CVEs published November 7, 2018
50 CVEs were published on November 7, 2018: 1 critical, 7 high.
- Published
- 50
- Critical
- 1
- High
- 7
- Medium
- 2
- Low
- 0
- Unrated
- 40
- Now in CISA KEV
- 0
- Fix available
- 1
Most affected products
- [UNKNOWN] nginx
- 3
- editor.md
- 1
- Micro Focus Operation Bridge Containerized Suite
- 1
- simplemde
- 1
- Superset
- 1
- TIBCO Software TIBCO ActiveSpaces - Community Edition ·… +1
- 1
- TIBCO Software TIBCO Enterprise Message Service
- 1
- TIBCO Software TIBCO FTL - Community Edition · TIBCO Sof… +1
- 1
- TIBCO Software TIBCO Messaging - Apache Kafka Distribution…
- 1
- TIBCO Software TIBCO Rendezvous · TIBCO Software TIBCO Subs…
- 1
Critical 1
High 7
- CVE-2018-19093An issue has been found in libIEC61850 v1.3.
- CVE-2018-16845nginx before versions 1.15.6, 1.14.1 has a vulnerability in the ngx_http_mp4_module, which might allow an attacker to cause infinite loop in[UNKNOWN] nginx
- CVE-2018-12411TIBCO ActiveSpaces Administrative Daemon Vulnerable to CSRF AttacksTIBCO Software TIBCO ActiveSpaces - Community Edition ·… +1
- CVE-2018-12412TIBCO FTL Realm Server Vulnerable to CSRF AttacksTIBCO Software TIBCO FTL - Community Edition · TIBCO Sof… +1
- CVE-2018-12413TIBCO Messaging - Apache Kafka Distribution - Schema Repository Vulnerable to CSRF AttacksTIBCO Software TIBCO Messaging - Apache Kafka Distribution…
- CVE-2018-12414TIBCO Rendezvous Vulnerable to CSRF AttacksTIBCO Software TIBCO Rendezvous · TIBCO Software TIBCO Subs…
- CVE-2018-12415TIBCO Enterprise Message Service Vulnerable to CSRF AttacksTIBCO Software TIBCO Enterprise Message Service
Medium, low and unrated 42
- CVE-2018-16149In sig_verify() in x509.c in axTLS version 2.1.3 and before, the PKCS#1 v1.5 signature verification blindly trusts the declared lengths in t
- CVE-2018-16150In sig_verify() in x509.c in axTLS version 2.1.3 and before, the PKCS#1 v1.5 signature verification does not reject excess data after the ha
- CVE-2018-16253In sig_verify() in x509.c in axTLS version 2.1.3 and before, the PKCS#1 v1.5 signature verification does not properly verify the ASN.1 metad
- CVE-2018-19089tianti 2.3 has stored XSS in the userlist module via the tianti-module-admin/user/ajax/save_role name parameter, which is mishandled in tian
- CVE-2018-19090tianti 2.3 has stored XSS in the article management module via an article title.
- CVE-2018-19091tianti 2.3 has reflected XSS in the user management module via the tianti-module-admin/user/list userName parameter.
- CVE-2018-19092An issue was discovered in YzmCMS v5.2.
- CVE-2018-19063An issue was discovered on Foscam C2 devices with System Firmware 1.11.1.8 and Application Firmware 2.72.1.32, and Opticam i5 devices with S
- CVE-2018-19064An issue was discovered on Foscam C2 devices with System Firmware 1.11.1.8 and Application Firmware 2.72.1.32, and Opticam i5 devices with S
- CVE-2018-19065An issue was discovered on Foscam C2 devices with System Firmware 1.11.1.8 and Application Firmware 2.72.1.32, and Opticam i5 devices with S
- CVE-2018-19066An issue was discovered on Foscam C2 devices with System Firmware 1.11.1.8 and Application Firmware 2.72.1.32, and Opticam i5 devices with S
- CVE-2018-19067An issue was discovered on Foscam C2 devices with System Firmware 1.11.1.8 and Application Firmware 2.72.1.32, and Opticam i5 devices with S
- CVE-2018-19068An issue was discovered on Foscam Opticam i5 devices with System Firmware 1.5.2.11 and Application Firmware 2.21.1.128.
