# CVEs published 2018-10-04 29 CVEs were published on October 4, 2018: 1 critical, 1 high. Days are UTC. - [CVE-2015-9271](https://cve.now/CVE-2015-9271.md): The VideoWhisper videowhisper-video-conference-integration plugin 4.91.8 for WordPress allows remote attackers to execute arbitrary code bec (no CVSS) - [CVE-2018-17983](https://cve.now/CVE-2018-17983.md): cext/manifest.c in Mercurial before 4.7.2 has an out-of-bounds read during parsing of a malformed manifest entry. (no CVSS, mercurial) - [CVE-2018-17984](https://cve.now/CVE-2018-17984.md): An unanchored /\[a-z\]{2}/ regular expression in ISPConfig before 3.1.13 makes it possible to include arbitrary files, leading to code executi (no CVSS) - [CVE-2018-17985](https://cve.now/CVE-2018-17985.md): An issue was discovered in cp-demangle.c in GNU libiberty, as distributed in GNU Binutils 2.31. (no CVSS) - [CVE-2018-16326](https://cve.now/CVE-2018-16326.md): PHP Scripts Mall Olx Clone 3.4.2 has XSS. (no CVSS) - [CVE-2018-16453](https://cve.now/CVE-2018-16453.md): PHP Scripts Mall Domain Lookup Script 3.0.5 allows XSS in the search bar. (no CVSS) - [CVE-2018-16455](https://cve.now/CVE-2018-16455.md): PHP Scripts Mall Market Place Script 1.0.1 allows XSS via a keyword. (no CVSS) - [CVE-2018-16456](https://cve.now/CVE-2018-16456.md): PHP Scripts Mall Website Seller Script 2.0.5 has XSS via a keyword. (no CVSS) - [CVE-2018-16457](https://cve.now/CVE-2018-16457.md): PHP Scripts Mall Open Source Real-estate Script 3.6.2 allows remote attackers to list the wp-content/themes/template\_dp\_dec2015/img director (no CVSS) - [CVE-2018-17891](https://cve.now/CVE-2018-17891.md): Carestream Vue RIS, RIS Client Builds: Version 11.2 and prior running on a Windows 8.1 machine with IIS/7.5. (no CVSS, Carestream Vue RIS) - [CVE-2018-0503](https://cve.now/CVE-2018-0503.md): $wgRateLimits entry for 'user' overrides 'newbie' (no CVSS, mediawiki · mediawiki/core) - [CVE-2018-0504](https://cve.now/CVE-2018-0504.md): Information disclosure in Special:Redirect/logid (no CVSS, mediawiki · mediawiki/core) - [CVE-2018-0505](https://cve.now/CVE-2018-0505.md): BotPasswords can bypass CentralAuth's account lock (no CVSS, mediawiki · mediawiki/core) - [CVE-2018-13258](https://cve.now/CVE-2018-13258.md): Tarball was missing .htaccess files (no CVSS, mediawiki · mediawiki/core) - [CVE-2018-17849](https://cve.now/CVE-2018-17849.md): Navigate CMS 2.8 has Stored XSS via a navigate\_upload.php (aka File Upload) request with a multipart/form-data JavaScript payload. (no CVSS) - [CVE-2018-17871](https://cve.now/CVE-2018-17871.md): Verba Collaboration Compliance and Quality Management Platform before 9.2.1.5545 has Incorrect Access Control. (no CVSS) - [CVE-2018-17872](https://cve.now/CVE-2018-17872.md): Verba Collaboration Compliance and Quality Management Platform before 9.2.1.5545 has Insecure Permissions. (no CVSS) - [CVE-2018-17876](https://cve.now/CVE-2018-17876.md): A Stored XSS vulnerability has been discovered in the v5.5.0 version of the Coaster CMS product. (no CVSS, web-feet/coastercms) - [CVE-2018-1602](https://cve.now/CVE-2018-1602.md): IBM Rational Quality Manager (RQM) 5.0 through 5.02 and 6.0 through 6.0.6 are vulnerable to cross-site scripting. (CVSS 5.4, IBM Rational Quality Manager) - [CVE-2018-1603](https://cve.now/CVE-2018-1603.md): IBM Rational Quality Manager (RQM) 5.0 through 5.02 and 6.0 through 6.0.6 are vulnerable to cross-site scripting. (CVSS 5.4, IBM Rational Quality Manager) - [CVE-2018-1604](https://cve.now/CVE-2018-1604.md): IBM Rational Quality Manager (RQM) 5.0 through 5.02 and 6.0 through 6.0.6 are vulnerable to cross-site scripting. (CVSS 5.4, IBM Rational Quality Manager) - [CVE-2018-1670](https://cve.now/CVE-2018-1670.md): IBM Financial Transaction Manager for ACH Services for Multi-Platform 3.0.2 could allow an authenticated user to obtain sensitive product co (CVSS 3.1, IBM Financial Transaction Manager) - [CVE-2018-1819](https://cve.now/CVE-2018-1819.md): IBM Financial Transaction Manager for Digital Payments for Multi-Platform 3.0.2, 3.0.4, 3.0.6, and 3.2.0 is vulnerable to SQL injection. (CVSS 6.3, IBM Financial Transaction Manager) - [CVE-2017-5658](https://cve.now/CVE-2017-5658.md): The statistics generator in Apache Pony Mail 0.7 to 0.9 was found to be returning timestamp data without proper authorization checks. (no CVSS, Apache Software Foundation Apache Pony Mail) - [CVE-2018-12470](https://cve.now/CVE-2018-12470.md): SQL injection in RegistrationSharing module (CVSS 9.8, SUSE Linux SMT) - [CVE-2018-12471](https://cve.now/CVE-2018-12471.md): External Entity processing in the RegistrationSharing module (CVSS 6.5, SUSE Linux SMT) - [CVE-2018-12472](https://cve.now/CVE-2018-12472.md): Authentication bypass in sibling check (CVSS 7.3, SUSE Linux SMT) - [CVE-2018-11784](https://cve.now/CVE-2018-11784.md): When the default servlet in Apache Tomcat versions 9.0.0.M1 to 9.0.11, 8.5.0 to 8.5.33 and 7.0.23 to 7.0.90 returned a redirect to a directo (no CVSS, Apache Software Foundation Apache Tomcat · org.apache.tomca…) - [CVE-2018-5492](https://cve.now/CVE-2018-5492.md): NetApp E-Series SANtricity OS Controller Software 11.30 and later version 11.30.5 is susceptible to unauthenticated remote code execution. (no CVSS, NetApp E-Series SANtricity OS Controller Software) --- Source: cve.now, built and run by Sazabi (AI-native observability and security) Page: https://cve.now/daily/2018-10-04 Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.