# CVEs published 2018-10-16

23 CVEs were published on October 16, 2018: 0 critical, 0 high. Days are UTC.

- [CVE-2018-11019](https://cve.now/CVE-2018-11019.md): kernel/omap/drivers/misc/gcx/gcioctl/gcif.c in the kernel component in Amazon Kindle Fire HD(3rd) Fire OS 4.5.5.3 allows attackers to inject (no CVSS)
- [CVE-2018-11020](https://cve.now/CVE-2018-11020.md): kernel/omap/drivers/rpmsg/rpmsg\_omx.c in the kernel component in Amazon Kindle Fire HD(3rd) Fire OS 4.5.5.3 allows attackers to inject a cra (no CVSS)
- [CVE-2018-11021](https://cve.now/CVE-2018-11021.md): kernel/omap/drivers/video/omap2/dsscomp/device.c in the kernel component in Amazon Kindle Fire HD(3rd) Fire OS 4.5.5.3 allows attackers to i (no CVSS)
- [CVE-2018-11022](https://cve.now/CVE-2018-11022.md): kernel/omap/drivers/misc/gcx/gcioctl/gcif.c in the kernel component in Amazon Kindle Fire HD(3rd) Fire OS 4.5.5.3 allows attackers to inject (no CVSS)
- [CVE-2018-11023](https://cve.now/CVE-2018-11023.md): kernel/omap/drivers/misc/gcx/gcioctl/gcif.c in the kernel component in Amazon Kindle Fire HD (3rd) Fire OS 4.5.5.3 allows attackers to injec (no CVSS)
- [CVE-2018-11024](https://cve.now/CVE-2018-11024.md): kernel/omap/drivers/misc/gcx/gcioctl/gcif.c in the kernel component in Amazon Kindle Fire HD (3rd) Fire OS 4.5.5.3 allows attackers to injec (no CVSS)
- [CVE-2018-11025](https://cve.now/CVE-2018-11025.md): kernel/omap/drivers/mfd/twl6030-gpadc.c in the kernel component in Amazon Kindle Fire HD(3rd) Fire OS 4.5.5.3 allows attackers to inject a c (no CVSS)
- [CVE-2018-14772](https://cve.now/CVE-2018-14772.md): Pydio 4.2.1 through 8.2.1 has an authenticated remote code execution vulnerability in which an attacker with administrator access to the web (no CVSS)
- [CVE-2018-18308](https://cve.now/CVE-2018-18308.md): In the 4.2.23 version of BigTree, a Stored XSS vulnerability has been discovered in /admin/ajax/file-browser/upload/ (aka the image upload a (no CVSS)
- [CVE-2018-6974](https://cve.now/CVE-2018-6974.md): VMware ESXi (6.7 before ESXi670-201810101-SG, 6.5 before ESXi650-201808401-BG, and 6.0 before ESXi600-201808401-BG), Workstation (14.x befor (no CVSS, VMware ESXi · VMware Workstation +1)
- [CVE-2018-1777](https://cve.now/CVE-2018-1777.md): IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 is vulnerable to cross-site scripting. (CVSS 5.4, IBM WebSphere Application Server)
- [CVE-2018-18389](https://cve.now/CVE-2018-18389.md): Due to incorrect access control in Neo4j Enterprise Database Server 3.4.x before 3.4.9, the setting of LDAP for authentication with STARTTLS (no CVSS, org.neo4j:neo4j-enterprise)
- [CVE-2018-18384](https://cve.now/CVE-2018-18384.md): Info-ZIP UnZip 6.0 has a buffer overflow in list.c, when a ZIP archive has a crafted relationship between the compressed-size value and the (no CVSS)
- [CVE-2018-18385](https://cve.now/CVE-2018-18385.md): Asciidoctor in versions \< 1.5.8 allows remote attackers to cause a denial of service (infinite loop). (no CVSS, asciidoctor)
- [CVE-2018-10839](https://cve.now/CVE-2018-10839.md): Qemu emulator \<= 3.0.0 built with the NE2000 NIC emulation support is vulnerable to an integer overflow, which could lead to buffer overflow (CVSS 6.5, The QEMU Project Qemu-kvm)
- [CVE-2018-13399](https://cve.now/CVE-2018-13399.md): The Microsoft Windows Installer for Atlassian Fisheye and Crucible before version 4.6.1 allows local attackers to escalate privileges becaus (no CVSS, Atlassian Fisheye and Crucible)
- [CVE-2018-18381](https://cve.now/CVE-2018-18381.md): Z-BlogPHP 1.5.2.1935 (Zero) has a stored XSS Vulnerability in zb\_system/function/c\_system\_admin.php via the Content-Type header during the u (no CVSS)
- [CVE-2018-18382](https://cve.now/CVE-2018-18382.md): Advanced HRM 1.6 allows Remote Code Execution via PHP code in a .php file to the user/update-user-avatar URI, which can be accessed through (no CVSS)
- [CVE-2018-18374](https://cve.now/CVE-2018-18374.md): XSS exists in the MetInfo 6.1.2 admin/index.php page via the anyid parameter. (no CVSS)
- [CVE-2018-18375](https://cve.now/CVE-2018-18375.md): goform/getProfileList in Orange AirBox Y858\_FL\_01.16\_04 allows attackers to extract APN data (name, number, username, and password) via the (no CVSS)
- [CVE-2018-18376](https://cve.now/CVE-2018-18376.md): goform/getWlanClientInfo in Orange AirBox Y858\_FL\_01.16\_04 allows remote attackers to discover information about currently connected devices (no CVSS)
- [CVE-2018-18377](https://cve.now/CVE-2018-18377.md): goform/setReset on Orange AirBox Y858\_FL\_01.16\_04 devices allows attackers to reset a router to factory settings, which can be used to login (no CVSS)
- [CVE-2018-18307](https://cve.now/CVE-2018-18307.md): A Stored XSS vulnerability has been discovered in version 4.1.0 of AlchemyCMS via the /admin/pictures image field. (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2018-10-16
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.