# CVEs published 2018-10-18

62 CVEs were published on October 18, 2018: 2 critical, 2 high. Days are UTC.

- [CVE-2018-11079](https://cve.now/CVE-2018-11079.md): Dell EMC Secure Remote Services, versions prior to 3.32.00.08, contains a Plaintext Password Storage vulnerability. (CVSS 5.5, DELL EMC ESRS Virtual Edition)
- [CVE-2018-11080](https://cve.now/CVE-2018-11080.md): Dell EMC Secure Remote Services, versions prior to 3.32.00.08, contains Improper File Permission Vulnerabilities. (CVSS 7.3, DELL EMC ESRS Virtual Edition)
- [CVE-2018-15756](https://cve.now/CVE-2018-15756.md): DoS Attack via Range Requests (CVSS 7.5, Pivotal Spring framework · org.springframework:spring-core)
- [CVE-2018-15758](https://cve.now/CVE-2018-15758.md): Privilege Escalation in spring-security-oauth2 (CVSS 9.6, Pivotal Spring Security OAuth · org.springframework.securit…)
- [CVE-2018-15765](https://cve.now/CVE-2018-15765.md): Dell EMC Secure Remote Services, versions prior to 3.32.00.08, contains an Information Exposure vulnerability. (CVSS 3.4, DELL EMC ESRS Virtual Edition)
- [CVE-2018-14807](https://cve.now/CVE-2018-14807.md): A stack-based buffer overflow vulnerability in Opto 22 PAC Control Basic and PAC Control Professional versions R10.0a and prior may allow re (no CVSS, Opto 22 PAC Control Basic and PAC Control Professional)
- [CVE-2018-18485](https://cve.now/CVE-2018-18485.md): An issue was discovered in PHPSHE 1.7. (no CVSS)
- [CVE-2018-18486](https://cve.now/CVE-2018-18486.md): An issue was discovered in PHPSHE 1.7. (no CVSS)
- [CVE-2018-18487](https://cve.now/CVE-2018-18487.md): In \\lib\\admin\\action\\dataaction.class.php in Gxlcms v2.0, the database backup filename generation uses mt\_rand() unsafely, resulting in pred (no CVSS)
- [CVE-2018-18488](https://cve.now/CVE-2018-18488.md): In \\lib\\admin\\action\\dataaction.class.php in Gxlcms v2.0, SQL Injection exists via the ids\[\] parameter. (no CVSS)
- [CVE-2015-4630](https://cve.now/CVE-2015-4630.md): Multiple cross-site request forgery (CSRF) vulnerabilities in Koha 3.14.x before 3.14.16, 3.16.x before 3.16.12, 3.18.x before 3.18.08, and (no CVSS)
- [CVE-2015-4631](https://cve.now/CVE-2015-4631.md): Multiple cross-site scripting (XSS) vulnerabilities in Koha 3.14.x before 3.14.16, 3.16.x before 3.16.12, 3.18.x before 3.18.08, and 3.20.x (no CVSS)
- [CVE-2015-4632](https://cve.now/CVE-2015-4632.md): Multiple directory traversal vulnerabilities in Koha 3.14.x before 3.14.16, 3.16.x before 3.16.12, 3.18.x before 3.18.08, and 3.20.x before (no CVSS)
- [CVE-2015-4633](https://cve.now/CVE-2015-4633.md): Multiple SQL injection vulnerabilities in Koha 3.14.x before 3.14.16, 3.16.x before 3.16.12, 3.18.x before 3.18.08, and 3.20.x before 3.20.1 (no CVSS)
- [CVE-2018-18483](https://cve.now/CVE-2018-18483.md): The get\_count function in cplus-dem.c in GNU libiberty, as distributed in GNU Binutils 2.31, allows remote attackers to cause a denial of se (no CVSS)
- [CVE-2018-18484](https://cve.now/CVE-2018-18484.md): An issue was discovered in cp-demangle.c in GNU libiberty, as distributed in GNU Binutils 2.31. (no CVSS)
- [CVE-2018-18478](https://cve.now/CVE-2018-18478.md): Persistent Cross-Site Scripting (XSS) issues in LibreNMS before 1.44 allow remote attackers to inject arbitrary web script or HTML via the d (no CVSS, librenms/librenms)
- [CVE-2018-18480](https://cve.now/CVE-2018-18480.md): A heap-based buffer over-read exists in libopencad 0.2.0 in the ReadMCHAR function in lib/dwg/io.cpp, resulting in an application crash. (no CVSS)
- [CVE-2018-18481](https://cve.now/CVE-2018-18481.md): A heap-based buffer over-read exists in libopencad 0.2.0 in the ReadCHAR function in lib/dwg/io.cpp, resulting in an application crash. (no CVSS)
- [CVE-2018-18482](https://cve.now/CVE-2018-18482.md): An issue was discovered in libpg\_query 10-1.0.2. (no CVSS, pg-query · pglast)
- [CVE-2018-1518](https://cve.now/CVE-2018-1518.md): IBM InfoSphere Information Server 11.7 is affected by a weak password encryption vulnerability that could allow a local user to obtain highl (CVSS 6.2, IBM InfoSphere Information Server)
- [CVE-2018-1822](https://cve.now/CVE-2018-1822.md): IBM FlashSystem 900 product GUI allows a specially crafted attack to bypass the authentication requirements of the system, resulting in the (CVSS 9.8, IBM FlashSystem)
