# CVEs published 2018-11-16

39 CVEs were published on November 16, 2018: 2 critical, 1 high. Days are UTC.

- [CVE-2018-15769](https://cve.now/CVE-2018-15769.md): RSA BSAFE Micro Edition Suite versions prior to 4.0.11 (in 4.0.x series) and versions prior to 4.1.6.2 (in 4.1.x series) contain a key manag (no CVSS)
- [CVE-2018-18955](https://cve.now/CVE-2018-18955.md): In the Linux kernel 4.15.x through 4.19.x before 4.19.2, map\_write() in kernel/user\_namespace.c allows privilege escalation because it misha (no CVSS)
- [CVE-2018-19311](https://cve.now/CVE-2018-19311.md): Centreon 3.4.x (fixed in Centreon 18.10.0) allows XSS via the Service field to the main.php?p=20201 URI, as demonstrated by the "Monitoring (no CVSS, centreon/centreon)
- [CVE-2018-19312](https://cve.now/CVE-2018-19312.md): Centreon 3.4.x (fixed in Centreon 18.10.0 and Centreon web 2.8.24) allows SQL Injection via the searchVM parameter to the main.php?p=20408 U (no CVSS, centreon/centreon)
- [CVE-2018-19318](https://cve.now/CVE-2018-19318.md): SRCMS 3.0.0 allows CSRF via admin.php?m=Admin&c=manager&a=update to change the username and password of the super administrator account. (no CVSS)
- [CVE-2018-19319](https://cve.now/CVE-2018-19319.md): SRCMS 3.0.0 allows CSRF via admin.php?m=Admin&c=gifts&a=update to change goods prices with the super administrator's privileges. (no CVSS)
- [CVE-2018-15692](https://cve.now/CVE-2018-15692.md): Inova Partner 5.0.5-RELEASE, Build 0510-0906 and earlier allows authenticated users authorization bypass and data manipulation in certain fu (no CVSS)
- [CVE-2018-15693](https://cve.now/CVE-2018-15693.md): Inova Partner 5.0.5-RELEASE, Build 0510-0906 and earlier allows authenticated users authorization bypass via insecure direct object referenc (no CVSS)
- [CVE-2018-16395](https://cve.now/CVE-2018-16395.md): An issue was discovered in the OpenSSL library in Ruby before 2.3.8, 2.4.x before 2.4.5, 2.5.x before 2.5.2, and 2.6.x before 2.6.0-preview3 (no CVSS, openssl)
- [CVE-2018-16396](https://cve.now/CVE-2018-16396.md): An issue was discovered in Ruby before 2.3.8, 2.4.x before 2.4.5, 2.5.x before 2.5.2, and 2.6.x before 2.6.0-preview3. (no CVSS)
- [CVE-2018-18755](https://cve.now/CVE-2018-18755.md): K-iwi Framework 1775 has SQL Injection via the admin/user/group/update user\_group\_id parameter or the admin/user/user/update user\_id paramet (no CVSS)
- [CVE-2018-18756](https://cve.now/CVE-2018-18756.md): Local Server 1.0.9 has a Buffer Overflow via crafted data on Port 4008. (no CVSS)
- [CVE-2018-18759](https://cve.now/CVE-2018-18759.md): Modbus Slave 7.0.0 in modbus tools has a Buffer Overflow. (no CVSS)
- [CVE-2018-18760](https://cve.now/CVE-2018-18760.md): RhinOS 3.0 build 1190 allows CSRF. (no CVSS)
- [CVE-2018-18761](https://cve.now/CVE-2018-18761.md): SaltOS 3.1 r8126 allows action=login&querystring=&user=\[SQL\] SQL Injection. (no CVSS)
- [CVE-2018-18763](https://cve.now/CVE-2018-18763.md): SaltOS 3.1 r8126 allows action=ajax&query=numbers&page=usuarios&action2=\[SQL\] SQL Injection. (no CVSS)
- [CVE-2018-18793](https://cve.now/CVE-2018-18793.md): School Event Management System 1.0 allows Arbitrary File Upload via event/controller.php?action=photos. (no CVSS)
- [CVE-2018-18794](https://cve.now/CVE-2018-18794.md): School Event Management System 1.0 allows CSRF via user/controller.php?action=edit. (no CVSS)
- [CVE-2018-18795](https://cve.now/CVE-2018-18795.md): School Event Management System 1.0 has SQL Injection via the student/index.php or event/index.php id parameter. (no CVSS)
- [CVE-2018-18796](https://cve.now/CVE-2018-18796.md): Library Management System 1.0 has SQL Injection via the "Search for Books" screen. (no CVSS)
