CVEs published October 10, 2018
110 CVEs were published on October 10, 2018: 2 critical, 10 high. 1 is now in CISA KEV.
- Published
- 110
- Critical
- 2
- High
- 10
- Medium
- 11
- Low
- 0
- Unrated
- 87
- Now in CISA KEV
- 1
- Fix available
- 31
Most affected products
- Juniper Networks Junos OS
- 18
- Microsoft Windows
- 13
- Microsoft Edge · Microsoft ChakraCore +1
- 5
- Microsoft SharePoint
- 4
- Microsoft Windows Server · Microsoft Windows
- 4
- Hangzhou Xiongmai Technology Co. XMeye P2P Cloud Server
- 3
- Microsoft Edge
- 3
- Microsoft SQL Server Management Studio
- 3
- Intel Graphics Driver
- 2
- Microsoft Exchange Server
- 2
Critical 2
High 10
- CVE-2018-0043Junos OS: RPD daemon crashes upon receipt of specific MPLS packetJuniper Networks Junos OS
- CVE-2018-0045Junos OS: RPD daemon crashes due to receipt of specific Draft-Rosen MVPN control packet in Draft-Rosen MVPN configurationJuniper Networks Junos OS
- CVE-2018-0046Junos Space: Reflected Cross-site Scripting vulnerability in OpenNMSJuniper Networks Junos Space
- CVE-2018-0047Junos Space Security Director: XSS vulnerability in web administrationJuniper Networks Junos Space Security Director
- CVE-2018-0048Junos OS: Memory exhaustion denial of service vulnerability in Routing Protocols Daemon (RPD) with Juniper Extension Toolkit (JET) support.Juniper Networks Junos OS
- CVE-2018-0049Junos OS: Receipt of a specifically crafted malicious MPLS packet leads to a Junos kernel crash.Juniper Networks Junos OS
- CVE-2018-0050Junos OS: Receipt of a malformed MPLS RSVP packet leads to a Routing Protocols Daemon (RPD) crash.Juniper Networks Junos OS
- CVE-2018-0051Junos OS: Denial of Service vulnerability in MS-PIC, MS-MIC, MS-MPC, MS-DPC and SRX flow daemon (flowd) related to SIP ALGJuniper Networks Junos OS
- CVE-2018-0052Junos OS: Unauthenticated remote root access possible when RSH service is enabledJuniper Networks Junos OS
- CVE-2018-8453An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in memory, aka "Win32k Microsoft Windows
Medium, low and unrated 98
- CVE-2018-12455Intelbras NPLUG 1.0.0.14 wireless repeater devices have a critical vulnerability that allows an attacker to authenticate in the web interfac
- CVE-2018-12456Intelbras NPLUG 1.0.0.14 wireless repeater devices have no CSRF token protection in the web interface, allowing attackers to perform actions
- CVE-2018-12596Episerver Ektron CMS before 9.0 SP3 Site CU 31, 9.1 before SP3 Site CU 45, or 9.2 before SP2 Site CU 22 allows remote attackers to call aspx
- CVE-2018-13789An issue was discovered in Descor Infocad FM before 3.1.0.0.
- CVE-2018-17337Intelbras NPLUG 1.0.0.14 devices have XSS via a crafted SSID that is received via a network broadcast.
- CVE-2018-17784Multiple vulnerabilities in YUI and FlashCanvas embedded in SugarCRM Community Edition 6.5.26 could allow an unauthenticated, remote attacke
- CVE-2018-18061An issue was discovered in dialog.php in tecrail Responsive FileManager 9.8.1.
- CVE-2018-18062An issue was discovered in dialog.php in tecrail Responsive FileManager 9.8.1.
