CVEs published October 31, 2018
40 CVEs were published on October 31, 2018: 0 critical, 3 high.
- Published
- 40
- Critical
- 0
- High
- 3
- Medium
- 14
- Low
- 0
- Unrated
- 23
- Now in CISA KEV
- 0
- Fix available
- 4
Most affected products
- F5 Networks BIG-IP
- 8
- The Gluster Project glusterfs
- 4
- Advantech WebAccess
- 3
- F5 Networks BIG-IP (LTM, AAM, AFM, Analytics, APM, ASM, DNS…
- 3
- io.spray:spray-json_2.12 · io.spray:spray-json_2.11 +1
- 2
- The Curl Project curl:
- 2
- [UNKNOWN] cfme
- 1
- [UNKNOWN] Dashbuilder
- 1
- [UNKNOWN] glusterfs
- 1
- [UNKNOWN] libexif
- 1
High 3
- CVE-2018-14651It was found that the fix for CVE-2018-10927, CVE-2018-10928, CVE-2018-10929, CVE-2018-10930, and CVE-2018-10926 was incomplete.[UNKNOWN] glusterfs
- CVE-2016-5402A code injection flaw was found in the way capacity and utilization imported control files are processed.[UNKNOWN] cfme
- CVE-2018-1851IBM WebSphere Application Server Liberty OpenID Connect could allow a remote attacker to execute arbitrary code on the system, caused by impIBM WebSphere Application Server
Medium, low and unrated 37
- CVE-2018-15705WADashboard API in Advantech WebAccess 8.3.1 and 8.3.2 allows remote authenticated attackers to write or overwrite any file on the filesysteAdvantech WebAccess
- CVE-2018-15706WADashboard API in Advantech WebAccess 8.3.1 and 8.3.2 allows remote authenticated attackers to read any file on the filesystem due to a dirAdvantech WebAccess
- CVE-2018-15707Advantech WebAccess 8.3.1 and 8.3.2 are vulnerable to cross-site scripting in the Bwmainleft.asp page.Advantech WebAccess
- CVE-2016-6328A vulnerability was found in libexif.[UNKNOWN] libexif
- CVE-2016-2125It was found that Samba before versions 4.5.3, 4.4.8, 4.3.13 always requested forwardable tickets when using Kerberos authentication.[UNKNOWN] samba
- CVE-2018-11759The Apache Web Server (httpd) specific code that normalised the requested path before matching it to the URI-worker map in Apache Tomcat JK Apache Software Foundation Apache Tomcat Connectors
- CVE-2018-14661It was found that usage of snprintf function in feature/locks translator of glusterfs server 3.8.4, as shipped with Red Hat Gluster Storage,The Gluster Project glusterfs-server
- CVE-2018-14652The Gluster file system through versions 3.12 and 4.1.4 is vulnerable to a buffer overflow in the 'features/index' translator via the code hThe Gluster Project glusterfs
- CVE-2018-14653The Gluster file system through versions 4.1.4 and 3.12 is vulnerable to a heap-based buffer overflow in the '__server_getspec' function viaThe Gluster Project glusterfs
- CVE-2018-14654The Gluster file system through version 4.1.4 is vulnerable to abuse of the 'features/index' translator.The Gluster Project glusterfs
- CVE-2018-14659The Gluster file system through versions 4.1.4 and 3.1.2 is vulnerable to a denial of service attack via use of the 'GF_XATTR_IOSTATS_DUMP_KThe Gluster Project glusterfs
- CVE-2018-16842Curl versions 7.14.1 through 7.61.1 are vulnerable to a heap-based buffer over-read in the tool_msgs.c:voutf() function that may result in iThe Curl Project curl:
- CVE-2018-16839Curl versions 7.33.0 through 7.61.1 are vulnerable to a buffer overrun in the SASL authentication code that may lead to denial of service.The Curl Project curl:
- CVE-2018-16840A heap use-after-free flaw was found in curl versions from 7.59.0 through 7.61.1 in the code related to closing an easy handle.The Curl Project curl
- CVE-2018-13281Information exposure vulnerability in SYNO.Core.ACL in Synology DiskStation Manager (DSM) before 6.2-23739-2 allows remote authenticated useSynology DiskStation Manager
- CVE-2018-13282Session fixation vulnerability in SYNO.PhotoStation.Auth in Synology Photo Station before 6.8.7-3481 allows remote attackers to hijack web sSynology Photo Station
- CVE-2018-18873An issue was discovered in JasPer 2.0.14.
