# CVEs published 2018-10-10

110 CVEs were published on October 10, 2018: 2 critical, 10 high. 1 is now in CISA KEV. Days are UTC.

- [CVE-2018-12455](https://cve.now/CVE-2018-12455.md): Intelbras NPLUG 1.0.0.14 wireless repeater devices have a critical vulnerability that allows an attacker to authenticate in the web interfac (no CVSS)
- [CVE-2018-12456](https://cve.now/CVE-2018-12456.md): Intelbras NPLUG 1.0.0.14 wireless repeater devices have no CSRF token protection in the web interface, allowing attackers to perform actions (no CVSS)
- [CVE-2018-12596](https://cve.now/CVE-2018-12596.md): Episerver Ektron CMS before 9.0 SP3 Site CU 31, 9.1 before SP3 Site CU 45, or 9.2 before SP2 Site CU 22 allows remote attackers to call aspx (no CVSS)
- [CVE-2018-13789](https://cve.now/CVE-2018-13789.md): An issue was discovered in Descor Infocad FM before 3.1.0.0. (no CVSS)
- [CVE-2018-17337](https://cve.now/CVE-2018-17337.md): Intelbras NPLUG 1.0.0.14 devices have XSS via a crafted SSID that is received via a network broadcast. (no CVSS)
- [CVE-2018-17784](https://cve.now/CVE-2018-17784.md): Multiple vulnerabilities in YUI and FlashCanvas embedded in SugarCRM Community Edition 6.5.26 could allow an unauthenticated, remote attacke (no CVSS)
- [CVE-2018-18061](https://cve.now/CVE-2018-18061.md): An issue was discovered in dialog.php in tecrail Responsive FileManager 9.8.1. (no CVSS)
- [CVE-2018-18062](https://cve.now/CVE-2018-18062.md): An issue was discovered in dialog.php in tecrail Responsive FileManager 9.8.1. (no CVSS)
- [CVE-2018-12410](https://cve.now/CVE-2018-12410.md): TIBCO Spotfire Statistics Services remote execution vulnerabilities (CVSS 9.8, TIBCO Software TIBCO Spotfire Statistics Services)
- [CVE-2018-12541](https://cve.now/CVE-2018-12541.md): In version from 3.0.0 to 3.5.3 of Eclipse Vert.x, the WebSocket HTTP upgrade implementation buffers the full http request before doing the h (no CVSS, The Eclipse Foundation Eclipse Vert.x · io.vertx:vertx-core)
- [CVE-2018-12542](https://cve.now/CVE-2018-12542.md): In version from 3.0.0 to 3.5.3 of Eclipse Vert.x, the StaticHandler uses external input to construct a pathname that should be within a rest (no CVSS, The Eclipse Foundation Eclipse Vert.x · io.vertx:vertx-web)
- [CVE-2018-12544](https://cve.now/CVE-2018-12544.md): In version from 3.5.Beta1 to 3.5.3 of Eclipse Vert.x, the OpenAPI XML type validator creates XML parsers without taking appropriate defense (no CVSS, The Eclipse Foundation Eclipse Vert.x · io.vertx:vertx-core)
- [CVE-2018-0043](https://cve.now/CVE-2018-0043.md): Junos OS: RPD daemon crashes upon receipt of specific MPLS packet (CVSS 8.8, Juniper Networks Junos OS)
- [CVE-2018-0044](https://cve.now/CVE-2018-0044.md): NFX Series: Insecure sshd configuration in Juniper Device Manager (JDM) and host OS (CVSS 9.8, Juniper Networks Junos OS)
- [CVE-2018-0045](https://cve.now/CVE-2018-0045.md): Junos OS: RPD daemon crashes due to receipt of specific Draft-Rosen MVPN control packet in Draft-Rosen MVPN configuration (CVSS 8.8, Juniper Networks Junos OS)
- [CVE-2018-0046](https://cve.now/CVE-2018-0046.md): Junos Space: Reflected Cross-site Scripting vulnerability in OpenNMS (CVSS 8.8, Juniper Networks Junos Space)
- [CVE-2018-0047](https://cve.now/CVE-2018-0047.md): Junos Space Security Director: XSS vulnerability in web administration (CVSS 8.0, Juniper Networks Junos Space Security Director)