- CVE-2018-12541In version from 3.0.0 to 3.5.3 of Eclipse Vert.x, the WebSocket HTTP upgrade implementation buffers the full http request before doing the hThe Eclipse Foundation Eclipse Vert.x · io.vertx:vertx-core
- CVE-2018-12542In version from 3.0.0 to 3.5.3 of Eclipse Vert.x, the StaticHandler uses external input to construct a pathname that should be within a restThe Eclipse Foundation Eclipse Vert.x · io.vertx:vertx-web
- CVE-2018-12544In version from 3.5.Beta1 to 3.5.3 of Eclipse Vert.x, the OpenAPI XML type validator creates XML parsers without taking appropriate defense The Eclipse Foundation Eclipse Vert.x · io.vertx:vertx-core
- CVE-2018-0053vSRX Series: A local authentication vulnerability may lead to full control of a vSRX instance while the system is booting.Juniper Networks Junos OS
- CVE-2018-0054QFX5000/EX4600 Series: Routing protocol flap upon receipt of high rate of Ethernet framesJuniper Networks Junos OS
- CVE-2018-0055Junos OS: jdhcpd process crash during processing of specially crafted DHCPv6 messageJuniper Networks Junos OS
- CVE-2018-0056MX Series: L2ALD daemon may crash if a duplicate MAC is learned by two different interfacesJuniper Networks Junos OS
- CVE-2018-0057Junos OS: authd allows assignment of IP address requested by DHCP subscriber logging in with Option 50 (Requested IP Address)Juniper Networks Junos OS
- CVE-2018-0058MX Series: In BBE configurations, receipt of a crafted IPv6 exception packet causes a Denial of ServiceJuniper Networks Junos OS
- CVE-2018-0059ScreenOS: Stored Cross-Site Scripting (XSS) vulnerabilityJuniper Networks ScreenOS
- CVE-2018-0060Junos OS: Invalid IP/mask learned from DHCP server might cause device control daemon (dcd) process crashJuniper Networks Junos OS
- CVE-2018-0061Junos OS: Denial of service in telnetdJuniper Networks Junos OS
- CVE-2018-0062Junos OS: Denial of Service in J-WebJuniper Networks Junos OS
- CVE-2018-0063Junos OS: Nexthop index allocation failed: private index space exhausted after incoming ARP requests to management interfaceJuniper Networks Junos OS
- CVE-2018-12152Pointer corruption in Unified Shader Compiler in Intel Graphics Drivers before 10.18.x.5056 (aka 15.33.x.5056), 10.18.x.5057 (aka 15.36.x.50Intel Graphics Driver
- CVE-2018-12153Denial of Service in Unified Shader Compiler in Intel Graphics Drivers before 10.18.x.5056 (aka 15.33.x.5056), 10.18.x.5057 (aka 15.36.x.505Intel Graphics Driver
- CVE-2018-12158Insufficient input validation in BIOS update utility in Intel NUC FW kits downloaded before May 24, 2018 may allow a privileged user to poteIntel NUC Firmware Kits
- CVE-2018-12161Insufficient session validation in the webserver component of the Intel Rapid Web Server 3 may allow an unauthenticated user to potentially Intel RAID Web Server
- CVE-2018-12172Improper password hashing in firmware in Intel Server Board (S7200AP,S7200APR) and Intel Compute Module (HNS7200AP, HNS7200AP) may allow a pIntel Server Board
- CVE-2018-12173Insufficient access protection in firmware in Intel Server Board, Intel Server System and Intel Compute Module before firmware version 00.01Intel Server Boards Firmware
- CVE-2018-12193Insufficient access control in driver stack for Intel QuickAssist Technology for Linux before version 4.2 may allow an unprivileged user to Intel QuickAssit Technology for Linux
- CVE-2018-13800A vulnerability has been identified in SIMATIC S7-1200 CPU family version 4 (All versions < V4.2.3).Siemens AG SIMATIC S7-1200 CPU family
- CVE-2018-13801A vulnerability has been identified in ROX II (All versions < V2.12.1).Siemens AG ROX II
- CVE-2018-13802A vulnerability has been identified in ROX II (All versions < V2.12.1).Siemens AG ROX II
- CVE-2018-13805A vulnerability has been identified in SIMATIC ET 200SP Open Controller (All versions >= V2.0 and < V2.1.6), SIMATIC S7-1500 Software ControSiemens AG SIMATIC ET 200SP Open Controller · Siemens AG… +1
- CVE-2018-17925Multiple instances of this vulnerability (Unsafe ActiveX Control Marked Safe For Scripting) have been identified in the third-party ActiveX GE iFix
- CVE-2018-18209XSS exists in DiliCMS 2.4.0 via the admin/index.php/setting/site?tab=site_attachment attachment_type parameter.