- CVE-2018-18874nc-cms through 2017-03-10 allows remote attackers to execute arbitrary PHP code via the "Upload File or Image" feature, with a .php filename
- CVE-2018-15317In BIG-IP 14.0.0-14.0.0.2, 13.0.0-13.1.1.5, 12.1.0-12.1.4.1, and 11.2.1-11.6.3.2, an attacker sending specially crafted SSL records to a SSLF5 Networks BIG-IP
- CVE-2018-15318In BIG-IP 14.0.0-14.0.0.2, 13.1.0.4-13.1.1.1, or 12.1.3.4-12.1.3.6, If an MPTCP connection receives an abort signal while the initial flow iF5 Networks BIG-IP
- CVE-2018-15319On BIG-IP 14.0.0-14.0.0.2, 13.0.0-13.1.1.1, or 12.1.0-12.1.3.6, malicious requests made to virtual servers with an HTTP profile can cause thF5 Networks BIG-IP
- CVE-2018-15320On BIG-IP 14.0.0-14.0.0.2 or 13.0.0-13.1.1.1, undisclosed traffic patterns may lead to denial of service conditions for the BIG-IP system.F5 Networks BIG-IP
- CVE-2018-15321When BIG-IP 14.0.0-14.0.0.2, 13.0.0-13.1.0.5, 12.1.0-12.1.3.5, 11.6.0-11.6.3.2, or 11.2.1-11.5.6, BIG-IQ Centralized Management 5.0.0-5.4.0 F5 Networks BIG-IP (LTM, AAM, AFM, Analytics, APM, ASM, DNS…
- CVE-2018-15322On BIG-IP 14.0.0-14.0.0.2, 13.0.0-13.1.0.7, 12.1.0-12.1.3.5, 11.6.0-11.6.3.2, or 11.2.1-11.5.6, BIG-IQ Centralized Management 6.0.0-6.0.1, 5F5 Networks BIG-IP (LTM, AAM, AFM, Analytics, APM, ASM, DNS…
- CVE-2018-15323On BIG-IP 14.0.0-14.0.0.2 or 13.0.0-13.1.1.1, in certain circumstances, when processing traffic through a Virtual Server with an associated F5 Networks BIG-IP
- CVE-2018-15324On BIG-IP APM 14.0.0-14.0.0.2 or 13.0.0-13.1.1.1, TMM may restart when processing a specially crafted request with APM portal access.F5 Networks BIG-IP
- CVE-2018-15325In BIG-IP 14.0.0-14.0.0.2 or 13.0.0-13.1.1.1, iControl and TMSH usage by authenticated users may leak a small amount of memory when executinF5 Networks BIG-IP
- CVE-2018-15326In some situations on BIG-IP APM 14.0.0-14.0.0.2, 13.0.0-13.1.0.7, 12.1.0-12.1.3.5, or 11.6.0-11.6.3.2, the CRLDP Auth access policy agent mF5 Networks BIG-IP
- CVE-2018-15327In BIG-IP 14.0.0-14.0.0.2 or 13.0.0-13.1.1.1 or Enterprise Manager 3.1.1, when authenticated administrative users run commands in the TraffiF5 Networks BIG-IP (LTM, AAM, AFM, Analytics, APM, ASM, DNS…
- CVE-2016-2121A permissions flaw was found in redis, which sets weak permissions on certain files and directories that could potentially contain sensitive[UNKNOWN] redis
- CVE-2016-6343JBoss BPM Suite 6 is vulnerable to a reflected XSS via dashbuilder.[UNKNOWN] Dashbuilder
- CVE-2018-18868No-CMS 1.1.3 is prone to Persistent XSS via a contact_us name parameter, as demonstrated by the VG48Z5PqVWname parameter.
- CVE-2018-18869EmpireCMS V7.5 allows remote attackers to upload and execute arbitrary code via ..%2F directory traversal in a .php filename in the upload/e
- CVE-2018-18853Lightbend Spray spray-json through 1.3.4 allows remote attackers to cause a denial of service (resource consumption) because of Algorithmic io.spray:spray-json_2.12 · io.spray:spray-json_2.11 +1
- CVE-2018-18854Lightbend Spray spray-json through 1.3.4 allows remote attackers to cause a denial of service (resource consumption) because of Algorithmic io.spray:spray-json_2.12 · io.spray:spray-json_2.11 +1
- CVE-2018-18867An SSRF issue was discovered in tecrail Responsive FileManager 9.13.4 via the upload.php url parameter.
- CVE-2018-18850In Octopus Deploy 2018.8.0 through 2018.9.x before 2018.9.1, an authenticated user with permission to modify deployment processes could uplo