CVEs published November 13, 2018
38 CVEs were published on November 13, 2018: 0 critical, 4 high.
- Published
- 38
- Critical
- 0
- High
- 4
- Medium
- 6
- Low
- 0
- Unrated
- 28
- Now in CISA KEV
- 0
- Fix available
- 14
Most affected products
- SAP Fiori Client
- 5
- Dell EMC RecoverPoint
- 2
- Rack
- 2
- Red Hat keycloak · org.keycloak:keycloak-parent
- 2
- SAP BusinessObjects Business Intelligence Platform
- 2
- Apache Software Foundation Apache Hadoop · org.apache.hadoo…
- 1
- Apache Software Foundation Apache Qpid Proton-J · org.apach…
- 1
- athlon1600/php-proxy
- 1
- Cisco AMP for Endpoints
- 1
- Huawei Technologies Co. ALP-AL00B, ALP-TL00B, BLA-AL00B, BL…
- 1
High 4
- CVE-2018-12416TIBCO DataSynapse GridServer Manager Component Vulnerable to Cross-Site Request ForgeryTIBCO Software TIBCO DataSynapse GridServer Manager
- CVE-2018-16850postgresql before versions 11.1, 10.6 is vulnerable to a to SQL injection in pg_upgrade and pg_dump via CREATE TRIGGER ...The PostgreSQL Project postgresql
- CVE-2018-1792IBM WebSphere MQ 8.0.0.0 through 8.0.0.10, 9.0.0.0 through 9.0.0.5, 9.0.1 through 9.0.5, and 9.1.0.0 could allow a local user to inject codeIBM MQ
- CVE-2018-15795CredHub Service Broker uses guessable client secretPivotal Cloud Foundry CredHub Service Broker · org.springfr…
Medium, low and unrated 34
- CVE-2018-16470There is a possible DoS vulnerability in the multipart parser in Rack before 2.0.6.Rack
- CVE-2018-16471There is a possible XSS vulnerability in Rack before 2.0.6 and 1.6.11.Rack
- CVE-2018-6980VMware vRealize Log Insight (4.7.x before 4.7.1 and 4.6.x before 4.6.2) contains a vulnerability due to improper authorization in the user rVMware vRealize Log Insight
- CVE-2018-17614This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Losant Arduino MQTT Client prior to V2.7Losant Arduino MQTT Client
- CVE-2018-8009Apache Hadoop 3.1.0, 3.0.0-alpha to 3.0.2, 2.9.0 to 2.9.1, 2.8.0 to 2.8.4, 2.0.0-alpha to 2.7.6, 0.23.0 to 0.23.11 is exploitable via the ziApache Software Foundation Apache Hadoop · org.apache.hadoo…
- CVE-2018-2473SAP BusinessObjects Business Intelligence Platform Server, versions 4.1 and 4.2, when using Web Intelligence Richclient 3 tiers mode gatewaySAP BusinessObjects Business Intelligence Platform Server
- CVE-2018-2476Due to insufficient URL Validation in forums in SAP NetWeaver versions 7.30, 7.31, 7.40, an attacker can redirect users to a malicious site.SAP NetWeaver
- CVE-2018-2477Knowledge Management (XMLForms) in SAP NetWeaver, versions 7.30, 7.31, 7.40 and 7.50 does not sufficiently validate an XML document acceptedKnowledge Management (XMLForms) in SAP NetWeaver
- CVE-2018-2478An attacker can use specially crafted inputs to execute commands on the host of a TREX / BWA installation, SAP Basis, versions: 7.0 to 7.02,SAP Basis
- CVE-2018-2479SAP BusinessObjects Business Intelligence Platform (BIWorkspace), versions 4.1 and 4.2, does not sufficiently encode user-controlled inputs,SAP BusinessObjects Business Intelligence Platform
- CVE-2018-2481In some SAP standard roles, in SAP_ABA versions, 7.00 to 7.02, 7.10 to 7.11, 7.30, 7.31, 7.40, 7.50, 75C to 75D, a transaction code reservedSAP_ABA
- CVE-2018-2482SAP Mobile Secure Android Application, Mobile-secure.apk Android client, before version 6.60.19942.0, allows an attacker to prevent legitimaSAP Mobile Secure Android Application
