# CVEs published 2018-10-03

40 CVEs were published on October 3, 2018: 0 critical, 9 high. Days are UTC.

- [CVE-2018-17972](https://cve.now/CVE-2018-17972.md): An issue was discovered in the proc\_pid\_stack function in fs/proc/base.c in the Linux kernel through 4.18.11. (no CVSS)
- [CVE-2018-17974](https://cve.now/CVE-2018-17974.md): An issue was discovered in Tcpreplay 4.3.0 beta1. (no CVSS)
- [CVE-2018-6695](https://cve.now/CVE-2018-6695.md): Threat Intelligence Exchange Server (TIE Server) SSH host keys generation vulnerability (CVSS 6.1, McAfee Threat Intelligence Exchange Server)
- [CVE-2017-2751](https://cve.now/CVE-2017-2751.md): A BIOS password extraction vulnerability has been reported on certain consumer notebooks with firmware F.22 and others. (no CVSS, HP 240 G1 Notebook PC and certain other consumer notebooks)
- [CVE-2018-17408](https://cve.now/CVE-2018-17408.md): Stack-based buffer overflows in Zahir Accounting Enterprise Plus 6 through build 10b allow remote attackers to execute arbitrary code via a (no CVSS)
- [CVE-2018-17428](https://cve.now/CVE-2018-17428.md): An issue was discovered in OPAC EasyWeb Five 5.7. (no CVSS)
- [CVE-2018-17540](https://cve.now/CVE-2018-17540.md): The gmp plugin in strongSwan before 5.7.1 has a Buffer Overflow via a crafted certificate. (no CVSS)
- [CVE-2018-17552](https://cve.now/CVE-2018-17552.md): SQL Injection in login.php in Naviwebs Navigate CMS 2.8 allows remote attackers to bypass authentication via the navigate-user cookie. (no CVSS)
- [CVE-2018-17553](https://cve.now/CVE-2018-17553.md): An "Unrestricted Upload of File with Dangerous Type" issue with directory traversal in navigate\_upload.php in Naviwebs Navigate CMS 2.8 allo (no CVSS)
- [CVE-2018-17562](https://cve.now/CVE-2018-17562.md): Multi-Tech FaxFinder before 5.1.6 has SQL Injection via a status/call\_details?oid= URI, allowing an attacker to extract the underlying datab (no CVSS)
- [CVE-2018-17880](https://cve.now/CVE-2018-17880.md): On D-Link DIR-823G 2018-09-19 devices, the GoAhead configuration allows /HNAP1 RunReboot commands without authentication to trigger a reboot (no CVSS)
- [CVE-2018-17881](https://cve.now/CVE-2018-17881.md): On D-Link DIR-823G 2018-09-19 devices, the GoAhead configuration allows /HNAP1 SetPasswdSettings commands without authentication to trigger (no CVSS)
- [CVE-2018-5921](https://cve.now/CVE-2018-5921.md): A potential security vulnerability has been identified with certain HP printers and MFPs in 2405129\_000052 and other firmware versions. (no CVSS, Certain HP Enterprise Printers, HP PageWide Printers, and M…)
- [CVE-2018-17969](https://cve.now/CVE-2018-17969.md): Samsung SCX-6545X V2.00.03.01 03-23-2012 devices allows remote attackers to discover cleartext credentials via iso.3.6.1.4.1.236.11.5.11.81. (no CVSS)
- [CVE-2018-12087](https://cve.now/CVE-2018-12087.md): Failure to validate certificates in OPC Foundation UA Client Applications communicating without security allows attackers with control over (no CVSS, OPCFoundation.NetStandard.Opc.Ua)
- [CVE-2018-17053](https://cve.now/CVE-2018-17053.md): Cross-site scripting (XSS) vulnerability in Identity Server in Progress Sitefinity CMS versions 10.0 through 11.0 allows remote attackers to (no CVSS)
- [CVE-2018-17054](https://cve.now/CVE-2018-17054.md): Cross-site scripting (XSS) vulnerability in Identity Server in Progress Sitefinity CMS versions 10.0 through 11.0 allows remote attackers to (no CVSS)
- [CVE-2018-17965](https://cve.now/CVE-2018-17965.md): ImageMagick 7.0.7-28 has a memory leak vulnerability in WriteSGIImage in coders/sgi.c. (no CVSS)
- [CVE-2018-17966](https://cve.now/CVE-2018-17966.md): ImageMagick 7.0.7-28 has a memory leak vulnerability in WritePDBImage in coders/pdb.c. (no CVSS)
- [CVE-2018-17967](https://cve.now/CVE-2018-17967.md): ImageMagick 7.0.7-28 has a memory leak vulnerability in ReadBGRImage in coders/bgr.c. (no CVSS)
- [CVE-2018-16048](https://cve.now/CVE-2018-16048.md): An issue was discovered in GitLab Community and Enterprise Edition before 11.0.6, 11.1.x before 11.1.5, and 11.2.x before 11.2.2. (no CVSS)
