# CVEs published 2018-11-01

29 CVEs were published on November 1, 2018: 2 critical, 6 high. Days are UTC.

- [CVE-2018-10586](https://cve.now/CVE-2018-10586.md): NetGain Enterprise Manager (EM) is affected by multiple Stored Cross-Site Scripting (XSS) vulnerabilities in versions before 10.1.12. (no CVSS)
- [CVE-2018-10587](https://cve.now/CVE-2018-10587.md): NetGain Enterprise Manager (EM) is affected by OS Command Injection vulnerabilities in versions before 10.0.57. (no CVSS)
- [CVE-2018-18695](https://cve.now/CVE-2018-18695.md): M2SOFT Report Designer Viewer 5.0 allows a Buffer Overflow with Extended Instruction Pointer (EIP) control via a crafted MRD file. (no CVSS)
- [CVE-2018-18714](https://cve.now/CVE-2018-18714.md): RegFilter.sys in IOBit Malware Fighter 6.2 and earlier is susceptible to a stack-based buffer overflow when an attacker uses IOCTL 0x8006E01 (no CVSS)
- [CVE-2018-18775](https://cve.now/CVE-2018-18775.md): Microstrategy Web, version 7, does not sufficiently encode user-controlled inputs, resulting in a Cross-Site Scripting (XSS) vulnerability v (no CVSS)
- [CVE-2018-18776](https://cve.now/CVE-2018-18776.md): Microstrategy Web, version 7, does not sufficiently encode user-controlled inputs, resulting in a Cross-Site Scripting (XSS) vulnerability v (no CVSS)
- [CVE-2018-18777](https://cve.now/CVE-2018-18777.md): Directory traversal vulnerability in Microstrategy Web, version 7, in "/WebMstr7/servlet/mstrWeb" (in the parameter subpage) allows remote a (no CVSS)
- [CVE-2018-6011](https://cve.now/CVE-2018-6011.md): The time-based one-time-password (TOTP) function in the application logic of the Green Electronics RainMachine Mini-8 (2nd generation) uses (no CVSS)
- [CVE-2018-6012](https://cve.now/CVE-2018-6012.md): The 'Weather Service' feature of the Green Electronics RainMachine Mini-8 (2nd generation) allows an attacker to inject arbitrary Python cod (no CVSS)
- [CVE-2018-6906](https://cve.now/CVE-2018-6906.md): A persistent Cross Site Scripting (XSS) vulnerability in the Green Electronics RainMachine Mini-8 (2nd Generation) and Touch HD 12 web appli (no CVSS)
- [CVE-2018-6907](https://cve.now/CVE-2018-6907.md): A Cross Site Request Forgery (CSRF) vulnerability in the Green Electronics RainMachine Mini-8 (2nd Generation) and Touch HD 12 web applicati (no CVSS)
- [CVE-2018-6908](https://cve.now/CVE-2018-6908.md): An authentication bypass vulnerability exists in the Green Electronics RainMachine Mini-8 (2nd Generation) and Touch HD 12 web application a (no CVSS)
- [CVE-2018-6909](https://cve.now/CVE-2018-6909.md): A missing X-Frame-Options header in the Green Electronics RainMachine Mini-8 (2nd Generation) and Touch HD 12 web application could be used (no CVSS)
- [CVE-2018-3900](https://cve.now/CVE-2018-3900.md): An exploitable code execution vulnerability exists in the QR code scanning functionality of Yi Home Camera 27US 1.8.7.0D. (CVSS 9.1, Yi Technology)
- [CVE-2018-3910](https://cve.now/CVE-2018-3910.md): An exploitable code execution vulnerability exists in the cloud OTA setup functionality of Yi Home Camera 27US 1.8.7.0D. (CVSS 8.8, Yi Technology)
- [CVE-2018-3928](https://cve.now/CVE-2018-3928.md): An exploitable code execution vulnerability exists in the firmware update functionality of Yi Home Camera 27US 1.8.7.0D. (CVSS 7.5, Yi Technology)
- [CVE-2018-3947](https://cve.now/CVE-2018-3947.md): An exploitable information disclosure vulnerability exists in the phone-to-camera communications of Yi Home Camera 27US 1.8.7.0D. (CVSS 9.0, Yi Technology)
- [CVE-2018-3977](https://cve.now/CVE-2018-3977.md): An exploitable code execution vulnerability exists in the XCF image rendering functionality of SDL2\_image-2.0.3. (CVSS 8.8, Simple DirectMedia Layer)
- [CVE-2018-14660](https://cve.now/CVE-2018-14660.md): A flaw was found in glusterfs server through versions 4.1.4 and 3.1.2 which allowed repeated usage of GF\_META\_LOCK\_KEY xattr. (CVSS 6.5, \[UNKNOWN\] glusterfs)
- [CVE-2018-7356](https://cve.now/CVE-2018-7356.md): All versions up to V3.03.10.B23P2 of ZTE ZXR10 8905E product are impacted by TCP Initial Sequence Number (ISN) reuse vulnerability, which ca (CVSS 5.6, ZTE ZXR10)
- [CVE-2016-2120](https://cve.now/CVE-2016-2120.md): An issue has been found in PowerDNS Authoritative Server versions up to and including 3.4.10, 4.0.1 allowing an authorized user to crash the (CVSS 7.5, \[UNKNOWN\] pdns)
- [CVE-2016-2123](https://cve.now/CVE-2016-2123.md): A flaw was found in samba versions 4.0.0 to 4.5.2. (CVSS 8.1, \[UNKNOWN\] samba)
- [CVE-2018-15454](https://cve.now/CVE-2018-15454.md): Cisco Adaptive Security Appliance Software and Cisco Firepower Threat Defense Software Denial of Service Vulnerability (CVSS 8.6, Cisco Adaptive Security Appliance (ASA) Software)
- [CVE-2018-18887](https://cve.now/CVE-2018-18887.md): S-CMS PHP 1.0 has SQL injection in member/member\_news.php via the type parameter (aka the $N\_type field). (no CVSS)
- [CVE-2018-18888](https://cve.now/CVE-2018-18888.md): An issue was discovered in laravelCMS through 2018-04-02. (no CVSS)
- [CVE-2018-18890](https://cve.now/CVE-2018-18890.md): MiniCMS 1.10 allows full path disclosure via /mc-admin/post.php?state=delete&delete= with an invalid filename. (no CVSS)
- [CVE-2018-18891](https://cve.now/CVE-2018-18891.md): MiniCMS 1.10 allows file deletion via /mc-admin/post.php?state=delete&delete= because the authentication check occurs too late. (no CVSS)
- [CVE-2018-18892](https://cve.now/CVE-2018-18892.md): MiniCMS 1.10 allows execution of arbitrary PHP code via the install.php sitename parameter, which affects the site\_name field in mc\_conf.php (no CVSS)
- [CVE-2018-18883](https://cve.now/CVE-2018-18883.md): An issue was discovered in Xen 4.9.x through 4.11.x, on Intel x86 platforms, allowing x86 HVM and PVH guests to cause a host OS denial of se (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2018-11-01
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.