CVEs published November 15, 2018
42 CVEs were published on November 15, 2018: 0 critical, 0 high.
- Published
- 42
- Critical
- 0
- High
- 0
- Medium
- 1
- Low
- 0
- Unrated
- 41
- Now in CISA KEV
- 0
- Fix available
- 2
Most affected products
- Denbun by NEOJAPAN Inc.
- 7
- Life Sciences Computing OpenDolphin
- 3
- Hiroshi Yuki YukiWiki
- 2
- Soliton Systems K.K. FileZen
- 2
- Baidu Browser
- 1
- BlueStacks App Player
- 1
- Cybozu Garoon
- 1
- Feitian Japan Co. SecureCore Standard Edition
- 1
- IBM WebSphere Application Server
- 1
- Metabase
- 1
Medium, low and unrated 42
- CVE-2018-19301tp4a TELEPORT 3.1.0 allows XSS via the login page because a crafted username is mishandled when an administrator later views the system log.
- CVE-2018-5407Simultaneous Multi-threading (SMT) in processors can enable local users to exploit software vulnerable to timing attacks via a side-channel Processors supporting Simultaneous Multi-Threading
- CVE-2018-14934The Bluetooth subsystem on Polycom Trio devices with software before 5.5.4 has Incorrect Access Control.
- CVE-2018-14935The Web administration console on Polycom Trio devices with software before 5.5.4 has XSS.
- CVE-2018-16619Sonatype Nexus Repository Manager before 3.14 allows XSS.
- CVE-2018-16620Sonatype Nexus Repository Manager before 3.14 has Incorrect Access Control.
- CVE-2018-16621Sonatype Nexus Repository Manager before 3.14 allows Java Expression Language Injection.
- CVE-2018-18954The pnv_lpc_do_eccb function in hw/ppc/pnv_lpc.c in Qemu before 3.1 allows out-of-bounds write or read access to PowerNV memory.
- CVE-2018-8529A remote code execution vulnerability exists when Team Foundation Server (TFS) does not enable basic authorization on the communication betwMicrosoft Team
- CVE-2018-1643The Installation Verification Tool of IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 is vulnerable to cross-site scripting.IBM WebSphere Application Server
- CVE-2018-0673Directory traversal vulnerability in Cybozu Garoon 3.5.0 to 4.6.3 allows authenticated attackers to read arbitrary files via unspecified vecCybozu Garoon
- CVE-2018-0679Cross-site scripting vulnerability in multiple FXC Inc.multiple FXC Inc. network devices (Managed Ethernet switch…
- CVE-2018-0680Denbun by NEOJAPAN Inc.Denbun by NEOJAPAN Inc.
- CVE-2018-0681Denbun by NEOJAPAN Inc.Denbun by NEOJAPAN Inc.
- CVE-2018-0682Denbun by NEOJAPAN Inc.Denbun by NEOJAPAN Inc.
- CVE-2018-0683Buffer overflow in Denbun by NEOJAPAN Inc.Denbun by NEOJAPAN Inc.
- CVE-2018-0684Buffer overflow in Denbun by NEOJAPAN Inc.Denbun by NEOJAPAN Inc.
- CVE-2018-0685SQL injection vulnerability in the Denbun POP version V3.3P R4.0 and earlier allows remote authenticated attackers to execute arbitrary SQL NEOJAPAN Denbun POP
- CVE-2018-0686Denbun by NEOJAPAN Inc.Denbun by NEOJAPAN Inc.
- CVE-2018-0687Cross-site scripting vulnerability in Denbun by NEOJAPAN Inc.Denbun by NEOJAPAN Inc.
- CVE-2018-0690An unvalidated software update vulnerability in Music Center for PC version 1.0.02 and earlier could allow a man-in-the-middle attacker to tSony Video & Sound Products Music Center for PC
- CVE-2018-0691Multiple +Message Apps (Softbank +Message App for Android prior to version 10.1.7, Softbank +Message App for iOS prior to version 1.1.23, NTSoftbank, NTT docomo, KDDI Multiple +Message Apps
- CVE-2018-0692Untrusted search path vulnerability in Baidu Browser Version 43.23.1000.500 and earlier allows an attacker to gain privileges via a Trojan hBaidu Browser
- CVE-2018-0693Directory traversal vulnerability in FileZen V3.0.0 to V4.2.1 allows remote attackers to upload an arbitrary file in the specific directory Soliton Systems K.K. FileZen
- CVE-2018-0694FileZen V3.0.0 to V4.2.1 allows remote attackers to execute arbitrary OS commands via unspecified vectors.Soliton Systems K.K. FileZen
- CVE-2018-0695Cross-site scripting vulnerability in User-friendly SVN (USVN) Version 1.0.7 and earlier allows remote attackers to inject arbitrary web scrUSVN Team User-friendly SVN
- CVE-2018-0697Cross-site scripting vulnerability in Metabase version 0.29.3 and earlier allows remote attackers to inject arbitrary web script or HTML viaMetabase
- CVE-2018-0699Cross-site scripting vulnerability in YukiWiki 2.1.3 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecifHiroshi Yuki YukiWiki
- CVE-2018-0700YukiWiki 2.1.3 and earlier does not process a particular request properly that may allow consumption of large amounts of CPU and memory resoHiroshi Yuki YukiWiki
- CVE-2018-0701BlueStacks App Player (BlueStacks App Player for Windows 3.0.0 to 4.31.55, BlueStacks App Player for macOS 2.0.0 and later) allows an attackBlueStacks App Player
- CVE-2018-12543In Eclipse Mosquitto versions 1.5 to 1.5.2 inclusive, if a message is published to Mosquitto that has a topic starting with $, but that is nThe Eclipse Foundation Eclipse Mosquitto
- CVE-2018-16160SecureCore Standard Edition Version 2.x allows an attacker to bypass the product 's authentication to log in to a Windows PC.Feitian Japan Co. SecureCore Standard Edition
- CVE-2018-16161OpenDolphin 2.7.0 and earlier allows authenticated users to gain administrative privileges and perform unintended operations.Life Sciences Computing OpenDolphin
- CVE-2018-16162OpenDolphin 2.7.0 and earlier allows authenticated attackers to obtain other users credentials such as a user ID and/or its password via unsLife Sciences Computing OpenDolphin
- CVE-2018-16163OpenDolphin 2.7.0 and earlier allows authenticated attackers to bypass authentication to create and/or delete other users accounts via unspeLife Sciences Computing OpenDolphin
- CVE-2018-12480NetIQ Access Manager XSS vulnerability in versions prior to 4.4 SP3NetIQ eDirectory NetIQ Access Manager
- CVE-2018-19288Zoho ManageEngine OpManager 12.3 before Build 123223 has XSS via the updateWidget API.
- CVE-2018-19289An issue was discovered in Valine v1.3.3.valine
- CVE-2018-19291An issue was discovered in DiliCMS 2.4.0.
- CVE-2015-9274HarfBuzz before 1.0.4 allows remote attackers to cause a denial of service (invalid read of two bytes and application crash) because of GPOS
- CVE-2018-19286The server in mubu note 2018-11-11 has XSS by configuring an account with a crafted name value (along with an arbitrary username value), and
- CVE-2018-19287XSS in the Ninja Forms plugin before 3.3.18 for WordPress allows Remote Attackers to execute JavaScript via the includes/Admin/Menus/Submiss