- [CVE-2018-0048](https://cve.now/CVE-2018-0048.md): Junos OS: Memory exhaustion denial of service vulnerability in Routing Protocols Daemon (RPD) with Juniper Extension Toolkit (JET) support. (CVSS 7.5, Juniper Networks Junos OS)
- [CVE-2018-0049](https://cve.now/CVE-2018-0049.md): Junos OS: Receipt of a specifically crafted malicious MPLS packet leads to a Junos kernel crash. (CVSS 7.5, Juniper Networks Junos OS)
- [CVE-2018-0050](https://cve.now/CVE-2018-0050.md): Junos OS: Receipt of a malformed MPLS RSVP packet leads to a Routing Protocols Daemon (RPD) crash. (CVSS 7.5, Juniper Networks Junos OS)
- [CVE-2018-0051](https://cve.now/CVE-2018-0051.md): Junos OS: Denial of Service vulnerability in MS-PIC, MS-MIC, MS-MPC, MS-DPC and SRX flow daemon (flowd) related to SIP ALG (CVSS 7.5, Juniper Networks Junos OS)
- [CVE-2018-0052](https://cve.now/CVE-2018-0052.md): Junos OS: Unauthenticated remote root access possible when RSH service is enabled (CVSS 7.2, Juniper Networks Junos OS)
- [CVE-2018-0053](https://cve.now/CVE-2018-0053.md): vSRX Series: A local authentication vulnerability may lead to full control of a vSRX instance while the system is booting. (CVSS 6.8, Juniper Networks Junos OS)
- [CVE-2018-0054](https://cve.now/CVE-2018-0054.md): QFX5000/EX4600 Series: Routing protocol flap upon receipt of high rate of Ethernet frames (CVSS 6.5, Juniper Networks Junos OS)
- [CVE-2018-0055](https://cve.now/CVE-2018-0055.md): Junos OS: jdhcpd process crash during processing of specially crafted DHCPv6 message (CVSS 6.5, Juniper Networks Junos OS)
- [CVE-2018-0056](https://cve.now/CVE-2018-0056.md): MX Series: L2ALD daemon may crash if a duplicate MAC is learned by two different interfaces (CVSS 6.5, Juniper Networks Junos OS)
- [CVE-2018-0057](https://cve.now/CVE-2018-0057.md): Junos OS: authd allows assignment of IP address requested by DHCP subscriber logging in with Option 50 (Requested IP Address) (CVSS 6.1, Juniper Networks Junos OS)
- [CVE-2018-0058](https://cve.now/CVE-2018-0058.md): MX Series: In BBE configurations, receipt of a crafted IPv6 exception packet causes a Denial of Service (CVSS 5.9, Juniper Networks Junos OS)
- [CVE-2018-0059](https://cve.now/CVE-2018-0059.md): ScreenOS: Stored Cross-Site Scripting (XSS) vulnerability (CVSS 5.4, Juniper Networks ScreenOS)
- [CVE-2018-0060](https://cve.now/CVE-2018-0060.md): Junos OS: Invalid IP/mask learned from DHCP server might cause device control daemon (dcd) process crash (CVSS 5.3, Juniper Networks Junos OS)
- [CVE-2018-0061](https://cve.now/CVE-2018-0061.md): Junos OS: Denial of service in telnetd (CVSS 5.3, Juniper Networks Junos OS)
- [CVE-2018-0062](https://cve.now/CVE-2018-0062.md): Junos OS: Denial of Service in J-Web (CVSS 5.3, Juniper Networks Junos OS)
- [CVE-2018-0063](https://cve.now/CVE-2018-0063.md): Junos OS: Nexthop index allocation failed: private index space exhausted after incoming ARP requests to management interface (CVSS 6.5, Juniper Networks Junos OS)
- [CVE-2018-12152](https://cve.now/CVE-2018-12152.md): Pointer corruption in Unified Shader Compiler in Intel Graphics Drivers before 10.18.x.5056 (aka 15.33.x.5056), 10.18.x.5057 (aka 15.36.x.50 (no CVSS, Intel Graphics Driver)