- [CVE-2016-9069](https://cve.now/CVE-2016-9069.md): A use-after-free in nsINode::ReplaceOrInsertBefore during DOM operations resulting in potentially exploitable crashes. (no CVSS, Mozilla Firefox)
- [CVE-2018-12358](https://cve.now/CVE-2018-12358.md): Service workers can use redirection to avoid the tainting of cross-origin resources in some instances, allowing a malicious site to read res (no CVSS, Mozilla Firefox)
- [CVE-2018-12359](https://cve.now/CVE-2018-12359.md): A buffer overflow can occur when rendering canvas content while adjusting the height and width of the canvas element dynamically, causing da (no CVSS, Mozilla Thunderbird · Mozilla Firefox ESR +1)
- [CVE-2018-12360](https://cve.now/CVE-2018-12360.md): A use-after-free vulnerability can occur when deleting an input element during a mutation event handler triggered by focusing that element. (no CVSS, Mozilla Thunderbird · Mozilla Firefox ESR +1)
- [CVE-2018-12361](https://cve.now/CVE-2018-12361.md): An integer overflow can occur in the SwizzleData code while calculating buffer sizes. (no CVSS, Mozilla Thunderbird · Mozilla Firefox ESR +1)
- [CVE-2018-12362](https://cve.now/CVE-2018-12362.md): An integer overflow can occur during graphics operations done by the Supplemental Streaming SIMD Extensions 3 (SSSE3) scaler, resulting in a (no CVSS, Mozilla Thunderbird · Mozilla Firefox ESR +1)
- [CVE-2018-12363](https://cve.now/CVE-2018-12363.md): A use-after-free vulnerability can occur when script uses mutation events to move DOM nodes between documents, resulting in the old document (no CVSS, Mozilla Thunderbird · Mozilla Firefox ESR +1)
- [CVE-2018-12364](https://cve.now/CVE-2018-12364.md): NPAPI plugins, such as Adobe Flash, can send non-simple cross-origin requests, bypassing CORS by making a same-origin POST that does a 307 r (no CVSS, Mozilla Thunderbird · Mozilla Firefox ESR +1)
- [CVE-2018-12365](https://cve.now/CVE-2018-12365.md): A compromised IPC child process can escape the content sandbox and list the names of arbitrary files on the file system without user consent (no CVSS, Mozilla Thunderbird · Mozilla Firefox ESR +1)
- [CVE-2018-12366](https://cve.now/CVE-2018-12366.md): An invalid grid size during QCMS (color profile) transformations can result in the out-of-bounds read interpreted as a float value. (no CVSS, Mozilla Thunderbird · Mozilla Firefox ESR +1)
- [CVE-2018-12367](https://cve.now/CVE-2018-12367.md): In the previous mitigations for Spectre, the resolution or precision of various methods was reduced to counteract the ability to measure pre (no CVSS, Mozilla Thunderbird · Mozilla Firefox ESR +1)
- [CVE-2018-12368](https://cve.now/CVE-2018-12368.md): Windows 10 does not warn users before opening executable files with the SettingContent-ms extension even when they have been downloaded from (no CVSS, Mozilla Thunderbird · Mozilla Firefox ESR +1)
- [CVE-2018-12369](https://cve.now/CVE-2018-12369.md): WebExtensions bundled with embedded experiments were not correctly checked for proper authorization. (no CVSS, Mozilla Firefox ESR · Mozilla Firefox)
- [CVE-2018-12370](https://cve.now/CVE-2018-12370.md): In Reader View SameSite cookie protections are not checked on exiting. (no CVSS, Mozilla Firefox)
- [CVE-2018-12372](https://cve.now/CVE-2018-12372.md): Decrypted S/MIME parts, when included in HTML crafted for an attack, can leak plaintext when included in a a HTML reply/forward. (no CVSS, Mozilla Thunderbird)
- [CVE-2018-12373](https://cve.now/CVE-2018-12373.md): dDecrypted S/MIME parts hidden with CSS or the plaintext HTML tag can leak plaintext when included in a HTML reply/forward. (no CVSS, Mozilla Thunderbird)
- [CVE-2018-12374](https://cve.now/CVE-2018-12374.md): Plaintext of decrypted emails can leak through by user submitting an embedded form by pressing enter key within a text input field. (no CVSS, Mozilla Thunderbird)
- [CVE-2018-12375](https://cve.now/CVE-2018-12375.md): Memory safety bugs present in Firefox 61. (no CVSS, Mozilla Firefox)
- [CVE-2018-12376](https://cve.now/CVE-2018-12376.md): Memory safety bugs present in Firefox 61 and Firefox ESR 60.1. (no CVSS, Mozilla Firefox · Mozilla Thunderbird)
- [CVE-2018-12377](https://cve.now/CVE-2018-12377.md): A use-after-free vulnerability can occur when refresh driver timers are refreshed in some circumstances during shutdown when the timer is de (no CVSS, Mozilla Firefox · Mozilla Thunderbird)
