# CVEs published 2018-10-24

35 CVEs were published on October 24, 2018: 0 critical, 1 high. Days are UTC.

- [CVE-2018-13342](https://cve.now/CVE-2018-13342.md): The server API in the Anda app relies on hardcoded credentials. (no CVSS)
- [CVE-2018-15750](https://cve.now/CVE-2018-15750.md): Directory Traversal vulnerability in salt-api in SaltStack Salt before 2017.7.8 and 2018.3.x before 2018.3.3 allows remote attackers to dete (no CVSS, salt)
- [CVE-2018-15751](https://cve.now/CVE-2018-15751.md): SaltStack Salt before 2017.7.8 and 2018.3.x before 2018.3.3 allow remote attackers to bypass authentication and execute arbitrary commands v (no CVSS, salt)
- [CVE-2018-17903](https://cve.now/CVE-2018-17903.md): SAGA1-L8B with any firmware versions prior to A0.10 are vulnerable to a replay attack and command forgery. (no CVSS, GAIN Electronic Co. SAGA1-L8B)
- [CVE-2018-17921](https://cve.now/CVE-2018-17921.md): SAGA1-L8B with any firmware versions prior to A0.10 are vulnerable to an attack that may allow an attacker to force-pair the device without (no CVSS, GAIN Electronic Co. SAGA1-L8B)
- [CVE-2018-17923](https://cve.now/CVE-2018-17923.md): SAGA1-L8B with any firmware versions prior to A0.10 are vulnerable to an attack that an attacker with physical access to the product may abl (no CVSS, GAIN Electronic Co. SAGA1-L8B)
- [CVE-2018-18551](https://cve.now/CVE-2018-18551.md): ServersCheck Monitoring Software through 14.3.3 has Persistent and Reflected XSS via the sensors.html status parameter, sensors.html type pa (no CVSS)
- [CVE-2018-18552](https://cve.now/CVE-2018-18552.md): ServersCheck Monitoring Software through 14.3.3 allows local users to cause a denial of service (menu functionality loss) by creating an LNK (no CVSS)
- [CVE-2018-18566](https://cve.now/CVE-2018-18566.md): The SIP service in Polycom VVX 500 and 601 devices 5.8.0.12848 and earlier allow remote attackers to obtain sensitive phone configuration in (no CVSS)
- [CVE-2018-18567](https://cve.now/CVE-2018-18567.md): AudioCodes 440HD and 450HD devices 3.1.2.89 and earlier allows man-in-the-middle attackers to obtain sensitive credential information by lev (no CVSS)
- [CVE-2018-18568](https://cve.now/CVE-2018-18568.md): Polycom VVX 500 and 601 devices 5.8.0.12848 and earlier allows man-in-the-middle attackers to obtain sensitive credential information by lev (no CVSS)
- [CVE-2018-18621](https://cve.now/CVE-2018-18621.md): CommuniGate Pro 6.2 allows stored XSS via a message body in Pronto! Mail Composer, which is mishandled in /MIME/INBOX-MM-1/ if the raw email (no CVSS)
- [CVE-2018-18638](https://cve.now/CVE-2018-18638.md): A command injection vulnerability in the setup API in the Neato Botvac Connected 2.2.0 allows network attackers to execute arbitrary command (no CVSS)
- [CVE-2018-8955](https://cve.now/CVE-2018-8955.md): The installer for BitDefender GravityZone relies on an encoded string in a filename to determine the URL for installation metadata, which al (no CVSS)
- [CVE-2016-10729](https://cve.now/CVE-2016-10729.md): An issue was discovered in Amanda 3.3.1. (no CVSS)
- [CVE-2016-10730](https://cve.now/CVE-2016-10730.md): An issue was discovered in Amanda 3.3.1. (no CVSS)
- [CVE-2018-12650](https://cve.now/CVE-2018-12650.md): Adrenalin HRMS version 5.4.0 contains a Reflected Cross Site Scripting (XSS) vulnerability in the ApplicationtEmployeeSearch page via 'prntD (no CVSS)
