# CVEs published 2018-11-02 28 CVEs were published on November 2, 2018: 3 critical, 9 high. Days are UTC. - [CVE-2018-11062](https://cve.now/CVE-2018-11062.md): Dell EMC Integrated Data Protection Appliance Undocumented Accounts Vulnerability (no CVSS, Dell EMC Integrated Data Protection Appliance) - [CVE-2018-15762](https://cve.now/CVE-2018-15762.md): Pivotal Operations Manager gives all users heightened privileges (CVSS 9.0, Pivotal Cloud Foundry Pivotal Operations Manager) - [CVE-2018-16847](https://cve.now/CVE-2018-16847.md): An OOB heap buffer r/w access issue was found in the NVM Express Controller emulation in QEMU. (CVSS 7.0, \[UNKNOWN\] QEMU:) - [CVE-2018-16849](https://cve.now/CVE-2018-16849.md): A flaw was found in openstack-mistral. (CVSS 3.1, \[UNKNOWN\] openstack-mistral · mistral) - [CVE-2018-3890](https://cve.now/CVE-2018-3890.md): An exploitable code execution vulnerability exists in the firmware update functionality of Yi Home Camera 27US 1.8.7.0D. (CVSS 7.6, Yi Technology) - [CVE-2018-3891](https://cve.now/CVE-2018-3891.md): An exploitable firmware downgrade vulnerability exists in the firmware update functionality of Yi Home Camera 27US 1.8.7.0D. (CVSS 5.7, Yi Technology) - [CVE-2018-3892](https://cve.now/CVE-2018-3892.md): An exploitable firmware downgrade vulnerability exists in the time syncing functionality of Yi Home Camera 27US 1.8.7.0D. (CVSS 9.6, Yi Technology) - [CVE-2018-3898](https://cve.now/CVE-2018-3898.md): An exploitable code execution vulnerability exists in the QR code scanning functionality of Yi Home Camera 27US 1.8.7.0D. (CVSS 8.3, Yi Technology) - [CVE-2018-3899](https://cve.now/CVE-2018-3899.md): An exploitable code execution vulnerability exists in the QR code scanning functionality of Yi Home Camera 27US 1.8.7.0D. (CVSS 8.3, Yi Technology) - [CVE-2018-3920](https://cve.now/CVE-2018-3920.md): An exploitable code execution vulnerability exists in the firmware update functionality of the Yi Home Camera 27US 1.8.7.0D. (CVSS 7.6, Yi Technology) - [CVE-2018-3934](https://cve.now/CVE-2018-3934.md): An exploitable code execution vulnerability exists in the firmware update functionality of Yi Home Camera 27US 1.8.7.0D. (CVSS 9.0, Yi Technology) - [CVE-2018-3935](https://cve.now/CVE-2018-3935.md): An exploitable code execution vulnerability exists in the UDP network functionality of Yi Home Camera 27US 1.8.7.0D. (CVSS 7.5, Yi Technology) - [CVE-2018-7798](https://cve.now/CVE-2018-7798.md): A Insufficient Verification of Data Authenticity (CWE-345) vulnerability exists in the Modicon M221, all versions, which could cause a chang (CVSS 8.2, Schneider Electric SE Modicon M221, All Versions) - [CVE-2018-7799](https://cve.now/CVE-2018-7799.md): A DLL hijacking vulnerability exists in Schneider Electric Software Update (SESU), all versions prior to V2.2.0, which could allow an attack (no CVSS, Schneider Electric SE Schneider Electric Software Update (S…) - [CVE-2017-1609](https://cve.now/CVE-2017-1609.md): IBM Quality Manager (RQM) 5.0 through 5.0.2 and 6.0 through 6.0.6 are vulnerable to cross-site scripting. (CVSS 5.4, IBM Rational Quality Manager) - [CVE-2018-1552](https://cve.now/CVE-2018-1552.md): IBM Robotic Process Automation with Automation Anywhere 10.0 and 11.0 allows a remote attacker to execute arbitrary code on the system, caus (CVSS 5.5, IBM Robotic Process Automation with Automation Anywhere) - [CVE-2018-1788](https://cve.now/CVE-2018-1788.md): IBM Spectrum Protect Server 7.1 and 8.1 could disclose highly sensitive information via trace logs to a local privileged user. (CVSS 4.1, IBM Spectrum Protect) - [CVE-2018-17918](https://cve.now/CVE-2018-17918.md): Circontrol CirCarLife all versions prior to 4.3.1, authentication to the device can be bypassed by entering the URL of a specific page. (no CVSS, Circontrol CirCarLife all versions prior to) - [CVE-2018-17922](https://cve.now/CVE-2018-17922.md): Circontrol CirCarLife all versions prior to 4.3.1, the PAP credentials of the device are stored in clear text in a log file that is accessib (no CVSS, Circontrol CirCarLife all versions prior to) - [CVE-2018-1835](https://cve.now/CVE-2018-1835.md): IBM Daeja ViewONE Professional, Standard & Virtual 5 is vulnerable to a XML External Entity Injection (XXE) attack when processing XML data. (CVSS 7.1, IBM Daeja ViewONE) - [CVE-2018-1846](https://cve.now/CVE-2018-1846.md): IBM Rational Engineering Lifecycle Manager 5.0 through 5.0.2 and 6.0 through 6.0.6 are vulnerable to a XML External Entity Injection (XXE) a (CVSS 7.1, IBM Rational Engineering Lifecycle Manager) - [CVE-2018-1876](https://cve.now/CVE-2018-1876.md): IBM Robotic Process Automation with Automation Anywhere 11 could under certain cases, display the password in a Control Room log file after (CVSS 6.2, IBM Robotic Process Automation with Automation Anywhere) - [CVE-2018-1877](https://cve.now/CVE-2018-1877.md): IBM Robotic Process Automation with Automation Anywhere 11 could store highly sensitive information in the form of unencrypted passwords tha (CVSS 6.2, IBM Robotic Process Automation with Automation Anywhere) - [CVE-2018-1878](https://cve.now/CVE-2018-1878.md): IBM Robotic Process Automation with Automation Anywhere 11 could disclose sensitive information in a web request that could aid in future at (CVSS 5.3, IBM Robotic Process Automation with Automation Anywhere) - [CVE-2018-17912](https://cve.now/CVE-2018-17912.md): An XXE vulnerability exists in CASE Suite Versions 3.10 and prior when processing parameter entities, which may allow remote file disclosure (no CVSS, CASE Suite) - [CVE-2018-17914](https://cve.now/CVE-2018-17914.md): InduSoft Web Studio versions prior to 8.1 SP2, and InTouch Edge HMI (formerly InTouch Machine Edition) versions prior to 2017 SP2. (no CVSS, InduSoft Web Studio, and InTouch Edge HMI) - [CVE-2018-17916](https://cve.now/CVE-2018-17916.md): InduSoft Web Studio versions prior to 8.1 SP2, and InTouch Edge HMI (formerly InTouch Machine Edition) versions prior to 2017 SP2. (no CVSS, InduSoft Web Studio, and InTouch Edge HMI) - [CVE-2018-18897](https://cve.now/CVE-2018-18897.md): An issue was discovered in Poppler 0.71.0. (no CVSS) --- Source: cve.now, built and run by Sazabi (AI-native observability and security) Page: https://cve.now/daily/2018-11-02 Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.