CVEs published October 19, 2018
42 CVEs were published on October 19, 2018: 1 critical, 0 high.
- Published
- 42
- Critical
- 1
- High
- 0
- Medium
- 0
- Low
- 0
- Unrated
- 41
- Now in CISA KEV
- 0
- Fix available
- 0
Most affected products
- Moxa ThingsPro IIoT Gateway and Device Management Software…
- 7
- F5 Networks BIG-IP
- 3
- F5 Networks BIG-IP AFM
- 2
- topthink/framework
- 2
- com.github.penggle:kaptcha
- 1
- Live Networks LIVE555 Media Server
- 1
- tribalsystems/zenario
- 1
Critical 1
Medium, low and unrated 41
- CVE-2018-12666SV3C L-SERIES HD CAMERA V2.3.4.2103-S50-NTD-B20170508B devices improperly identifies users only by the authentication level sent in the cook
- CVE-2018-12667The SV3C HD Camera (L-SERIES V2.3.4.2103-S50-NTD-B20170508B and V2.3.4.2103-S50-NTD-B20170823B) is affected by an improper authentication vu
- CVE-2018-12668SV3C L-SERIES HD CAMERA V2.3.4.2103-S50-NTD-B20170508B and V2.3.4.2103-S50-NTD-B20170823B devices have a Hard-coded Password.
- CVE-2018-12669SV3C L-SERIES HD CAMERA V2.3.4.2103-S50-NTD-B20170508B and V2.3.4.2103-S50-NTD-B20170823B devices allow remote authenticated users to reset
- CVE-2018-12670SV3C L-SERIES HD CAMERA V2.3.4.2103-S50-NTD-B20170508B and V2.3.4.2103-S50-NTD-B20170823B devices allow OS Command Injection.
- CVE-2018-12671An attacker with remote access to the SV3C HD Camera (L-SERIES V2.3.4.2103-S50-NTD-B20170508B and V2.3.4.2103-S50-NTD-B20170823B) web interf
- CVE-2018-12672The SV3C HD Camera (L-SERIES V2.3.4.2103-S50-NTD-B20170508B) does not perform proper validation on user-supplied input and is vulnerable to
- CVE-2018-12673An attacker with remote access to the SV3C HD Camera (L-SERIES V2.3.4.2103-S50-NTD-B20170508B and V2.3.4.2103-S50-NTD-B20170823B) web interf
- CVE-2018-12674The SV3C HD Camera (L-SERIES V2.3.4.2103-S50-NTD-B20170508B and V2.3.4.2103-S50-NTD-B20170823B) stores the username and password within the
- CVE-2018-12675The SV3C HD Camera (L-SERIES V2.3.4.2103-S50-NTD-B20170508B and V2.3.4.2103-S50-NTD-B20170823B) does not perform origin checks on URLs that
- CVE-2018-18026IMFCameraProtect.sys in IObit Malware Fighter 6.2 (and possibly lower versions) is vulnerable to a stack-based buffer overflow.
- CVE-2018-18223Open Design Alliance Drawings SDK 2019Update1 has a vulnerability during the reading of malformed files, allowing attackers to obtain sensit
- CVE-2018-18224A vulnerability exists in the file reading procedure in Open Design Alliance Drawings SDK 2019Update1 on non-Windows platforms in which atta
- CVE-2018-18284Artifex Ghostscript 9.25 and earlier allows attackers to bypass a sandbox protection mechanism via vectors involving the 1Policy operator.
- CVE-2018-18398Xfce Thunar 1.6.15, when Xfce 4.12 is used, mishandles the IBus-Unikey input method for file searches within File Manager, leading to an out
- CVE-2018-18416LANGO Codeigniter Multilingual Script 1.0 has XSS in the input and upload sections, as demonstrated by the site_name parameter to the admin/
- CVE-2018-18417In the 3.1 version of Ekushey Project Manager CRM, Stored XSS has been discovered in the input and upload sections, as demonstrated by the n
- CVE-2018-18419Stored XSS has been discovered in the upload section of ARDAWAN.COM User Management 1.1, as demonstrated by a .jpg filename to the /account
- CVE-2018-18420Cross-Site Request Forgery (CSRF) vulnerability was discovered in the 8.3 version of Zenario Content Management System via the admin/organiztribalsystems/zenario
- CVE-2018-18428TP-Link TL-SC3130 1.6.18P12_121101 devices allow unauthenticated RTSP stream access, as demonstrated by a /jpg/image.jpg URI.