- [CVE-2018-12153](https://cve.now/CVE-2018-12153.md): Denial of Service in Unified Shader Compiler in Intel Graphics Drivers before 10.18.x.5056 (aka 15.33.x.5056), 10.18.x.5057 (aka 15.36.x.505 (no CVSS, Intel Graphics Driver)
- [CVE-2018-12158](https://cve.now/CVE-2018-12158.md): Insufficient input validation in BIOS update utility in Intel NUC FW kits downloaded before May 24, 2018 may allow a privileged user to pote (no CVSS, Intel NUC Firmware Kits)
- [CVE-2018-12161](https://cve.now/CVE-2018-12161.md): Insufficient session validation in the webserver component of the Intel Rapid Web Server 3 may allow an unauthenticated user to potentially (no CVSS, Intel RAID Web Server)
- [CVE-2018-12172](https://cve.now/CVE-2018-12172.md): Improper password hashing in firmware in Intel Server Board (S7200AP,S7200APR) and Intel Compute Module (HNS7200AP, HNS7200AP) may allow a p (no CVSS, Intel Server Board)
- [CVE-2018-12173](https://cve.now/CVE-2018-12173.md): Insufficient access protection in firmware in Intel Server Board, Intel Server System and Intel Compute Module before firmware version 00.01 (no CVSS, Intel Server Boards Firmware)
- [CVE-2018-12193](https://cve.now/CVE-2018-12193.md): Insufficient access control in driver stack for Intel QuickAssist Technology for Linux before version 4.2 may allow an unprivileged user to (no CVSS, Intel QuickAssit Technology for Linux)
- [CVE-2018-13800](https://cve.now/CVE-2018-13800.md): A vulnerability has been identified in SIMATIC S7-1200 CPU family version 4 (All versions \< V4.2.3). (no CVSS, Siemens AG SIMATIC S7-1200 CPU family)
- [CVE-2018-13801](https://cve.now/CVE-2018-13801.md): A vulnerability has been identified in ROX II (All versions \< V2.12.1). (no CVSS, Siemens AG ROX II)
- [CVE-2018-13802](https://cve.now/CVE-2018-13802.md): A vulnerability has been identified in ROX II (All versions \< V2.12.1). (no CVSS, Siemens AG ROX II)
- [CVE-2018-13805](https://cve.now/CVE-2018-13805.md): A vulnerability has been identified in SIMATIC ET 200SP Open Controller (All versions \>= V2.0 and \< V2.1.6), SIMATIC S7-1500 Software Contro (no CVSS, Siemens AG SIMATIC ET 200SP Open Controller · Siemens AG… +1)
- [CVE-2018-17925](https://cve.now/CVE-2018-17925.md): Multiple instances of this vulnerability (Unsafe ActiveX Control Marked Safe For Scripting) have been identified in the third-party ActiveX (no CVSS, GE iFix)
- [CVE-2018-18209](https://cve.now/CVE-2018-18209.md): XSS exists in DiliCMS 2.4.0 via the admin/index.php/setting/site?tab=site\_attachment attachment\_type parameter. (no CVSS)
- [CVE-2018-18210](https://cve.now/CVE-2018-18210.md): XSS exists in DiliCMS 2.4.0 via the admin/index.php/setting/site?tab=site\_attachment attachment\_url parameter. (no CVSS)
- [CVE-2018-18211](https://cve.now/CVE-2018-18211.md): PbootCMS 1.2.1 has SQL injection via the HTTP POST data to the api.php/cms/addform?fcode=1 URI. (no CVSS)
- [CVE-2018-17915](https://cve.now/CVE-2018-17915.md): All versions of Hangzhou Xiongmai Technology Co., Ltd XMeye P2P Cloud Server do not encrypt all device communication. (no CVSS, Hangzhou Xiongmai Technology Co. XMeye P2P Cloud Server)
- [CVE-2018-17917](https://cve.now/CVE-2018-17917.md): All versions of Hangzhou Xiongmai Technology Co., Ltd XMeye P2P Cloud Server may allow an attacker to use MAC addresses to enumerate potenti (no CVSS, Hangzhou Xiongmai Technology Co. XMeye P2P Cloud Server)
