# CVEs published 2018-10-22

14 CVEs were published on October 22, 2018: 0 critical, 1 high. Days are UTC.

- [CVE-2018-18581](https://cve.now/CVE-2018-18581.md): An issue has been found in LuPng through 2017-03-10. (no CVSS)
- [CVE-2018-18582](https://cve.now/CVE-2018-18582.md): An issue has been found in LuPng through 2017-03-10. (no CVSS)
- [CVE-2018-18583](https://cve.now/CVE-2018-18583.md): An issue has been found in LuPng through 2017-03-10. (no CVSS)
- [CVE-2018-18578](https://cve.now/CVE-2018-18578.md): DedeCMS 5.7 SP2 allows XSS via the plus/qrcode.php type parameter. (no CVSS)
- [CVE-2018-18579](https://cve.now/CVE-2018-18579.md): Reflected XSS exists in DedeCMS 5.7 SP2 via the /member/pm.php folder parameter. (no CVSS)
- [CVE-2018-13114](https://cve.now/CVE-2018-13114.md): Missing authentication and improper input validation in KERUI Wifi Endoscope Camera (YPC99) allow an attacker to execute arbitrary commands (no CVSS)
- [CVE-2018-13115](https://cve.now/CVE-2018-13115.md): Lack of an authentication mechanism in KERUI Wifi Endoscope Camera (YPC99) allows an attacker to watch or block the camera stream. (no CVSS)
- [CVE-2018-12246](https://cve.now/CVE-2018-12246.md): Symantec Web Isolation (WI) 1.11 prior to 1.11.21 is susceptible to a reflected cross-site scripting (XSS) vulnerability. (no CVSS, Symantec Web Isolation)
- [CVE-2018-15703](https://cve.now/CVE-2018-15703.md): Advantech WebAccess 8.3.2 and below is vulnerable to multiple reflected cross site scripting vulnerabilities. (no CVSS, Advantech WebAccess)
- [CVE-2018-15704](https://cve.now/CVE-2018-15704.md): Advantech WebAccess 8.3.2 and below is vulnerable to a stack buffer overflow vulnerability. (no CVSS, Advantech WebAccess)
- [CVE-2018-18557](https://cve.now/CVE-2018-18557.md): LibTIFF 3.9.3, 3.9.4, 3.9.5, 3.9.6, 3.9.7, 4.0.0alpha4, 4.0.0alpha5, 4.0.0alpha6, 4.0.0beta7, 4.0.0, 4.0.1, 4.0.2, 4.0.3, 4.0.4, 4.0.4beta, (no CVSS)
- [CVE-2018-18559](https://cve.now/CVE-2018-18559.md): In the Linux kernel through 4.19, a use-after-free can occur due to a race condition between fanout\_add from setsockopt and bind on an AF\_PA (no CVSS)
- [CVE-2018-1850](https://cve.now/CVE-2018-1850.md): IBM Security Access Manager Appliance 9.0.3.1, 9.0.4.0 and 9.0.5.0 could allow unauthorized administration operations when Advanced Access C (CVSS 8.8, IBM Security Access Manager Appliance)
- [CVE-2018-18553](https://cve.now/CVE-2018-18553.md): Leanote 2.6.1 has XSS via the Blog Basic Setting title field, which is mishandled during rendering of the "likes" page. (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2018-10-22
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.