CVEs published November 6, 2018
47 CVEs were published on November 6, 2018: 1 critical, 0 high. 1 is now in CISA KEV.
- Published
- 47
- Critical
- 1
- High
- 0
- Medium
- 2
- Low
- 0
- Unrated
- 44
- Now in CISA KEV
- 1
- Fix available
- 5
Most affected products
- Google Android
- 30
- Apache Software Foundation Apache Syncope · org.apache.sync…
- 2
- IBM Rational Team Concert · IBM Rational Software Archit… +5
- 2
- [UNKNOWN] RichFaces · org.richfaces:richfaces-core
- 1
- i18n
- 1
- npm cached-path-relative · cached-path-relative
- 1
- npm knightjs · knightjs
- 1
- npm takeapeek · takeapeek
- 1
- npm tianma-static · tianma-static
- 1
Critical 1
Medium, low and unrated 46
- CVE-2018-17186An administrator with workflow definition entitlements can use DTD to perform malicious operations, including but not limited to file read, Apache Software Foundation Apache Syncope · org.apache.sync…
- CVE-2018-16473A path traversal in takeapeek module versions <=0.2.2 allows an attacker to list directory and files.npm takeapeek · takeapeek
- CVE-2018-16474A stored xss in tianma-static module versions <=1.0.4 allows an attacker to execute arbitrary javascript.npm tianma-static · tianma-static
- CVE-2018-16475A Path Traversal in Knightjs versions <= 0.0.1 allows an attacker to read content of arbitrary files on a remote server.npm knightjs · knightjs
- CVE-2018-17184A malicious user with enough administration entitlements can inject html-like elements containing JavaScript statements into Connector namesApache Software Foundation Apache Syncope · org.apache.sync…
- CVE-2018-9355In bta_dm_sdp_result of bta_dm_act.cc, there is a possible out of bounds stack write due to a missing bounds check.Google Android
- CVE-2018-9356In bnep_data_ind of bnep_main.c, there is a possible remote code execution due to a double free.Google Android
- CVE-2018-9357In BNEP_Write of bnep_api.cc, there is a possible out of bounds write due to an incorrect bounds check.Google Android
- CVE-2018-9358In gatts_process_attribute_req of gatt_sc.cc, there is a possible read of uninitialized data due to a missing bounds check.Google Android
- CVE-2018-9359In process_l2cap_cmd of l2c_main.cc, there is a possible out of bounds read due to a missing bounds check.Google Android
- CVE-2018-9360In process_l2cap_cmd of l2c_main.cc, there is a possible out of bounds read due to a missing bounds check.
- CVE-2018-9361In process_l2cap_cmd of l2c_main.cc, there is a possible out of bounds read due to a missing bounds check.Google Android
- CVE-2018-9362In processMessagePart of InboundSmsHandler.java, there is a possible remote denial of service due to improper input validation.Google Android
- CVE-2018-9363In the hidp_process_report in bluetooth, there is an integer overflow.Google Android
- CVE-2018-9385In driver_override_store of bus.c, there is a possible out of bounds write due to an incorrect bounds check.Google Android
- CVE-2018-9415In driver_override_store and driver_override_show of bus.c, there is a possible double free due to improper locking.Google Android
- CVE-2018-9422In get_futex_key of futex.c, there is a use-after-free due to improper locking.Google Android
- CVE-2018-9427In CopyToOMX of OMXNodeInstance.cpp there is a possible out-of-bounds write due to an incorrect bounds check.Google Android
- CVE-2018-9436In bnep_data_ind of bnep_main.cc, there is a possible out of bounds read due to a missing bounds check.Google Android
- CVE-2018-9437In getstring of ID3.cpp there is a possible out-of-bounds read due to a missing bounds check.Google Android
- CVE-2018-9438When a device connects only over WiFi VPN, the device may not receive security updates due to some incorrect checks.Google Android
