CVEs published November 2, 2018
28 CVEs were published on November 2, 2018: 3 critical, 9 high.
- Published
- 28
- Critical
- 3
- High
- 9
- Medium
- 7
- Low
- 1
- Unrated
- 8
- Now in CISA KEV
- 0
- Fix available
- 3
Most affected products
- Yi Technology
- 8
- IBM Robotic Process Automation with Automation Anywhere
- 4
- Circontrol CirCarLife all versions prior to
- 2
- InduSoft Web Studio, and InTouch Edge HMI
- 2
- [UNKNOWN] openstack-mistral · mistral
- 1
- [UNKNOWN] QEMU:
- 1
- CASE Suite
- 1
- Dell EMC Integrated Data Protection Appliance
- 1
- IBM Daeja ViewONE
- 1
- IBM Rational Engineering Lifecycle Manager
- 1
Critical 3
- CVE-2018-15762Pivotal Operations Manager gives all users heightened privilegesPivotal Cloud Foundry Pivotal Operations Manager
- CVE-2018-3892An exploitable firmware downgrade vulnerability exists in the time syncing functionality of Yi Home Camera 27US 1.8.7.0D.Yi Technology
- CVE-2018-3934An exploitable code execution vulnerability exists in the firmware update functionality of Yi Home Camera 27US 1.8.7.0D.Yi Technology
High 9
- CVE-2018-16847An OOB heap buffer r/w access issue was found in the NVM Express Controller emulation in QEMU.[UNKNOWN] QEMU:
- CVE-2018-3890An exploitable code execution vulnerability exists in the firmware update functionality of Yi Home Camera 27US 1.8.7.0D.Yi Technology
- CVE-2018-3898An exploitable code execution vulnerability exists in the QR code scanning functionality of Yi Home Camera 27US 1.8.7.0D.Yi Technology
- CVE-2018-3899An exploitable code execution vulnerability exists in the QR code scanning functionality of Yi Home Camera 27US 1.8.7.0D.Yi Technology
- CVE-2018-3920An exploitable code execution vulnerability exists in the firmware update functionality of the Yi Home Camera 27US 1.8.7.0D.Yi Technology
- CVE-2018-3935An exploitable code execution vulnerability exists in the UDP network functionality of Yi Home Camera 27US 1.8.7.0D.Yi Technology
- CVE-2018-7798A Insufficient Verification of Data Authenticity (CWE-345) vulnerability exists in the Modicon M221, all versions, which could cause a changSchneider Electric SE Modicon M221, All Versions
- CVE-2018-1835IBM Daeja ViewONE Professional, Standard & Virtual 5 is vulnerable to a XML External Entity Injection (XXE) attack when processing XML data.IBM Daeja ViewONE
- CVE-2018-1846IBM Rational Engineering Lifecycle Manager 5.0 through 5.0.2 and 6.0 through 6.0.6 are vulnerable to a XML External Entity Injection (XXE) aIBM Rational Engineering Lifecycle Manager
Medium, low and unrated 16
- CVE-2018-11062Dell EMC Integrated Data Protection Appliance Undocumented Accounts VulnerabilityDell EMC Integrated Data Protection Appliance
- CVE-2018-16849A flaw was found in openstack-mistral.[UNKNOWN] openstack-mistral · mistral
- CVE-2018-3891An exploitable firmware downgrade vulnerability exists in the firmware update functionality of Yi Home Camera 27US 1.8.7.0D.Yi Technology
- CVE-2018-7799A DLL hijacking vulnerability exists in Schneider Electric Software Update (SESU), all versions prior to V2.2.0, which could allow an attackSchneider Electric SE Schneider Electric Software Update (S…
- CVE-2017-1609IBM Quality Manager (RQM) 5.0 through 5.0.2 and 6.0 through 6.0.6 are vulnerable to cross-site scripting.IBM Rational Quality Manager
- CVE-2018-1552IBM Robotic Process Automation with Automation Anywhere 10.0 and 11.0 allows a remote attacker to execute arbitrary code on the system, causIBM Robotic Process Automation with Automation Anywhere
- CVE-2018-1788IBM Spectrum Protect Server 7.1 and 8.1 could disclose highly sensitive information via trace logs to a local privileged user.IBM Spectrum Protect
- CVE-2018-17918Circontrol CirCarLife all versions prior to 4.3.1, authentication to the device can be bypassed by entering the URL of a specific page.Circontrol CirCarLife all versions prior to
- CVE-2018-17922Circontrol CirCarLife all versions prior to 4.3.1, the PAP credentials of the device are stored in clear text in a log file that is accessibCircontrol CirCarLife all versions prior to
- CVE-2018-1876IBM Robotic Process Automation with Automation Anywhere 11 could under certain cases, display the password in a Control Room log file after IBM Robotic Process Automation with Automation Anywhere
- CVE-2018-1877IBM Robotic Process Automation with Automation Anywhere 11 could store highly sensitive information in the form of unencrypted passwords thaIBM Robotic Process Automation with Automation Anywhere
- CVE-2018-1878IBM Robotic Process Automation with Automation Anywhere 11 could disclose sensitive information in a web request that could aid in future atIBM Robotic Process Automation with Automation Anywhere
- CVE-2018-17912An XXE vulnerability exists in CASE Suite Versions 3.10 and prior when processing parameter entities, which may allow remote file disclosureCASE Suite
- CVE-2018-17914InduSoft Web Studio versions prior to 8.1 SP2, and InTouch Edge HMI (formerly InTouch Machine Edition) versions prior to 2017 SP2.InduSoft Web Studio, and InTouch Edge HMI
- CVE-2018-17916InduSoft Web Studio versions prior to 8.1 SP2, and InTouch Edge HMI (formerly InTouch Machine Edition) versions prior to 2017 SP2.InduSoft Web Studio, and InTouch Edge HMI
- CVE-2018-18897An issue was discovered in Poppler 0.71.0.