# CVEs published 2018-10-30

40 CVEs were published on October 30, 2018: 1 critical, 0 high. 1 is now in CISA KEV. Days are UTC.

- [CVE-2018-16461](https://cve.now/CVE-2018-16461.md): A command injection vulnerability in libnmapp package for versions \<0.4.16 allows arbitrary commands to be executed via arguments to the ran (no CVSS, libnmap)
- [CVE-2018-16462](https://cve.now/CVE-2018-16462.md): A command injection vulnerability in the apex-publish-static-files npm module version \<2.0.1 which allows arbitrary shell command execution (no CVSS, apex-publish-static-files)
- [CVE-2018-16463](https://cve.now/CVE-2018-16463.md): A bug causing session fixation in Nextcloud Server prior to 14.0.0, 13.0.3 and 12.0.8 could potentially allow an attacker to obtain access t (no CVSS, Nextcloud Server)
- [CVE-2018-16464](https://cve.now/CVE-2018-16464.md): A missing access check in Nextcloud Server prior to 14.0.0 could lead to continued access to password protected link shares when the owner h (no CVSS, Nextcloud Server)
- [CVE-2018-16465](https://cve.now/CVE-2018-16465.md): Missing state in Nextcloud Server prior to 14.0.0 would not enforce the use of a second factor at login if the the provider of the second fa (no CVSS, Nextcloud Server)
- [CVE-2018-16466](https://cve.now/CVE-2018-16466.md): Improper revalidation of permissions in Nextcloud Server prior to 14.0.0, 13.0.6 and 12.0.11 lead to not accepting access restrictions by ac (no CVSS, Nextcloud Server)
- [CVE-2018-16467](https://cve.now/CVE-2018-16467.md): A missing check in Nextcloud Server prior to 14.0.0 could give unauthorized access to the previews of single file password protected shares. (no CVSS, Nextcloud Server)
- [CVE-2018-16468](https://cve.now/CVE-2018-16468.md): In the Loofah gem for Ruby, through v2.2.2, unsanitized JavaScript may occur in sanitized output when a crafted SVG element is republished. (no CVSS, Loofah)
- [CVE-2018-16469](https://cve.now/CVE-2018-16469.md): The merge.recursive function in the merge package \<1.2.1 can be tricked into adding or modifying properties of the Object prototype. (no CVSS, HackerOne merge · merge)
- [CVE-2018-17931](https://cve.now/CVE-2018-17931.md): If an attacker has physical access to the VGo Robot (Versions 3.0.3.52164 and 3.0.3.53662. (no CVSS, VGo Robot)
- [CVE-2018-17933](https://cve.now/CVE-2018-17933.md): VGo Robot (Versions 3.0.3.52164 and 3.0.3.53662. (no CVSS, VGo Robot)
- [CVE-2018-8858](https://cve.now/CVE-2018-8858.md): If an attacker has access to the firmware from the VGo Robot (Versions 3.0.3.52164 and 3.0.3.53662. (no CVSS, VGo Robot)
- [CVE-2017-8931](https://cve.now/CVE-2017-8931.md): Bitdefender GravityZone VMware appliance before 6.2.1-35 might allow attackers to gain access with root privileges via unspecified vectors. (no CVSS)
- [CVE-2015-5159](https://cve.now/CVE-2015-5159.md): python-kdcproxy before 0.3.2 allows remote attackers to cause a denial of service via a large POST request. (no CVSS, kdcproxy)
- [CVE-2018-10532](https://cve.now/CVE-2018-10532.md): An issue was discovered on EE 4GEE HH70VB-2BE8GB3 HH70\_E1\_02.00\_19 devices. (no CVSS)
- [CVE-2018-10709](https://cve.now/CVE-2018-10709.md): The AsrDrv101.sys and AsrDrv102.sys low-level drivers in ASRock RGBLED before v1.0.35.1, A-Tuning before v3.0.210, F-Stream before v3.0.210, (no CVSS)
- [CVE-2018-10710](https://cve.now/CVE-2018-10710.md): The AsrDrv101.sys and AsrDrv102.sys low-level drivers in ASRock RGBLED before v1.0.35.1, A-Tuning before v3.0.210, F-Stream before v3.0.210, (no CVSS)
- [CVE-2018-10711](https://cve.now/CVE-2018-10711.md): The AsrDrv101.sys and AsrDrv102.sys low-level drivers in ASRock RGBLED before v1.0.35.1, A-Tuning before v3.0.210, F-Stream before v3.0.210, (no CVSS)
- [CVE-2018-10712](https://cve.now/CVE-2018-10712.md): The AsrDrv101.sys and AsrDrv102.sys low-level drivers in ASRock RGBLED before v1.0.35.1, A-Tuning before v3.0.210, F-Stream before v3.0.210, (no CVSS)
