# CVEs published 2018-10-07

6 CVEs were published on October 7, 2018: 0 critical, 0 high. Days are UTC.

- [CVE-2012-6710](https://cve.now/CVE-2012-6710.md): ext\_find\_user in eXtplorer through 2.1.2 allows remote attackers to bypass authentication via a password\[\]= (aka an empty array) in an actio (no CVSS)
- [CVE-2018-18023](https://cve.now/CVE-2018-18023.md): In ImageMagick 7.0.8-13 Q16, there is a heap-based buffer over-read in the SVGStripString function of coders/svg.c, which allows attackers t (no CVSS)
- [CVE-2018-18024](https://cve.now/CVE-2018-18024.md): In ImageMagick 7.0.8-13 Q16, there is an infinite loop in the ReadBMPImage function of the coders/bmp.c file. (no CVSS)
- [CVE-2018-18025](https://cve.now/CVE-2018-18025.md): In ImageMagick 7.0.8-13 Q16, there is a heap-based buffer over-read in the EncodeImage function of coders/pict.c, which allows attackers to (no CVSS)
- [CVE-2015-9273](https://cve.now/CVE-2015-9273.md): The wp-slimstat (aka Slimstat Analytics) plugin before 4.1.6.1 for WordPress has XSS via an HTTP Referer header, or via a field associated w (no CVSS)
- [CVE-2018-18021](https://cve.now/CVE-2018-18021.md): arch/arm64/kvm/guest.c in KVM in the Linux kernel before 4.18.12 on the arm64 platform mishandles the KVM\_SET\_ON\_REG ioctl. (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2018-10-07
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.