CVEs published in October 2018
1,469 vulnerabilities, 177 critical, 2 exploited.
- owndms ownticketOwnTicket 2018-05-23 allows SQL Injection via the showTicketId or editTicketStatusId parameter.9.8 Critical
- moxa thingspro, thingspro iiot gateway and device management software solutions +1 moreRemote Code Execution in Moxa ThingsPro IIoT Gateway and Device Management Software Solutions...9.8 Critical
- moxa thingspro, thingspro iiot gateway and device management software solutions +1 moreHidden Token Access in Moxa ThingsPro IIoT Gateway and Device Management Software Solutions...9.8 Critical
- moxa thingspro, thingspro iiot gateway and device management software solutions +1 moreSensitive Information Stored in Clear Text in Moxa ThingsPro IIoT Gateway and Device Management...9.8 Critical
- moxa thingspro, thingspro iiot gateway and device management software solutions +1 morePassword Management Issue in Moxa ThingsPro IIoT Gateway and Device Management Software Solutions...9.8 Critical
- moxa thingspro, thingspro iiot gateway and device management software solutions +1 morePrivilege Escalation via Broken Access Control in Moxa ThingsPro IIoT Gateway and Device...8.8 High
- moxa thingspro, thingspro iiot gateway and device management software solutions +1 moreUser Privilege Escalation in Moxa ThingsPro IIoT Gateway and Device Management Software Solutions...8.8 High
- moxa thingspro, thingspro iiot gateway and device management software solutions +1 moreUser Enumeration in Moxa ThingsPro IIoT Gateway and Device Management Software Solutions version...7.5 High
- debian linux, live networks live555 media server, live555 media server +2 moreAn exploitable code execution vulnerability exists in the HTTP packet-parsing functionality of...10.0 Critical
- f5 big-ip apm clients, big-ip edge client, big-ip access policy manager +2 more +4 moreIn F5 BIG-IP APM 13.0.0-13.1.1.1, APM Client 7.1.5-7.1.6, and/or Edge Client 7101-7160, the BIG...5.5 Medium
- f5 big-ip (ltm, aam, afm, analytics, apm, asm, dns, edge gateway, fps, gtm, link controller, pem, webaccelerator), big-ip access policy manager, big-ip advanced firewall manager +11 more +13 moreOn F5 BIG-IP 13.0.0-13.1.1.1 and 12.1.0-12.1.3.6, there is a reflected Cross Site Scripting (XSS)...6.1 Medium
- f5 big-ip afm, big-ip advanced firewall manager +1 moreOn F5 BIG-IP AFM 13.0.0-13.1.1.1 and 12.1.0-12.1.3.6, there is a Reflected Cross Site Scripting...6.1 Medium
- f5 big-ip afm, big-ip advanced firewall manager +1 moreOn F5 BIG-IP AFM 13.0.0-13.1.1.1 and 12.1.0-12.1.3.6, there is a Reflected Cross Site Scripting...6.1 Medium
- f5 big-ip (ltm, aam, afm, analytics, apm, asm, dns, edge gateway, fps, gtm, link controller, pem, webaccelerator), big-ip access policy manager, big-ip advanced firewall manager +11 more +13 moreOn F5 BIG-IP 13.0.0-13.1.1.1 and 12.1.0-12.1.3.6, a reflected Cross-Site Scripting (XSS)...6.1 Medium
- splunkSplunk Enterprise 6.6.x, when configured to run as root but drop privileges to a specific non...7.0 High
drupal7Debiandrupal7 - security updateNo score- elfutils project elfutils, canonical ubuntu linux, debian linux +4 more +6 moreDivide-by-zero vulnerabilities in the function arlib_add_symbols() in arlib.c in elfutils 0.174...5.5 Medium
- elfutils project elfutils, canonical ubuntu linux, debian linux +4 more +6 moreAn Invalid Memory Address Dereference exists in the function elf_end in libelf in elfutils...6.5 Medium
- artifex ghostscript, gpl ghostscript, canonical ubuntu linux +8 more +10 moreArtifex Ghostscript 9.25 and earlier allows attackers to bypass a sandbox protection mechanism...8.6 High
- dell emc secure remote services, dell emc esrs virtual edition +1 moreDell EMC Secure Remote Services, versions prior to 3.32.00.08, contains an Information Exposure...3.4 Low
