CVEs published October 30, 2018
40 CVEs were published on October 30, 2018: 1 critical, 0 high. 1 is now in CISA KEV.
- Published
- 40
- Critical
- 1
- High
- 0
- Medium
- 0
- Low
- 0
- Unrated
- 39
- Now in CISA KEV
- 1
- Fix available
- 12
Most affected products
- Nextcloud Server
- 5
- VGo Robot
- 3
- mantisbt/mantisbt
- 2
- net.mingsoft:ms-mcms
- 2
- apex-publish-static-files
- 1
- HackerOne merge · merge
- 1
- kdcproxy
- 1
- libnmap
- 1
- Loofah
- 1
- OpenSSL
- 1
Critical 1
Medium, low and unrated 39
- CVE-2018-16461A command injection vulnerability in libnmapp package for versions <0.4.16 allows arbitrary commands to be executed via arguments to the ranlibnmap
- CVE-2018-16462A command injection vulnerability in the apex-publish-static-files npm module version <2.0.1 which allows arbitrary shell command execution apex-publish-static-files
- CVE-2018-16463A bug causing session fixation in Nextcloud Server prior to 14.0.0, 13.0.3 and 12.0.8 could potentially allow an attacker to obtain access tNextcloud Server
- CVE-2018-16464A missing access check in Nextcloud Server prior to 14.0.0 could lead to continued access to password protected link shares when the owner hNextcloud Server
- CVE-2018-16465Missing state in Nextcloud Server prior to 14.0.0 would not enforce the use of a second factor at login if the the provider of the second faNextcloud Server
- CVE-2018-16466Improper revalidation of permissions in Nextcloud Server prior to 14.0.0, 13.0.6 and 12.0.11 lead to not accepting access restrictions by acNextcloud Server
- CVE-2018-16467A missing check in Nextcloud Server prior to 14.0.0 could give unauthorized access to the previews of single file password protected shares.Nextcloud Server
- CVE-2018-16468In the Loofah gem for Ruby, through v2.2.2, unsanitized JavaScript may occur in sanitized output when a crafted SVG element is republished.Loofah
- CVE-2018-16469The merge.recursive function in the merge package <1.2.1 can be tricked into adding or modifying properties of the Object prototype.HackerOne merge · merge
- CVE-2018-17931If an attacker has physical access to the VGo Robot (Versions 3.0.3.52164 and 3.0.3.53662.VGo Robot
- CVE-2018-17933VGo Robot (Versions 3.0.3.52164 and 3.0.3.53662.VGo Robot
- CVE-2018-8858If an attacker has access to the firmware from the VGo Robot (Versions 3.0.3.52164 and 3.0.3.53662.VGo Robot
- CVE-2017-8931Bitdefender GravityZone VMware appliance before 6.2.1-35 might allow attackers to gain access with root privileges via unspecified vectors.
- CVE-2015-5159python-kdcproxy before 0.3.2 allows remote attackers to cause a denial of service via a large POST request.kdcproxy
- CVE-2018-10532An issue was discovered on EE 4GEE HH70VB-2BE8GB3 HH70_E1_02.00_19 devices.
- CVE-2018-10709The AsrDrv101.sys and AsrDrv102.sys low-level drivers in ASRock RGBLED before v1.0.35.1, A-Tuning before v3.0.210, F-Stream before v3.0.210,
- CVE-2018-10710The AsrDrv101.sys and AsrDrv102.sys low-level drivers in ASRock RGBLED before v1.0.35.1, A-Tuning before v3.0.210, F-Stream before v3.0.210,
- CVE-2018-10711The AsrDrv101.sys and AsrDrv102.sys low-level drivers in ASRock RGBLED before v1.0.35.1, A-Tuning before v3.0.210, F-Stream before v3.0.210,
- CVE-2018-10712The AsrDrv101.sys and AsrDrv102.sys low-level drivers in ASRock RGBLED before v1.0.35.1, A-Tuning before v3.0.210, F-Stream before v3.0.210,
- CVE-2018-17782A cross-site scripting (XSS) vulnerability in the Manage Filters page (manage_filter_page.php) in MantisBT 2.1.0 through 2.17.1 allows remotmantisbt/mantisbt
- CVE-2018-17783A cross-site scripting (XSS) vulnerability in the Edit Filter page (manage_filter_edit page.php) in MantisBT 2.1.0 through 2.17.1 allows remmantisbt/mantisbt
- CVE-2018-18281Since Linux kernel version 3.2, the mremap() syscall performs TLB flushes after dropping pagetable locks.
- CVE-2015-7266The Interactive Advertising Bureau (IAB) OpenRTB 2.3 protocol implementation might allow remote attackers to conceal the status of ad transa
- CVE-2018-0734Timing attack against DSAOpenSSL
- CVE-2018-18822Grapixel New Media v2.0 allows SQL Injection via the pages.aspx pageref parameter.
- CVE-2018-18825Pagoda Linux panel V6.0 has XSS via the verification code associated with an invalid account login.
- CVE-2018-18826There exists a heap-based buffer overflow in vc1_decode_p_mb_intfi in vc1_block.c in Libav 12.3, which allows attackers to cause a denial-of
- CVE-2018-18827There exists a heap-based buffer over-read in ff_vc1_pred_dc in vc1_block.c in Libav 12.3, which allows attackers to cause a denial-of-servi
- CVE-2018-18828There exists a heap-based buffer overflow in vc1_decode_i_block_adv in vc1_block.c in Libav 12.3, which allows attackers to cause a denial-o
- CVE-2018-18829There exists a NULL pointer dereference in ff_vc1_parse_frame_header_adv in vc1.c in Libav 12.3, which allows attackers to cause a denial-of
- CVE-2018-18830An issue was discovered in com\mingsoft\basic\action\web\FileAction.java in MCMS 4.6.5.net.mingsoft:ms-mcms
- CVE-2018-18831An issue was discovered in com\mingsoft\cms\action\GeneraterAction.java in MCMS 4.6.5.net.mingsoft:ms-mcms
- CVE-2018-18832admin/check.asp in DKCMS 9.4 allows SQL Injection via an ASPSESSIONID cookie to admin/admin.asp.
- CVE-2018-18834An issue has been found in libIEC61850 v1.3.
- CVE-2018-18835upload_template() in system/changeskin.php in DocCms 2016.5.12 allows remote attackers to execute arbitrary PHP code via a template file.
- CVE-2018-18840XSS was discovered in SEMCMS PHP V3.4 via the SEMCMS_SeoAndTag.php?Class=edit&CF=SeoAndTag tag_indexmetatit parameter.
- CVE-2018-18841XSS was discovered in SEMCMS PHP V3.4 via the SEMCMS_SeoAndTag.php?Class=edit&CF=SeoAndTag tag_indexkey parameter.
- CVE-2018-18842CSRF exists in zb_users/plugin/AppCentre/theme.js.php in Z-BlogPHP 1.5.2.1935 (Zero), which allows remote attackers to execute arbitrary PHP
- CVE-2018-18817The Leostream Agent before Build 7.0.1.0 when used with Leostream Connection Broker 8.2.72 or earlier allows remote attackers to modify regi