- CVE-2018-19069An issue was discovered on Foscam C2 devices with System Firmware 1.11.1.8 and Application Firmware 2.72.1.32, and Opticam i5 devices with S
- CVE-2018-19070An issue was discovered on Foscam C2 devices with System Firmware 1.11.1.8 and Application Firmware 2.72.1.32, and Opticam i5 devices with S
- CVE-2018-19071An issue was discovered on Foscam C2 devices with System Firmware 1.11.1.8 and Application Firmware 2.72.1.32, and Opticam i5 devices with S
- CVE-2018-19072An issue was discovered on Foscam C2 devices with System Firmware 1.11.1.8 and Application Firmware 2.72.1.32, and Opticam i5 devices with S
- CVE-2018-19073An issue was discovered on Foscam C2 devices with System Firmware 1.11.1.8 and Application Firmware 2.72.1.32, and Opticam i5 devices with S
- CVE-2018-19074An issue was discovered on Foscam C2 devices with System Firmware 1.11.1.8 and Application Firmware 2.72.1.32, and Opticam i5 devices with S
- CVE-2018-19075An issue was discovered on Foscam C2 devices with System Firmware 1.11.1.8 and Application Firmware 2.72.1.32, and Opticam i5 devices with S
- CVE-2018-19076An issue was discovered on Foscam C2 devices with System Firmware 1.11.1.8 and Application Firmware 2.72.1.32, and Opticam i5 devices with S
- CVE-2018-19077An issue was discovered on Foscam Opticam i5 devices with System Firmware 1.5.2.11 and Application Firmware 2.21.1.128.
- CVE-2018-19078An issue was discovered on Foscam Opticam i5 devices with System Firmware 1.5.2.11 and Application Firmware 2.21.1.128.
- CVE-2018-19079An issue was discovered on Foscam Opticam i5 devices with System Firmware 1.5.2.11 and Application Firmware 2.21.1.128.
- CVE-2018-19080An issue was discovered on Foscam Opticam i5 devices with System Firmware 1.5.2.11 and Application Firmware 2.21.1.128.
- CVE-2018-19081An issue was discovered on Foscam Opticam i5 devices with System Firmware 1.5.2.11 and Application Firmware 2.21.1.128.
- CVE-2018-19082An issue was discovered on Foscam Opticam i5 devices with System Firmware 1.5.2.11 and Application Firmware 2.21.1.128.
- CVE-2018-19083WeCenter 3.2.0 through 3.2.2 has XSS in the views/default/question/index.tpl.html htmlspecialchars_decode function via the /?/publish/ajax/p
- CVE-2018-19061DedeCMS 5.7 SP2 has SQL Injection via the dede\co_do.php ids parameter.
- CVE-2018-19058An issue was discovered in Poppler 0.71.0.
- CVE-2018-19059An issue was discovered in Poppler 0.71.0.
- CVE-2018-19060An issue was discovered in Poppler 0.71.0.
- CVE-2018-19056pandao Editor.md 1.5.0 has DOM XSS via input starting with a "<<" substring, which is mishandled during construction of an A element.editor.md
- CVE-2018-19057SimpleMDE 1.11.2 has XSS via an onerror attribute of a crafted IMG element, or via certain input with [ and ( characters, which is mishandlesimplemde
- CVE-2018-16843nginx before versions 1.15.6 and 1.14.1 has a vulnerability in the implementation of HTTP/2 that can allow for excessive memory consumption.[UNKNOWN] nginx
- CVE-2018-16844nginx before versions 1.15.6 and 1.14.1 has a vulnerability in the implementation of HTTP/2 that can allow for excessive CPU usage.[UNKNOWN] nginx
- CVE-2018-8021Versions of Superset prior to 0.23 used an unsafe load method from the pickle library to deserialize data leading to possible remote code exSuperset
- CVE-2018-19047mPDF through 7.1.6, if deployed as a web application that accepts arbitrary HTML, allows SSRF, as demonstrated by a '<img src="http://192.16
- CVE-2018-19052An issue was discovered in mod_alias_physical_handler in mod_alias.c in lighttpd before 1.4.50.
- CVE-2018-19053PbootCMS 1.2.2 allows remote attackers to execute arbitrary PHP code by specifying a .php filename in a "SET GLOBAL general_log_file" statem
- CVE-2018-19050MetInfo 6.1.3 has XSS via the admin/index.php?a=dogetpassword langset parameter.
- CVE-2018-19051MetInfo 6.1.3 has XSS via the admin/index.php?a=dogetpassword abt_type parameter.