- [CVE-2018-17919](https://cve.now/CVE-2018-17919.md): All versions of Hangzhou Xiongmai Technology Co., Ltd XMeye P2P Cloud Server may allow an attacker to use an undocumented user account "defa (no CVSS, Hangzhou Xiongmai Technology Co. XMeye P2P Cloud Server)
- [CVE-2018-18207](https://cve.now/CVE-2018-18207.md): Virtualmin 6.03 allows Frame Injection via the settings-editor\_read.cgi file parameter. (no CVSS)
- [CVE-2018-18208](https://cve.now/CVE-2018-18208.md): Virtualmin 6.03 allows XSS via the query string, as demonstrated by the webmin\_search.cgi URI. (no CVSS)
- [CVE-2018-12131](https://cve.now/CVE-2018-12131.md): Permissions in the driver pack installers for Intel NVMe before version 4.0.0.1007 and Intel RSTe before version 4.7.0.2083 may allow an aut (no CVSS, Intel NVMe and Intel RSTe)
- [CVE-2018-15311](https://cve.now/CVE-2018-15311.md): When F5 BIG-IP 13.0.0-13.1.0.5, 12.1.0-12.1.3.5, 11.6.0-11.6.3.2, or 11.5.1-11.5.6 is processing specially crafted TCP traffic with the Larg (no CVSS, F5 Networks BIG-IP)
- [CVE-2018-8006](https://cve.now/CVE-2018-8006.md): An instance of a cross-site scripting vulnerability was identified to be present in the web based administration console on the queue.jsp pa (no CVSS, Apache Software Foundation Apache ActiveMQ · org.apache.act…)
- [CVE-2018-8265](https://cve.now/CVE-2018-8265.md): A remote code execution vulnerability exists in the way Microsoft Exchange software parses specially crafted email messages, aka "Microsoft (no CVSS, Microsoft Exchange Server)
- [CVE-2018-8292](https://cve.now/CVE-2018-8292.md): An information disclosure vulnerability exists in .NET Core when authentication information is inadvertently exposed in a redirect, aka ".NE (no CVSS, Microsoft PowerShell Core · Microsoft .NET Core +1)
- [CVE-2018-8320](https://cve.now/CVE-2018-8320.md): A security feature bypass vulnerability exists in DNS Global Blocklist feature, aka "Windows DNS Security Feature Bypass Vulnerability." Thi (no CVSS, Microsoft Windows Server 2012 R2 · Microsoft Windows Ser… +1)
- [CVE-2018-8329](https://cve.now/CVE-2018-8329.md): An Elevation of Privilege vulnerability exists in Windows Subsystem for Linux when it fails to properly handle objects in memory, aka "Linux (no CVSS, Microsoft Windows)
- [CVE-2018-8330](https://cve.now/CVE-2018-8330.md): An information disclosure vulnerability exists when the Windows kernel improperly handles objects in memory, aka "Windows Kernel Information (no CVSS, Microsoft Windows)
- [CVE-2018-8333](https://cve.now/CVE-2018-8333.md): An Elevation of Privilege vulnerability exists in Filter Manager when it improperly handles objects in memory, aka "Microsoft Filter Manager (no CVSS, Microsoft Windows)
- [CVE-2018-8411](https://cve.now/CVE-2018-8411.md): An elevation of privilege vulnerability exists when NTFS improperly checks access, aka "NTFS Elevation of Privilege Vulnerability." This aff (no CVSS, Microsoft Windows)
- [CVE-2018-8413](https://cve.now/CVE-2018-8413.md): A remote code execution vulnerability exists when "Windows Theme API" does not properly decompress files, aka "Windows Theme API Remote Code (no CVSS, Microsoft Windows)
- [CVE-2018-8423](https://cve.now/CVE-2018-8423.md): A remote code execution vulnerability exists in the Microsoft JET Database Engine, aka "Microsoft JET Database Engine Remote Code Execution (no CVSS, Microsoft Windows)
