# CVEs published 2018-10-31

40 CVEs were published on October 31, 2018: 0 critical, 3 high. Days are UTC.

- [CVE-2018-15705](https://cve.now/CVE-2018-15705.md): WADashboard API in Advantech WebAccess 8.3.1 and 8.3.2 allows remote authenticated attackers to write or overwrite any file on the filesyste (no CVSS, Advantech WebAccess)
- [CVE-2018-15706](https://cve.now/CVE-2018-15706.md): WADashboard API in Advantech WebAccess 8.3.1 and 8.3.2 allows remote authenticated attackers to read any file on the filesystem due to a dir (no CVSS, Advantech WebAccess)
- [CVE-2018-15707](https://cve.now/CVE-2018-15707.md): Advantech WebAccess 8.3.1 and 8.3.2 are vulnerable to cross-site scripting in the Bwmainleft.asp page. (no CVSS, Advantech WebAccess)
- [CVE-2016-6328](https://cve.now/CVE-2016-6328.md): A vulnerability was found in libexif. (CVSS 6.1, \[UNKNOWN\] libexif)
- [CVE-2018-14651](https://cve.now/CVE-2018-14651.md): It was found that the fix for CVE-2018-10927, CVE-2018-10928, CVE-2018-10929, CVE-2018-10930, and CVE-2018-10926 was incomplete. (CVSS 8.8, \[UNKNOWN\] glusterfs)
- [CVE-2016-2125](https://cve.now/CVE-2016-2125.md): It was found that Samba before versions 4.5.3, 4.4.8, 4.3.13 always requested forwardable tickets when using Kerberos authentication. (CVSS 6.4, \[UNKNOWN\] samba)
- [CVE-2018-11759](https://cve.now/CVE-2018-11759.md): The Apache Web Server (httpd) specific code that normalised the requested path before matching it to the URI-worker map in Apache Tomcat JK (no CVSS, Apache Software Foundation Apache Tomcat Connectors)
- [CVE-2018-14661](https://cve.now/CVE-2018-14661.md): It was found that usage of snprintf function in feature/locks translator of glusterfs server 3.8.4, as shipped with Red Hat Gluster Storage, (CVSS 6.5, The Gluster Project glusterfs-server)
- [CVE-2018-14652](https://cve.now/CVE-2018-14652.md): The Gluster file system through versions 3.12 and 4.1.4 is vulnerable to a buffer overflow in the 'features/index' translator via the code h (CVSS 6.5, The Gluster Project glusterfs)
- [CVE-2018-14653](https://cve.now/CVE-2018-14653.md): The Gluster file system through versions 4.1.4 and 3.12 is vulnerable to a heap-based buffer overflow in the '\_\_server\_getspec' function via (CVSS 6.5, The Gluster Project glusterfs)
- [CVE-2018-14654](https://cve.now/CVE-2018-14654.md): The Gluster file system through version 4.1.4 is vulnerable to abuse of the 'features/index' translator. (CVSS 5.4, The Gluster Project glusterfs)
- [CVE-2018-14659](https://cve.now/CVE-2018-14659.md): The Gluster file system through versions 4.1.4 and 3.1.2 is vulnerable to a denial of service attack via use of the 'GF\_XATTR\_IOSTATS\_DUMP\_K (CVSS 6.5, The Gluster Project glusterfs)
- [CVE-2018-16842](https://cve.now/CVE-2018-16842.md): Curl versions 7.14.1 through 7.61.1 are vulnerable to a heap-based buffer over-read in the tool\_msgs.c:voutf() function that may result in i (CVSS 4.4, The Curl Project curl:)
- [CVE-2018-16839](https://cve.now/CVE-2018-16839.md): Curl versions 7.33.0 through 7.61.1 are vulnerable to a buffer overrun in the SASL authentication code that may lead to denial of service. (CVSS 4.3, The Curl Project curl:)
- [CVE-2018-16840](https://cve.now/CVE-2018-16840.md): A heap use-after-free flaw was found in curl versions from 7.59.0 through 7.61.1 in the code related to closing an easy handle. (CVSS 4.3, The Curl Project curl)
- [CVE-2018-13281](https://cve.now/CVE-2018-13281.md): Information exposure vulnerability in SYNO.Core.ACL in Synology DiskStation Manager (DSM) before 6.2-23739-2 allows remote authenticated use (CVSS 4.3, Synology DiskStation Manager)
- [CVE-2018-13282](https://cve.now/CVE-2018-13282.md): Session fixation vulnerability in SYNO.PhotoStation.Auth in Synology Photo Station before 6.8.7-3481 allows remote attackers to hijack web s (CVSS 5.6, Synology Photo Station)
- [CVE-2018-18873](https://cve.now/CVE-2018-18873.md): An issue was discovered in JasPer 2.0.14. (no CVSS)
- [CVE-2018-18874](https://cve.now/CVE-2018-18874.md): nc-cms through 2017-03-10 allows remote attackers to execute arbitrary PHP code via the "Upload File or Image" feature, with a .php filename (no CVSS)
- [CVE-2018-15317](https://cve.now/CVE-2018-15317.md): In BIG-IP 14.0.0-14.0.0.2, 13.0.0-13.1.1.5, 12.1.0-12.1.4.1, and 11.2.1-11.6.3.2, an attacker sending specially crafted SSL records to a SSL (no CVSS, F5 Networks BIG-IP)
