# CVEs published 2018-10-19

42 CVEs were published on October 19, 2018: 1 critical, 0 high. Days are UTC.

- [CVE-2018-12666](https://cve.now/CVE-2018-12666.md): SV3C L-SERIES HD CAMERA V2.3.4.2103-S50-NTD-B20170508B devices improperly identifies users only by the authentication level sent in the cook (no CVSS)
- [CVE-2018-12667](https://cve.now/CVE-2018-12667.md): The SV3C HD Camera (L-SERIES V2.3.4.2103-S50-NTD-B20170508B and V2.3.4.2103-S50-NTD-B20170823B) is affected by an improper authentication vu (no CVSS)
- [CVE-2018-12668](https://cve.now/CVE-2018-12668.md): SV3C L-SERIES HD CAMERA V2.3.4.2103-S50-NTD-B20170508B and V2.3.4.2103-S50-NTD-B20170823B devices have a Hard-coded Password. (no CVSS)
- [CVE-2018-12669](https://cve.now/CVE-2018-12669.md): SV3C L-SERIES HD CAMERA V2.3.4.2103-S50-NTD-B20170508B and V2.3.4.2103-S50-NTD-B20170823B devices allow remote authenticated users to reset (no CVSS)
- [CVE-2018-12670](https://cve.now/CVE-2018-12670.md): SV3C L-SERIES HD CAMERA V2.3.4.2103-S50-NTD-B20170508B and V2.3.4.2103-S50-NTD-B20170823B devices allow OS Command Injection. (no CVSS)
- [CVE-2018-12671](https://cve.now/CVE-2018-12671.md): An attacker with remote access to the SV3C HD Camera (L-SERIES V2.3.4.2103-S50-NTD-B20170508B and V2.3.4.2103-S50-NTD-B20170823B) web interf (no CVSS)
- [CVE-2018-12672](https://cve.now/CVE-2018-12672.md): The SV3C HD Camera (L-SERIES V2.3.4.2103-S50-NTD-B20170508B) does not perform proper validation on user-supplied input and is vulnerable to (no CVSS)
- [CVE-2018-12673](https://cve.now/CVE-2018-12673.md): An attacker with remote access to the SV3C HD Camera (L-SERIES V2.3.4.2103-S50-NTD-B20170508B and V2.3.4.2103-S50-NTD-B20170823B) web interf (no CVSS)
- [CVE-2018-12674](https://cve.now/CVE-2018-12674.md): The SV3C HD Camera (L-SERIES V2.3.4.2103-S50-NTD-B20170508B and V2.3.4.2103-S50-NTD-B20170823B) stores the username and password within the (no CVSS)
- [CVE-2018-12675](https://cve.now/CVE-2018-12675.md): The SV3C HD Camera (L-SERIES V2.3.4.2103-S50-NTD-B20170508B and V2.3.4.2103-S50-NTD-B20170823B) does not perform origin checks on URLs that (no CVSS)
- [CVE-2018-18026](https://cve.now/CVE-2018-18026.md): IMFCameraProtect.sys in IObit Malware Fighter 6.2 (and possibly lower versions) is vulnerable to a stack-based buffer overflow. (no CVSS)
- [CVE-2018-18223](https://cve.now/CVE-2018-18223.md): Open Design Alliance Drawings SDK 2019Update1 has a vulnerability during the reading of malformed files, allowing attackers to obtain sensit (no CVSS)
- [CVE-2018-18224](https://cve.now/CVE-2018-18224.md): A vulnerability exists in the file reading procedure in Open Design Alliance Drawings SDK 2019Update1 on non-Windows platforms in which atta (no CVSS)
- [CVE-2018-18284](https://cve.now/CVE-2018-18284.md): Artifex Ghostscript 9.25 and earlier allows attackers to bypass a sandbox protection mechanism via vectors involving the 1Policy operator. (no CVSS)
- [CVE-2018-18398](https://cve.now/CVE-2018-18398.md): Xfce Thunar 1.6.15, when Xfce 4.12 is used, mishandles the IBus-Unikey input method for file searches within File Manager, leading to an out (no CVSS)
- [CVE-2018-18416](https://cve.now/CVE-2018-18416.md): LANGO Codeigniter Multilingual Script 1.0 has XSS in the input and upload sections, as demonstrated by the site\_name parameter to the admin/ (no CVSS)
- [CVE-2018-18417](https://cve.now/CVE-2018-18417.md): In the 3.1 version of Ekushey Project Manager CRM, Stored XSS has been discovered in the input and upload sections, as demonstrated by the n (no CVSS)
- [CVE-2018-18419](https://cve.now/CVE-2018-18419.md): Stored XSS has been discovered in the upload section of ARDAWAN.COM User Management 1.1, as demonstrated by a .jpg filename to the /account (no CVSS)
- [CVE-2018-18420](https://cve.now/CVE-2018-18420.md): Cross-Site Request Forgery (CSRF) vulnerability was discovered in the 8.3 version of Zenario Content Management System via the admin/organiz (no CVSS, tribalsystems/zenario)
- [CVE-2018-18428](https://cve.now/CVE-2018-18428.md): TP-Link TL-SC3130 1.6.18P12\_121101 devices allow unauthenticated RTSP stream access, as demonstrated by a /jpg/image.jpg URI. (no CVSS)
- [CVE-2018-18438](https://cve.now/CVE-2018-18438.md): Qemu has integer overflows because IOReadHandler and its associated functions use a signed integer data type for a size value. (no CVSS)
- [CVE-2018-18380](https://cve.now/CVE-2018-18380.md): A Session Fixation issue was discovered in Bigtree before 4.2.24. (no CVSS)