- [CVE-2018-12378](https://cve.now/CVE-2018-12378.md): A use-after-free vulnerability can occur when an IndexedDB index is deleted while still in use by JavaScript code that is providing payload (no CVSS, Mozilla Firefox · Mozilla Thunderbird)
- [CVE-2018-12379](https://cve.now/CVE-2018-12379.md): When the Mozilla Updater opens a MAR format file which contains a very long item filename, an out-of-bounds write can be triggered, leading (no CVSS, Mozilla Firefox · Mozilla Thunderbird)
- [CVE-2018-12381](https://cve.now/CVE-2018-12381.md): Manually dragging and dropping an Outlook email message into the browser will trigger a page navigation when the message's mail columns are (no CVSS, Mozilla Firefox ESR · Mozilla Firefox)
- [CVE-2018-12382](https://cve.now/CVE-2018-12382.md): The displayed addressbar URL can be spoofed on Firefox for Android using a javascript: URI in concert with JavaScript to insert text before (no CVSS, Mozilla Firefox)
- [CVE-2018-12383](https://cve.now/CVE-2018-12383.md): If a user saved passwords before Firefox 58 and then later set a master password, an unencrypted copy of these passwords is still accessible (no CVSS, Mozilla Firefox · Mozilla Thunderbird)
- [CVE-2018-12385](https://cve.now/CVE-2018-12385.md): A potentially exploitable crash in TransportSecurityInfo used for SSL can be triggered by data stored in the local cache in the user profile (no CVSS, Mozilla Thunderbird · Mozilla Firefox ESR +1)
- [CVE-2018-12386](https://cve.now/CVE-2018-12386.md): A vulnerability in register allocation in JavaScript can lead to type confusion, allowing for an arbitrary read and write. (no CVSS, Mozilla Firefox ESR · Mozilla Firefox)
- [CVE-2018-12387](https://cve.now/CVE-2018-12387.md): A vulnerability where the JavaScript JIT compiler inlines Array.prototype.push with multiple arguments that results in the stack pointer bei (no CVSS, Mozilla Firefox ESR · Mozilla Firefox)
- [CVE-2018-5156](https://cve.now/CVE-2018-5156.md): A vulnerability can occur when capturing a media stream when the media source type is changed as the capture is occurring. (no CVSS, Mozilla Thunderbird · Mozilla Firefox ESR +1)
- [CVE-2018-5186](https://cve.now/CVE-2018-5186.md): Memory safety bugs present in Firefox 60. (no CVSS, Mozilla Firefox)
- [CVE-2018-5187](https://cve.now/CVE-2018-5187.md): Memory safety bugs present in Firefox 60 and Firefox ESR 60. (no CVSS, Mozilla Thunderbird · Mozilla Firefox ESR +1)
- [CVE-2018-5188](https://cve.now/CVE-2018-5188.md): Memory safety bugs present in Firefox 60, Firefox ESR 60, and Firefox ESR 52.8. (no CVSS, Mozilla Thunderbird · Mozilla Firefox ESR +1)
- [CVE-2018-18454](https://cve.now/CVE-2018-18454.md): CCITTFaxStream::readRow() in Stream.cc in Xpdf 4.00 allows remote attackers to cause a denial of service (heap-based buffer over-read) via a (no CVSS)
- [CVE-2018-18455](https://cve.now/CVE-2018-18455.md): The GfxImageColorMap class in GfxState.cc in Xpdf 4.00 allows remote attackers to cause a denial of service (heap-based buffer over-read) vi (no CVSS)
- [CVE-2018-18456](https://cve.now/CVE-2018-18456.md): The function Object::isName() in Object.h (called from Gfx::opSetFillColorN) in Xpdf 4.00 allows remote attackers to cause a denial of servi (no CVSS)
- [CVE-2018-18457](https://cve.now/CVE-2018-18457.md): The function DCTStream::readScan in Stream.cc in Xpdf 4.00 allows remote attackers to cause a denial of service (NULL pointer dereference) v (no CVSS)
- [CVE-2018-18458](https://cve.now/CVE-2018-18458.md): The function DCTStream::decodeImage in Stream.cc in Xpdf 4.00 allows remote attackers to cause a denial of service (NULL pointer dereference (no CVSS)
- [CVE-2018-18459](https://cve.now/CVE-2018-18459.md): The function DCTStream::getBlock in Stream.cc in Xpdf 4.00 allows remote attackers to cause a denial of service (NULL pointer dereference) v (no CVSS)
- [CVE-2018-18460](https://cve.now/CVE-2018-18460.md): XSS exists in the wp-live-chat-support v8.0.15 plugin for WordPress via the modules/gdpr.php term parameter in a wp-admin/admin.php wplivech (no CVSS)
- [CVE-2018-18461](https://cve.now/CVE-2018-18461.md): The Arigato Autoresponder and Newsletter (aka bft-autoresponder) v2.5.1.7 plugin for WordPress allows remote attackers to execute arbitrary (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2018-10-18
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.