- CVE-2018-18210XSS exists in DiliCMS 2.4.0 via the admin/index.php/setting/site?tab=site_attachment attachment_url parameter.
- CVE-2018-18211PbootCMS 1.2.1 has SQL injection via the HTTP POST data to the api.php/cms/addform?fcode=1 URI.
- CVE-2018-17915All versions of Hangzhou Xiongmai Technology Co., Ltd XMeye P2P Cloud Server do not encrypt all device communication.Hangzhou Xiongmai Technology Co. XMeye P2P Cloud Server
- CVE-2018-17917All versions of Hangzhou Xiongmai Technology Co., Ltd XMeye P2P Cloud Server may allow an attacker to use MAC addresses to enumerate potentiHangzhou Xiongmai Technology Co. XMeye P2P Cloud Server
- CVE-2018-17919All versions of Hangzhou Xiongmai Technology Co., Ltd XMeye P2P Cloud Server may allow an attacker to use an undocumented user account "defaHangzhou Xiongmai Technology Co. XMeye P2P Cloud Server
- CVE-2018-18207Virtualmin 6.03 allows Frame Injection via the settings-editor_read.cgi file parameter.
- CVE-2018-18208Virtualmin 6.03 allows XSS via the query string, as demonstrated by the webmin_search.cgi URI.
- CVE-2018-12131Permissions in the driver pack installers for Intel NVMe before version 4.0.0.1007 and Intel RSTe before version 4.7.0.2083 may allow an autIntel NVMe and Intel RSTe
- CVE-2018-15311When F5 BIG-IP 13.0.0-13.1.0.5, 12.1.0-12.1.3.5, 11.6.0-11.6.3.2, or 11.5.1-11.5.6 is processing specially crafted TCP traffic with the LargF5 Networks BIG-IP
- CVE-2018-8006An instance of a cross-site scripting vulnerability was identified to be present in the web based administration console on the queue.jsp paApache Software Foundation Apache ActiveMQ · org.apache.act…
- CVE-2018-8265A remote code execution vulnerability exists in the way Microsoft Exchange software parses specially crafted email messages, aka "Microsoft Microsoft Exchange Server
- CVE-2018-8292An information disclosure vulnerability exists in .NET Core when authentication information is inadvertently exposed in a redirect, aka ".NEMicrosoft PowerShell Core · Microsoft .NET Core +1
- CVE-2018-8320A security feature bypass vulnerability exists in DNS Global Blocklist feature, aka "Windows DNS Security Feature Bypass Vulnerability." ThiMicrosoft Windows Server 2012 R2 · Microsoft Windows Ser… +1
- CVE-2018-8329An Elevation of Privilege vulnerability exists in Windows Subsystem for Linux when it fails to properly handle objects in memory, aka "LinuxMicrosoft Windows
- CVE-2018-8330An information disclosure vulnerability exists when the Windows kernel improperly handles objects in memory, aka "Windows Kernel InformationMicrosoft Windows
- CVE-2018-8333An Elevation of Privilege vulnerability exists in Filter Manager when it improperly handles objects in memory, aka "Microsoft Filter ManagerMicrosoft Windows
- CVE-2018-8411An elevation of privilege vulnerability exists when NTFS improperly checks access, aka "NTFS Elevation of Privilege Vulnerability." This affMicrosoft Windows
- CVE-2018-8413A remote code execution vulnerability exists when "Windows Theme API" does not properly decompress files, aka "Windows Theme API Remote CodeMicrosoft Windows
- CVE-2018-8423A remote code execution vulnerability exists in the Microsoft JET Database Engine, aka "Microsoft JET Database Engine Remote Code Execution Microsoft Windows
- CVE-2018-8427An information disclosure vulnerability exists in the way that Microsoft Graphics Components handle objects in memory, aka "Microsoft GraphiMicrosoft Office · Microsoft Windows Server +2
- CVE-2018-8432A remote code execution vulnerability exists in the way that Microsoft Graphics Components handle objects in memory, aka "Microsoft GraphicsMicrosoft Windows · Microsoft Office +2
