# CVEs published 2018-10-11

16 CVEs were published on October 11, 2018: 0 critical, 2 high. Days are UTC.

- [CVE-2018-17927](https://cve.now/CVE-2018-17927.md): In Delta Industrial Automation TPEditor, TPEditor Versions 1.90 and prior, multiple out-of-bounds write vulnerabilities may be exploited by (no CVSS, Delta Electronics Delta Industrial Automation TPEditor)
- [CVE-2018-17929](https://cve.now/CVE-2018-17929.md): In Delta Industrial Automation TPEditor, TPEditor Versions 1.90 and prior, multiple stack-based buffer overflow vulnerabilities may be explo (no CVSS, Delta Electronics Delta Industrial Automation TPEditor)
- [CVE-2018-12441](https://cve.now/CVE-2018-12441.md): The CorsairService Service in Corsair Utility Engine is installed with insecure default permissions, which allows unprivileged local users t (no CVSS)
- [CVE-2018-18257](https://cve.now/CVE-2018-18257.md): An issue was discovered in BageCMS 3.1.3. (no CVSS)
- [CVE-2018-18258](https://cve.now/CVE-2018-18258.md): An issue was discovered in BageCMS 3.1.3. (no CVSS)
- [CVE-2018-15766](https://cve.now/CVE-2018-15766.md): Dell Encryption and Dell Endpoint Security Suite Enterprise Security Policy Overwrite Vulnerability (no CVSS, Dell Encryption · Dell Endpoint Security Suite Enterprise)
- [CVE-2018-18215](https://cve.now/CVE-2018-18215.md): In youke365 v1.1.5, admin/user.html has a CSRF vulnerability that can add an user account. (no CVSS)
- [CVE-2018-9206](https://cve.now/CVE-2018-9206.md): Unauthenticated arbitrary file upload vulnerability in Blueimp jQuery-File-Upload \<= v9.22.0 (no CVSS, Blueimp jQuery-File-Upload · blueimp-file-upload)
- [CVE-2018-18242](https://cve.now/CVE-2018-18242.md): youke365 v1.1.5 has SQL injection via admin/login.html, as demonstrated by username=admin&pass=123456&code=9823&act=login&submit=%E7%99%BB+% (no CVSS)
- [CVE-2018-12449](https://cve.now/CVE-2018-12449.md): The Whale browser installer 0.4.3.0 and earlier versions allows DLL hijacking. (no CVSS, NAVER Whale Browser Installer)
- [CVE-2018-1706](https://cve.now/CVE-2018-1706.md): IBM Spectrum Symphony 7.2.0.2 is vulnerable to cross-site scripting. (CVSS 5.4, IBM Spectrum Symphony)
- [CVE-2018-1708](https://cve.now/CVE-2018-1708.md): IBM Spectrum Symphony 7.1.2 and 7.2.0.2 could allow an authenticated user to obtain sensitive user information such as passwords through the (CVSS 6.5, IBM Spectrum Symphony)
- [CVE-2018-1724](https://cve.now/CVE-2018-1724.md): IBM Spectrum LSF 9.1.1 9.1.2, 9.1.3, and 10.1 could allow a local user to change their job user at job submission time due to improper file (CVSS 5.9, IBM Spectrum LSF)
- [CVE-2018-1738](https://cve.now/CVE-2018-1738.md): IBM Security Key Lifecycle Manager 2.6, 2.7, 3.0 could allow an authenticated user to obtain highly sensitive information or jeopardize syst (CVSS 7.1, IBM Security Key Lifecycle Manager)
- [CVE-2018-1745](https://cve.now/CVE-2018-1745.md): IBM Security Key Lifecycle Manager 2.7 and 3.0 could allow an unauthenticated user to restart the SKLM server due to missing authentication. (CVSS 7.5, IBM Security Key Lifecycle Manager)
- [CVE-2018-18240](https://cve.now/CVE-2018-18240.md): Pippo through 1.11.0 allows remote code execution via a command to java.lang.ProcessBuilder because the XstreamEngine component does not use (no CVSS, ro.pippo:pippo-core · ro.pippo:pippo-session)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2018-10-11
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.