- [CVE-2018-14558](https://cve.now/CVE-2018-14558.md): An issue was discovered on Tenda AC7 devices with firmware through V15.03.06.44\_CN(AC7), AC9 devices with firmware through V15.03.05.19(6318 (CVSS 9.8, KEV)
- [CVE-2018-17782](https://cve.now/CVE-2018-17782.md): A cross-site scripting (XSS) vulnerability in the Manage Filters page (manage\_filter\_page.php) in MantisBT 2.1.0 through 2.17.1 allows remot (no CVSS, mantisbt/mantisbt)
- [CVE-2018-17783](https://cve.now/CVE-2018-17783.md): A cross-site scripting (XSS) vulnerability in the Edit Filter page (manage\_filter\_edit page.php) in MantisBT 2.1.0 through 2.17.1 allows rem (no CVSS, mantisbt/mantisbt)
- [CVE-2018-18281](https://cve.now/CVE-2018-18281.md): Since Linux kernel version 3.2, the mremap() syscall performs TLB flushes after dropping pagetable locks. (no CVSS)
- [CVE-2015-7266](https://cve.now/CVE-2015-7266.md): The Interactive Advertising Bureau (IAB) OpenRTB 2.3 protocol implementation might allow remote attackers to conceal the status of ad transa (no CVSS)
- [CVE-2018-0734](https://cve.now/CVE-2018-0734.md): Timing attack against DSA (no CVSS, OpenSSL)
- [CVE-2018-18822](https://cve.now/CVE-2018-18822.md): Grapixel New Media v2.0 allows SQL Injection via the pages.aspx pageref parameter. (no CVSS)
- [CVE-2018-18825](https://cve.now/CVE-2018-18825.md): Pagoda Linux panel V6.0 has XSS via the verification code associated with an invalid account login. (no CVSS)
- [CVE-2018-18826](https://cve.now/CVE-2018-18826.md): There exists a heap-based buffer overflow in vc1\_decode\_p\_mb\_intfi in vc1\_block.c in Libav 12.3, which allows attackers to cause a denial-of (no CVSS)
- [CVE-2018-18827](https://cve.now/CVE-2018-18827.md): There exists a heap-based buffer over-read in ff\_vc1\_pred\_dc in vc1\_block.c in Libav 12.3, which allows attackers to cause a denial-of-servi (no CVSS)
- [CVE-2018-18828](https://cve.now/CVE-2018-18828.md): There exists a heap-based buffer overflow in vc1\_decode\_i\_block\_adv in vc1\_block.c in Libav 12.3, which allows attackers to cause a denial-o (no CVSS)
- [CVE-2018-18829](https://cve.now/CVE-2018-18829.md): There exists a NULL pointer dereference in ff\_vc1\_parse\_frame\_header\_adv in vc1.c in Libav 12.3, which allows attackers to cause a denial-of (no CVSS)
- [CVE-2018-18830](https://cve.now/CVE-2018-18830.md): An issue was discovered in com\\mingsoft\\basic\\action\\web\\FileAction.java in MCMS 4.6.5. (no CVSS, net.mingsoft:ms-mcms)
- [CVE-2018-18831](https://cve.now/CVE-2018-18831.md): An issue was discovered in com\\mingsoft\\cms\\action\\GeneraterAction.java in MCMS 4.6.5. (no CVSS, net.mingsoft:ms-mcms)
- [CVE-2018-18832](https://cve.now/CVE-2018-18832.md): admin/check.asp in DKCMS 9.4 allows SQL Injection via an ASPSESSIONID cookie to admin/admin.asp. (no CVSS)
- [CVE-2018-18834](https://cve.now/CVE-2018-18834.md): An issue has been found in libIEC61850 v1.3. (no CVSS)
- [CVE-2018-18835](https://cve.now/CVE-2018-18835.md): upload\_template() in system/changeskin.php in DocCms 2016.5.12 allows remote attackers to execute arbitrary PHP code via a template file. (no CVSS)
- [CVE-2018-18840](https://cve.now/CVE-2018-18840.md): XSS was discovered in SEMCMS PHP V3.4 via the SEMCMS\_SeoAndTag.php?Class=edit&CF=SeoAndTag tag\_indexmetatit parameter. (no CVSS)
- [CVE-2018-18841](https://cve.now/CVE-2018-18841.md): XSS was discovered in SEMCMS PHP V3.4 via the SEMCMS\_SeoAndTag.php?Class=edit&CF=SeoAndTag tag\_indexkey parameter. (no CVSS)
- [CVE-2018-18842](https://cve.now/CVE-2018-18842.md): CSRF exists in zb\_users/plugin/AppCentre/theme.js.php in Z-BlogPHP 1.5.2.1935 (Zero), which allows remote attackers to execute arbitrary PHP (no CVSS)
- [CVE-2018-18817](https://cve.now/CVE-2018-18817.md): The Leostream Agent before Build 7.0.1.0 when used with Leostream Connection Broker 8.2.72 or earlier allows remote attackers to modify regi (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2018-10-30
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.