Since it build and run on top of Microsoft windows platform and speculated that vulnerabilities might given from Microsoft itself. For instance: LAquis SCADA Versions 4.1.0.3870 and prior

Integer overflow to buffer overflow vulnerabilities, which may allow remote code execution.

Hints: Microsoft GDI+ is prone to an integer-overflow vulnerability. An attacker can exploit this issue by enticing unsuspecting users to view a malicious BMP file.

Vulnerabilities checklist:

• CVE-2018-17895 out-of-bounds read vulnerabilities, which may allow remote code execution.
• CVE-2018-17911 stack-based buffer overflow vulnerabilities, which may allow remote code execution.
• CVE-2018-17899 path traversal vulnerability, which may allow remote code execution
• CVE-2018-17901 when processing project files the application fails to sanitize user input prior to performing write operations on a stack object, which may allow an attacker to execute code under the current process.
• CVE-2018-17897 integer overflow to buffer overflow vulnerabilities, which may allow remote code execution.
• CVE-2018-17893 untrusted pointer dereference vulnerability, which may allow remote code execution.

Remedy: Upgrade to 4.1.0.4114 or later

The VLC is a packet-based media player it plays almost all video content. It can play some, even if they’re damaged, incomplete, or unfinished, such as files that are still downloading via a peer-to-peer (P2P) network. So it is very popular in the IoT Environments especially video streaming in vehicular IoT (VSV-IoT) environments. However security researchers have discovered a serious code execution vulnerability in the LIVE555 streaming media library.

If above vulnerability occurs in your devices, what will be happened?

If the stack buffer is filled with data supplied from an untrusted user then that user can corrupt the stack in such a way as to inject executable code into the running program and take control of the process. As a result this method is able for attacker to gain unauthorized access to a computer.
So your vulnerable IoT device will be involuntary join into the IoT Botnet army. So please be careful.

The vendor released security patches on October 17 (see below):

http://www.live555.com/liveMedia/public/

Remark: RTSP over HTTP tunneling doesn’t mean TCP will be used. As TCP has more overheads than UDP, real time streaming will prefer to use UDP as less traffic will be made.

Background:
Libssh is a library written in C implementing the SSH protocol. It can be used to implement client and server applications.

Vulnerability found on 17th Oct 2018:
By presenting the server an SSH2_MSG_USERAUTH_SUCCESS message in place of the SSH2_MSG_USERAUTH_REQUEST message which the server would expect to initiate authentication, the attacker could successfully authentciate without any credentials.

Remediation:
libssh 0.8.4 and 0.7.6 security and bugfix release (Refer below url):

Comment: This bug may found earlier than file a CVE record. Cyber World indeed not safe!

https://www.libssh.org/2018/10/16/libssh-0-8-4-and-0-7-6-security-and-bugfix-release/

The Yammer desktop app is a native client for Mac and Windows with the full functionality of Yammer. Along with streamlined log in and SSO support, the app integrates with native operating system capabilities such as notifications, shortcuts, and launch on startup.
Microsoft announce vulnerability occurs today. But it looks that it is a old bug found 2013.
Should you have interest of the bud details. Attached diagram can provide hints to you for reference.
If you are going to do the remediation, please refer to below url (Official announcement)

CVE-2018-8569 | Yammer Desktop Application Remote Code Execution Vulnerability

https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8569

Theoretically, big data analytics is the often complex process of examining large and varied data sets to uncover information including hidden patterns and unknown correlation. Basically it can help organizations make informed business decisions. Since you can use the URL API to send administration, expression, or function requests to the TIBCO web server. Use the URL API for testing the health of the server, rather than for creating web-based applications.

As a result, without needing to authenticate, an attacker may be able to remotely execute code with the permissions of the system account used to run the web server component. Meanwhile the web server component ( Spotfire Statistics Services) hits multiple vulnerabilities that may allow the remote execution of code. In order to maintain your operation without any interruption. It is suggest to follow the vendor advisory to do the remediation. Below URL for your reference.

https://www.tibco.com/support/advisories/2018/10/tibco-security-advisory-october-10-2018-tibco-spotfire-statistics

Sometimes, vulnerabilities open to public but the response of vendor not as expected efficiency. Still remember that a announcement issued by US Cert on 6th Oct 2018. The details shown that the electronic manufacture product by Auto-Maskin has encountered four different vulnerabilities. Perhaps the remediation not release from manufacture in the moment because the firmware image store in the download repository is not recently.

Should you have interest in above topic? Below details are the vendor homepage and vulnerability notes articles for your reference.

Vulnerability Notes – Auto-Maskin DCU 210E RP 210E and Marine Pro Observer App  https://www.kb.cert.org/vuls/id/176301

Vendor Home page https://www.auto-maskin.com/news

Junos OS is the FreeBSD-based operating system used in Juniper Networks routing, switching and security devices. Starting in Junos OS Release 16.1, It did not maintain the SDK programming function. But  alternative feature provides a rich set of APIs to program the Junos OS control plane. JET allows users to build applications on top of Junos OS and hence, replaces the legacy Junos SDK.

From security point of view, it is a good decision. Although the new approach will be reduced potential risk given by custom SDK development. However it is hard to avoid vulnerability occurs in product itself!

For more details, please see below details for reference.

https://kb.juniper.net/InfoCenter/index?page=content&channel=SECURITY_ADVISORIES&cat=SIRT_1&&actp=&sort=datemodified&dir=descending&max=1000&batch=15&rss=true&itData.offset=15