# CVEs published 2018-11-13

38 CVEs were published on November 13, 2018: 0 critical, 4 high. Days are UTC.

- [CVE-2018-16470](https://cve.now/CVE-2018-16470.md): There is a possible DoS vulnerability in the multipart parser in Rack before 2.0.6. (no CVSS, Rack)
- [CVE-2018-16471](https://cve.now/CVE-2018-16471.md): There is a possible XSS vulnerability in Rack before 2.0.6 and 1.6.11. (no CVSS, Rack)
- [CVE-2018-6980](https://cve.now/CVE-2018-6980.md): VMware vRealize Log Insight (4.7.x before 4.7.1 and 4.6.x before 4.6.2) contains a vulnerability due to improper authorization in the user r (no CVSS, VMware vRealize Log Insight)
- [CVE-2018-17614](https://cve.now/CVE-2018-17614.md): This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Losant Arduino MQTT Client prior to V2.7 (no CVSS, Losant Arduino MQTT Client)
- [CVE-2018-8009](https://cve.now/CVE-2018-8009.md): Apache Hadoop 3.1.0, 3.0.0-alpha to 3.0.2, 2.9.0 to 2.9.1, 2.8.0 to 2.8.4, 2.0.0-alpha to 2.7.6, 0.23.0 to 0.23.11 is exploitable via the zi (no CVSS, Apache Software Foundation Apache Hadoop · org.apache.hadoo…)
- [CVE-2018-2473](https://cve.now/CVE-2018-2473.md): SAP BusinessObjects Business Intelligence Platform Server, versions 4.1 and 4.2, when using Web Intelligence Richclient 3 tiers mode gateway (no CVSS, SAP BusinessObjects Business Intelligence Platform Server)
- [CVE-2018-2476](https://cve.now/CVE-2018-2476.md): Due to insufficient URL Validation in forums in SAP NetWeaver versions 7.30, 7.31, 7.40, an attacker can redirect users to a malicious site. (no CVSS, SAP NetWeaver)
- [CVE-2018-2477](https://cve.now/CVE-2018-2477.md): Knowledge Management (XMLForms) in SAP NetWeaver, versions 7.30, 7.31, 7.40 and 7.50 does not sufficiently validate an XML document accepted (no CVSS, Knowledge Management (XMLForms) in SAP NetWeaver)
- [CVE-2018-2478](https://cve.now/CVE-2018-2478.md): An attacker can use specially crafted inputs to execute commands on the host of a TREX / BWA installation, SAP Basis, versions: 7.0 to 7.02, (no CVSS, SAP Basis)
- [CVE-2018-2479](https://cve.now/CVE-2018-2479.md): SAP BusinessObjects Business Intelligence Platform (BIWorkspace), versions 4.1 and 4.2, does not sufficiently encode user-controlled inputs, (no CVSS, SAP BusinessObjects Business Intelligence Platform)
- [CVE-2018-2481](https://cve.now/CVE-2018-2481.md): In some SAP standard roles, in SAP\_ABA versions, 7.00 to 7.02, 7.10 to 7.11, 7.30, 7.31, 7.40, 7.50, 75C to 75D, a transaction code reserved (no CVSS, SAP\_ABA)
- [CVE-2018-2482](https://cve.now/CVE-2018-2482.md): SAP Mobile Secure Android Application, Mobile-secure.apk Android client, before version 6.60.19942.0, allows an attacker to prevent legitima (no CVSS, SAP Mobile Secure Android Application)
- [CVE-2018-2483](https://cve.now/CVE-2018-2483.md): HTTP Verb Tampering is possible in SAP BusinessObjects Business Intelligence Platform, versions 4.1 and 4.2, Central Management Console (CMC (no CVSS, SAP BusinessObjects Business Intelligence Platform)
- [CVE-2018-2485](https://cve.now/CVE-2018-2485.md): It is possible for a malicious application or malware to execute JavaScript in a SAP Fiori application. (no CVSS, SAP Fiori Client)
- [CVE-2018-2487](https://cve.now/CVE-2018-2487.md): SAP Disclosure Management 10.x allows an attacker to exploit through a specially crafted zip file provided by users: When extracted in speci (no CVSS, SAP Disclosure Management)
- [CVE-2018-2488](https://cve.now/CVE-2018-2488.md): It is possible for a malware application installed on an Android device to send local push notifications with an empty message to SAP Fiori (no CVSS, SAP Fiori Client)
- [CVE-2018-2489](https://cve.now/CVE-2018-2489.md): Locally, without any permission, an arbitrary android application could delete the SSO configuration of SAP Fiori Client. (no CVSS, SAP Fiori Client)
- [CVE-2018-2490](https://cve.now/CVE-2018-2490.md): The broadcast messages received by SAP Fiori Client are not protected by permissions. (no CVSS, SAP Fiori Client)
