CVEs published November 9, 2018
32 CVEs were published on November 9, 2018: 0 critical, 6 high.
- Published
- 32
- Critical
- 0
- High
- 6
- Medium
- 7
- Low
- 1
- Unrated
- 18
- Now in CISA KEV
- 0
- Fix available
- 1
Most affected products
- IBM DB2 for Linux, UNIX and Windows
- 6
- [UNKNOWN] pdns
- 1
- Cloud Foundry bits-service-release
- 1
- flarum/framework
- 1
- IBM API Connect
- 1
- IBM Campaign
- 1
- IBM Cognos Analytics
- 1
- IBM Marketing Operations
- 1
- IBM Maximo Asset Management
- 1
- IBM MQ
- 1
High 6
- CVE-2018-15796Signing Key Extraction in Bits Service ReleaseCloud Foundry bits-service-release
- CVE-2018-1774IBM API Connect 5.0.0.0, 5.0.8.4, 2018.1 and 2018.3.6 is vulnerable to CSV injection via the developer portal and analytics that could contaIBM API Connect
- CVE-2018-1780IBM DB2 for Linux, UNIX and Windows (includes DB2 Connect Server) 9.7, 10.1, 10.5, and 11.1 could allow a local db2 instance owner to obtainIBM DB2 for Linux, UNIX and Windows
- CVE-2018-1781IBM DB2 for Linux, UNIX and Windows (includes DB2 Connect Server) 9.7, 10.1, 10.5, and 11.1 could allow a local user to obtain root access bIBM DB2 for Linux, UNIX and Windows
- CVE-2018-1802IBM DB2 for Linux, UNIX and Windows (includes DB2 Connect Server) 9.7, 10.1, 10.5, and 11.1 binaries load shared libraries from an untrustedIBM DB2 for Linux, UNIX and Windows
- CVE-2018-1834IBM DB2 for Linux, UNIX and Windows (includes DB2 Connect Server) 9.7, 10.1, 10.5, and 11.1 contains a vulnerability that could allow a locaIBM DB2 for Linux, UNIX and Windows
Medium, low and unrated 26
- CVE-2018-19145An issue was discovered in S-CMS v1.5.
- CVE-2018-17612Sennheiser HeadSetup 7.3.4903 places Certification Authority (CA) certificates into the Trusted Root CA store of the local system, and publi
- CVE-2018-19138WSTMart 2.0.7 has CSRF via the index.php/admin/staffs/add.html URI.
- CVE-2018-19139An issue has been found in JasPer 2.0.14.
- CVE-2018-14644An issue has been found in PowerDNS Recursor from 4.0.0 up to and including 4.1.4.[UNKNOWN] pdns
- CVE-2018-19136DomainMOD through 4.11.01 has XSS via the assets/edit/registrar-account.php raid parameter.
- CVE-2018-19137DomainMOD through 4.11.01 has XSS via the assets/edit/ip-address.php ipid parameter.
- CVE-2018-1872IBM Maximo Asset Management 7.6 is vulnerable to cross-site scripting.IBM Maximo Asset Management
- CVE-2018-19127A code injection vulnerability in /type.php in PHPCMS 2008 allows attackers to write arbitrary content to a website cache file with a contro
- CVE-2018-19121An issue has been found in libIEC61850 v1.3.
- CVE-2018-19122An issue has been found in libIEC61850 v1.3.
- CVE-2018-19124PrestaShop 1.6.x before 1.6.1.23 and 1.7.x before 1.7.4.4 on Windows allows remote attackers to write to arbitrary image files.
- CVE-2018-19125PrestaShop 1.6.x before 1.6.1.23 and 1.7.x before 1.7.4.4 allows remote attackers to delete an image directory.
- CVE-2018-19126PrestaShop 1.6.x before 1.6.1.23 and 1.7.x before 1.7.4.4 allows remote attackers to execute arbitrary code via a file upload.
- CVE-2018-19128In Libav 12.3, there is a heap-based buffer over-read in decode_frame in libavcodec/lcldec.c that allows an attacker to cause denial-of-serv
- CVE-2018-19129In Libav 12.3, a NULL pointer dereference (RIP points to zero) issue in ff_mpa_synth_filter_float in libavcodec/mpegaudiodsp_template.c can
- CVE-2018-19130In Libav 12.3, there is an invalid memory access in vc1_decode_frame in libavcodec/vc1dec.c that allows attackers to cause a denial-of-servi
- CVE-2018-19131Squid before 4.4 has XSS via a crafted X.509 certificate during HTTP(S) error page generation for certificate errors.
- CVE-2018-19132Squid before 4.4, when SNMP is enabled, allows a denial of service (Memory Leak) via an SNMP packet.
- CVE-2018-19133In Flarum Core 0.1.0-beta.7.1, a serious leak can get everyone's email address.flarum/framework
- CVE-2016-9749IBM Campaign 9.1.0, 9.1.2, 10.0, and 10.1 could allow an authenticated user with access to the local network to bypass security due to lack IBM Campaign
- CVE-2017-1119IBM Marketing Operations 9.1.0, 9.1.2, and 10.1 could allow a remote attacker to obtain sensitive information.IBM Marketing Operations
- CVE-2018-1684IBM WebSphere MQ 8.0 through 9.1 is vulnerable to a error with MQTT topic string publishing that can cause a denial of service attack.IBM MQ
- CVE-2018-1799IBM DB2 for Linux, UNIX and Windows (includes DB2 Connect Server) 9.7, 10.1, 10.5, and 11.1 could allow a local unprivileged user to overwriIBM DB2 for Linux, UNIX and Windows
- CVE-2018-1842IBM Cognos Analytics 11 Configuration tool, under certain circumstances, will bypass OIDC namespace signature verification on its id_token.IBM Cognos Analytics
- CVE-2018-1857IBM DB2 for Linux, UNIX and Windows (includes DB2 Connect Server) 11.1 could allow a user to bypass FGAC control and gain access to data theIBM DB2 for Linux, UNIX and Windows