# CVEs published 2018-10-08

48 CVEs were published on October 8, 2018: 4 critical, 9 high. Days are UTC.

- [CVE-2018-14656](https://cve.now/CVE-2018-14656.md): A missing address check in the callers of the show\_opcodes() in the Linux kernel allows an attacker to dump the kernel memory at an arbitrar (CVSS 7.0, \[UNKNOWN\] kernel)
- [CVE-2018-18069](https://cve.now/CVE-2018-18069.md): process\_forms in the WPML (aka sitepress-multilingual-cms) plugin through 3.6.3 for WordPress has XSS via any locale\_file\_name\_ parameter (s (no CVSS)
- [CVE-2016-7475](https://cve.now/CVE-2016-7475.md): Under some circumstances on BIG-IP 12.0.0-12.1.0, 11.6.0-11.6.1, or 11.4.0-11.5.4 HF1, the Traffic Management Microkernel (TMM) may not prop (no CVSS, F5 Networks BIG-IP)
- [CVE-2018-18064](https://cve.now/CVE-2018-18064.md): cairo through 1.15.14 has an out-of-bounds stack-memory write during processing of a crafted document by WebKitGTK+ because of the interacti (no CVSS)
- [CVE-2018-18065](https://cve.now/CVE-2018-18065.md): \_set\_key in agent/helpers/table\_container.c in Net-SNMP before 5.8 has a NULL Pointer Exception bug that can be used by an authenticated att (no CVSS)
- [CVE-2018-18066](https://cve.now/CVE-2018-18066.md): snmp\_oid\_compare in snmplib/snmp\_api.c in Net-SNMP before 5.8 has a NULL Pointer Exception bug that can be used by an unauthenticated attack (CVSS 7.5)
- [CVE-2018-15903](https://cve.now/CVE-2018-15903.md): The Discuss v1.2.1 module in Claromentis 8.2.2 is vulnerable to stored Cross Site Scripting (XSS). (no CVSS)
- [CVE-2018-17775](https://cve.now/CVE-2018-17775.md): Seqrite End Point Security v7.4 has "Everyone: (F)" permission for %PROGRAMFILES%\\Seqrite\\Seqrite, which allows local users to gain privileg (no CVSS)
- [CVE-2018-17977](https://cve.now/CVE-2018-17977.md): The Linux kernel 4.14.67 mishandles certain interaction among XFRM Netlink messages, IPPROTO\_AH packets, and IPPROTO\_IP packets, which allow (no CVSS)
- [CVE-2018-16291](https://cve.now/CVE-2018-16291.md): An exploitable use-after-free vulnerability exists in the JavaScript engine of Foxit Reader before 9.3 and PhantomPDF before 9.3, a differen (no CVSS)
- [CVE-2018-16292](https://cve.now/CVE-2018-16292.md): An exploitable use-after-free vulnerability exists in the JavaScript engine of Foxit Reader before 9.3 and PhantomPDF before 9.3, a differen (no CVSS)
- [CVE-2018-16293](https://cve.now/CVE-2018-16293.md): An exploitable use-after-free vulnerability exists in the JavaScript engine of Foxit Reader before 9.3 and PhantomPDF before 9.3, a differen (no CVSS)
- [CVE-2018-16294](https://cve.now/CVE-2018-16294.md): An exploitable use-after-free vulnerability exists in the JavaScript engine of Foxit Reader before 9.3 and PhantomPDF before 9.3, a differen (no CVSS)
- [CVE-2018-16295](https://cve.now/CVE-2018-16295.md): An exploitable use-after-free vulnerability exists in the JavaScript engine of Foxit Reader before 9.3 and PhantomPDF before 9.3, a differen (no CVSS)
- [CVE-2018-16296](https://cve.now/CVE-2018-16296.md): An exploitable use-after-free vulnerability exists in the JavaScript engine of Foxit Reader before 9.3 and PhantomPDF before 9.3, a differen (no CVSS)
- [CVE-2018-16297](https://cve.now/CVE-2018-16297.md): An exploitable use-after-free vulnerability exists in the JavaScript engine of Foxit Reader before 9.3 and PhantomPDF before 9.3, a differen (no CVSS)
