CVEs published October 8, 2018
48 CVEs were published on October 8, 2018: 4 critical, 9 high.
- Published
- 48
- Critical
- 4
- High
- 9
- Medium
- 6
- Low
- 0
- Unrated
- 29
- Now in CISA KEV
- 0
- Fix available
- 9
Most affected products
- Foxit Software Foxit PDF Reader
- 7
- IBM Security Key Lifecycle Manager
- 6
- WECON PI Studio HMI · WECON PI Studio
- 3
- Auto-Maskin DCU-210E · Auto-Maskin RP-210E
- 2
- Auto-Maskin DCU-210E · Auto-Maskin RP-210E +1
- 2
- pyopenssl
- 2
- [UNKNOWN] kernel
- 1
- F5 Networks BIG-IP
- 1
- github.com/go-gitea/gitea
- 1
- paramiko
- 1
Critical 4
- CVE-2018-5399The Auto-Maskin DCU 210E firmware contains an undocumented Dropbear SSH server, v2015.55, configured to listen on Port 22 while the DCU is running and is configured with a hard-coded credentialsAuto-Maskin DCU-210E · Auto-Maskin RP-210E
- CVE-2018-5400The Auto-Maskin DCU 210E, RP-210E, and Marine Pro Observer Android App utilize an undocumented custom protocol to set up Modbus communications with other devices without validating those devices, resulting in an origin validation errorAuto-Maskin DCU-210E · Auto-Maskin RP-210E +1
- CVE-2018-5401The Auto-Maskin DCU 210E, RP-210E, and Marine Pro Observer Android App transmit sensitive or security-critical data in cleartext in a communication channel that can be sniffed by unauthorized actorsAuto-Maskin DCU-210E · Auto-Maskin RP-210E +1
- CVE-2018-5402The Auto-Maskin DCU 210E, RP-210E, and Marine Pro Observer Android App use an embedded webserver that uses unencrypted plaintext for the transmission of the administrator PINAuto-Maskin DCU-210E · Auto-Maskin RP-210E
High 9
- CVE-2018-14656A missing address check in the callers of the show_opcodes() in the Linux kernel allows an attacker to dump the kernel memory at an arbitrar[UNKNOWN] kernel
- CVE-2018-18066snmp_oid_compare in snmplib/snmp_api.c in Net-SNMP before 5.8 has a NULL Pointer Exception bug that can be used by an unauthenticated attack
- CVE-2018-3940An exploitable use-after-free vulnerability exists in the JavaScript engine of Foxit Software's PDF Reader, version 9.1.0.5096.Foxit Software Foxit PDF Reader
- CVE-2018-3941An exploitable use-after-free vulnerability exists in the JavaScript engine of Foxit Software's Foxit PDF Reader version 9.1.0.5096.Foxit Software Foxit PDF Reader
- CVE-2018-3942An exploitable use-after-free vulnerability exists in the JavaScript engine of Foxit Software's PDF Reader, version 9.1.0.5096.Foxit Software Foxit PDF Reader
- CVE-2018-3945An exploitable use-after-free vulnerability exists in the JavaScript engine of Foxit Software's Foxit PDF Reader version 9.1.0.5096.Foxit Software Foxit PDF Reader
- CVE-2018-3992An exploitable use-after-free vulnerability exists in the JavaScript engine of Foxit Software's Foxit PDF Reader, version 9.2.0.9297.Foxit Software Foxit PDF Reader
- CVE-2018-3996An exploitable use-after-free vulnerability exists in the JavaScript engine of Foxit Software's PDF Reader, version 9.2.0.9297.Foxit Software Foxit PDF Reader
- CVE-2018-3997An exploitable use-after-free vulnerability exists in the JavaScript engine of Foxit Software's Foxit PDF Reader, version 9.2.0.9297.Foxit Software Foxit PDF Reader
Medium, low and unrated 35
- CVE-2018-18069process_forms in the WPML (aka sitepress-multilingual-cms) plugin through 3.6.3 for WordPress has XSS via any locale_file_name_ parameter (s
- CVE-2016-7475Under some circumstances on BIG-IP 12.0.0-12.1.0, 11.6.0-11.6.1, or 11.4.0-11.5.4 HF1, the Traffic Management Microkernel (TMM) may not propF5 Networks BIG-IP
- CVE-2018-18064cairo through 1.15.14 has an out-of-bounds stack-memory write during processing of a crafted document by WebKitGTK+ because of the interacti
- CVE-2018-18065_set_key in agent/helpers/table_container.c in Net-SNMP before 5.8 has a NULL Pointer Exception bug that can be used by an authenticated att
- CVE-2018-15903The Discuss v1.2.1 module in Claromentis 8.2.2 is vulnerable to stored Cross Site Scripting (XSS).