- [CVE-2018-8427](https://cve.now/CVE-2018-8427.md): An information disclosure vulnerability exists in the way that Microsoft Graphics Components handle objects in memory, aka "Microsoft Graphi (no CVSS, Microsoft Office · Microsoft Windows Server +2)
- [CVE-2018-8432](https://cve.now/CVE-2018-8432.md): A remote code execution vulnerability exists in the way that Microsoft Graphics Components handle objects in memory, aka "Microsoft Graphics (no CVSS, Microsoft Windows · Microsoft Office +2)
- [CVE-2018-8448](https://cve.now/CVE-2018-8448.md): An elevation of privilege vulnerability exists when Microsoft Exchange Outlook Web Access (OWA) fails to properly handle web requests, aka " (no CVSS, Microsoft Exchange Server)
- [CVE-2018-8453](https://cve.now/CVE-2018-8453.md): An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in memory, aka "Win32k (CVSS 7.8, KEV, Microsoft Windows)
- [CVE-2018-8460](https://cve.now/CVE-2018-8460.md): A remote code execution vulnerability exists when Internet Explorer improperly accesses objects in memory, aka "Internet Explorer Memory Cor (no CVSS, Microsoft Internet Explorer)
- [CVE-2018-8472](https://cve.now/CVE-2018-8472.md): An information disclosure vulnerability exists in the way that the Windows Graphics Device Interface (GDI) handles objects in memory, allowi (no CVSS, Microsoft Windows)
- [CVE-2018-8473](https://cve.now/CVE-2018-8473.md): A remote code execution vulnerability exists when Microsoft Edge improperly accesses objects in memory, aka "Microsoft Edge Memory Corruptio (no CVSS, Microsoft Edge · Microsoft ChakraCore)
- [CVE-2018-8480](https://cve.now/CVE-2018-8480.md): An elevation of privilege vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request t (no CVSS, Microsoft SharePoint)
- [CVE-2018-8481](https://cve.now/CVE-2018-8481.md): An information disclosure vulnerability exists when Windows Media Player improperly discloses file information, aka "Windows Media Player In (no CVSS, Microsoft Windows)
- [CVE-2018-8482](https://cve.now/CVE-2018-8482.md): An information disclosure vulnerability exists when Windows Media Player improperly discloses file information, aka "Windows Media Player In (no CVSS, Microsoft Windows)
- [CVE-2018-8484](https://cve.now/CVE-2018-8484.md): An elevation of privilege vulnerability exists when the DirectX Graphics Kernel (DXGKRNL) driver improperly handles objects in memory, aka " (no CVSS, Microsoft Windows Server 2012 R2 · Microsoft Windows RT +2)
- [CVE-2018-8486](https://cve.now/CVE-2018-8486.md): An information disclosure vulnerability exists when DirectX improperly handles objects in memory, aka "DirectX Information Disclosure Vulner (no CVSS, Microsoft Windows)
- [CVE-2018-8488](https://cve.now/CVE-2018-8488.md): An elevation of privilege vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request t (no CVSS, Microsoft SharePoint)
- [CVE-2018-8489](https://cve.now/CVE-2018-8489.md): A remote code execution vulnerability exists when Windows Hyper-V on a host server fails to properly validate input from an authenticated us (no CVSS, Microsoft Windows)
- [CVE-2018-8490](https://cve.now/CVE-2018-8490.md): A remote code execution vulnerability exists when Windows Hyper-V on a host server fails to properly validate input from an authenticated us (no CVSS, Microsoft Windows Server · Microsoft Windows)
