CVEs published November 1, 2018
29 CVEs were published on November 1, 2018: 2 critical, 6 high.
- Published
- 29
- Critical
- 2
- High
- 6
- Medium
- 2
- Low
- 0
- Unrated
- 19
- Now in CISA KEV
- 0
- Fix available
- 0
Most affected products
- Yi Technology
- 4
- [UNKNOWN] glusterfs
- 1
- [UNKNOWN] pdns
- 1
- [UNKNOWN] samba
- 1
- Cisco Adaptive Security Appliance (ASA) Software
- 1
- Simple DirectMedia Layer
- 1
- ZTE ZXR10
- 1
Critical 2
- CVE-2018-3900An exploitable code execution vulnerability exists in the QR code scanning functionality of Yi Home Camera 27US 1.8.7.0D.Yi Technology
- CVE-2018-3947An exploitable information disclosure vulnerability exists in the phone-to-camera communications of Yi Home Camera 27US 1.8.7.0D.Yi Technology
High 6
- CVE-2018-3910An exploitable code execution vulnerability exists in the cloud OTA setup functionality of Yi Home Camera 27US 1.8.7.0D.Yi Technology
- CVE-2018-3928An exploitable code execution vulnerability exists in the firmware update functionality of Yi Home Camera 27US 1.8.7.0D.Yi Technology
- CVE-2018-3977An exploitable code execution vulnerability exists in the XCF image rendering functionality of SDL2_image-2.0.3.Simple DirectMedia Layer
- CVE-2016-2120An issue has been found in PowerDNS Authoritative Server versions up to and including 3.4.10, 4.0.1 allowing an authorized user to crash the[UNKNOWN] pdns
- CVE-2016-2123A flaw was found in samba versions 4.0.0 to 4.5.2.[UNKNOWN] samba
- CVE-2018-15454Cisco Adaptive Security Appliance Software and Cisco Firepower Threat Defense Software Denial of Service VulnerabilityCisco Adaptive Security Appliance (ASA) Software
Medium, low and unrated 21
- CVE-2018-10586NetGain Enterprise Manager (EM) is affected by multiple Stored Cross-Site Scripting (XSS) vulnerabilities in versions before 10.1.12.
- CVE-2018-10587NetGain Enterprise Manager (EM) is affected by OS Command Injection vulnerabilities in versions before 10.0.57.
- CVE-2018-18695M2SOFT Report Designer Viewer 5.0 allows a Buffer Overflow with Extended Instruction Pointer (EIP) control via a crafted MRD file.
- CVE-2018-18714RegFilter.sys in IOBit Malware Fighter 6.2 and earlier is susceptible to a stack-based buffer overflow when an attacker uses IOCTL 0x8006E01
- CVE-2018-18775Microstrategy Web, version 7, does not sufficiently encode user-controlled inputs, resulting in a Cross-Site Scripting (XSS) vulnerability v
- CVE-2018-18776Microstrategy Web, version 7, does not sufficiently encode user-controlled inputs, resulting in a Cross-Site Scripting (XSS) vulnerability v
- CVE-2018-18777Directory traversal vulnerability in Microstrategy Web, version 7, in "/WebMstr7/servlet/mstrWeb" (in the parameter subpage) allows remote a
- CVE-2018-6011The time-based one-time-password (TOTP) function in the application logic of the Green Electronics RainMachine Mini-8 (2nd generation) uses
- CVE-2018-6012The 'Weather Service' feature of the Green Electronics RainMachine Mini-8 (2nd generation) allows an attacker to inject arbitrary Python cod
- CVE-2018-6906A persistent Cross Site Scripting (XSS) vulnerability in the Green Electronics RainMachine Mini-8 (2nd Generation) and Touch HD 12 web appli
- CVE-2018-6907A Cross Site Request Forgery (CSRF) vulnerability in the Green Electronics RainMachine Mini-8 (2nd Generation) and Touch HD 12 web applicati
- CVE-2018-6908An authentication bypass vulnerability exists in the Green Electronics RainMachine Mini-8 (2nd Generation) and Touch HD 12 web application a
- CVE-2018-6909A missing X-Frame-Options header in the Green Electronics RainMachine Mini-8 (2nd Generation) and Touch HD 12 web application could be used
- CVE-2018-14660A flaw was found in glusterfs server through versions 4.1.4 and 3.1.2 which allowed repeated usage of GF_META_LOCK_KEY xattr.[UNKNOWN] glusterfs
- CVE-2018-7356All versions up to V3.03.10.B23P2 of ZTE ZXR10 8905E product are impacted by TCP Initial Sequence Number (ISN) reuse vulnerability, which caZTE ZXR10
- CVE-2018-18887S-CMS PHP 1.0 has SQL injection in member/member_news.php via the type parameter (aka the $N_type field).
- CVE-2018-18888An issue was discovered in laravelCMS through 2018-04-02.
- CVE-2018-18890MiniCMS 1.10 allows full path disclosure via /mc-admin/post.php?state=delete&delete= with an invalid filename.
- CVE-2018-18891MiniCMS 1.10 allows file deletion via /mc-admin/post.php?state=delete&delete= because the authentication check occurs too late.
- CVE-2018-18892MiniCMS 1.10 allows execution of arbitrary PHP code via the install.php sitename parameter, which affects the site_name field in mc_conf.php
- CVE-2018-18883An issue was discovered in Xen 4.9.x through 4.11.x, on Intel x86 platforms, allowing x86 HVM and PVH guests to cause a host OS denial of se