# CVEs published 2018-11-15

42 CVEs were published on November 15, 2018: 0 critical, 0 high. Days are UTC.

- [CVE-2018-19301](https://cve.now/CVE-2018-19301.md): tp4a TELEPORT 3.1.0 allows XSS via the login page because a crafted username is mishandled when an administrator later views the system log. (no CVSS)
- [CVE-2018-5407](https://cve.now/CVE-2018-5407.md): Simultaneous Multi-threading (SMT) in processors can enable local users to exploit software vulnerable to timing attacks via a side-channel (no CVSS, Processors supporting Simultaneous Multi-Threading)
- [CVE-2018-14934](https://cve.now/CVE-2018-14934.md): The Bluetooth subsystem on Polycom Trio devices with software before 5.5.4 has Incorrect Access Control. (no CVSS)
- [CVE-2018-14935](https://cve.now/CVE-2018-14935.md): The Web administration console on Polycom Trio devices with software before 5.5.4 has XSS. (no CVSS)
- [CVE-2018-16619](https://cve.now/CVE-2018-16619.md): Sonatype Nexus Repository Manager before 3.14 allows XSS. (no CVSS)
- [CVE-2018-16620](https://cve.now/CVE-2018-16620.md): Sonatype Nexus Repository Manager before 3.14 has Incorrect Access Control. (no CVSS)
- [CVE-2018-16621](https://cve.now/CVE-2018-16621.md): Sonatype Nexus Repository Manager before 3.14 allows Java Expression Language Injection. (no CVSS)
- [CVE-2018-18954](https://cve.now/CVE-2018-18954.md): The pnv\_lpc\_do\_eccb function in hw/ppc/pnv\_lpc.c in Qemu before 3.1 allows out-of-bounds write or read access to PowerNV memory. (no CVSS)
- [CVE-2018-8529](https://cve.now/CVE-2018-8529.md): A remote code execution vulnerability exists when Team Foundation Server (TFS) does not enable basic authorization on the communication betw (no CVSS, Microsoft Team)
- [CVE-2018-1643](https://cve.now/CVE-2018-1643.md): The Installation Verification Tool of IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 is vulnerable to cross-site scripting. (CVSS 6.1, IBM WebSphere Application Server)
- [CVE-2018-0673](https://cve.now/CVE-2018-0673.md): Directory traversal vulnerability in Cybozu Garoon 3.5.0 to 4.6.3 allows authenticated attackers to read arbitrary files via unspecified vec (no CVSS, Cybozu Garoon)
- [CVE-2018-0679](https://cve.now/CVE-2018-0679.md): Cross-site scripting vulnerability in multiple FXC Inc. (no CVSS, multiple FXC Inc. network devices (Managed Ethernet switch…)
- [CVE-2018-0680](https://cve.now/CVE-2018-0680.md): Denbun by NEOJAPAN Inc. (no CVSS, Denbun by NEOJAPAN Inc.)
- [CVE-2018-0681](https://cve.now/CVE-2018-0681.md): Denbun by NEOJAPAN Inc. (no CVSS, Denbun by NEOJAPAN Inc.)
- [CVE-2018-0682](https://cve.now/CVE-2018-0682.md): Denbun by NEOJAPAN Inc. (no CVSS, Denbun by NEOJAPAN Inc.)
- [CVE-2018-0683](https://cve.now/CVE-2018-0683.md): Buffer overflow in Denbun by NEOJAPAN Inc. (no CVSS, Denbun by NEOJAPAN Inc.)
- [CVE-2018-0684](https://cve.now/CVE-2018-0684.md): Buffer overflow in Denbun by NEOJAPAN Inc. (no CVSS, Denbun by NEOJAPAN Inc.)
- [CVE-2018-0685](https://cve.now/CVE-2018-0685.md): SQL injection vulnerability in the Denbun POP version V3.3P R4.0 and earlier allows remote authenticated attackers to execute arbitrary SQL (no CVSS, NEOJAPAN Denbun POP)
- [CVE-2018-0686](https://cve.now/CVE-2018-0686.md): Denbun by NEOJAPAN Inc. (no CVSS, Denbun by NEOJAPAN Inc.)
- [CVE-2018-0687](https://cve.now/CVE-2018-0687.md): Cross-site scripting vulnerability in Denbun by NEOJAPAN Inc. (no CVSS, Denbun by NEOJAPAN Inc.)
