CVEs published October 3, 2018
40 CVEs were published on October 3, 2018: 0 critical, 9 high.
- Published
- 40
- Critical
- 0
- High
- 9
- Medium
- 3
- Low
- 0
- Unrated
- 28
- Now in CISA KEV
- 0
- Fix available
- 1
Most affected products
- Foxit Software Foxit PDF Reader
- 8
- IBM WebSphere Application Server
- 2
- Certain HP Enterprise Printers, HP PageWide Printers, and M…
- 1
- Delta Electronics ISPSoft
- 1
- HP 240 G1 Notebook PC and certain other consumer notebooks
- 1
- McAfee Data Loss Prevention Endpoint
- 1
- McAfee Threat Intelligence Exchange Server
- 1
- OPCFoundation.NetStandard.Opc.Ua
- 1
High 9
- CVE-2018-3946An exploitable use-after-free vulnerability exists in the JavaScript engine of Foxit Software's PDF Reader version 9.1.0.5096.Foxit Software Foxit PDF Reader
- CVE-2018-3964An exploitable use-after-free vulnerability exists in the JavaScript engine of Foxit Software's Foxit PDF Reader version 9.1.0.5096.Foxit Software Foxit PDF Reader
- CVE-2018-3965An exploitable use-after-free vulnerability exists in the JavaScript engine of Foxit Software's Foxit PDF Reader version 9.1.0.5096.Foxit Software Foxit PDF Reader
- CVE-2018-3966An exploitable use-after-free vulnerability exists in the JavaScript engine of Foxit Software's Foxit PDF Reader version 9.1.0.5096.Foxit Software Foxit PDF Reader
- CVE-2018-3967An exploitable use-after-free vulnerability exists in the JavaScript engine of Foxit Software's Foxit PDF Reader version 9.1.0.5096.Foxit Software Foxit PDF Reader
- CVE-2018-3993An exploitable use-after-free vulnerability exists in the JavaScript engine of Foxit Software's Foxit PDF Reader version 9.2.0.9297.Foxit Software Foxit PDF Reader
- CVE-2018-3994An exploitable use-after-free vulnerability exists in the JavaScript engine of Foxit Software's Foxit PDF Reader version 9.2.0.9297.Foxit Software Foxit PDF Reader
- CVE-2018-3995An exploitable use-after-free vulnerability exists in the JavaScript engine of Foxit Software's PDF Reader, version 9.2.0.9297.Foxit Software Foxit PDF Reader
- CVE-2018-6689Data Loss Prevention Endpoint (DLPe) - Authentication Bypass vulnerabilityMcAfee Data Loss Prevention Endpoint
Medium, low and unrated 31
- CVE-2018-17972An issue was discovered in the proc_pid_stack function in fs/proc/base.c in the Linux kernel through 4.18.11.
- CVE-2018-17974An issue was discovered in Tcpreplay 4.3.0 beta1.
- CVE-2018-6695Threat Intelligence Exchange Server (TIE Server) SSH host keys generation vulnerabilityMcAfee Threat Intelligence Exchange Server
- CVE-2017-2751A BIOS password extraction vulnerability has been reported on certain consumer notebooks with firmware F.22 and others.HP 240 G1 Notebook PC and certain other consumer notebooks
- CVE-2018-17408Stack-based buffer overflows in Zahir Accounting Enterprise Plus 6 through build 10b allow remote attackers to execute arbitrary code via a
- CVE-2018-17428An issue was discovered in OPAC EasyWeb Five 5.7.
- CVE-2018-17540The gmp plugin in strongSwan before 5.7.1 has a Buffer Overflow via a crafted certificate.
- CVE-2018-17552SQL Injection in login.php in Naviwebs Navigate CMS 2.8 allows remote attackers to bypass authentication via the navigate-user cookie.
- CVE-2018-17553An "Unrestricted Upload of File with Dangerous Type" issue with directory traversal in navigate_upload.php in Naviwebs Navigate CMS 2.8 allo
- CVE-2018-17562Multi-Tech FaxFinder before 5.1.6 has SQL Injection via a status/call_details?oid= URI, allowing an attacker to extract the underlying datab
- CVE-2018-17880On D-Link DIR-823G 2018-09-19 devices, the GoAhead configuration allows /HNAP1 RunReboot commands without authentication to trigger a reboot
- CVE-2018-17881On D-Link DIR-823G 2018-09-19 devices, the GoAhead configuration allows /HNAP1 SetPasswdSettings commands without authentication to trigger
- CVE-2018-5921A potential security vulnerability has been identified with certain HP printers and MFPs in 2405129_000052 and other firmware versions.Certain HP Enterprise Printers, HP PageWide Printers, and M…
- CVE-2018-17969Samsung SCX-6545X V2.00.03.01 03-23-2012 devices allows remote attackers to discover cleartext credentials via iso.3.6.1.4.1.236.11.5.11.81.
- CVE-2018-12087Failure to validate certificates in OPC Foundation UA Client Applications communicating without security allows attackers with control over OPCFoundation.NetStandard.Opc.Ua
- CVE-2018-17053Cross-site scripting (XSS) vulnerability in Identity Server in Progress Sitefinity CMS versions 10.0 through 11.0 allows remote attackers to
- CVE-2018-17054Cross-site scripting (XSS) vulnerability in Identity Server in Progress Sitefinity CMS versions 10.0 through 11.0 allows remote attackers to
- CVE-2018-17965ImageMagick 7.0.7-28 has a memory leak vulnerability in WriteSGIImage in coders/sgi.c.
- CVE-2018-17966ImageMagick 7.0.7-28 has a memory leak vulnerability in WritePDBImage in coders/pdb.c.
- CVE-2018-17967ImageMagick 7.0.7-28 has a memory leak vulnerability in ReadBGRImage in coders/bgr.c.
- CVE-2018-16048An issue was discovered in GitLab Community and Enterprise Edition before 11.0.6, 11.1.x before 11.1.5, and 11.2.x before 11.2.2.
- CVE-2018-16049An issue was discovered in GitLab Community and Enterprise Edition before 11.0.6, 11.1.x before 11.1.5, and 11.2.x before 11.2.2.
- CVE-2018-16050An issue was discovered in GitLab Community and Enterprise Edition 11.1.x before 11.1.5 and 11.2.x before 11.2.2.
- CVE-2018-16051An issue was discovered in GitLab Community and Enterprise Edition before 11.0.6, 11.1.x before 11.1.5, and 11.2.x before 11.2.2.
- CVE-2018-1793IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 using SAML ear is vulnerable to cross-site scripting.IBM WebSphere Application Server
- CVE-2018-1794IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 using OAuth ear is vulnerable to cross-site scripting.IBM WebSphere Application Server
- CVE-2018-14800Delta Electronics ISPSoft version 3.0.5 and prior allow an attacker, by opening a crafted file, to cause the application to read past the boDelta Electronics ISPSoft
- CVE-2018-17938Zimbra Collaboration before 8.8.10 GA allows text content spoofing via a loginErrorCode value.
- CVE-2018-17942The convert_to_decimal function in vasnprintf.c in Gnulib before 2018-09-23 has a heap-based buffer overflow because memory is not allocated
- CVE-2018-17946The Tribulant Slideshow Gallery plugin before 1.6.6.1 for WordPress has XSS via the id, method, Gallerymessage, Galleryerror, or Galleryupda
- CVE-2018-17947The Snazzy Maps plugin before 1.1.5 for WordPress has XSS via the text or tab parameter.