- [CVE-2018-18529](https://cve.now/CVE-2018-18529.md): ThinkPHP 3.2.4 has SQL Injection via the count parameter because the Library/Think/Db/Driver/Mysql.class.php parseKey function mishandles th (no CVSS, topthink/framework)
- [CVE-2018-18530](https://cve.now/CVE-2018-18530.md): ThinkPHP 5.1.25 has SQL Injection via the count parameter because the library/think/db/Query.php aggregate function mishandles the aggregate (no CVSS, topthink/framework)
- [CVE-2018-18531](https://cve.now/CVE-2018-18531.md): text/impl/DefaultTextCreator.java, text/impl/ChineseTextProducer.java, and text/impl/FiveLetterFirstNameTextCreator.java in kaptcha 2.3.2 us (no CVSS, com.github.penggle:kaptcha)
- [CVE-2018-18527](https://cve.now/CVE-2018-18527.md): OwnTicket 2018-05-23 allows SQL Injection via the showTicketId or editTicketStatusId parameter. (no CVSS)
- [CVE-2018-18520](https://cve.now/CVE-2018-18520.md): An Invalid Memory Address Dereference exists in the function elf\_end in libelf in elfutils through v0.174. (no CVSS)
- [CVE-2018-18521](https://cve.now/CVE-2018-18521.md): Divide-by-zero vulnerabilities in the function arlib\_add\_symbols() in arlib.c in elfutils 0.174 allow remote attackers to cause a denial of (no CVSS)
- [CVE-2018-18390](https://cve.now/CVE-2018-18390.md): User Enumeration in Moxa ThingsPro IIoT Gateway and Device Management Software Solutions version 2.1. (no CVSS, Moxa ThingsPro IIoT Gateway and Device Management Software…)
- [CVE-2018-18391](https://cve.now/CVE-2018-18391.md): User Privilege Escalation in Moxa ThingsPro IIoT Gateway and Device Management Software Solutions version 2.1. (no CVSS, Moxa ThingsPro IIoT Gateway and Device Management Software…)
- [CVE-2018-18392](https://cve.now/CVE-2018-18392.md): Privilege Escalation via Broken Access Control in Moxa ThingsPro IIoT Gateway and Device Management Software Solutions version 2.1. (no CVSS, Moxa ThingsPro IIoT Gateway and Device Management Software…)
- [CVE-2018-18393](https://cve.now/CVE-2018-18393.md): Password Management Issue in Moxa ThingsPro IIoT Gateway and Device Management Software Solutions version 2.1. (no CVSS, Moxa ThingsPro IIoT Gateway and Device Management Software…)
- [CVE-2018-18394](https://cve.now/CVE-2018-18394.md): Sensitive Information Stored in Clear Text in Moxa ThingsPro IIoT Gateway and Device Management Software Solutions version 2.1. (no CVSS, Moxa ThingsPro IIoT Gateway and Device Management Software…)
- [CVE-2018-18395](https://cve.now/CVE-2018-18395.md): Hidden Token Access in Moxa ThingsPro IIoT Gateway and Device Management Software Solutions version 2.1. (no CVSS, Moxa ThingsPro IIoT Gateway and Device Management Software…)
- [CVE-2018-18396](https://cve.now/CVE-2018-18396.md): Remote Code Execution in Moxa ThingsPro IIoT Gateway and Device Management Software Solutions version 2.1. (no CVSS, Moxa ThingsPro IIoT Gateway and Device Management Software…)
- [CVE-2018-15312](https://cve.now/CVE-2018-15312.md): On F5 BIG-IP 13.0.0-13.1.1.1 and 12.1.0-12.1.3.6, a reflected Cross-Site Scripting (XSS) vulnerability exists in an undisclosed page of the (no CVSS, F5 Networks BIG-IP)
- [CVE-2018-15313](https://cve.now/CVE-2018-15313.md): On F5 BIG-IP AFM 13.0.0-13.1.1.1 and 12.1.0-12.1.3.6, there is a Reflected Cross Site Scripting vulnerability in undisclosed TMUI page. (no CVSS, F5 Networks BIG-IP AFM)
- [CVE-2018-15314](https://cve.now/CVE-2018-15314.md): On F5 BIG-IP AFM 13.0.0-13.1.1.1 and 12.1.0-12.1.3.6, there is a Reflected Cross Site Scripting vulnerability in undisclosed TMUI page. (no CVSS, F5 Networks BIG-IP AFM)
- [CVE-2018-15315](https://cve.now/CVE-2018-15315.md): On F5 BIG-IP 13.0.0-13.1.1.1 and 12.1.0-12.1.3.6, there is a reflected Cross Site Scripting (XSS) vulnerability in an undisclosed Configurat (no CVSS, F5 Networks BIG-IP)
- [CVE-2018-15316](https://cve.now/CVE-2018-15316.md): In F5 BIG-IP APM 13.0.0-13.1.1.1, APM Client 7.1.5-7.1.6, and/or Edge Client 7101-7160, the BIG-IP APM Edge Client component loads the polic (no CVSS, F5 Networks BIG-IP)
- [CVE-2018-4013](https://cve.now/CVE-2018-4013.md): An exploitable code execution vulnerability exists in the HTTP packet-parsing functionality of the LIVE555 RTSP server library version 0.92. (CVSS 10.0, Live Networks LIVE555 Media Server)
- [CVE-2017-18348](https://cve.now/CVE-2017-18348.md): Splunk Enterprise 6.6.x, when configured to run as root but drop privileges to a specific non-root account, allows local users to gain privi (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2018-10-19
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.