- [CVE-2018-8491](https://cve.now/CVE-2018-8491.md): A remote code execution vulnerability exists when Internet Explorer improperly accesses objects in memory, aka "Internet Explorer Memory Cor (no CVSS, Microsoft Internet Explorer)
- [CVE-2018-8492](https://cve.now/CVE-2018-8492.md): A security feature bypass vulnerability exists in Device Guard that could allow an attacker to inject malicious code into a Windows PowerShe (no CVSS, Microsoft Windows Server · Microsoft Windows)
- [CVE-2018-8493](https://cve.now/CVE-2018-8493.md): An information disclosure vulnerability exists when the Windows TCP/IP stack improperly handles fragmented IP packets, aka "Windows TCP/IP I (no CVSS, Microsoft Windows Server 2012 R2 · Microsoft Windows RT +2)
- [CVE-2018-8494](https://cve.now/CVE-2018-8494.md): A remote code execution vulnerability exists when the Microsoft XML Core Services MSXML parser processes user input, aka "MS XML Remote Code (no CVSS, Microsoft Windows)
- [CVE-2018-8495](https://cve.now/CVE-2018-8495.md): A remote code execution vulnerability exists when Windows Shell improperly handles URIs, aka "Windows Shell Remote Code Execution Vulnerabil (no CVSS, Microsoft Windows Server · Microsoft Windows)
- [CVE-2018-8497](https://cve.now/CVE-2018-8497.md): An elevation of privilege vulnerability exists in the way that the Windows Kernel handles objects in memory, aka "Windows Kernel Elevation o (no CVSS, Microsoft Windows Server · Microsoft Windows)
- [CVE-2018-8498](https://cve.now/CVE-2018-8498.md): An elevation of privilege vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request t (no CVSS, Microsoft SharePoint)
- [CVE-2018-8500](https://cve.now/CVE-2018-8500.md): A remote code execution vulnerability exists in the way that the ChakraCore scripting engine handles objects in memory, aka "Scripting Engin (no CVSS, Microsoft ChakraCore · Microsoft.ChakraCore)
- [CVE-2018-8501](https://cve.now/CVE-2018-8501.md): A remote code execution vulnerability exists in Microsoft PowerPoint software when the software fails to properly handle objects in Protecte (no CVSS, Microsoft PowerPoint Viewer · Microsoft Office +1)
- [CVE-2018-8502](https://cve.now/CVE-2018-8502.md): A remote code execution vulnerability exists in Microsoft Excel software when the software fails to properly handle objects in Protected Vie (no CVSS, Microsoft Office · Microsoft Excel)
- [CVE-2018-8503](https://cve.now/CVE-2018-8503.md): A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka "C (no CVSS, Microsoft Edge · Microsoft ChakraCore +1)
- [CVE-2018-8504](https://cve.now/CVE-2018-8504.md): A remote code execution vulnerability exists in Microsoft Word software when the software fails to properly handle objects in Protected View (no CVSS, Microsoft SharePoint Server · Microsoft Office +1)
- [CVE-2018-8505](https://cve.now/CVE-2018-8505.md): A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka "C (no CVSS, Microsoft Edge · Microsoft ChakraCore +1)
- [CVE-2018-8506](https://cve.now/CVE-2018-8506.md): An Information Disclosure vulnerability exists in the way that Microsoft Windows Codecs Library handles objects in memory, aka "Microsoft Wi (no CVSS, Microsoft Windows 10 Servers · Microsoft Windows)
