# CVEs published 2018-10-15

33 CVEs were published on October 15, 2018: 0 critical, 2 high. Days are UTC.

- [CVE-2017-5934](https://cve.now/CVE-2017-5934.md): Cross-site scripting (XSS) vulnerability in the link dialogue in GUI editor in MoinMoin before 1.9.10 allows remote attackers to inject arbi (no CVSS, moin)
- [CVE-2018-15538](https://cve.now/CVE-2018-15538.md): Agentejo Cockpit has multiple Cross-Site Scripting vulnerabilities. (no CVSS)
- [CVE-2018-15539](https://cve.now/CVE-2018-15539.md): Agentejo Cockpit lacks an anti-CSRF protection mechanism. (no CVSS)
- [CVE-2018-15540](https://cve.now/CVE-2018-15540.md): Agentejo Cockpit performs actions on files without appropriate validation and therefore allows an attacker to traverse the file system to un (no CVSS)
- [CVE-2018-17532](https://cve.now/CVE-2018-17532.md): Teltonika RUT9XX routers with firmware before 00.04.233 are prone to multiple unauthenticated OS command injection vulnerabilities in autolo (no CVSS)
- [CVE-2018-17533](https://cve.now/CVE-2018-17533.md): Teltonika RUT9XX routers with firmware before 00.05.01.1 are prone to cross-site scripting vulnerabilities in hotspotlogin.cgi due to insuff (no CVSS)
- [CVE-2018-17534](https://cve.now/CVE-2018-17534.md): Teltonika RUT9XX routers with firmware before 00.04.233 provide a root terminal on a serial interface without proper access control. (no CVSS)
- [CVE-2018-17980](https://cve.now/CVE-2018-17980.md): NoMachine before 5.3.27 and 6.x before 6.3.6 allows attackers to gain privileges via a Trojan horse wintab32.dll file located in the same di (no CVSS)
- [CVE-2018-18259](https://cve.now/CVE-2018-18259.md): Stored XSS has been discovered in version 1.0.12 of the LUYA CMS software via /admin/api-cms-nav/create-page. (no CVSS)
- [CVE-2018-12154](https://cve.now/CVE-2018-12154.md): Denial of Service in Unified Shader Compiler in Intel Graphics Drivers before 10.18.x.5056 (aka 15.33.x.5056), 10.18.x.5057 (aka 15.36.x.505 (no CVSS, Intel Graphics Driver)
- [CVE-2018-15378](https://cve.now/CVE-2018-15378.md): Clam AntiVirus unmew11() Denial of Service Vulnerability (no CVSS, Cisco ClamAV)
- [CVE-2018-15590](https://cve.now/CVE-2018-15590.md): An issue was discovered in Ivanti Workspace Control before 10.3.0.0 and RES One Workspace, when file and folder security are configured. (no CVSS)
- [CVE-2018-15591](https://cve.now/CVE-2018-15591.md): An issue was discovered in Ivanti Workspace Control before 10.3.10.0 and RES One Workspace. (no CVSS)
- [CVE-2018-15592](https://cve.now/CVE-2018-15592.md): An issue was discovered in Ivanti Workspace Control before 10.3.10.0 and RES One Workspace. (no CVSS)
- [CVE-2018-15593](https://cve.now/CVE-2018-15593.md): An issue was discovered in Ivanti Workspace Control before 10.3.10.0 and RES One Workspace. (no CVSS)
- [CVE-2018-17961](https://cve.now/CVE-2018-17961.md): Artifex Ghostscript 9.25 and earlier allows attackers to bypass a sandbox protection mechanism via vectors involving errorhandler setup. (no CVSS)
- [CVE-2018-18073](https://cve.now/CVE-2018-18073.md): Artifex Ghostscript allows attackers to bypass a sandbox protection mechanism by leveraging exposure of system operators in the saved execut (no CVSS)
- [CVE-2018-18361](https://cve.now/CVE-2018-18361.md): An issue was discovered in nc-cms through 2017-03-10. (no CVSS)
- [CVE-2018-1744](https://cve.now/CVE-2018-1744.md): IBM Security Key Lifecycle Manager 2.5, 2.6, 2.7, and 3.0 could allow a remote attacker to traverse directories on the system. (CVSS 7.7, IBM Security Key Lifecycle Manager)
- [CVE-2018-1747](https://cve.now/CVE-2018-1747.md): IBM Security Key Lifecycle Manager 2.5, 2.6, 2.7, and 3.0 is vulnerable to a XML External Entity Injection (XXE) attack when processing XML (CVSS 7.1, IBM Security Key Lifecycle Manager)
- [CVE-2018-18322](https://cve.now/CVE-2018-18322.md): CentOS-WebPanel.com (aka CWP) CentOS Web Panel 0.9.8.480 has Command Injection via shell metacharacters in the admin/index.php service\_start (no CVSS)
- [CVE-2018-18323](https://cve.now/CVE-2018-18323.md): CentOS-WebPanel.com (aka CWP) CentOS Web Panel 0.9.8.480 has Local File Inclusion via directory traversal with an admin/index.php?module=fil (no CVSS)
- [CVE-2018-18324](https://cve.now/CVE-2018-18324.md): CentOS-WebPanel.com (aka CWP) CentOS Web Panel 0.9.8.480 has XSS via the admin/fileManager2.php fm\_current\_dir parameter, or the admin/index (no CVSS)
- [CVE-2018-18319](https://cve.now/CVE-2018-18319.md): An issue was discovered in the Merlin.PHP component 0.6.6 for Asuswrt-Merlin devices. (no CVSS)
- [CVE-2018-18320](https://cve.now/CVE-2018-18320.md): An issue was discovered in the Merlin.PHP component 0.6.6 for Asuswrt-Merlin devices. (no CVSS)
- [CVE-2018-18318](https://cve.now/CVE-2018-18318.md): The /dev/block/mmcblk0rpmb driver kernel module on Qiku 360 Phone N6 Pro 1801-A01 devices allows attackers to cause a denial of service (NUL (no CVSS)
- [CVE-2018-18315](https://cve.now/CVE-2018-18315.md): com/mossle/cdn/CdnController.java in lemon 1.9.0 allows attackers to upload arbitrary files because the copyMultipartFileToFile method in Cd (no CVSS)
- [CVE-2018-18316](https://cve.now/CVE-2018-18316.md): emlog v6.0.0 has CSRF via the admin/user.php?action=new URI. (no CVSS)
- [CVE-2018-18317](https://cve.now/CVE-2018-18317.md): DESHANG DSCMS 1.1 has CSRF via the public/index.php/admin/admin/add.html URI. (no CVSS)
- [CVE-2018-18296](https://cve.now/CVE-2018-18296.md): MetInfo 6.1.2 has XSS via the /admin/index.php bigclass parameter in an n=column&a=doadd action. (no CVSS)
- [CVE-2018-18309](https://cve.now/CVE-2018-18309.md): An issue was discovered in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.31. (no CVSS)
- [CVE-2018-18310](https://cve.now/CVE-2018-18310.md): An invalid memory address dereference was discovered in dwfl\_segment\_report\_module.c in libdwfl in elfutils through v0.174. (no CVSS)
- [CVE-2018-18260](https://cve.now/CVE-2018-18260.md): In the 2.4 version of Camaleon CMS, Stored XSS has been discovered. (no CVSS, camaleon\_cms)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2018-10-15
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.