- [CVE-2018-17060](https://cve.now/CVE-2018-17060.md): Telerik Extensions for ASP.NET MVC (all versions) does not whitelist requests, which can allow a remote attacker to access files inside the (no CVSS, TelerikMvcExtensions)
- [CVE-2018-17440](https://cve.now/CVE-2018-17440.md): An issue was discovered on D-Link Central WiFi Manager before v 1.03r0100-Beta1. (no CVSS)
- [CVE-2018-17441](https://cve.now/CVE-2018-17441.md): An issue was discovered on D-Link Central WiFi Manager before v 1.03r0100-Beta1. (no CVSS)
- [CVE-2018-17442](https://cve.now/CVE-2018-17442.md): An issue was discovered on D-Link Central WiFi Manager before v 1.03r0100-Beta1. (no CVSS)
- [CVE-2018-17443](https://cve.now/CVE-2018-17443.md): An issue was discovered on D-Link Central WiFi Manager before v 1.03r0100-Beta1. (no CVSS)
- [CVE-2018-3940](https://cve.now/CVE-2018-3940.md): An exploitable use-after-free vulnerability exists in the JavaScript engine of Foxit Software's PDF Reader, version 9.1.0.5096. (CVSS 8.0, Foxit Software Foxit PDF Reader)
- [CVE-2018-3941](https://cve.now/CVE-2018-3941.md): An exploitable use-after-free vulnerability exists in the JavaScript engine of Foxit Software's Foxit PDF Reader version 9.1.0.5096. (CVSS 8.0, Foxit Software Foxit PDF Reader)
- [CVE-2018-3942](https://cve.now/CVE-2018-3942.md): An exploitable use-after-free vulnerability exists in the JavaScript engine of Foxit Software's PDF Reader, version 9.1.0.5096. (CVSS 8.0, Foxit Software Foxit PDF Reader)
- [CVE-2018-3945](https://cve.now/CVE-2018-3945.md): An exploitable use-after-free vulnerability exists in the JavaScript engine of Foxit Software's Foxit PDF Reader version 9.1.0.5096. (CVSS 8.0, Foxit Software Foxit PDF Reader)
- [CVE-2018-3992](https://cve.now/CVE-2018-3992.md): An exploitable use-after-free vulnerability exists in the JavaScript engine of Foxit Software's Foxit PDF Reader, version 9.2.0.9297. (CVSS 8.0, Foxit Software Foxit PDF Reader)
- [CVE-2018-3996](https://cve.now/CVE-2018-3996.md): An exploitable use-after-free vulnerability exists in the JavaScript engine of Foxit Software's PDF Reader, version 9.2.0.9297. (CVSS 8.0, Foxit Software Foxit PDF Reader)
- [CVE-2018-3997](https://cve.now/CVE-2018-3997.md): An exploitable use-after-free vulnerability exists in the JavaScript engine of Foxit Software's Foxit PDF Reader, version 9.2.0.9297. (CVSS 8.0, Foxit Software Foxit PDF Reader)
- [CVE-2018-1000803](https://cve.now/CVE-2018-1000803.md): Gitea version prior to version 1.5.1 contains a CWE-200 vulnerability that can result in Exposure of users private email addresses. (no CVSS, github.com/go-gitea/gitea)
- [CVE-2018-1000804](https://cve.now/CVE-2018-1000804.md): contiki-ng version 4 contains a Buffer Overflow vulnerability in AQL (Antelope Query Language) database engine that can result in Attacker c (no CVSS)
- [CVE-2018-1000805](https://cve.now/CVE-2018-1000805.md): Paramiko version 2.4.1, 2.3.2, 2.2.3, 2.1.5, 2.0.8, 1.18.5, 1.17.6 contains a Incorrect Access Control vulnerability in SSH server that can (no CVSS, paramiko)
- [CVE-2018-1000808](https://cve.now/CVE-2018-1000808.md): Python Cryptographic Authority pyopenssl version Before 17.5.0 contains a CWE - 401 : Failure to Release Memory Before Removing Last Referen (no CVSS, pyopenssl)
- [CVE-2018-1000809](https://cve.now/CVE-2018-1000809.md): privacyIDEA version 2.23.1 and earlier contains a Improper Input Validation vulnerability in token validation api that can result in Denial- (no CVSS, privacyidea)