- [CVE-2018-0690](https://cve.now/CVE-2018-0690.md): An unvalidated software update vulnerability in Music Center for PC version 1.0.02 and earlier could allow a man-in-the-middle attacker to t (no CVSS, Sony Video & Sound Products Music Center for PC)
- [CVE-2018-0691](https://cve.now/CVE-2018-0691.md): Multiple +Message Apps (Softbank +Message App for Android prior to version 10.1.7, Softbank +Message App for iOS prior to version 1.1.23, NT (no CVSS, Softbank, NTT docomo, KDDI Multiple +Message Apps)
- [CVE-2018-0692](https://cve.now/CVE-2018-0692.md): Untrusted search path vulnerability in Baidu Browser Version 43.23.1000.500 and earlier allows an attacker to gain privileges via a Trojan h (no CVSS, Baidu Browser)
- [CVE-2018-0693](https://cve.now/CVE-2018-0693.md): Directory traversal vulnerability in FileZen V3.0.0 to V4.2.1 allows remote attackers to upload an arbitrary file in the specific directory (no CVSS, Soliton Systems K.K. FileZen)
- [CVE-2018-0694](https://cve.now/CVE-2018-0694.md): FileZen V3.0.0 to V4.2.1 allows remote attackers to execute arbitrary OS commands via unspecified vectors. (no CVSS, Soliton Systems K.K. FileZen)
- [CVE-2018-0695](https://cve.now/CVE-2018-0695.md): Cross-site scripting vulnerability in User-friendly SVN (USVN) Version 1.0.7 and earlier allows remote attackers to inject arbitrary web scr (no CVSS, USVN Team User-friendly SVN)
- [CVE-2018-0697](https://cve.now/CVE-2018-0697.md): Cross-site scripting vulnerability in Metabase version 0.29.3 and earlier allows remote attackers to inject arbitrary web script or HTML via (no CVSS, Metabase)
- [CVE-2018-0699](https://cve.now/CVE-2018-0699.md): Cross-site scripting vulnerability in YukiWiki 2.1.3 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecif (no CVSS, Hiroshi Yuki YukiWiki)
- [CVE-2018-0700](https://cve.now/CVE-2018-0700.md): YukiWiki 2.1.3 and earlier does not process a particular request properly that may allow consumption of large amounts of CPU and memory reso (no CVSS, Hiroshi Yuki YukiWiki)
- [CVE-2018-0701](https://cve.now/CVE-2018-0701.md): BlueStacks App Player (BlueStacks App Player for Windows 3.0.0 to 4.31.55, BlueStacks App Player for macOS 2.0.0 and later) allows an attack (no CVSS, BlueStacks App Player)
- [CVE-2018-12543](https://cve.now/CVE-2018-12543.md): In Eclipse Mosquitto versions 1.5 to 1.5.2 inclusive, if a message is published to Mosquitto that has a topic starting with $, but that is n (no CVSS, The Eclipse Foundation Eclipse Mosquitto)
- [CVE-2018-16160](https://cve.now/CVE-2018-16160.md): SecureCore Standard Edition Version 2.x allows an attacker to bypass the product 's authentication to log in to a Windows PC. (no CVSS, Feitian Japan Co. SecureCore Standard Edition)
- [CVE-2018-16161](https://cve.now/CVE-2018-16161.md): OpenDolphin 2.7.0 and earlier allows authenticated users to gain administrative privileges and perform unintended operations. (no CVSS, Life Sciences Computing OpenDolphin)
- [CVE-2018-16162](https://cve.now/CVE-2018-16162.md): OpenDolphin 2.7.0 and earlier allows authenticated attackers to obtain other users credentials such as a user ID and/or its password via uns (no CVSS, Life Sciences Computing OpenDolphin)
- [CVE-2018-16163](https://cve.now/CVE-2018-16163.md): OpenDolphin 2.7.0 and earlier allows authenticated attackers to bypass authentication to create and/or delete other users accounts via unspe (no CVSS, Life Sciences Computing OpenDolphin)
- [CVE-2018-12480](https://cve.now/CVE-2018-12480.md): NetIQ Access Manager XSS vulnerability in versions prior to 4.4 SP3 (no CVSS, NetIQ eDirectory NetIQ Access Manager)
- [CVE-2018-19288](https://cve.now/CVE-2018-19288.md): Zoho ManageEngine OpManager 12.3 before Build 123223 has XSS via the updateWidget API. (no CVSS)
- [CVE-2018-19289](https://cve.now/CVE-2018-19289.md): An issue was discovered in Valine v1.3.3. (no CVSS, valine)
- [CVE-2018-19291](https://cve.now/CVE-2018-19291.md): An issue was discovered in DiliCMS 2.4.0. (no CVSS)
- [CVE-2015-9274](https://cve.now/CVE-2015-9274.md): HarfBuzz before 1.0.4 allows remote attackers to cause a denial of service (invalid read of two bytes and application crash) because of GPOS (no CVSS)
- [CVE-2018-19286](https://cve.now/CVE-2018-19286.md): The server in mubu note 2018-11-11 has XSS by configuring an account with a crafted name value (along with an arbitrary username value), and (no CVSS)
- [CVE-2018-19287](https://cve.now/CVE-2018-19287.md): XSS in the Ninja Forms plugin before 3.3.18 for WordPress allows Remote Attackers to execute JavaScript via the includes/Admin/Menus/Submiss (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2018-11-15
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.