site scripting.IBM Rational Quality Manager
- CVE-2018-1557IBM Rational Quality Manager (RQM) 5.0 through 5.02 and 6.0 through 6.0.6 are vulnerable to cross-site scripting.IBM Rational Quality Manager
- CVE-2018-1558IBM Rational Collaborative Lifecycle Management 5.0 through 5.02 and 6.0 through 6.0.6 are vulnerable to cross-site scripting.IBM Rational Collaborative Lifecycle Management
- CVE-2018-1593IBM Multi-Cloud Data Encryption (MDE) 2.1 could allow an unauthorized user to manipulate data due to missing file checksums.IBM Multi-Cloud Data Encryption
- CVE-2018-1601IBM Rational Quality Manager (RQM) 5.0 through 5.02 and 6.0 through 6.0.6 are vulnerable to cross-site scripting.IBM Rational Quality Manager
- CVE-2018-1605IBM Rational Quality Manager (RQM) 5.0 through 5.02 and 6.0 through 6.0.6 are vulnerable to cross-site scripting.IBM Rational Quality Manager
- CVE-2018-1691IBM Rational Quality Manager (RQM) 5.0 through 5.02 and 6.0 through 6.0.6 are vulnerable to cross-site scripting.IBM Rational Quality Manager
- CVE-2018-1692IBM Rational Quality Manager (RQM) 5.0 through 5.02 and 6.0 through 6.0.6 are vulnerable to cross-site scripting.IBM Rational Quality Manager
- CVE-2018-9069BIOS Write Protection Race ConditionLenovo Group IdeaPad
- CVE-2018-11072Dell Digital Delivery versions prior to 3.5.1 contain a DLL Injection Vulnerability.Dell EMC Dell Digital Delivery