# CVEs published 2018-10-28

40 CVEs were published on October 28, 2018: 0 critical, 0 high. Days are UTC.

- [CVE-2018-18764](https://cve.now/CVE-2018-18764.md): An exploitable arbitrary memory read vulnerability exists in the MQTT packet-parsing functionality of Cesanta Mongoose 6.13. (no CVSS)
- [CVE-2018-18765](https://cve.now/CVE-2018-18765.md): An exploitable arbitrary memory read vulnerability exists in the MQTT packet-parsing functionality of Cesanta Mongoose 6.13. (no CVSS)
- [CVE-2018-18751](https://cve.now/CVE-2018-18751.md): An issue was discovered in GNU gettext 0.19.8. (no CVSS)
- [CVE-2018-18752](https://cve.now/CVE-2018-18752.md): Webiness Inventory 2.3 suffers from an Arbitrary File upload vulnerability via PHP code in the protected/library/ajax/WsSaveToModel.php logo (no CVSS)
- [CVE-2018-18753](https://cve.now/CVE-2018-18753.md): Typecho V1.1 allows remote attackers to send shell commands via base64-encoded serialized data, as demonstrated by SSRF. (no CVSS)
- [CVE-2018-18754](https://cve.now/CVE-2018-18754.md): ZyXEL VMG3312-B10B 1.00(AAPP.7) devices have a backdoor root account with the tTn3+Z@!Sr0O+ password hash in the etc/default.cfg file. (no CVSS)
- [CVE-2016-10731](https://cve.now/CVE-2016-10731.md): ProjectSend (formerly cFTP) r582 allows SQL injection via manage-files.php with the request parameter status, manage-files.php with the requ (no CVSS)
- [CVE-2016-10732](https://cve.now/CVE-2016-10732.md): ProjectSend (formerly cFTP) r582 allows authentication bypass via a direct request for users.php, home.php, edit-file.php?file\_id=1, or proc (no CVSS)
- [CVE-2016-10733](https://cve.now/CVE-2016-10733.md): ProjectSend (formerly cFTP) r582 allows directory traversal via file=../ in the process-zip-download.php query string. (no CVSS)
- [CVE-2016-10734](https://cve.now/CVE-2016-10734.md): ProjectSend (formerly cFTP) r582 allows Insecure Direct Object Reference via includes/actions.log.export.php. (no CVSS)
- [CVE-2018-18733](https://cve.now/CVE-2018-18733.md): An XSS issue was discovered in Catfish CMS 4.8.30, related to "write source code," a similar issue to CVE-2018-13999. (no CVSS)
- [CVE-2018-18734](https://cve.now/CVE-2018-18734.md): A CSRF issue was discovered in admin/Index/addmanageuser.html in Catfish CMS 4.8.30. (no CVSS)
- [CVE-2018-18735](https://cve.now/CVE-2018-18735.md): A CSRF issue was discovered in admin/Index/tiquan in catfish blog 2.0.33. (no CVSS)
- [CVE-2018-18736](https://cve.now/CVE-2018-18736.md): An XSS issue was discovered in catfish blog 2.0.33, related to "write source code." (no CVSS)
- [CVE-2018-18737](https://cve.now/CVE-2018-18737.md): An XXE issue was discovered in Douchat 4.0.4 because Data\\notify.php calls simplexml\_load\_string. (no CVSS)
- [CVE-2018-18738](https://cve.now/CVE-2018-18738.md): An XSS issue was discovered in SEMCMS 3.4 via the admin/SEMCMS\_Categories.php?pid=1&lgid=1 category\_key parameter. (no CVSS)
- [CVE-2018-18739](https://cve.now/CVE-2018-18739.md): An XSS issue was discovered in SEMCMS 3.4 via the admin/SEMCMS\_Products.php?lgid=1 Keywords field. (no CVSS)
- [CVE-2018-18740](https://cve.now/CVE-2018-18740.md): An XSS issue was discovered in SEMCMS 3.4 via the first input field to the admin/SEMCMS\_Link.php?lgid=1 URI. (no CVSS)
- [CVE-2018-18741](https://cve.now/CVE-2018-18741.md): An XSS issue was discovered in SEMCMS 3.4 via admin/SEMCMS\_Download.php?lgid=1 during editing. (no CVSS)
- [CVE-2018-18742](https://cve.now/CVE-2018-18742.md): A CSRF issue was discovered in SEMCMS 3.4 via the admin/SEMCMS\_User.php?Class=add&CF=user URI. (no CVSS)
