# CVEs published 2018-11-09 32 CVEs were published on November 9, 2018: 0 critical, 6 high. Days are UTC. - [CVE-2018-19145](https://cve.now/CVE-2018-19145.md): An issue was discovered in S-CMS v1.5. (no CVSS) - [CVE-2018-15796](https://cve.now/CVE-2018-15796.md): Signing Key Extraction in Bits Service Release (CVSS 8.1, Cloud Foundry bits-service-release) - [CVE-2018-17612](https://cve.now/CVE-2018-17612.md): Sennheiser HeadSetup 7.3.4903 places Certification Authority (CA) certificates into the Trusted Root CA store of the local system, and publi (no CVSS) - [CVE-2018-19138](https://cve.now/CVE-2018-19138.md): WSTMart 2.0.7 has CSRF via the index.php/admin/staffs/add.html URI. (no CVSS) - [CVE-2018-19139](https://cve.now/CVE-2018-19139.md): An issue has been found in JasPer 2.0.14. (no CVSS) - [CVE-2018-14644](https://cve.now/CVE-2018-14644.md): An issue has been found in PowerDNS Recursor from 4.0.0 up to and including 4.1.4. (CVSS 5.3, \[UNKNOWN\] pdns) - [CVE-2018-19136](https://cve.now/CVE-2018-19136.md): DomainMOD through 4.11.01 has XSS via the assets/edit/registrar-account.php raid parameter. (no CVSS) - [CVE-2018-19137](https://cve.now/CVE-2018-19137.md): DomainMOD through 4.11.01 has XSS via the assets/edit/ip-address.php ipid parameter. (no CVSS) - [CVE-2018-1872](https://cve.now/CVE-2018-1872.md): IBM Maximo Asset Management 7.6 is vulnerable to cross-site scripting. (CVSS 5.4, IBM Maximo Asset Management) - [CVE-2018-19127](https://cve.now/CVE-2018-19127.md): A code injection vulnerability in /type.php in PHPCMS 2008 allows attackers to write arbitrary content to a website cache file with a contro (no CVSS) - [CVE-2018-19121](https://cve.now/CVE-2018-19121.md): An issue has been found in libIEC61850 v1.3. (no CVSS) - [CVE-2018-19122](https://cve.now/CVE-2018-19122.md): An issue has been found in libIEC61850 v1.3. (no CVSS) - [CVE-2018-19124](https://cve.now/CVE-2018-19124.md): PrestaShop 1.6.x before 1.6.1.23 and 1.7.x before 1.7.4.4 on Windows allows remote attackers to write to arbitrary image files. (no CVSS) - [CVE-2018-19125](https://cve.now/CVE-2018-19125.md): PrestaShop 1.6.x before 1.6.1.23 and 1.7.x before 1.7.4.4 allows remote attackers to delete an image directory. (no CVSS) - [CVE-2018-19126](https://cve.now/CVE-2018-19126.md): PrestaShop 1.6.x before 1.6.1.23 and 1.7.x before 1.7.4.4 allows remote attackers to execute arbitrary code via a file upload. (no CVSS) - [CVE-2018-19128](https://cve.now/CVE-2018-19128.md): In Libav 12.3, there is a heap-based buffer over-read in decode\_frame in libavcodec/lcldec.c that allows an attacker to cause denial-of-serv (no CVSS) - [CVE-2018-19129](https://cve.now/CVE-2018-19129.md): In Libav 12.3, a NULL pointer dereference (RIP points to zero) issue in ff\_mpa\_synth\_filter\_float in libavcodec/mpegaudiodsp\_template.c can (no CVSS) - [CVE-2018-19130](https://cve.now/CVE-2018-19130.md): In Libav 12.3, there is an invalid memory access in vc1\_decode\_frame in libavcodec/vc1dec.c that allows attackers to cause a denial-of-servi (no CVSS) - [CVE-2018-19131](https://cve.now/CVE-2018-19131.md): Squid before 4.4 has XSS