- [CVE-2018-2491](https://cve.now/CVE-2018-2491.md): When opening a deep link URL in SAP Fiori Client with log level set to "Debug", the client application logs the URL to the log file. (no CVSS, SAP Fiori Client)
- [CVE-2018-12416](https://cve.now/CVE-2018-12416.md): TIBCO DataSynapse GridServer Manager Component Vulnerable to Cross-Site Request Forgery (CVSS 7.1, TIBCO Software TIBCO DataSynapse GridServer Manager)
- [CVE-2018-14655](https://cve.now/CVE-2018-14655.md): A flaw was found in Keycloak 3.4.3.Final, 4.0.0.Beta2, 4.3.0.Final. (CVSS 4.6, Red Hat keycloak · org.keycloak:keycloak-parent)
- [CVE-2018-14657](https://cve.now/CVE-2018-14657.md): A flaw was found in Keycloak 4.2.1.Final, 4.3.0.Final. (CVSS 5.4, Red Hat keycloak · org.keycloak:keycloak-parent)
- [CVE-2018-14658](https://cve.now/CVE-2018-14658.md): A flaw was found in JBOSS Keycloak 3.2.1.Final. (CVSS 6.1, Red Hat keycloak · org.keycloak:keycloak-core)
- [CVE-2018-7910](https://cve.now/CVE-2018-7910.md): Some Huawei smartphones ALP-AL00B 8.0.0.118D(C00), ALP-TL00B 8.0.0.118D(C01), BLA-AL00B 8.0.0.118D(C00), BLA-L09C 8.0.0.127(C432), 8.0.0.128 (no CVSS, Huawei Technologies Co. ALP-AL00B, ALP-TL00B, BLA-AL00B, BL…)
- [CVE-2018-7925](https://cve.now/CVE-2018-7925.md): The radio module of some Huawei smartphones Emily-AL00A The versions before 8.1.0.171(C00) have a lock-screen bypass vulnerability. (no CVSS, Huawei Technologies Co. Emily-AL00A)
- [CVE-2018-7926](https://cve.now/CVE-2018-7926.md): Huawei Watch 2 with versions and earlier than OWDD.180707.001.E1 have an improper authorization vulnerability. (no CVSS, Huawei Technologies Co. Huawei Watch)
- [CVE-2018-6260](https://cve.now/CVE-2018-6260.md): NVIDIA graphics driver contains a vulnerability that may allow access to application data processed on the GPU through a side channel expose (no CVSS, Nvidia GPU Graphics Driver)
- [CVE-2018-16850](https://cve.now/CVE-2018-16850.md): postgresql before versions 11.1, 10.6 is vulnerable to a to SQL injection in pg\_upgrade and pg\_dump via CREATE TRIGGER ... (CVSS 8.0, The PostgreSQL Project postgresql)
- [CVE-2018-17187](https://cve.now/CVE-2018-17187.md): The Apache Qpid Proton-J transport includes an optional wrapper layer to perform TLS, enabled by use of the 'transport.ssl(...)' methods. (no CVSS, Apache Software Foundation Apache Qpid Proton-J · org.apach…)
- [CVE-2018-1792](https://cve.now/CVE-2018-1792.md): IBM WebSphere MQ 8.0.0.0 through 8.0.0.10, 9.0.0.0 through 9.0.0.5, 9.0.1 through 9.0.5, and 9.1.0.0 could allow a local user to inject code (CVSS 8.8, IBM MQ)
- [CVE-2018-1808](https://cve.now/CVE-2018-1808.md): IBM WebSphere Commerce 9.0.0.0 through 9.0.0.6 could allow some server-side code injection due to inadequate input control. (CVSS 4.3, IBM WebSphere Commerce)
- [CVE-2018-15452](https://cve.now/CVE-2018-15452.md): Cisco Advanced Malware Protection for Endpoints on Windows DLL Preloading Vulnerability (CVSS 5.5, Cisco AMP for Endpoints)
- [CVE-2018-15771](https://cve.now/CVE-2018-15771.md): Dell EMC RecoverPoint Information Disclosure Vulnerability (no CVSS, Dell EMC RecoverPoint)
- [CVE-2018-15772](https://cve.now/CVE-2018-15772.md): Dell EMC RecoverPoint Uncontrolled Resource Consumption Vulnerability (no CVSS, Dell EMC RecoverPoint)
- [CVE-2018-15795](https://cve.now/CVE-2018-15795.md): CredHub Service Broker uses guessable client secret (CVSS 8.1, Pivotal Cloud Foundry CredHub Service Broker · org.springfr…)
- [CVE-2018-18591](https://cve.now/CVE-2018-18591.md): MFSBGN03823 rev.1 - Micro Focus Service Manager, unauthorized disclosure of data (CVSS 6.8, Micro Focus Service Manager)
- [CVE-2018-19246](https://cve.now/CVE-2018-19246.md): PHP-Proxy 5.1.0 allows remote attackers to read local files if the default "pre-installed version" (intended for users who lack shell access (no CVSS, athlon1600/php-proxy)
- [CVE-2018-19244](https://cve.now/CVE-2018-19244.md): An XML External Entity (XXE) vulnerability exists in the Charles 4.2.7 import/export setup option. (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2018-11-13
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.