- [CVE-2018-8509](https://cve.now/CVE-2018-8509.md): A remote code execution vulnerability exists when Microsoft Edge improperly accesses objects in memory, aka "Microsoft Edge Memory Corruptio (no CVSS, Microsoft Edge)
- [CVE-2018-8510](https://cve.now/CVE-2018-8510.md): A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka "C (no CVSS, Microsoft Edge · Microsoft ChakraCore +1)
- [CVE-2018-8511](https://cve.now/CVE-2018-8511.md): A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka "C (no CVSS, Microsoft Edge · Microsoft ChakraCore +1)
- [CVE-2018-8512](https://cve.now/CVE-2018-8512.md): A security feature bypass vulnerability exists in Microsoft Edge when the Edge Content Security Policy (CSP) fails to properly validate cert (no CVSS, Microsoft Edge)
- [CVE-2018-8513](https://cve.now/CVE-2018-8513.md): A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka "C (no CVSS, Microsoft Edge · Microsoft ChakraCore +1)
- [CVE-2018-8518](https://cve.now/CVE-2018-8518.md): An elevation of privilege vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request t (no CVSS, Microsoft SharePoint)
- [CVE-2018-8527](https://cve.now/CVE-2018-8527.md): An information disclosure vulnerability exists in Microsoft SQL Server Management Studio (SSMS) when parsing a malicious XEL file containing (no CVSS, Microsoft SQL Server Management Studio)
- [CVE-2018-8530](https://cve.now/CVE-2018-8530.md): A security feature bypass vulnerability exists when Microsoft Edge improperly handles requests of different origins, aka "Microsoft Edge Sec (no CVSS, Microsoft Edge)
- [CVE-2018-8531](https://cve.now/CVE-2018-8531.md): A remote code execution vulnerability exists in the way that Azure IoT Hub Device Client SDK using MQTT protocol accesses objects in memory, (no CVSS, Microsoft Hub Device Client SDK · Microsoft Azure IoT Edge)
- [CVE-2018-8532](https://cve.now/CVE-2018-8532.md): An information disclosure vulnerability exists in Microsoft SQL Server Management Studio (SSMS) when parsing a malicious XMLA file containin (no CVSS, Microsoft SQL Server Management Studio)
- [CVE-2018-8533](https://cve.now/CVE-2018-8533.md): An information disclosure vulnerability exists in Microsoft SQL Server Management Studio (SSMS) when parsing malicious XML content containin (no CVSS, Microsoft SQL Server Management Studio)
- [CVE-2018-18206](https://cve.now/CVE-2018-18206.md): In the client in Bytom before 1.0.6, checkTopicRegister in p2p/discover/net.go does not prevent negative idx values, leading to a crash. (no CVSS, github.com/bytom/bytom)
- [CVE-2018-18202](https://cve.now/CVE-2018-18202.md): The QLogic 4Gb Fibre Channel 5.5.2.6.0 and 4/8Gb SAN 7.10.1.20.0 modules for IBM BladeCenter have an undocumented support account with a sup (no CVSS)
- [CVE-2018-16737](https://cve.now/CVE-2018-16737.md): tinc before 1.0.30 has a broken authentication protocol, without even a partial mitigation. (no CVSS)
- [CVE-2018-16738](https://cve.now/CVE-2018-16738.md): tinc 1.0.30 through 1.0.34 has a broken authentication protocol, although there is a partial mitigation. (no CVSS)
- [CVE-2018-16758](https://cve.now/CVE-2018-16758.md): Missing message authentication in the meta-protocol in Tinc VPN version 1.0.34 and earlier allows a man-in-the-middle attack to disable the (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2018-10-10
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.