- [CVE-2018-15318](https://cve.now/CVE-2018-15318.md): In BIG-IP 14.0.0-14.0.0.2, 13.1.0.4-13.1.1.1, or 12.1.3.4-12.1.3.6, If an MPTCP connection receives an abort signal while the initial flow i (no CVSS, F5 Networks BIG-IP)
- [CVE-2018-15319](https://cve.now/CVE-2018-15319.md): On BIG-IP 14.0.0-14.0.0.2, 13.0.0-13.1.1.1, or 12.1.0-12.1.3.6, malicious requests made to virtual servers with an HTTP profile can cause th (no CVSS, F5 Networks BIG-IP)
- [CVE-2018-15320](https://cve.now/CVE-2018-15320.md): On BIG-IP 14.0.0-14.0.0.2 or 13.0.0-13.1.1.1, undisclosed traffic patterns may lead to denial of service conditions for the BIG-IP system. (no CVSS, F5 Networks BIG-IP)
- [CVE-2018-15321](https://cve.now/CVE-2018-15321.md): When BIG-IP 14.0.0-14.0.0.2, 13.0.0-13.1.0.5, 12.1.0-12.1.3.5, 11.6.0-11.6.3.2, or 11.2.1-11.5.6, BIG-IQ Centralized Management 5.0.0-5.4.0 (no CVSS, F5 Networks BIG-IP (LTM, AAM, AFM, Analytics, APM, ASM, DNS…)
- [CVE-2018-15322](https://cve.now/CVE-2018-15322.md): On BIG-IP 14.0.0-14.0.0.2, 13.0.0-13.1.0.7, 12.1.0-12.1.3.5, 11.6.0-11.6.3.2, or 11.2.1-11.5.6, BIG-IQ Centralized Management 6.0.0-6.0.1, 5 (no CVSS, F5 Networks BIG-IP (LTM, AAM, AFM, Analytics, APM, ASM, DNS…)
- [CVE-2018-15323](https://cve.now/CVE-2018-15323.md): On BIG-IP 14.0.0-14.0.0.2 or 13.0.0-13.1.1.1, in certain circumstances, when processing traffic through a Virtual Server with an associated (no CVSS, F5 Networks BIG-IP)
- [CVE-2018-15324](https://cve.now/CVE-2018-15324.md): On BIG-IP APM 14.0.0-14.0.0.2 or 13.0.0-13.1.1.1, TMM may restart when processing a specially crafted request with APM portal access. (no CVSS, F5 Networks BIG-IP)
- [CVE-2018-15325](https://cve.now/CVE-2018-15325.md): In BIG-IP 14.0.0-14.0.0.2 or 13.0.0-13.1.1.1, iControl and TMSH usage by authenticated users may leak a small amount of memory when executin (no CVSS, F5 Networks BIG-IP)
- [CVE-2018-15326](https://cve.now/CVE-2018-15326.md): In some situations on BIG-IP APM 14.0.0-14.0.0.2, 13.0.0-13.1.0.7, 12.1.0-12.1.3.5, or 11.6.0-11.6.3.2, the CRLDP Auth access policy agent m (no CVSS, F5 Networks BIG-IP)
- [CVE-2018-15327](https://cve.now/CVE-2018-15327.md): In BIG-IP 14.0.0-14.0.0.2 or 13.0.0-13.1.1.1 or Enterprise Manager 3.1.1, when authenticated administrative users run commands in the Traffi (no CVSS, F5 Networks BIG-IP (LTM, AAM, AFM, Analytics, APM, ASM, DNS…)
- [CVE-2016-2121](https://cve.now/CVE-2016-2121.md): A permissions flaw was found in redis, which sets weak permissions on certain files and directories that could potentially contain sensitive (CVSS 4.0, \[UNKNOWN\] redis)
- [CVE-2016-5402](https://cve.now/CVE-2016-5402.md): A code injection flaw was found in the way capacity and utilization imported control files are processed. (CVSS 8.8, \[UNKNOWN\] cfme)
- [CVE-2016-6343](https://cve.now/CVE-2016-6343.md): JBoss BPM Suite 6 is vulnerable to a reflected XSS via dashbuilder. (CVSS 6.1, \[UNKNOWN\] Dashbuilder)
- [CVE-2018-1851](https://cve.now/CVE-2018-1851.md): IBM WebSphere Application Server Liberty OpenID Connect could allow a remote attacker to execute arbitrary code on the system, caused by imp (CVSS 7.3, IBM WebSphere Application Server)
- [CVE-2018-18868](https://cve.now/CVE-2018-18868.md): No-CMS 1.1.3 is prone to Persistent XSS via a contact\_us name parameter, as demonstrated by the VG48Z5PqVWname parameter. (no CVSS)
- [CVE-2018-18869](https://cve.now/CVE-2018-18869.md): EmpireCMS V7.5 allows remote attackers to upload and execute arbitrary code via ..%2F directory traversal in a .php filename in the upload/e (no CVSS)
- [CVE-2018-18853](https://cve.now/CVE-2018-18853.md): Lightbend Spray spray-json through 1.3.4 allows remote attackers to cause a denial of service (resource consumption) because of Algorithmic (no CVSS, io.spray:spray-json\_2.12 · io.spray:spray-json\_2.11 +1)
- [CVE-2018-18854](https://cve.now/CVE-2018-18854.md): Lightbend Spray spray-json through 1.3.4 allows remote attackers to cause a denial of service (resource consumption) because of Algorithmic (no CVSS, io.spray:spray-json\_2.12 · io.spray:spray-json\_2.11 +1)
- [CVE-2018-18867](https://cve.now/CVE-2018-18867.md): An SSRF issue was discovered in tecrail Responsive FileManager 9.13.4 via the upload.php url parameter. (no CVSS)
- [CVE-2018-18850](https://cve.now/CVE-2018-18850.md): In Octopus Deploy 2018.8.0 through 2018.9.x before 2018.9.1, an authenticated user with permission to modify deployment processes could uplo (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2018-10-31
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.