- [CVE-2018-14812](https://cve.now/CVE-2018-14812.md): An uncontrolled search path element (DLL Hijacking) vulnerability has been identified in Fuji Electric Energy Savings Estimator versions V.1 (no CVSS, Fuji Electric Energy Savings Estimator)
- [CVE-2018-18013](https://cve.now/CVE-2018-18013.md): \* Xen Mobile through 10.8.0 includes a service listening on port 5001 within its firewall that accepts unauthenticated input. (no CVSS)
- [CVE-2018-18014](https://cve.now/CVE-2018-18014.md): \* Lack of authentication in Citrix Xen Mobile through 10.8 allows low-privileged local users to execute system commands as root by making re (CVSS 4.8)
- [CVE-2018-18476](https://cve.now/CVE-2018-18476.md): mysql-binuuid-rails 1.1.0 and earlier allows SQL Injection because it removes default string escaping for affected database columns. (no CVSS, mysql-binuuid-rails)
- [CVE-2018-18517](https://cve.now/CVE-2018-18517.md): Citrix NetScaler Gateway 10.5.x before 10.5.69.003, 11.1.x before 11.1.59.004, 12.0.x before 12.0.58.7, and 12.1.x before 12.1.49.1 has XSS. (no CVSS)
- [CVE-2018-18547](https://cve.now/CVE-2018-18547.md): Vesta Control Panel through 0.9.8-22 has XSS via the edit/web/ domain parameter, the list/backup/ backup parameter, the list/rrd/ period par (no CVSS)
- [CVE-2018-18548](https://cve.now/CVE-2018-18548.md): ajenticp (aka Ajenti Docker control panel) for Ajenti through v1.2.23.13 has XSS via a filename that is mishandled in File Manager. (no CVSS, ajenti)
- [CVE-2018-18635](https://cve.now/CVE-2018-18635.md): www/guis/admin/application/controllers/UserController.php in the administration login interface in MailCleaner CE 2018.08 and 2018.09 allows (no CVSS)
- [CVE-2018-18636](https://cve.now/CVE-2018-18636.md): XSS exists in cgi-bin/webcm on D-link DSL-2640T routers via the var:RelaodHref or var:conid parameter. (no CVSS)
- [CVE-2018-9279](https://cve.now/CVE-2018-9279.md): An issue was discovered on Eaton UPS 9PX 8000 SP devices. (no CVSS)
- [CVE-2018-9280](https://cve.now/CVE-2018-9280.md): An issue was discovered on Eaton UPS 9PX 8000 SP devices. (no CVSS)
- [CVE-2018-9281](https://cve.now/CVE-2018-9281.md): An issue was discovered on Eaton UPS 9PX 8000 SP devices. (no CVSS)
- [CVE-2018-11785](https://cve.now/CVE-2018-11785.md): Missing authorization check in Apache Impala before 3.0.1 allows a Kerberos-authenticated but unauthorized user to inject random data into a (no CVSS, Apache Software Foundation Apache Impala)
- [CVE-2018-11792](https://cve.now/CVE-2018-11792.md): In Apache Impala before 3.0.1, ALTER TABLE/VIEW RENAME required ALTER on the old table. (no CVSS, Apache Software Foundation Apache Impala)
- [CVE-2018-15442](https://cve.now/CVE-2018-15442.md): Cisco Webex Meetings Desktop App Update Service Command Injection Vulnerability (CVSS 7.8, Cisco WebEx Event Center)
- [CVE-2018-1541](https://cve.now/CVE-2018-1541.md): IBM WebSphere Commerce Enterprise V7, V8, and V9 is vulnerable to cross-site scripting. (CVSS 5.4, IBM WebSphere Commerce Enterprise)
- [CVE-2018-17935](https://cve.now/CVE-2018-17935.md): All versions of Telecrane F25 Series Radio Controls before 00.0A use fixed codes that are reproducible by sniffing and re-transmission. (no CVSS, Telecrane F25 Series)
- [CVE-2018-11804](https://cve.now/CVE-2018-11804.md): Spark's Apache Maven-based build includes a convenience script, 'build/mvn', that downloads and runs a zinc server to speed up compilation. (no CVSS, Apache Software Foundation Apache Spark · org.apache.spa… +1)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2018-10-24
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.