# CVEs published 2018-11-05

22 CVEs were published on November 5, 2018: 0 critical, 0 high. Days are UTC.

- [CVE-2018-17905](https://cve.now/CVE-2018-17905.md): When processing project files in Omron CX-Supervisor Versions 3.4.1.0 and prior and tampering with a specific byte, memory corruption may oc (no CVSS, Omron CX-Supervisor)
- [CVE-2018-17907](https://cve.now/CVE-2018-17907.md): When processing project files in Omron CX-Supervisor Versions 3.4.1.0 and prior and tampering with the value of an offset, an attacker can f (no CVSS, Omron CX-Supervisor)
- [CVE-2018-17909](https://cve.now/CVE-2018-17909.md): When processing project files in Omron CX-Supervisor Versions 3.4.1.0 and prior, the application fails to check if it is referencing freed m (no CVSS, Omron CX-Supervisor)
- [CVE-2018-17913](https://cve.now/CVE-2018-17913.md): A type confusion vulnerability exists when processing project files in Omron CX-Supervisor Versions 3.4.1.0 and prior, which may allow an at (no CVSS, Omron CX-Supervisor)
- [CVE-2018-13396](https://cve.now/CVE-2018-13396.md): There was an argument injection vulnerability in Sourcetree for macOS from version 1.0b2 before version 3.0.0 via Git subrepositories in Mer (no CVSS, Atlassian Sourcetree for macOS)
- [CVE-2018-13397](https://cve.now/CVE-2018-13397.md): There was an argument injection vulnerability in Sourcetree for Windows from version 0.5.1.0 before version 3.0.0 via Git subrepositories in (no CVSS, Atlassian Sourcetree for Windows)
- [CVE-2018-18957](https://cve.now/CVE-2018-18957.md): An issue has been found in libIEC61850 v1.3. (no CVSS)
- [CVE-2018-18956](https://cve.now/CVE-2018-18956.md): The ProcessMimeEntity function in util-decode-mime.c in Suricata 4.x before 4.0.6 allows remote attackers to cause a denial of service (segf (no CVSS)
- [CVE-2018-18820](https://cve.now/CVE-2018-18820.md): A buffer overflow was discovered in the URL-authentication backend of the Icecast before 2.4.4. (no CVSS)
- [CVE-2018-9208](https://cve.now/CVE-2018-9208.md): Unauthenticated arbitrary file upload vulnerability in jQuery Picture Cut \<= v1.1Beta (no CVSS, Tuyoshi Vinicius jQuery Picture Cut)
- [CVE-2018-18949](https://cve.now/CVE-2018-18949.md): Zoho ManageEngine OpManager 12.3 before 123222 has SQL Injection via Mail Server settings. (no CVSS)
- [CVE-2018-18950](https://cve.now/CVE-2018-18950.md): KindEditor through 4.1.11 has a path traversal vulnerability in php/upload\_json.php. (no CVSS)
- [CVE-2018-18952](https://cve.now/CVE-2018-18952.md): JEECMS 9.3 has XSS via an index.do#/content/update?type=update URI. (no CVSS)
- [CVE-2018-18933](https://cve.now/CVE-2018-18933.md): The u3d plugin 9.3.0.10809 (aka plugins\\U3DBrowser.fpi) in FoxitReader.exe in Foxit Reader 9.3.0.10826 allows remote attackers to cause a de (no CVSS)
- [CVE-2018-18934](https://cve.now/CVE-2018-18934.md): An issue was discovered in PopojiCMS v2.0.1. (no CVSS)
- [CVE-2018-18935](https://cve.now/CVE-2018-18935.md): An issue was discovered in PopojiCMS v2.0.1. (no CVSS)
- [CVE-2018-18936](https://cve.now/CVE-2018-18936.md): An issue was discovered in PopojiCMS v2.0.1. (no CVSS)
- [CVE-2018-18937](https://cve.now/CVE-2018-18937.md): An issue has been found in libIEC61850 v1.3. (no CVSS)
- [CVE-2018-18938](https://cve.now/CVE-2018-18938.md): An issue was discovered in WUZHI CMS 4.1.0. (no CVSS)
- [CVE-2018-18939](https://cve.now/CVE-2018-18939.md): An issue was discovered in WUZHI CMS 4.1.0. (no CVSS)
- [CVE-2018-18942](https://cve.now/CVE-2018-18942.md): In baserCMS before 4.1.4, lib\\Baser\\Model\\ThemeConfig.php allows remote attackers to execute arbitrary PHP code via the admin/theme\_configs/ (no CVSS, baserproject/basercms)
- [CVE-2018-18943](https://cve.now/CVE-2018-18943.md): An issue was discovered in baserCMS before 4.1.4. (no CVSS, baserproject/basercms)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2018-11-05
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.