- [CVE-2018-18743](https://cve.now/CVE-2018-18743.md): An XSS issue was discovered in SEMCMS 3.4 via the second text field to the admin/SEMCMS\_Categories.php?pid=1&lgid=1 URI. (no CVSS)
- [CVE-2018-18744](https://cve.now/CVE-2018-18744.md): An XSS issue was discovered in SEMCMS 3.4 via the fifth text box to the admin/SEMCMS\_Main.php URI. (no CVSS)
- [CVE-2018-18745](https://cve.now/CVE-2018-18745.md): An XSS issue was discovered in SEMCMS 3.4 via admin/SEMCMS\_Menu.php?lgid=1 during editing. (no CVSS)
- [CVE-2018-18748](https://cve.now/CVE-2018-18748.md): Sandboxie 5.26 allows a Sandbox Escape via an "import os" statement, followed by os.system("cmd") or os.system("powershell"), within a .py f (no CVSS)
- [CVE-2018-18749](https://cve.now/CVE-2018-18749.md): data-tools through 2017-07-26 has an Integer Overflow leading to an incorrect end value for the write\_wchars function. (no CVSS)
- [CVE-2018-18717](https://cve.now/CVE-2018-18717.md): An issue was discovered in Eleanor CMS through 2015-03-19. (no CVSS)
- [CVE-2018-18718](https://cve.now/CVE-2018-18718.md): An issue was discovered in gThumb through 3.6.2. (no CVSS)
- [CVE-2018-18720](https://cve.now/CVE-2018-18720.md): An XSS issue was discovered in index.php/admin/system/basic in YUNUCMS 1.1.5. (no CVSS)
- [CVE-2018-18721](https://cve.now/CVE-2018-18721.md): An XSS issue was discovered in admin/link/editlink?id=5 in YUNUCMS 1.1.5. (no CVSS)
- [CVE-2018-18722](https://cve.now/CVE-2018-18722.md): An XSS issue was discovered in admin/content/editcontent?id=29&gopage=1 in YUNUCMS 1.1.5. (no CVSS)
- [CVE-2018-18723](https://cve.now/CVE-2018-18723.md): An XSS issue was discovered in index.php/admin/area/editarea/id/110000 in YUNUCMS 1.1.5. (no CVSS)
- [CVE-2018-18724](https://cve.now/CVE-2018-18724.md): An XSS issue was discovered in index.php/admin/category/editcategory?id=73 in YUNUCMS 1.1.5. (no CVSS)
- [CVE-2018-18725](https://cve.now/CVE-2018-18725.md): An XSS issue was discovered in admin/banner/editbanner?id=20 in YUNUCMS 1.1.5. (no CVSS)
- [CVE-2018-18726](https://cve.now/CVE-2018-18726.md): An XSS issue was discovered in admin/sitelink/editsitelink?id=16 in YUNUCMS 1.1.5. (no CVSS)
- [CVE-2018-18727](https://cve.now/CVE-2018-18727.md): An issue was discovered on Tenda AC7 V15.03.06.44\_CN, AC9 V15.03.05.19(6318)\_CN, AC10 V15.03.06.23\_CN, AC15 V15.03.05.19\_CN, and AC18 V15.03 (no CVSS)
- [CVE-2018-18728](https://cve.now/CVE-2018-18728.md): An issue was discovered on Tenda AC9 V15.03.05.19(6318)\_CN, AC15 V15.03.05.19\_CN, and AC18 V15.03.05.19(6318)\_CN devices. (no CVSS)
- [CVE-2018-18729](https://cve.now/CVE-2018-18729.md): An issue was discovered on Tenda AC7 V15.03.06.44\_CN, AC9 V15.03.05.19(6318)\_CN, AC10 V15.03.06.23\_CN, AC15 V15.03.05.19\_CN, and AC18 V15.03 (no CVSS)
- [CVE-2018-18730](https://cve.now/CVE-2018-18730.md): An issue was discovered on Tenda AC7 V15.03.06.44\_CN, AC9 V15.03.05.19(6318)\_CN, AC10 V15.03.06.23\_CN, AC15 V15.03.05.19\_CN, and AC18 V15.03 (no CVSS)
- [CVE-2018-18731](https://cve.now/CVE-2018-18731.md): An issue was discovered on Tenda AC7 V15.03.06.44\_CN, AC9 V15.03.05.19(6318)\_CN, AC10 V15.03.06.23\_CN, AC15 V15.03.05.19\_CN, and AC18 V15.03 (no CVSS)
- [CVE-2018-18732](https://cve.now/CVE-2018-18732.md): An issue was discovered on Tenda AC7 V15.03.06.44\_CN, AC9 V15.03.05.19(6318)\_CN, AC10 V15.03.06.23\_CN, AC15 V15.03.05.19\_CN, and AC18 V15.03 (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2018-10-28
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.