CVEs published October 15, 2018
33 CVEs were published on October 15, 2018: 0 critical, 2 high.
- Published
- 33
- Critical
- 0
- High
- 2
- Medium
- 0
- Low
- 0
- Unrated
- 31
- Now in CISA KEV
- 0
- Fix available
- 2
Most affected products
- IBM Security Key Lifecycle Manager
- 2
- camaleon_cms
- 1
- Cisco ClamAV
- 1
- Intel Graphics Driver
- 1
- moin
- 1
High 2
- CVE-2018-1744IBM Security Key Lifecycle Manager 2.5, 2.6, 2.7, and 3.0 could allow a remote attacker to traverse directories on the system.IBM Security Key Lifecycle Manager
- CVE-2018-1747IBM Security Key Lifecycle Manager 2.5, 2.6, 2.7, and 3.0 is vulnerable to a XML External Entity Injection (XXE) attack when processing XML IBM Security Key Lifecycle Manager
Medium, low and unrated 31
- CVE-2017-5934Cross-site scripting (XSS) vulnerability in the link dialogue in GUI editor in MoinMoin before 1.9.10 allows remote attackers to inject arbimoin
- CVE-2018-15538Agentejo Cockpit has multiple Cross-Site Scripting vulnerabilities.
- CVE-2018-15539Agentejo Cockpit lacks an anti-CSRF protection mechanism.
- CVE-2018-15540Agentejo Cockpit performs actions on files without appropriate validation and therefore allows an attacker to traverse the file system to un
- CVE-2018-17532Teltonika RUT9XX routers with firmware before 00.04.233 are prone to multiple unauthenticated OS command injection vulnerabilities in autolo
- CVE-2018-17533Teltonika RUT9XX routers with firmware before 00.05.01.1 are prone to cross-site scripting vulnerabilities in hotspotlogin.cgi due to insuff
- CVE-2018-17534Teltonika RUT9XX routers with firmware before 00.04.233 provide a root terminal on a serial interface without proper access control.
- CVE-2018-17980NoMachine before 5.3.27 and 6.x before 6.3.6 allows attackers to gain privileges via a Trojan horse wintab32.dll file located in the same di
- CVE-2018-18259Stored XSS has been discovered in version 1.0.12 of the LUYA CMS software via /admin/api-cms-nav/create-page.
- CVE-2018-12154Denial of Service in Unified Shader Compiler in Intel Graphics Drivers before 10.18.x.5056 (aka 15.33.x.5056), 10.18.x.5057 (aka 15.36.x.505Intel Graphics Driver
- CVE-2018-15378Clam AntiVirus unmew11() Denial of Service VulnerabilityCisco ClamAV
- CVE-2018-15590An issue was discovered in Ivanti Workspace Control before 10.3.0.0 and RES One Workspace, when file and folder security are configured.
- CVE-2018-15591An issue was discovered in Ivanti Workspace Control before 10.3.10.0 and RES One Workspace.
- CVE-2018-15592An issue was discovered in Ivanti Workspace Control before 10.3.10.0 and RES One Workspace.
- CVE-2018-15593An issue was discovered in Ivanti Workspace Control before 10.3.10.0 and RES One Workspace.
- CVE-2018-17961Artifex Ghostscript 9.25 and earlier allows attackers to bypass a sandbox protection mechanism via vectors involving errorhandler setup.
- CVE-2018-18073Artifex Ghostscript allows attackers to bypass a sandbox protection mechanism by leveraging exposure of system operators in the saved execut
- CVE-2018-18361An issue was discovered in nc-cms through 2017-03-10.
- CVE-2018-18322CentOS-WebPanel.com (aka CWP) CentOS Web Panel 0.9.8.480 has Command Injection via shell metacharacters in the admin/index.php service_start
- CVE-2018-18323CentOS-WebPanel.com (aka CWP) CentOS Web Panel 0.9.8.480 has Local File Inclusion via directory traversal with an admin/index.php?module=fil
- CVE-2018-18324CentOS-WebPanel.com (aka CWP) CentOS Web Panel 0.9.8.480 has XSS via the admin/fileManager2.php fm_current_dir parameter, or the admin/index
- CVE-2018-18319An issue was discovered in the Merlin.PHP component 0.6.6 for Asuswrt-Merlin devices.
- CVE-2018-18320An issue was discovered in the Merlin.PHP component 0.6.6 for Asuswrt-Merlin devices.
- CVE-2018-18318The /dev/block/mmcblk0rpmb driver kernel module on Qiku 360 Phone N6 Pro 1801-A01 devices allows attackers to cause a denial of service (NUL
- CVE-2018-18315com/mossle/cdn/CdnController.java in lemon 1.9.0 allows attackers to upload arbitrary files because the copyMultipartFileToFile method in Cd
- CVE-2018-18316emlog v6.0.0 has CSRF via the admin/user.php?action=new URI.
- CVE-2018-18317DESHANG DSCMS 1.1 has CSRF via the public/index.php/admin/admin/add.html URI.
- CVE-2018-18296MetInfo 6.1.2 has XSS via the /admin/index.php bigclass parameter in an n=column&a=doadd action.
- CVE-2018-18309An issue was discovered in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.31.
- CVE-2018-18310An invalid memory address dereference was discovered in dwfl_segment_report_module.c in libdwfl in elfutils through v0.174.
- CVE-2018-18260In the 2.4 version of Camaleon CMS, Stored XSS has been discovered.camaleon_cms