- CVE-2018-8448An elevation of privilege vulnerability exists when Microsoft Exchange Outlook Web Access (OWA) fails to properly handle web requests, aka "Microsoft Exchange Server
- CVE-2018-8460A remote code execution vulnerability exists when Internet Explorer improperly accesses objects in memory, aka "Internet Explorer Memory CorMicrosoft Internet Explorer
- CVE-2018-8472An information disclosure vulnerability exists in the way that the Windows Graphics Device Interface (GDI) handles objects in memory, allowiMicrosoft Windows
- CVE-2018-8473A remote code execution vulnerability exists when Microsoft Edge improperly accesses objects in memory, aka "Microsoft Edge Memory CorruptioMicrosoft Edge · Microsoft ChakraCore
- CVE-2018-8480An elevation of privilege vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request tMicrosoft SharePoint
- CVE-2018-8481An information disclosure vulnerability exists when Windows Media Player improperly discloses file information, aka "Windows Media Player InMicrosoft Windows
- CVE-2018-8482An information disclosure vulnerability exists when Windows Media Player improperly discloses file information, aka "Windows Media Player InMicrosoft Windows
- CVE-2018-8484An elevation of privilege vulnerability exists when the DirectX Graphics Kernel (DXGKRNL) driver improperly handles objects in memory, aka "Microsoft Windows Server 2012 R2 · Microsoft Windows RT +2
- CVE-2018-8486An information disclosure vulnerability exists when DirectX improperly handles objects in memory, aka "DirectX Information Disclosure VulnerMicrosoft Windows
- CVE-2018-8488An elevation of privilege vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request tMicrosoft SharePoint
- CVE-2018-8489A remote code execution vulnerability exists when Windows Hyper-V on a host server fails to properly validate input from an authenticated usMicrosoft Windows
- CVE-2018-8490A remote code execution vulnerability exists when Windows Hyper-V on a host server fails to properly validate input from an authenticated usMicrosoft Windows Server · Microsoft Windows
- CVE-2018-8491A remote code execution vulnerability exists when Internet Explorer improperly accesses objects in memory, aka "Internet Explorer Memory CorMicrosoft Internet Explorer
- CVE-2018-8492A security feature bypass vulnerability exists in Device Guard that could allow an attacker to inject malicious code into a Windows PowerSheMicrosoft Windows Server · Microsoft Windows
- CVE-2018-8493An information disclosure vulnerability exists when the Windows TCP/IP stack improperly handles fragmented IP packets, aka "Windows TCP/IP IMicrosoft Windows Server 2012 R2 · Microsoft Windows RT +2
- CVE-2018-8494A remote code execution vulnerability exists when the Microsoft XML Core Services MSXML parser processes user input, aka "MS XML Remote CodeMicrosoft Windows
- CVE-2018-8495A remote code execution vulnerability exists when Windows Shell improperly handles URIs, aka "Windows Shell Remote Code Execution VulnerabilMicrosoft Windows Server · Microsoft Windows
- CVE-2018-8497An elevation of privilege vulnerability exists in the way that the Windows Kernel handles objects in memory, aka "Windows Kernel Elevation oMicrosoft Windows Server · Microsoft Windows
- CVE-2018-8498An elevation of privilege vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request tMicrosoft SharePoint
- CVE-2018-8500A remote code execution vulnerability exists in the way that the ChakraCore scripting engine handles objects in memory, aka "Scripting EnginMicrosoft ChakraCore · Microsoft.ChakraCore
