CVEs published October 18, 2018
62 CVEs were published on October 18, 2018: 2 critical, 2 high.
- Published
- 62
- Critical
- 2
- High
- 2
- Medium
- 2
- Low
- 1
- Unrated
- 55
- Now in CISA KEV
- 0
- Fix available
- 39
Most affected products
- Mozilla Thunderbird · Mozilla Firefox ESR +1
- 14
- Mozilla Firefox
- 6
- Mozilla Firefox · Mozilla Thunderbird
- 5
- Mozilla Firefox ESR · Mozilla Firefox
- 4
- DELL EMC ESRS Virtual Edition
- 3
- Mozilla Thunderbird
- 3
- IBM FlashSystem
- 1
- IBM InfoSphere Information Server
- 1
- librenms/librenms
- 1
- Opto 22 PAC Control Basic and PAC Control Professional
- 1
Critical 2
High 2
Medium, low and unrated 58
- CVE-2018-11079Dell EMC Secure Remote Services, versions prior to 3.32.00.08, contains a Plaintext Password Storage vulnerability.DELL EMC ESRS Virtual Edition
- CVE-2018-15765Dell EMC Secure Remote Services, versions prior to 3.32.00.08, contains an Information Exposure vulnerability.DELL EMC ESRS Virtual Edition
- CVE-2018-14807A stack-based buffer overflow vulnerability in Opto 22 PAC Control Basic and PAC Control Professional versions R10.0a and prior may allow reOpto 22 PAC Control Basic and PAC Control Professional
- CVE-2018-18485An issue was discovered in PHPSHE 1.7.
- CVE-2018-18486An issue was discovered in PHPSHE 1.7.
- CVE-2018-18487In \lib\admin\action\dataaction.class.php in Gxlcms v2.0, the database backup filename generation uses mt_rand() unsafely, resulting in pred
- CVE-2018-18488In \lib\admin\action\dataaction.class.php in Gxlcms v2.0, SQL Injection exists via the ids[] parameter.
- CVE-2015-4630Multiple cross-site request forgery (CSRF) vulnerabilities in Koha 3.14.x before 3.14.16, 3.16.x before 3.16.12, 3.18.x before 3.18.08, and
- CVE-2015-4631Multiple cross-site scripting (XSS) vulnerabilities in Koha 3.14.x before 3.14.16, 3.16.x before 3.16.12, 3.18.x before 3.18.08, and 3.20.x
- CVE-2015-4632Multiple directory traversal vulnerabilities in Koha 3.14.x before 3.14.16, 3.16.x before 3.16.12, 3.18.x before 3.18.08, and 3.20.x before
- CVE-2015-4633Multiple SQL injection vulnerabilities in Koha 3.14.x before 3.14.16, 3.16.x before 3.16.12, 3.18.x before 3.18.08, and 3.20.x before 3.20.1
- CVE-2018-18483The get_count function in cplus-dem.c in GNU libiberty, as distributed in GNU Binutils 2.31, allows remote attackers to cause a denial of se
- CVE-2018-18484An issue was discovered in cp-demangle.c in GNU libiberty, as distributed in GNU Binutils 2.31.
- CVE-2018-18478Persistent Cross-Site Scripting (XSS) issues in LibreNMS before 1.44 allow remote attackers to inject arbitrary web script or HTML via the dlibrenms/librenms
- CVE-2018-18480A heap-based buffer over-read exists in libopencad 0.2.0 in the ReadMCHAR function in lib/dwg/io.cpp, resulting in an application crash.
- CVE-2018-18481A heap-based buffer over-read exists in libopencad 0.2.0 in the ReadCHAR function in lib/dwg/io.cpp, resulting in an application crash.
- CVE-2018-18482An issue was discovered in libpg_query 10-1.0.2.pg-query · pglast
- CVE-2018-1518IBM InfoSphere Information Server 11.7 is affected by a weak password encryption vulnerability that could allow a local user to obtain highlIBM InfoSphere Information Server
- CVE-2016-9069A use-after-free in nsINode::ReplaceOrInsertBefore during DOM operations resulting in potentially exploitable crashes.Mozilla Firefox
- CVE-2018-12358Service workers can use redirection to avoid the tainting of cross-origin resources in some instances, allowing a malicious site to read resMozilla Firefox
- CVE-2018-12359A buffer overflow can occur when rendering canvas content while adjusting the height and width of the canvas element dynamically, causing daMozilla Thunderbird · Mozilla Firefox ESR +1
- CVE-2018-12360A use-after-free vulnerability can occur when deleting an input element during a mutation event handler triggered by focusing that element.Mozilla Thunderbird · Mozilla Firefox ESR +1
- CVE-2018-12361An integer overflow can occur in the SwizzleData code while calculating buffer sizes.Mozilla Thunderbird · Mozilla Firefox ESR +1
- CVE-2018-12362An integer overflow can occur during graphics operations done by the Supplemental Streaming SIMD Extensions 3 (SSSE3) scaler, resulting in aMozilla Thunderbird · Mozilla Firefox ESR +1
- CVE-2018-12363A use-after-free vulnerability can occur when script uses mutation events to move DOM nodes between documents, resulting in the old documentMozilla Thunderbird · Mozilla Firefox ESR +1
- CVE-2018-12364NPAPI plugins, such as Adobe Flash, can send non-simple cross-origin requests, bypassing CORS by making a same-origin POST that does a 307 rMozilla Thunderbird · Mozilla Firefox ESR +1
- CVE-2018-12365A compromised IPC child process can escape the content sandbox and list the names of arbitrary files on the file system without user consentMozilla Thunderbird · Mozilla Firefox ESR +1
