CVEs published November 16, 2018
39 CVEs were published on November 16, 2018: 2 critical, 1 high.
- Published
- 39
- Critical
- 2
- High
- 1
- Medium
- 4
- Low
- 0
- Unrated
- 32
- Now in CISA KEV
- 0
- Fix available
- 8
Most affected products
- ZTE ZXHN F670
- 5
- centreon/centreon
- 2
- Lenovo Chassis Management Module
- 2
- IBM Jazz Reporting Service
- 1
- IBM WebSphere Application Server
- 1
- Lenovo System x UEFI · IBM System x UEFI
- 1
- Lenovo ThinkServer BMC
- 1
- openssl
- 1
- phpmailer/phpmailer
- 1
Critical 2
- CVE-2018-7359All versions up to V1.1.10P3T18 of ZTE ZXHN F670 product are impacted by heap-based buffer overflow vulnerability, which may allow an attackZTE ZXHN F670
- CVE-2018-7360All versions up to V1.1.10P3T18 of ZTE ZXHN F670 product are impacted by information exposure vulnerability, which may allow an unauthenticaZTE ZXHN F670
High 1
Medium, low and unrated 36
- CVE-2018-15769RSA BSAFE Micro Edition Suite versions prior to 4.0.11 (in 4.0.x series) and versions prior to 4.1.6.2 (in 4.1.x series) contain a key manag
- CVE-2018-18955In the Linux kernel 4.15.x through 4.19.x before 4.19.2, map_write() in kernel/user_namespace.c allows privilege escalation because it misha
- CVE-2018-19311Centreon 3.4.x (fixed in Centreon 18.10.0) allows XSS via the Service field to the main.php?p=20201 URI, as demonstrated by the "Monitoring centreon/centreon
- CVE-2018-19312Centreon 3.4.x (fixed in Centreon 18.10.0 and Centreon web 2.8.24) allows SQL Injection via the searchVM parameter to the main.php?p=20408 Ucentreon/centreon
- CVE-2018-19318SRCMS 3.0.0 allows CSRF via admin.php?m=Admin&c=manager&a=update to change the username and password of the super administrator account.
- CVE-2018-19319SRCMS 3.0.0 allows CSRF via admin.php?m=Admin&c=gifts&a=update to change goods prices with the super administrator's privileges.
- CVE-2018-15692Inova Partner 5.0.5-RELEASE, Build 0510-0906 and earlier allows authenticated users authorization bypass and data manipulation in certain fu
- CVE-2018-15693Inova Partner 5.0.5-RELEASE, Build 0510-0906 and earlier allows authenticated users authorization bypass via insecure direct object referenc
- CVE-2018-16395An issue was discovered in the OpenSSL library in Ruby before 2.3.8, 2.4.x before 2.4.5, 2.5.x before 2.5.2, and 2.6.x before 2.6.0-preview3openssl
- CVE-2018-16396An issue was discovered in Ruby before 2.3.8, 2.4.x before 2.4.5, 2.5.x before 2.5.2, and 2.6.x before 2.6.0-preview3.
- CVE-2018-18755K-iwi Framework 1775 has SQL Injection via the admin/user/group/update user_group_id parameter or the admin/user/user/update user_id paramet
- CVE-2018-18756Local Server 1.0.9 has a Buffer Overflow via crafted data on Port 4008.
- CVE-2018-18759Modbus Slave 7.0.0 in modbus tools has a Buffer Overflow.
- CVE-2018-18760RhinOS 3.0 build 1190 allows CSRF.
- CVE-2018-18761SaltOS 3.1 r8126 allows action=login&querystring=&user=[SQL] SQL Injection.
- CVE-2018-18763SaltOS 3.1 r8126 allows action=ajax&query=numbers&page=usuarios&action2=[SQL] SQL Injection.
- CVE-2018-18793School Event Management System 1.0 allows Arbitrary File Upload via event/controller.php?action=photos.
- CVE-2018-18794School Event Management System 1.0 allows CSRF via user/controller.php?action=edit.
- CVE-2018-18795School Event Management System 1.0 has SQL Injection via the student/index.php or event/index.php id parameter.
- CVE-2018-18796Library Management System 1.0 has SQL Injection via the "Search for Books" screen.
- CVE-2018-18797School Attendance Monitoring System 1.0 has CSRF via /user/user/edit.php.
- CVE-2018-18799School Attendance Monitoring System 1.0 has CSRF via event/controller.php?action=photos.
- CVE-2018-18801The BSEN Ordering software 1.0 has SQL Injection via student/index.php?view=view&id=[SQL] or index.php?q=single-item&id=[SQL].
- CVE-2018-18803Curriculum Evaluation System 1.0 allows SQL Injection via the login screen, related to frmCourse.vb and includes/user.vb.
- CVE-2018-18804Bakeshop Inventory System 1.0 has SQL injection via the login screen, related to include/publicfunction.vb.
- CVE-2018-18805Point Of Sales 1.0 allows SQL injection via the login screen, related to LoginForm1.vb.
- CVE-2018-18806School Equipment Monitoring System 1.0 allows SQL injection via the login screen, related to include/user.vb.
- CVE-2018-1639The Report Builder of Jazz Reporting Service 5.0 through 5.0.2 and 6.0 through 6.0.6 could allow an authenticated user to obtain sensitive iIBM Jazz Reporting Service
- CVE-2018-1797IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 using Enterprise bundle Archives (EBA) could allow a local attacker to traverse direIBM WebSphere Application Server
- CVE-2018-7361All versions up to V1.1.10P3T18 of ZTE ZXHN F670 product are impacted by null pointer dereference vulnerability, which may allows an attackeZTE ZXHN F670
- CVE-2018-7363All versions up to V1.1.10P3T18 of ZTE ZXHN F670 product are impacted by improper authorization vulnerability.ZTE ZXHN F670
- CVE-2018-9071CMM Security VulnerabilityLenovo Chassis Management Module
- CVE-2018-9073CMM Security VulnerabilityLenovo Chassis Management Module
- CVE-2018-9085Missing System x Flash Memory Write Protection Lock BitLenovo System x UEFI · IBM System x UEFI
- CVE-2018-9086Legacy Server BMC Remote Command InjectionLenovo ThinkServer BMC
- CVE-2018-19296PHPMailer before 5.2.27 and 6.x before 6.0.6 is vulnerable to an object injection attack.phpmailer/phpmailer