- CVE-2018-17775Seqrite End Point Security v7.4 has "Everyone: (F)" permission for %PROGRAMFILES%\Seqrite\Seqrite, which allows local users to gain privileg
- CVE-2018-17977The Linux kernel 4.14.67 mishandles certain interaction among XFRM Netlink messages, IPPROTO_AH packets, and IPPROTO_IP packets, which allow
- CVE-2018-16291An exploitable use-after-free vulnerability exists in the JavaScript engine of Foxit Reader before 9.3 and PhantomPDF before 9.3, a differen
- CVE-2018-16292An exploitable use-after-free vulnerability exists in the JavaScript engine of Foxit Reader before 9.3 and PhantomPDF before 9.3, a differen
- CVE-2018-16293An exploitable use-after-free vulnerability exists in the JavaScript engine of Foxit Reader before 9.3 and PhantomPDF before 9.3, a differen
- CVE-2018-16294An exploitable use-after-free vulnerability exists in the JavaScript engine of Foxit Reader before 9.3 and PhantomPDF before 9.3, a differen
- CVE-2018-16295An exploitable use-after-free vulnerability exists in the JavaScript engine of Foxit Reader before 9.3 and PhantomPDF before 9.3, a differen
- CVE-2018-16296An exploitable use-after-free vulnerability exists in the JavaScript engine of Foxit Reader before 9.3 and PhantomPDF before 9.3, a differen
- CVE-2018-16297An exploitable use-after-free vulnerability exists in the JavaScript engine of Foxit Reader before 9.3 and PhantomPDF before 9.3, a differen
- CVE-2018-17060Telerik Extensions for ASP.NET MVC (all versions) does not whitelist requests, which can allow a remote attacker to access files inside the TelerikMvcExtensions
- CVE-2018-17440An issue was discovered on D-Link Central WiFi Manager before v 1.03r0100-Beta1.
- CVE-2018-17441An issue was discovered on D-Link Central WiFi Manager before v 1.03r0100-Beta1.
- CVE-2018-17442An issue was discovered on D-Link Central WiFi Manager before v 1.03r0100-Beta1.
- CVE-2018-17443An issue was discovered on D-Link Central WiFi Manager before v 1.03r0100-Beta1.
- CVE-2018-1000803Gitea version prior to version 1.5.1 contains a CWE-200 vulnerability that can result in Exposure of users private email addresses.github.com/go-gitea/gitea
- CVE-2018-1000804contiki-ng version 4 contains a Buffer Overflow vulnerability in AQL (Antelope Query Language) database engine that can result in Attacker c
- CVE-2018-1000805Paramiko version 2.4.1, 2.3.2, 2.2.3, 2.1.5, 2.0.8, 1.18.5, 1.17.6 contains a Incorrect Access Control vulnerability in SSH server that can paramiko
- CVE-2018-1000808Python Cryptographic Authority pyopenssl version Before 17.5.0 contains a CWE - 401 : Failure to Release Memory Before Removing Last Referenpyopenssl
- CVE-2018-1000809privacyIDEA version 2.23.1 and earlier contains a Improper Input Validation vulnerability in token validation api that can result in Denial-privacyidea
- CVE-2018-1000810The Rust Programming Language Standard Library version 1.29.0, 1.28.0, 1.27.2, 1.27.1, 127.0, 126.2, 126.1, 126.0 contains a CWE-680: Intege
- CVE-2018-1741IBM Tivoli Key Lifecycle Manager 2.6, 2.7, and 3.0 does not properly limit the number or frequency of interaction which could be used to cauIBM Security Key Lifecycle Manager
- CVE-2018-1742IBM Tivoli Key Lifecycle Manager 2.6, 2.7, and 3.0 contains hard-coded credentials, such as a password or cryptographic key, which it uses fIBM Security Key Lifecycle Manager
- CVE-2018-1743IBM Tivoli Key Lifecycle Manager 2.6, 2.7, and 3.0 discloses sensitive information to unauthorized users.IBM Security Key Lifecycle Manager
- CVE-2018-1749IBM Tivoli Key Lifecycle Manager 2.6, 2.7, and 3.0 uses incomplete blacklisting for input validation which allows attackers to bypass applicIBM Security Key Lifecycle Manager
- CVE-2018-1750IBM Security Key Lifecycle Manager 3.0 specifies permissions for a security-critical resource in a way that allows that resource to be read IBM Security Key Lifecycle Manager
- CVE-2018-1753IBM Tivoli Key Lifecycle Manager 2.6, 2.7, and 3.0 generates an error message that includes sensitive information about its environment, useIBM Security Key Lifecycle Manager
- CVE-2018-14810WECON Technology Co., Ltd.WECON PI Studio HMI · WECON PI Studio
- CVE-2018-14818WECON Technology Co., Ltd.WECON PI Studio HMI · WECON PI Studio
- CVE-2018-17889In WECON Technology Co., Ltd.WECON PI Studio HMI · WECON PI Studio
- CVE-2018-1000807Python Cryptographic Authority pyopenssl version prior to version 17.5.0 contains a CWE-416: Use After Free vulnerability in X509 object hanpyopenssl