via a crafted X.509 certificate during HTTP(S) error page generation for certificate errors. (no CVSS) - [CVE-2018-19132](https://cve.now/CVE-2018-19132.md): Squid before 4.4, when SNMP is enabled, allows a denial of service (Memory Leak) via an SNMP packet. (no CVSS) - [CVE-2018-19133](https://cve.now/CVE-2018-19133.md): In Flarum Core 0.1.0-beta.7.1, a serious leak can get everyone's email address. (no CVSS, flarum/framework) - [CVE-2016-9749](https://cve.now/CVE-2016-9749.md): IBM Campaign 9.1.0, 9.1.2, 10.0, and 10.1 could allow an authenticated user with access to the local network to bypass security due to lack (CVSS 4.0, IBM Campaign) - [CVE-2017-1119](https://cve.now/CVE-2017-1119.md): IBM Marketing Operations 9.1.0, 9.1.2, and 10.1 could allow a remote attacker to obtain sensitive information. (CVSS 4.3, IBM Marketing Operations) - [CVE-2018-1684](https://cve.now/CVE-2018-1684.md): IBM WebSphere MQ 8.0 through 9.1 is vulnerable to a error with MQTT topic string publishing that can cause a denial of service attack. (CVSS 5.3, IBM MQ) - [CVE-2018-1774](https://cve.now/CVE-2018-1774.md): IBM API Connect 5.0.0.0, 5.0.8.4, 2018.1 and 2018.3.6 is vulnerable to CSV injection via the developer portal and analytics that could conta (CVSS 8.9, IBM API Connect) - [CVE-2018-1780](https://cve.now/CVE-2018-1780.md): IBM DB2 for Linux, UNIX and Windows (includes DB2 Connect Server) 9.7, 10.1, 10.5, and 11.1 could allow a local db2 instance owner to obtain (CVSS 7.8, IBM DB2 for Linux, UNIX and Windows) - [CVE-2018-1781](https://cve.now/CVE-2018-1781.md): IBM DB2 for Linux, UNIX and Windows (includes DB2 Connect Server) 9.7, 10.1, 10.5, and 11.1 could allow a local user to obtain root access b (CVSS 8.4, IBM DB2 for Linux, UNIX and Windows) - [CVE-2018-1799](https://cve.now/CVE-2018-1799.md): IBM DB2 for Linux, UNIX and Windows (includes DB2 Connect Server) 9.7, 10.1, 10.5, and 11.1 could allow a local unprivileged user to overwri (CVSS 6.2, IBM DB2 for Linux, UNIX and Windows) - [CVE-2018-1802](https://cve.now/CVE-2018-1802.md): IBM DB2 for Linux, UNIX and Windows (includes DB2 Connect Server) 9.7, 10.1, 10.5, and 11.1 binaries load shared libraries from an untrusted (CVSS 8.4, IBM DB2 for Linux, UNIX and Windows) - [CVE-2018-1834](https://cve.now/CVE-2018-1834.md): IBM DB2 for Linux, UNIX and Windows (includes DB2 Connect Server) 9.7, 10.1, 10.5, and 11.1 contains a vulnerability that could allow a loca (CVSS 7.4, IBM DB2 for Linux, UNIX and Windows) - [CVE-2018-1842](https://cve.now/CVE-2018-1842.md): IBM Cognos Analytics 11 Configuration tool, under certain circumstances, will bypass OIDC namespace signature verification on its id\_token. (CVSS 3.6, IBM Cognos Analytics) - [CVE-2018-1857](https://cve.now/CVE-2018-1857.md): IBM DB2 for Linux, UNIX and Windows (includes DB2 Connect Server) 11.1 could allow a user to bypass FGAC control and gain access to data the (CVSS 4.8, IBM DB2 for Linux, UNIX and Windows) --- Source: cve.now, built and run by Sazabi (AI-native observability and security) Page: https://cve.now/daily/2018-11-09 Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.