CVEs published October 23, 2018
69 CVEs were published on October 23, 2018: 0 critical, 1 high.
- Published
- 69
- Critical
- 0
- High
- 1
- Medium
- 1
- Low
- 0
- Unrated
- 67
- Now in CISA KEV
- 0
- Fix available
- 6
Most affected products
- Qualcomm Snapdragon Automobile, Snapdragon Mobile, Snapdrag…
- 7
- Qualcomm Snapdragon Mobile, Snapdragon Wear
- 5
- Trend Micro Antivirus for Mac
- 5
- Advantech WebAccess
- 4
- Qualcomm Snapdragon Mobile
- 4
- Atlassian Jira
- 3
- Qualcomm Small Cell SoC, Snapdragon Automobile, Snapdragon…
- 2
- Qualcomm Snapdragon Automobile, Snapdragon Mobile
- 2
- [UNKNOWN] Ansible · ansible
- 1
- com.alibaba:fastjson · ro.pippo:pippo-fastjson
- 1
High 1
Medium, low and unrated 68
- CVE-2018-12901A vulnerability in the conferencing component of Mitel ST 14.2, versions GA29 (19.49.9400.0) and earlier, could allow an unauthenticated att
- CVE-2018-15497The Mitel MiVoice 5330e VoIP device is affected by memory corruption flaws in the SIP/SDP packet handling functionality.
- CVE-2018-16226A vulnerability in the web admin component of Mitel MiVoice Office 400, versions R5.0 HF3 (v8839a1) and earlier, could allow an unauthentica
- CVE-2018-16235Telligent Community 6.x, 7.x, 8.x, 9.x before 9.2.10.11796, 10.1.x before 10.1.10.11792, and 10.2.x before 10.2.3.4725 has XSS via the Feed
- CVE-2018-17444A Directory Traversal issue was discovered in Citrix SD-WAN 10.1.0 and NetScaler SD-WAN 9.3.x before 9.3.6 and 10.0.x before 10.0.4.
- CVE-2018-17445A Command Injection issue was discovered in Citrix SD-WAN 10.1.0 and NetScaler SD-WAN 9.3.x before 9.3.6 and 10.0.x before 10.0.4.
- CVE-2018-17446A SQL Injection issue was discovered in Citrix SD-WAN 10.1.0 and NetScaler SD-WAN 9.3.x before 9.3.6 and 10.0.x before 10.0.4.
- CVE-2018-17447An Information Exposure Through Log Files issue was discovered in Citrix SD-WAN 10.1.0 and NetScaler SD-WAN 9.3.x before 9.3.6 and 10.0.x be
- CVE-2018-17448An Incorrect Access Control issue was discovered in Citrix SD-WAN 10.1.0 and NetScaler SD-WAN 9.3.x before 9.3.6 and 10.0.x before 10.0.4.
- CVE-2018-17873An incorrect access control vulnerability in the FTP configuration of WiFiRanger devices with firmware version 7.0.8rc3 and earlier allows a
- CVE-2018-17877A lottery smart contract implementation for Greedy 599, an Ethereum gambling game, generates a random value that is predictable via an exter
- CVE-2018-17968A gambling smart contract implementation for RuletkaIo, an Ethereum gambling game, generates a random value that is predictable by an extern
- CVE-2018-18437In AXIOS ITALIA Axioscloud Sissiweb Registro Elettronico 1.7.0, secret/relogoff.aspx has XSS via the Error_Desc parameter.
- CVE-2018-18467An issue was discovered in Daniel Gultsch Conversations 2.3.4.
- CVE-2018-18475Zoho ManageEngine OpManager before 12.3 build 123214 allows Unrestricted Arbitrary File Upload.
- CVE-2018-7427Cross-site scripting (XSS) vulnerability in Splunk Web in Splunk Enterprise 6.0.x before 6.0.14, 6.1.x before 6.1.13, 6.2.x before 6.2.14, 6
- CVE-2018-7429Splunkd in Splunk Enterprise 6.2.x before 6.2.14 6.3.x before 6.3.11, and 6.4.x before 6.4.8; and Splunk Light before 6.5.0 allow remote att
- CVE-2018-7431Directory traversal vulnerability in the Splunk Django App in Splunk Enterprise 6.0.x before 6.0.14, 6.1.x before 6.1.13, 6.2.x before 6.2.1
- CVE-2018-7432Splunk Enterprise 6.2.x before 6.2.14, 6.3.x before 6.3.10, 6.4.x before 6.4.7, and 6.5.x before 6.5.3; and Splunk Light before 6.6.0 allow
- CVE-2017-18349parseObject in Fastjson before 1.2.25, as used in FastjsonEngine in Pippo 1.11.0 and other products, allows remote attackers to execute arbicom.alibaba:fastjson · ro.pippo:pippo-fastjson
- CVE-2018-14806Advantech WebAccess 8.3.1 and earlier has a path traversal vulnerability which may allow an attacker to execute arbitrary code.Advantech WebAccess
- CVE-2018-14816Advantech WebAccess 8.3.1 and earlier has several stack-based buffer overflow vulnerabilities that have been identified, which may allow an Advantech WebAccess
- CVE-2018-14820Advantech WebAccess 8.3.1 and earlier has a .dll component that is susceptible to external control of file name or path vulnerability, whichAdvantech WebAccess
- CVE-2018-14828Advantech WebAccess 8.3.1 and earlier has an improper privilege management vulnerability, which may allow an attacker to access those files Advantech WebAccess
- CVE-2018-18628An issue was discovered in Pippo 1.11.0.ro.pippo:pippo-core
- CVE-2018-18626An issue was discovered in PHPYun V4.6.