- [CVE-2018-18797](https://cve.now/CVE-2018-18797.md): School Attendance Monitoring System 1.0 has CSRF via /user/user/edit.php. (no CVSS)
- [CVE-2018-18799](https://cve.now/CVE-2018-18799.md): School Attendance Monitoring System 1.0 has CSRF via event/controller.php?action=photos. (no CVSS)
- [CVE-2018-18801](https://cve.now/CVE-2018-18801.md): The BSEN Ordering software 1.0 has SQL Injection via student/index.php?view=view&id=\[SQL\] or index.php?q=single-item&id=\[SQL\]. (no CVSS)
- [CVE-2018-18803](https://cve.now/CVE-2018-18803.md): Curriculum Evaluation System 1.0 allows SQL Injection via the login screen, related to frmCourse.vb and includes/user.vb. (no CVSS)
- [CVE-2018-18804](https://cve.now/CVE-2018-18804.md): Bakeshop Inventory System 1.0 has SQL injection via the login screen, related to include/publicfunction.vb. (no CVSS)
- [CVE-2018-18805](https://cve.now/CVE-2018-18805.md): Point Of Sales 1.0 allows SQL injection via the login screen, related to LoginForm1.vb. (no CVSS)
- [CVE-2018-18806](https://cve.now/CVE-2018-18806.md): School Equipment Monitoring System 1.0 allows SQL injection via the login screen, related to include/user.vb. (no CVSS)
- [CVE-2018-1639](https://cve.now/CVE-2018-1639.md): The Report Builder of Jazz Reporting Service 5.0 through 5.0.2 and 6.0 through 6.0.6 could allow an authenticated user to obtain sensitive i (CVSS 4.3, IBM Jazz Reporting Service)
- [CVE-2018-1797](https://cve.now/CVE-2018-1797.md): IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 using Enterprise bundle Archives (EBA) could allow a local attacker to traverse dire (CVSS 6.3, IBM WebSphere Application Server)
- [CVE-2018-7359](https://cve.now/CVE-2018-7359.md): All versions up to V1.1.10P3T18 of ZTE ZXHN F670 product are impacted by heap-based buffer overflow vulnerability, which may allow an attack (CVSS 9.0, ZTE ZXHN F670)
- [CVE-2018-7360](https://cve.now/CVE-2018-7360.md): All versions up to V1.1.10P3T18 of ZTE ZXHN F670 product are impacted by information exposure vulnerability, which may allow an unauthentica (CVSS 9.6, ZTE ZXHN F670)
- [CVE-2018-7361](https://cve.now/CVE-2018-7361.md): All versions up to V1.1.10P3T18 of ZTE ZXHN F670 product are impacted by null pointer dereference vulnerability, which may allows an attacke (CVSS 6.5, ZTE ZXHN F670)
- [CVE-2018-7362](https://cve.now/CVE-2018-7362.md): All versions up to V1.1.10P3T18 of ZTE ZXHN F670 product are impacted by improper access control vulnerability, which may allows an unauthor (CVSS 7.5, ZTE ZXHN F670)
- [CVE-2018-7363](https://cve.now/CVE-2018-7363.md): All versions up to V1.1.10P3T18 of ZTE ZXHN F670 product are impacted by improper authorization vulnerability. (CVSS 4.3, ZTE ZXHN F670)
- [CVE-2018-9071](https://cve.now/CVE-2018-9071.md): CMM Security Vulnerability (no CVSS, Lenovo Chassis Management Module)
- [CVE-2018-9073](https://cve.now/CVE-2018-9073.md): CMM Security Vulnerability (no CVSS, Lenovo Chassis Management Module)
- [CVE-2018-9085](https://cve.now/CVE-2018-9085.md): Missing System x Flash Memory Write Protection Lock Bit (no CVSS, Lenovo System x UEFI · IBM System x UEFI)
- [CVE-2018-9086](https://cve.now/CVE-2018-9086.md): Legacy Server BMC Remote Command Injection (no CVSS, Lenovo ThinkServer BMC)
- [CVE-2018-19296](https://cve.now/CVE-2018-19296.md): PHPMailer before 5.2.27 and 6.x before 6.0.6 is vulnerable to an object injection attack. (no CVSS, phpmailer/phpmailer)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2018-11-16
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.