- CVE-2018-8501A remote code execution vulnerability exists in Microsoft PowerPoint software when the software fails to properly handle objects in ProtecteMicrosoft PowerPoint Viewer · Microsoft Office +1
- CVE-2018-8502A remote code execution vulnerability exists in Microsoft Excel software when the software fails to properly handle objects in Protected VieMicrosoft Office · Microsoft Excel
- CVE-2018-8503A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka "CMicrosoft Edge · Microsoft ChakraCore +1
- CVE-2018-8504A remote code execution vulnerability exists in Microsoft Word software when the software fails to properly handle objects in Protected ViewMicrosoft SharePoint Server · Microsoft Office +1
- CVE-2018-8505A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka "CMicrosoft Edge · Microsoft ChakraCore +1
- CVE-2018-8506An Information Disclosure vulnerability exists in the way that Microsoft Windows Codecs Library handles objects in memory, aka "Microsoft WiMicrosoft Windows 10 Servers · Microsoft Windows
- CVE-2018-8509A remote code execution vulnerability exists when Microsoft Edge improperly accesses objects in memory, aka "Microsoft Edge Memory CorruptioMicrosoft Edge
- CVE-2018-8510A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka "CMicrosoft Edge · Microsoft ChakraCore +1
- CVE-2018-8511A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka "CMicrosoft Edge · Microsoft ChakraCore +1
- CVE-2018-8512A security feature bypass vulnerability exists in Microsoft Edge when the Edge Content Security Policy (CSP) fails to properly validate certMicrosoft Edge
- CVE-2018-8513A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka "CMicrosoft Edge · Microsoft ChakraCore +1
- CVE-2018-8518An elevation of privilege vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request tMicrosoft SharePoint
- CVE-2018-8527An information disclosure vulnerability exists in Microsoft SQL Server Management Studio (SSMS) when parsing a malicious XEL file containingMicrosoft SQL Server Management Studio
- CVE-2018-8530A security feature bypass vulnerability exists when Microsoft Edge improperly handles requests of different origins, aka "Microsoft Edge SecMicrosoft Edge
- CVE-2018-8531A remote code execution vulnerability exists in the way that Azure IoT Hub Device Client SDK using MQTT protocol accesses objects in memory,Microsoft Hub Device Client SDK · Microsoft Azure IoT Edge
- CVE-2018-8532An information disclosure vulnerability exists in Microsoft SQL Server Management Studio (SSMS) when parsing a malicious XMLA file containinMicrosoft SQL Server Management Studio
- CVE-2018-8533An information disclosure vulnerability exists in Microsoft SQL Server Management Studio (SSMS) when parsing malicious XML content containinMicrosoft SQL Server Management Studio
- CVE-2018-18206In the client in Bytom before 1.0.6, checkTopicRegister in p2p/discover/net.go does not prevent negative idx values, leading to a crash.github.com/bytom/bytom
- CVE-2018-18202The QLogic 4Gb Fibre Channel 5.5.2.6.0 and 4/8Gb SAN 7.10.1.20.0 modules for IBM BladeCenter have an undocumented support account with a sup
- CVE-2018-16737tinc before 1.0.30 has a broken authentication protocol, without even a partial mitigation.
- CVE-2018-16738tinc 1.0.30 through 1.0.34 has a broken authentication protocol, although there is a partial mitigation.
- CVE-2018-16758Missing message authentication in the meta-protocol in Tinc VPN version 1.0.34 and earlier allows a man-in-the-middle attack to disable the