- [CVE-2018-1000810](https://cve.now/CVE-2018-1000810.md): The Rust Programming Language Standard Library version 1.29.0, 1.28.0, 1.27.2, 1.27.1, 127.0, 126.2, 126.1, 126.0 contains a CWE-680: Intege (no CVSS)
- [CVE-2018-1741](https://cve.now/CVE-2018-1741.md): IBM Tivoli Key Lifecycle Manager 2.6, 2.7, and 3.0 does not properly limit the number or frequency of interaction which could be used to cau (CVSS 6.5, IBM Security Key Lifecycle Manager)
- [CVE-2018-1742](https://cve.now/CVE-2018-1742.md): IBM Tivoli Key Lifecycle Manager 2.6, 2.7, and 3.0 contains hard-coded credentials, such as a password or cryptographic key, which it uses f (CVSS 5.9, IBM Security Key Lifecycle Manager)
- [CVE-2018-1743](https://cve.now/CVE-2018-1743.md): IBM Tivoli Key Lifecycle Manager 2.6, 2.7, and 3.0 discloses sensitive information to unauthorized users. (CVSS 5.3, IBM Security Key Lifecycle Manager)
- [CVE-2018-1749](https://cve.now/CVE-2018-1749.md): IBM Tivoli Key Lifecycle Manager 2.6, 2.7, and 3.0 uses incomplete blacklisting for input validation which allows attackers to bypass applic (CVSS 4.3, IBM Security Key Lifecycle Manager)
- [CVE-2018-1750](https://cve.now/CVE-2018-1750.md): IBM Security Key Lifecycle Manager 3.0 specifies permissions for a security-critical resource in a way that allows that resource to be read (CVSS 4.2, IBM Security Key Lifecycle Manager)
- [CVE-2018-1753](https://cve.now/CVE-2018-1753.md): IBM Tivoli Key Lifecycle Manager 2.6, 2.7, and 3.0 generates an error message that includes sensitive information about its environment, use (CVSS 4.3, IBM Security Key Lifecycle Manager)
- [CVE-2018-5399](https://cve.now/CVE-2018-5399.md): The Auto-Maskin DCU 210E firmware contains an undocumented Dropbear SSH server, v2015.55, configured to listen on Port 22 while the DCU is running and is configured with a hard-coded credentials (CVSS 9.4, Auto-Maskin DCU-210E · Auto-Maskin RP-210E)
- [CVE-2018-5400](https://cve.now/CVE-2018-5400.md): The Auto-Maskin DCU 210E, RP-210E, and Marine Pro Observer Android App utilize an undocumented custom protocol to set up Modbus communications with other devices without validating those devices, resulting in an origin validation error (CVSS 9.1, Auto-Maskin DCU-210E · Auto-Maskin RP-210E +1)
- [CVE-2018-5401](https://cve.now/CVE-2018-5401.md): The Auto-Maskin DCU 210E, RP-210E, and Marine Pro Observer Android App transmit sensitive or security-critical data in cleartext in a communication channel that can be sniffed by unauthorized actors (CVSS 9.1, Auto-Maskin DCU-210E · Auto-Maskin RP-210E +1)
- [CVE-2018-5402](https://cve.now/CVE-2018-5402.md): The Auto-Maskin DCU 210E, RP-210E, and Marine Pro Observer Android App use an embedded webserver that uses unencrypted plaintext for the transmission of the administrator PIN (CVSS 9.1, Auto-Maskin DCU-210E · Auto-Maskin RP-210E)
- [CVE-2018-14810](https://cve.now/CVE-2018-14810.md): WECON Technology Co., Ltd. (no CVSS, WECON PI Studio HMI · WECON PI Studio)
- [CVE-2018-14818](https://cve.now/CVE-2018-14818.md): WECON Technology Co., Ltd. (no CVSS, WECON PI Studio HMI · WECON PI Studio)
- [CVE-2018-17889](https://cve.now/CVE-2018-17889.md): In WECON Technology Co., Ltd. (no CVSS, WECON PI Studio HMI · WECON PI Studio)
- [CVE-2018-1000807](https://cve.now/CVE-2018-1000807.md): Python Cryptographic Authority pyopenssl version prior to version 17.5.0 contains a CWE-416: Use After Free vulnerability in X509 object han (no CVSS, pyopenssl)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2018-10-08
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.