CVEs published October 4, 2018
29 CVEs were published on October 4, 2018: 1 critical, 1 high.
- Published
- 29
- Critical
- 1
- High
- 1
- Medium
- 5
- Low
- 1
- Unrated
- 21
- Now in CISA KEV
- 0
- Fix available
- 9
Most affected products
- mediawiki · mediawiki/core
- 4
- IBM Rational Quality Manager
- 3
- SUSE Linux SMT
- 3
- IBM Financial Transaction Manager
- 2
- Apache Software Foundation Apache Pony Mail
- 1
- Apache Software Foundation Apache Tomcat · org.apache.tomca…
- 1
- Carestream Vue RIS
- 1
- mercurial
- 1
- NetApp E-Series SANtricity OS Controller Software
- 1
- web-feet/coastercms
- 1
Critical 1
High 1
Medium, low and unrated 27
- CVE-2015-9271The VideoWhisper videowhisper-video-conference-integration plugin 4.91.8 for WordPress allows remote attackers to execute arbitrary code bec
- CVE-2018-17983cext/manifest.c in Mercurial before 4.7.2 has an out-of-bounds read during parsing of a malformed manifest entry.mercurial
- CVE-2018-17984An unanchored /[a-z]{2}/ regular expression in ISPConfig before 3.1.13 makes it possible to include arbitrary files, leading to code executi
- CVE-2018-17985An issue was discovered in cp-demangle.c in GNU libiberty, as distributed in GNU Binutils 2.31.
- CVE-2018-16326PHP Scripts Mall Olx Clone 3.4.2 has XSS.
- CVE-2018-16453PHP Scripts Mall Domain Lookup Script 3.0.5 allows XSS in the search bar.
- CVE-2018-16455PHP Scripts Mall Market Place Script 1.0.1 allows XSS via a keyword.
- CVE-2018-16456PHP Scripts Mall Website Seller Script 2.0.5 has XSS via a keyword.
- CVE-2018-16457PHP Scripts Mall Open Source Real-estate Script 3.6.2 allows remote attackers to list the wp-content/themes/template_dp_dec2015/img director
- CVE-2018-17891Carestream Vue RIS, RIS Client Builds: Version 11.2 and prior running on a Windows 8.1 machine with IIS/7.5.Carestream Vue RIS
- CVE-2018-0503$wgRateLimits entry for 'user' overrides 'newbie'mediawiki · mediawiki/core
- CVE-2018-0504Information disclosure in Special:Redirect/logidmediawiki · mediawiki/core
- CVE-2018-0505BotPasswords can bypass CentralAuth's account lockmediawiki · mediawiki/core
- CVE-2018-13258Tarball was missing .htaccess filesmediawiki · mediawiki/core
- CVE-2018-17849Navigate CMS 2.8 has Stored XSS via a navigate_upload.php (aka File Upload) request with a multipart/form-data JavaScript payload.
- CVE-2018-17871Verba Collaboration Compliance and Quality Management Platform before 9.2.1.5545 has Incorrect Access Control.
- CVE-2018-17872Verba Collaboration Compliance and Quality Management Platform before 9.2.1.5545 has Insecure Permissions.
- CVE-2018-17876A Stored XSS vulnerability has been discovered in the v5.5.0 version of the Coaster CMS product.web-feet/coastercms
- CVE-2018-1602IBM Rational Quality Manager (RQM) 5.0 through 5.02 and 6.0 through 6.0.6 are vulnerable to cross-site scripting.IBM Rational Quality Manager
- CVE-2018-1603IBM Rational Quality Manager (RQM) 5.0 through 5.02 and 6.0 through 6.0.6 are vulnerable to cross-site scripting.IBM Rational Quality Manager
- CVE-2018-1604IBM Rational Quality Manager (RQM) 5.0 through 5.02 and 6.0 through 6.0.6 are vulnerable to cross-site scripting.IBM Rational Quality Manager
- CVE-2018-1670IBM Financial Transaction Manager for ACH Services for Multi-Platform 3.0.2 could allow an authenticated user to obtain sensitive product coIBM Financial Transaction Manager
- CVE-2018-1819IBM Financial Transaction Manager for Digital Payments for Multi-Platform 3.0.2, 3.0.4, 3.0.6, and 3.2.0 is vulnerable to SQL injection.IBM Financial Transaction Manager
- CVE-2017-5658The statistics generator in Apache Pony Mail 0.7 to 0.9 was found to be returning timestamp data without proper authorization checks.Apache Software Foundation Apache Pony Mail
- CVE-2018-12471External Entity processing in the RegistrationSharing moduleSUSE Linux SMT
- CVE-2018-11784When the default servlet in Apache Tomcat versions 9.0.0.M1 to 9.0.11, 8.5.0 to 8.5.33 and 7.0.23 to 7.0.90 returned a redirect to a directoApache Software Foundation Apache Tomcat · org.apache.tomca…
- CVE-2018-5492NetApp E-Series SANtricity OS Controller Software 11.30 and later version 11.30.5 is susceptible to unauthenticated remote code execution.NetApp E-Series SANtricity OS Controller Software