- CVE-2018-18608DedeCMS 5.7 SP2 allows XSS via the function named GetPageList defined in the include/datalistcp.class.php file that is used to display the p
- CVE-2018-18622An issue was discovered in Waimai Super Cms 20150505.
- CVE-2018-18589MFSBGN03827 rev.1 - Microfocus Real User Monitoring 9.4.0 BPRDownload Java Deserialization VulnerabilityMicro Focus Microfocus Real User Monitoring
- CVE-2018-18605A heap-based buffer over-read issue was discovered in the function sec_merge_hash_lookup in merge.c in the Binary File Descriptor (BFD) libr
- CVE-2018-18606An issue was discovered in the merge_strings function in merge.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in
- CVE-2018-18607An issue was discovered in elf_link_input_bfd in elflink.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU B
- CVE-2018-8569A remote code execution vulnerability exists in the Yammer desktop application due to the loading of arbitrary content, aka "Yammer Desktop Microsoft Yammer Desktop App
- CVE-2018-18599Stegdetect through 2018-05-26 has an out-of-bounds write in f5_compress in the f5.c file.
- CVE-2018-18603360 Total Security 3.5.0.1033 allows a Sandbox Escape via an "import os" statement, followed by os.system("CMD") or os.system("PowerShell"),
- CVE-2018-13400Several administrative resources in Atlassian Jira before version 7.6.9, from version 7.7.0 before version 7.7.5, from version 7.8.0 before Atlassian Jira
- CVE-2018-13401The XsrfErrorAction resource in Atlassian Jira before version 7.6.9, from version 7.7.0 before version 7.7.5, from version 7.8.0 before versAtlassian Jira
- CVE-2018-13402Many resources in Atlassian Jira before version 7.6.9, from version 7.7.0 before version 7.7.5, from version 7.8.0 before version 7.8.5, froAtlassian Jira
- CVE-2018-15366A UrlfWTPPagePtr KERedirect Use-After-Free Privilege Escalation vulnerability in Trend Micro Antivirus for Mac (Consumer) 7.0 (2017) and aboTrend Micro Antivirus for Mac
- CVE-2018-15367A ctl_set KERedirect Untrusted Pointer Dereference Privilege Escalation vulnerability in Trend Micro Antivirus for Mac (Consumer) 7.0 (2017)Trend Micro Antivirus for Mac
- CVE-2018-18327A KERedirect Untrusted Pointer Dereference Privilege Escalation vulnerability in Trend Micro Antivirus for Mac (Consumer) 7.0 (2017) and aboTrend Micro Antivirus for Mac
- CVE-2018-18328A KERedirect Untrusted Pointer Dereference Privilege Escalation vulnerability in Trend Micro Antivirus for Mac (Consumer) 7.0 (2017) and aboTrend Micro Antivirus for Mac
- CVE-2018-18329A KERedirect Untrusted Pointer Dereference Privilege Escalation vulnerability in Trend Micro Antivirus for Mac (Consumer) 7.0 (2017) and aboTrend Micro Antivirus for Mac
- CVE-2018-7911Some Huawei smart phones ALP-AL00B 8.0.0.106(C00), 8.0.0.113(SP2C00), 8.0.0.113(SP3C00), 8.0.0.113(SP7C00), 8.0.0.118(C00), 8.0.0.120(SP2C00Huawei Technologies Co. ALP-AL00B, ALP-AL00B-RSC, BLA-TL00B…
- CVE-2017-18170Improper input validation in Bluetooth Controller function can lead to possible memory corruption in Snapdragon Mobile in version QCA9379, SQualcomm Snapdragon Mobile
- CVE-2017-18171Improper input validation for GATT data packet received in Bluetooth Controller function can lead to possible memory corruption in SnapdragoQualcomm Snapdragon Mobile
- CVE-2017-18172In a device, with screen size 1440x2560, the check of contiguous buffer will overflow on certain buffer size resulting in an Integer OverfloQualcomm Snapdragon Automobile, Snapdragon Mobile
- CVE-2017-18277When dynamic memory allocation fails, currently the process sleeps for one second and continues with infinite loop without retrying for memoQualcomm Snapdragon Automobile, Snapdragon Mobile, Snapdrag…