- pivotal spring security oauth, spring security oauth +1 morePrivilege Escalation in spring-security-oauth29.6 Critical
- pivotal spring framework, debian linux, oracle agile product lifecycle management +37 more +39 moreDoS Attack via Range Requests7.5 High
- emc secure remote services, dell emc esrs virtual edition +1 moreDell EMC Secure Remote Services, versions prior to 3.32.00.08, contains Improper File Permission...7.3 High
- emc secure remote services, dell emc esrs virtual edition +1 moreDell EMC Secure Remote Services, versions prior to 3.32.00.08, contains a Plaintext Password...5.5 Medium
- gxlcmsIn \lib\admin\action\dataaction.class.php in Gxlcms v2.0, SQL Injection exists via the ids[]...9.8 Critical
- gxlcmsIn \lib\admin\action\dataaction.class.php in Gxlcms v2.0, the database backup filename generation...7.5 High
- phpsheAn issue was discovered in PHPSHE 1.7. SQL injection exists via the admin.php?mod=user&act=del...9.8 Critical
- phpsheAn issue was discovered in PHPSHE 1.7. admin.php?mod=db&act=del allows remote attackers to delete...7.5 High
- opto 22 pac control basic and pac control professional, opto22 pac control +1 moreA stack-based buffer overflow vulnerability in Opto 22 PAC Control Basic and PAC Control...9.8 Critical
- gnu binutilsAn issue was discovered in cp-demangle.c in GNU libiberty, as distributed in GNU Binutils 2.31....5.5 Medium
- gnu binutilsThe get_count function in cplus-dem.c in GNU libiberty, as distributed in GNU Binutils 2.31,...7.8 High
- kohaMultiple SQL injection vulnerabilities in Koha 3.14.x before 3.14.16, 3.16.x before 3.16.12, 3.18...9.8 Critical
- kohaMultiple directory traversal vulnerabilities in Koha 3.14.x before 3.14.16, 3.16.x before 3.16.12...7.5 High
- kohaMultiple cross-site scripting (XSS) vulnerabilities in Koha 3.14.x before 3.14.16, 3.16.x before...5.4 Medium
- kohaMultiple cross-site request forgery (CSRF) vulnerabilities in Koha 3.14.x before 3.14.16, 3.16.x...8.0 High
- libpg query project querylibpg_query memory leak6.5 Medium
- libopencad project libopencadA heap-based buffer over-read exists in libopencad 0.2.0 in the ReadCHAR function in lib/dwg/io...6.5 Medium
- libopencad project libopencadA heap-based buffer over-read exists in libopencad 0.2.0 in the ReadMCHAR function in lib/dwg/io...6.5 Medium
- librenmsLibreNMS XSS Vulnerability6.1 Medium
- ibm flashsystem 900, flashsystem 840 firmware, flashsystem 900 firmware +2 moreIBM FlashSystem 900 product GUI allows a specially crafted attack to bypass the authentication...9.8 Critical
- ibm infosphere information server, infosphere information server on cloud +1 moreIBM InfoSphere Information Server 11.7 is affected by a weak password encryption vulnerability...6.2 Medium
- mozilla firefoxThe displayed addressbar URL can be spoofed on Firefox for Android using a javascript: URI in...5.3 Medium
yast2-smtSUSESecurity update for yast2-smtNo scorepostgresql10SUSE,postgresql10-libsSUSE,postgresql-initSUSE +2 moreSecurity update for postgresql10No scoreucode-intelSUSESecurity update for ucode-intelNo score- kibokolabs arigato autoresponder and newsletterThe Arigato Autoresponder and Newsletter (aka bft-autoresponder) v2.5.1.7 plugin for WordPress...9.8 Critical
- 3cx live chatXSS exists in the wp-live-chat-support v8.0.15 plugin for WordPress via the modules/gdpr.php term...6.1 Medium
- xpdfreader xpdfThe function DCTStream::getBlock in Stream.cc in Xpdf 4.00 allows remote attackers to cause a...5.5 Medium
- xpdfreader xpdfThe function DCTStream::decodeImage in Stream.cc in Xpdf 4.00 allows remote attackers to cause a...5.5 Medium
- xpdfreader xpdfThe function DCTStream::readScan in Stream.cc in Xpdf 4.00 allows remote attackers to cause a...5.5 Medium
- Show moreLoading…