- CVE-2018-12366An invalid grid size during QCMS (color profile) transformations can result in the out-of-bounds read interpreted as a float value.Mozilla Thunderbird · Mozilla Firefox ESR +1
- CVE-2018-12367In the previous mitigations for Spectre, the resolution or precision of various methods was reduced to counteract the ability to measure preMozilla Thunderbird · Mozilla Firefox ESR +1
- CVE-2018-12368Windows 10 does not warn users before opening executable files with the SettingContent-ms extension even when they have been downloaded fromMozilla Thunderbird · Mozilla Firefox ESR +1
- CVE-2018-12369WebExtensions bundled with embedded experiments were not correctly checked for proper authorization.Mozilla Firefox ESR · Mozilla Firefox
- CVE-2018-12370In Reader View SameSite cookie protections are not checked on exiting.Mozilla Firefox
- CVE-2018-12372Decrypted S/MIME parts, when included in HTML crafted for an attack, can leak plaintext when included in a a HTML reply/forward.Mozilla Thunderbird
- CVE-2018-12373dDecrypted S/MIME parts hidden with CSS or the plaintext HTML tag can leak plaintext when included in a HTML reply/forward.Mozilla Thunderbird
- CVE-2018-12374Plaintext of decrypted emails can leak through by user submitting an embedded form by pressing enter key within a text input field.Mozilla Thunderbird
- CVE-2018-12375Memory safety bugs present in Firefox 61.Mozilla Firefox
- CVE-2018-12376Memory safety bugs present in Firefox 61 and Firefox ESR 60.1.Mozilla Firefox · Mozilla Thunderbird
- CVE-2018-12377A use-after-free vulnerability can occur when refresh driver timers are refreshed in some circumstances during shutdown when the timer is deMozilla Firefox · Mozilla Thunderbird
- CVE-2018-12378A use-after-free vulnerability can occur when an IndexedDB index is deleted while still in use by JavaScript code that is providing payload Mozilla Firefox · Mozilla Thunderbird
- CVE-2018-12379When the Mozilla Updater opens a MAR format file which contains a very long item filename, an out-of-bounds write can be triggered, leading Mozilla Firefox · Mozilla Thunderbird
- CVE-2018-12381Manually dragging and dropping an Outlook email message into the browser will trigger a page navigation when the message's mail columns are Mozilla Firefox ESR · Mozilla Firefox
- CVE-2018-12382The displayed addressbar URL can be spoofed on Firefox for Android using a javascript: URI in concert with JavaScript to insert text before Mozilla Firefox
- CVE-2018-12383If a user saved passwords before Firefox 58 and then later set a master password, an unencrypted copy of these passwords is still accessibleMozilla Firefox · Mozilla Thunderbird
- CVE-2018-12385A potentially exploitable crash in TransportSecurityInfo used for SSL can be triggered by data stored in the local cache in the user profileMozilla Thunderbird · Mozilla Firefox ESR +1
- CVE-2018-12386A vulnerability in register allocation in JavaScript can lead to type confusion, allowing for an arbitrary read and write.Mozilla Firefox ESR · Mozilla Firefox
- CVE-2018-12387A vulnerability where the JavaScript JIT compiler inlines Array.prototype.push with multiple arguments that results in the stack pointer beiMozilla Firefox ESR · Mozilla Firefox
- CVE-2018-5156A vulnerability can occur when capturing a media stream when the media source type is changed as the capture is occurring.Mozilla Thunderbird · Mozilla Firefox ESR +1
- CVE-2018-5186Memory safety bugs present in Firefox 60.Mozilla Firefox
- CVE-2018-5187Memory safety bugs present in Firefox 60 and Firefox ESR 60.Mozilla Thunderbird · Mozilla Firefox ESR +1
- CVE-2018-5188Memory safety bugs present in Firefox 60, Firefox ESR 60, and Firefox ESR 52.8.Mozilla Thunderbird · Mozilla Firefox ESR +1
- CVE-2018-18454CCITTFaxStream::readRow() in Stream.cc in Xpdf 4.00 allows remote attackers to cause a denial of service (heap-based buffer over-read) via a
- CVE-2018-18455The GfxImageColorMap class in GfxState.cc in Xpdf 4.00 allows remote attackers to cause a denial of service (heap-based buffer over-read) vi
- CVE-2018-18456The function Object::isName() in Object.h (called from Gfx::opSetFillColorN) in Xpdf 4.00 allows remote attackers to cause a denial of servi
- CVE-2018-18457The function DCTStream::readScan in Stream.cc in Xpdf 4.00 allows remote attackers to cause a denial of service (NULL pointer dereference) v
- CVE-2018-18458The function DCTStream::decodeImage in Stream.cc in Xpdf 4.00 allows remote attackers to cause a denial of service (NULL pointer dereference
- CVE-2018-18459The function DCTStream::getBlock in Stream.cc in Xpdf 4.00 allows remote attackers to cause a denial of service (NULL pointer dereference) v
- CVE-2018-18460XSS exists in the wp-live-chat-support v8.0.15 plugin for WordPress via the modules/gdpr.php term parameter in a wp-admin/admin.php wplivech
- CVE-2018-18461The Arigato Autoresponder and Newsletter (aka bft-autoresponder) v2.5.1.7 plugin for WordPress allows remote attackers to execute arbitrary