- CVE-2018-2483HTTP Verb Tampering is possible in SAP BusinessObjects Business Intelligence Platform, versions 4.1 and 4.2, Central Management Console (CMCSAP BusinessObjects Business Intelligence Platform
- CVE-2018-2485It is possible for a malicious application or malware to execute JavaScript in a SAP Fiori application.SAP Fiori Client
- CVE-2018-2487SAP Disclosure Management 10.x allows an attacker to exploit through a specially crafted zip file provided by users: When extracted in speciSAP Disclosure Management
- CVE-2018-2488It is possible for a malware application installed on an Android device to send local push notifications with an empty message to SAP Fiori SAP Fiori Client
- CVE-2018-2489Locally, without any permission, an arbitrary android application could delete the SSO configuration of SAP Fiori Client.SAP Fiori Client
- CVE-2018-2490The broadcast messages received by SAP Fiori Client are not protected by permissions.SAP Fiori Client
- CVE-2018-2491When opening a deep link URL in SAP Fiori Client with log level set to "Debug", the client application logs the URL to the log file.SAP Fiori Client
- CVE-2018-14655A flaw was found in Keycloak 3.4.3.Final, 4.0.0.Beta2, 4.3.0.Final.Red Hat keycloak · org.keycloak:keycloak-parent
- CVE-2018-14657A flaw was found in Keycloak 4.2.1.Final, 4.3.0.Final.Red Hat keycloak · org.keycloak:keycloak-parent
- CVE-2018-14658A flaw was found in JBOSS Keycloak 3.2.1.Final.Red Hat keycloak · org.keycloak:keycloak-core
- CVE-2018-7910Some Huawei smartphones ALP-AL00B 8.0.0.118D(C00), ALP-TL00B 8.0.0.118D(C01), BLA-AL00B 8.0.0.118D(C00), BLA-L09C 8.0.0.127(C432), 8.0.0.128Huawei Technologies Co. ALP-AL00B, ALP-TL00B, BLA-AL00B, BL…
- CVE-2018-7925The radio module of some Huawei smartphones Emily-AL00A The versions before 8.1.0.171(C00) have a lock-screen bypass vulnerability.Huawei Technologies Co. Emily-AL00A
- CVE-2018-7926Huawei Watch 2 with versions and earlier than OWDD.180707.001.E1 have an improper authorization vulnerability.Huawei Technologies Co. Huawei Watch
- CVE-2018-6260NVIDIA graphics driver contains a vulnerability that may allow access to application data processed on the GPU through a side channel exposeNvidia GPU Graphics Driver
- CVE-2018-17187The Apache Qpid Proton-J transport includes an optional wrapper layer to perform TLS, enabled by use of the 'transport.ssl(...)' methods.Apache Software Foundation Apache Qpid Proton-J · org.apach…
- CVE-2018-1808IBM WebSphere Commerce 9.0.0.0 through 9.0.0.6 could allow some server-side code injection due to inadequate input control.IBM WebSphere Commerce
- CVE-2018-15452Cisco Advanced Malware Protection for Endpoints on Windows DLL Preloading VulnerabilityCisco AMP for Endpoints
- CVE-2018-15771Dell EMC RecoverPoint Information Disclosure VulnerabilityDell EMC RecoverPoint
- CVE-2018-15772Dell EMC RecoverPoint Uncontrolled Resource Consumption VulnerabilityDell EMC RecoverPoint
- CVE-2018-18591MFSBGN03823 rev.1 - Micro Focus Service Manager, unauthorized disclosure of dataMicro Focus Service Manager
- CVE-2018-19246PHP-Proxy 5.1.0 allows remote attackers to read local files if the default "pre-installed version" (intended for users who lack shell accessathlon1600/php-proxy
- CVE-2018-19244An XML External Entity (XXE) vulnerability exists in the Charles 4.2.7 import/export setup option.