- CVE-2017-18282Non-secure SW can cause SDCC to generate secure bus accesses, which may expose RPM access in Snapdragon Mobile, Snapdragon Wear in version MQualcomm Snapdragon Mobile, Snapdragon Wear
- CVE-2017-18283Possible memory corruption when Read Val Blob Req is received with invalid parameters in Snapdragon Mobile in version QCA9379, SD 210/SD 212Qualcomm Snapdragon Mobile
- CVE-2017-18292Secure app running in non secure space can restart TZ by calling Widevine app API repeatedly in Snapdragon Automobile, Snapdragon Mobile andQualcomm Snapdragon Automobile, Snapdragon Mobile, Snapdrag…
- CVE-2017-18293When a particular GPIO is protected by blocking access to the corresponding GPIO resource registers, the protection can be bypassed using thQualcomm Snapdragon Mobile, Snapdragon Wear
- CVE-2017-18294While reading file class type from ELF header, a buffer overread may happen if the ELF file size is less than the size of ELF64 header size Qualcomm Small Cell SoC, Snapdragon Automobile, Snapdragon…
- CVE-2017-18295Possible buffer overflow if input is not null terminated in DSP Service module in Snapdragon Automobile, Snapdragon Mobile, Snapdragon Wear Qualcomm Snapdragon Automobile, Snapdragon Mobile, Snapdrag…
- CVE-2017-18296Access control on applications is not applied while accessing SafeSwitch services can lead to improper access in Snapdragon Automobile, SnapQualcomm Snapdragon Automobile, Snapdragon Mobile, Snapdrag…
- CVE-2017-18297Double memory free while closing TEE SE API Session management in Snapdragon Mobile in version SD 425, SD 430, SD 450, SD 625, SD 650/52, SDQualcomm Snapdragon Mobile
- CVE-2017-18298Lack of Input Validation in SDMX API can lead to NULL pointer access in Snapdragon Automobile, Snapdragon Mobile and Snapdragon Wear in versQualcomm Snapdragon Automobile, Snapdragon Mobile, Snapdrag…
- CVE-2017-18299Improper translation table consolidation logic leads to resource exhaustion and QSEE error in Snapdragon Automobile, Snapdragon Mobile and SQualcomm Snapdragon Automobile, Snapdragon Mobile, Snapdrag…
- CVE-2017-18300Secure display content could be accessed by third party trusted application after creating a fault in other trusted applications in SnapdragQualcomm Snapdragon Mobile, Snapdragon Wear
- CVE-2017-18303While processing the sensors registry configuration file, if inputs are not validated a buffer overflow will occur in Snapdragon Automobile,Qualcomm Snapdragon Automobile, Snapdragon Mobile, Snapdrag…
- CVE-2017-18304Insufficient memory allocation in boot due to incorrect size being passed could result in out of bounds access in Small Cell SoC, SnapdragonQualcomm Small Cell SoC, Snapdragon Automobile, Snapdragon…
- CVE-2017-18305XBL sec mem dump system call allows complete control of EL3 by unlocking all XPUs if enable fuse is not blown in Snapdragon Mobile, SnapdragQualcomm Snapdragon Mobile, Snapdragon Wear
- CVE-2017-18312While accessing SafeSwitch services, third party can manipulate a given device and perform unauthorized operation due to lack of checking ofQualcomm Snapdragon Automobile, Snapdragon Mobile
- CVE-2017-18313Under certain mode of operations, HLOS may be able get direct or indirect access through DXE channels to tamper with the authenticated WCNSSQualcomm Snapdragon Mobile, Snapdragon Wear
- CVE-2018-18587BigProf AppGini 5.70 stores the passwords in the database using the MD5 hash.
- CVE-2018-18586chmextract.c in the chmextract sample program, as distributed with libmspack before 0.8alpha, does not protect against absolute/relative pat
- CVE-2018-18584In mspack/cab.h in libmspack before 0.8alpha and cabextract before 1.8, the CAB block input buffer is one byte too small for the maximal Qua
- CVE-2018-18585chmd_read_headers in mspack/chmd.c in libmspack before 0.8alpha accepts a filename that has '\0' as its first or second character (such as t