- CVE-2018-18438Qemu has integer overflows because IOReadHandler and its associated functions use a signed integer data type for a size value.
- CVE-2018-18380A Session Fixation issue was discovered in Bigtree before 4.2.24.
- CVE-2018-18529ThinkPHP 3.2.4 has SQL Injection via the count parameter because the Library/Think/Db/Driver/Mysql.class.php parseKey function mishandles thtopthink/framework
- CVE-2018-18530ThinkPHP 5.1.25 has SQL Injection via the count parameter because the library/think/db/Query.php aggregate function mishandles the aggregatetopthink/framework
- CVE-2018-18531text/impl/DefaultTextCreator.java, text/impl/ChineseTextProducer.java, and text/impl/FiveLetterFirstNameTextCreator.java in kaptcha 2.3.2 uscom.github.penggle:kaptcha
- CVE-2018-18527OwnTicket 2018-05-23 allows SQL Injection via the showTicketId or editTicketStatusId parameter.
- CVE-2018-18520An Invalid Memory Address Dereference exists in the function elf_end in libelf in elfutils through v0.174.
- CVE-2018-18521Divide-by-zero vulnerabilities in the function arlib_add_symbols() in arlib.c in elfutils 0.174 allow remote attackers to cause a denial of
- CVE-2018-18390User Enumeration in Moxa ThingsPro IIoT Gateway and Device Management Software Solutions version 2.1.Moxa ThingsPro IIoT Gateway and Device Management Software…
- CVE-2018-18391User Privilege Escalation in Moxa ThingsPro IIoT Gateway and Device Management Software Solutions version 2.1.Moxa ThingsPro IIoT Gateway and Device Management Software…
- CVE-2018-18392Privilege Escalation via Broken Access Control in Moxa ThingsPro IIoT Gateway and Device Management Software Solutions version 2.1.Moxa ThingsPro IIoT Gateway and Device Management Software…
- CVE-2018-18393Password Management Issue in Moxa ThingsPro IIoT Gateway and Device Management Software Solutions version 2.1.Moxa ThingsPro IIoT Gateway and Device Management Software…
- CVE-2018-18394Sensitive Information Stored in Clear Text in Moxa ThingsPro IIoT Gateway and Device Management Software Solutions version 2.1.Moxa ThingsPro IIoT Gateway and Device Management Software…
- CVE-2018-18395Hidden Token Access in Moxa ThingsPro IIoT Gateway and Device Management Software Solutions version 2.1.Moxa ThingsPro IIoT Gateway and Device Management Software…
- CVE-2018-18396Remote Code Execution in Moxa ThingsPro IIoT Gateway and Device Management Software Solutions version 2.1.Moxa ThingsPro IIoT Gateway and Device Management Software…
- CVE-2018-15312On F5 BIG-IP 13.0.0-13.1.1.1 and 12.1.0-12.1.3.6, a reflected Cross-Site Scripting (XSS) vulnerability exists in an undisclosed page of the F5 Networks BIG-IP
- CVE-2018-15313On F5 BIG-IP AFM 13.0.0-13.1.1.1 and 12.1.0-12.1.3.6, there is a Reflected Cross Site Scripting vulnerability in undisclosed TMUI page.F5 Networks BIG-IP AFM
- CVE-2018-15314On F5 BIG-IP AFM 13.0.0-13.1.1.1 and 12.1.0-12.1.3.6, there is a Reflected Cross Site Scripting vulnerability in undisclosed TMUI page.F5 Networks BIG-IP AFM
- CVE-2018-15315On F5 BIG-IP 13.0.0-13.1.1.1 and 12.1.0-12.1.3.6, there is a reflected Cross Site Scripting (XSS) vulnerability in an undisclosed ConfiguratF5 Networks BIG-IP
- CVE-2018-15316In F5 BIG-IP APM 13.0.0-13.1.1.1, APM Client 7.1.5-7.1.6, and/or Edge Client 7101-7160, the BIG-IP APM Edge Client component loads the policF5 Networks BIG-IP
- CVE-2017-18348Splunk Enterprise 6.6.x, when configured to run as root but drop privileges to a specific non-root account, allows local users to gain privi