- CVE-2018-9444In ih264d_video_decode of ih264d_api.c there is a possible resource exhaustion due to an infinite loop.Google Android
- CVE-2018-9445In readMetadata of Utils.cpp, there is a possible path traversal bug due to a confused deputy.Google Android
- CVE-2018-9446In smp_br_state_machine_event of smp_br_main.cc, there is a possible out of bounds write due to memory corruption.Google Android
- CVE-2018-9448In avct_bcb_msg_ind of avct_bcb_act.cc, there is a possible out of bounds read due to a missing bounds check.Google Android
- CVE-2018-9450In avrc_proc_vendor_command of avrc_api.cc, there is a possible out of bounds write due to a missing bounds check.Google Android
- CVE-2018-9451In DynamicRefTable::load of ResourceTypes.cpp, there is a possible out of bounds read due to a missing bounds check.Google Android
- CVE-2018-9453In avdt_msg_prs_cfg of avdt_msg.cc, there is a possible out of bounds read due to a missing bounds check.Google Android
- CVE-2018-9454In bnep_data_ind of bnep_main.cc, there is a possible out of bounds read due to a missing bounds check.Google Android
- CVE-2018-9455In sdpu_extract_attr_seq of sdp_utils.cc, there is a possible out of bounds read due to an incorrect bounds check.Google Android
- CVE-2018-9458In computeFocusedWindow of RootWindowContainer.java, and related functions, there is possible interception of keypresses due to focus being Google Android
- CVE-2018-9459In Attachment of Attachment.java and getFilePath of EmlAttachmentProvider.java, there is a possible Elevation of Privilege due to a path traGoogle Android
- CVE-2018-9465In task_get_unused_fd_flags of binder.c, there is a possible memory corruption due to a use after free.Google Android
- CVE-2018-9488In the SELinux permissions of crash_dump.te, there is a permissions bypass due to a missing restriction.Google Android
- CVE-2018-9489When wifi is switched, function sendNetworkStateChangeBroadcast of WifiStateMachine.java broadcasts an intent including detailed wifi networGoogle Android
- CVE-2018-9516In hid_debug_events_read of drivers/hid/hid-debug.c, there is a possible out of bounds write due to a missing bounds check.Google Android
- CVE-2014-10077Hash#slice in lib/i18n/core_ext/hash.rb in the i18n gem before 0.8.0 for Ruby allows remote attackers to cause a denial of service (applicati18n
- CVE-2018-1606IBM Jazz based applications (IBM Rational Collaborative Lifecycle Management 5.0 through 5.02 and 6.0 through 6.0.6, IBM Rational DOORS NextIBM Rational Team Concert · IBM Rational Software Archit… +5
- CVE-2018-1694IBM Jazz applications (IBM Rational Collaborative Lifecycle Management 5.0 through 5.02 and 6.0 through 6.0.6, IBM Rational DOORS Next GenerIBM Rational Team Concert · IBM Rational Software Archit… +5
- CVE-2018-16986Texas Instruments BLE-STACK v2.2.1 for SimpleLink CC2640 and CC2650 devices allows remote attackers to execute arbitrary code via a malforme
- CVE-2018-18963Busca.aspx.cs in Degrau Publicidade e Internet Plataforma de E-commerce allows SQL Injection via the busca/ URI.
- CVE-2018-18964osCommerce 2.3.4.1 has an incomplete '.htaccess' for blacklist filtering in the "product" page.
- CVE-2018-18965osCommerce 2.3.4.1 has an incomplete '.htaccess' for blacklist filtering in the "product" page.
- CVE-2018-18966osCommerce 2.3.4.1 has an incomplete '.htaccess' for blacklist filtering in the "product" page.
- CVE-2018-18980An XML External Entity injection (XXE) vulnerability exists in Zoho ManageEngine Network Configuration Manager and OpManager before 12.3.214
- CVE-2018-16472A prototype pollution attack in cached-path-relative versions <=1.0.1 allows an attacker to inject properties on Object.prototype which are npm cached-path-relative · cached-path-relative