- [CVE-2018-16049](https://cve.now/CVE-2018-16049.md): An issue was discovered in GitLab Community and Enterprise Edition before 11.0.6, 11.1.x before 11.1.5, and 11.2.x before 11.2.2. (no CVSS)
- [CVE-2018-16050](https://cve.now/CVE-2018-16050.md): An issue was discovered in GitLab Community and Enterprise Edition 11.1.x before 11.1.5 and 11.2.x before 11.2.2. (no CVSS)
- [CVE-2018-16051](https://cve.now/CVE-2018-16051.md): An issue was discovered in GitLab Community and Enterprise Edition before 11.0.6, 11.1.x before 11.1.5, and 11.2.x before 11.2.2. (no CVSS)
- [CVE-2018-3946](https://cve.now/CVE-2018-3946.md): An exploitable use-after-free vulnerability exists in the JavaScript engine of Foxit Software's PDF Reader version 9.1.0.5096. (CVSS 8.0, Foxit Software Foxit PDF Reader)
- [CVE-2018-3964](https://cve.now/CVE-2018-3964.md): An exploitable use-after-free vulnerability exists in the JavaScript engine of Foxit Software's Foxit PDF Reader version 9.1.0.5096. (CVSS 8.0, Foxit Software Foxit PDF Reader)
- [CVE-2018-3965](https://cve.now/CVE-2018-3965.md): An exploitable use-after-free vulnerability exists in the JavaScript engine of Foxit Software's Foxit PDF Reader version 9.1.0.5096. (CVSS 8.0, Foxit Software Foxit PDF Reader)
- [CVE-2018-3966](https://cve.now/CVE-2018-3966.md): An exploitable use-after-free vulnerability exists in the JavaScript engine of Foxit Software's Foxit PDF Reader version 9.1.0.5096. (CVSS 8.0, Foxit Software Foxit PDF Reader)
- [CVE-2018-3967](https://cve.now/CVE-2018-3967.md): An exploitable use-after-free vulnerability exists in the JavaScript engine of Foxit Software's Foxit PDF Reader version 9.1.0.5096. (CVSS 8.0, Foxit Software Foxit PDF Reader)
- [CVE-2018-3993](https://cve.now/CVE-2018-3993.md): An exploitable use-after-free vulnerability exists in the JavaScript engine of Foxit Software's Foxit PDF Reader version 9.2.0.9297. (CVSS 8.0, Foxit Software Foxit PDF Reader)
- [CVE-2018-3994](https://cve.now/CVE-2018-3994.md): An exploitable use-after-free vulnerability exists in the JavaScript engine of Foxit Software's Foxit PDF Reader version 9.2.0.9297. (CVSS 8.0, Foxit Software Foxit PDF Reader)
- [CVE-2018-3995](https://cve.now/CVE-2018-3995.md): An exploitable use-after-free vulnerability exists in the JavaScript engine of Foxit Software's PDF Reader, version 9.2.0.9297. (CVSS 8.0, Foxit Software Foxit PDF Reader)
- [CVE-2018-1793](https://cve.now/CVE-2018-1793.md): IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 using SAML ear is vulnerable to cross-site scripting. (CVSS 6.1, IBM WebSphere Application Server)
- [CVE-2018-1794](https://cve.now/CVE-2018-1794.md): IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 using OAuth ear is vulnerable to cross-site scripting. (CVSS 6.1, IBM WebSphere Application Server)
- [CVE-2018-14800](https://cve.now/CVE-2018-14800.md): Delta Electronics ISPSoft version 3.0.5 and prior allow an attacker, by opening a crafted file, to cause the application to read past the bo (no CVSS, Delta Electronics ISPSoft)
- [CVE-2018-6689](https://cve.now/CVE-2018-6689.md): Data Loss Prevention Endpoint (DLPe) - Authentication Bypass vulnerability (CVSS 7.0, McAfee Data Loss Prevention Endpoint)
- [CVE-2018-17938](https://cve.now/CVE-2018-17938.md): Zimbra Collaboration before 8.8.10 GA allows text content spoofing via a loginErrorCode value. (no CVSS)
- [CVE-2018-17942](https://cve.now/CVE-2018-17942.md): The convert\_to\_decimal function in vasnprintf.c in Gnulib before 2018-09-23 has a heap-based buffer overflow because memory is not allocated (no CVSS)
- [CVE-2018-17946](https://cve.now/CVE-2018-17946.md): The Tribulant Slideshow Gallery plugin before 1.6.6.1 for WordPress has XSS via the id, method, Gallerymessage, Galleryerror, or Galleryupda (no CVSS)
- [CVE-2018-17947](https://cve.now/CVE-2018-17947.md): The Snazzy Maps plugin before 1.1.5 for WordPress has XSS via the text or tab parameter. (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2018-10-03
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.