CVEs published November 27, 2018
96 CVEs were published on November 27, 2018: 0 critical, 2 high. Browse them by severity, product and exploitation status.
- Published
- 96
- Critical
- 0
- High
- 2
- Medium
- 1
- Low
- 0
- Unrated
- 93
- Now in CISA KEV
- 0
- Fix available
- 11
Most affected products
- Lenovo ThinkSystem SMM
- 9
- Huawei Technologies Co. eSpace
- 3
- NUUO CMS
- 3
- Nvidia GeForce Experience
- 3
- QNAP Systems QTS
- 2
- Apache Software Foundation Apache Hadoop · org.apache.hadoo…
- 1
- CyberSecurity Philippines - CERT UmbracoCMS · umbraco
- 1
- Fortinet FortiOS
- 1
- Huawei Technologies Co. Emily-AL00A
- 1
- Huawei Technologies Co. FusionSphere OpenStack
- 1
High 2
Medium, low and unrated 94
- CVE-2018-7946There is an information leak vulnerability in some Huawei smartphones.Huawei Technologies Co. Huawei Honor 7A, Huawei Honor 9 Lite
- CVE-2018-7958There is an anonymous TLS cipher suites supported vulnerability in Huawei eSpace product.Huawei Technologies Co. eSpace
- CVE-2018-7959There is a short key vulnerability in Huawei eSpace product.Huawei Technologies Co. eSpace
- CVE-2018-7960There is a SRTP icon display vulnerability in Huawei eSpace product.Huawei Technologies Co. eSpace
- CVE-2018-7961There is a smart SMS verification code vulnerability in some Huawei smart phones.Huawei Technologies Co. Emily-AL00A
- CVE-2018-7977There is an information leakage vulnerability on several Huawei products.Huawei Technologies Co. FusionSphere OpenStack
- CVE-2018-7988There is a Factory Reset Protection (FRP) bypass vulnerability on several smartphones.Huawei Technologies Co. Huawei nova 2 Plus, Huawei Mate9 Pro
- CVE-2018-0719Security Advisory for Vulnerabilities in QTSQNAP Systems QTS
- CVE-2018-10142The Expedition Migration tool 1.0.106 and earlier may allow an unauthenticated attacker to enumerate files on the operating system.Palo Alto Networks Expedition
- CVE-2018-13022Cross-site scripting vulnerability in the API 404 page on Xiaomi Mi Router 3 version 2.22.15 allows attackers to execute arbitrary…
- CVE-2018-13023System command injection vulnerability in wifi_access in Xiaomi Mi Router 3 version 2.22.15 allows attackers to execute system commands…
- CVE-2018-13306System command injection in formDlna in TOTOLINK A3002RU version 1.0.8 allows attackers to execute system commands via the "ftpUser" POST…
- CVE-2018-13307System command injection in fromNtp in TOTOLINK A3002RU version 1.0.8 allows attackers to execute system commands via the "ntpServerIp2"…
- CVE-2018-13314System command injection in formAliasIp in TOTOLINK A3002RU version 1.0.8 allows attackers to execute system commands via the "ipAddr"…
- CVE-2018-13316System command injection in formAliasIp in TOTOLINK A3002RU version 1.0.8 allows attackers to execute system commands via the "subnet"…
- CVE-2018-13329Cross-site scripting in ajaxdata.php in TerraMaster TOS version 3.1.03 allows attackers to execute JavaScript via the "lines" URL parameter.
- CVE-2018-13330System command injection in ajaxdata.php in TerraMaster TOS version 3.1.03 allows attackers to execute system commands during group…
- CVE-2018-13331Cross-site scripting in Control Panel in TerraMaster TOS version 3.1.03 allows attackers to execute JavaScript when viewing users by…
- CVE-2018-13332Directory Traversal in the explorer application in TerraMaster TOS version 3.1.03 allows attackers to upload files to arbitrary locations…
- CVE-2018-13333Cross-site scripting in File Manager in TerraMaster TOS version 3.1.03 allows attackers to execute JavaScript in the permissions window by…
- CVE-2018-13334Cross-site scripting in handle.php in TerraMaster TOS version 3.1.03 allows attackers to execute JavaScript via the "options[sysname]"…
- CVE-2018-13335Cross-site scripting in Control Panel in TerraMaster TOS version 3.1.03 allows attackers to execute JavaScript when viewing shared folders…
- CVE-2018-13336System command injection in ajaxdata.php in TerraMaster TOS version 3.1.03 allows attackers to execute system commands via the "pwd"…
- CVE-2018-13337Session Fixation in the web application for TerraMaster TOS version 3.1.03 allows attackers to control users' session cookies via…
- CVE-2018-13338System command injection in ajaxdata.php in TerraMaster TOS version 3.1.03 allows attackers to execute system commands via the "username"…
Show all 94 entriesShow fewer entries
- CVE-2018-13349Cross-site scripting in the web application taskbar in TerraMaster TOS version 3.1.03 allows attackers to execute JavaScript via the…
- CVE-2018-13350SQL injection in logtable.php in TerraMaster TOS version 3.1.03 allows attackers to execute SQL queries via the "Event" parameter.
- CVE-2018-13351Cross-site scripting in Control Panel in TerraMaster TOS version 3.1.03 allows attackers to execute JavaScript via the edit password form.
- CVE-2018-13352Session Exposure in the web application for TerraMaster TOS version 3.1.03 allows attackers to view active session tokens in a…
- CVE-2018-13353System command injection in ajaxdata.php in TerraMaster TOS version 3.1.03 allows attackers to execute commands via the "checkport"…
- CVE-2018-13354System command injection in logtable.php in TerraMaster TOS version 3.1.03 allows attackers to execute system commands via the "Event"…
- CVE-2018-13355Incorrect access controls in ajaxdata.php in TerraMaster TOS version 3.1.03 allow attackers to create user groups without proper…
- CVE-2018-13356Incorrect access control on ajaxdata.php in TerraMaster TOS version 3.1.03 allows attackers to elevate user permissions.
- CVE-2018-13357Cross-site scripting in Control Panel in TerraMaster TOS version 3.1.03 allows attackers to execute JavaScript when viewing Shared Folders…
- CVE-2018-13358System command injection in ajaxdata.php in TerraMaster TOS version 3.1.03 allows attackers to execute system commands via the "checkName"…
- CVE-2018-13359Cross-site scripting in usertable.php in TerraMaster TOS version 3.1.03 allows attackers to execute JavaScript via the "modgroup" parameter.
- CVE-2018-13360Cross-site scripting in Text Editor in TerraMaster TOS version 3.1.03 allows attackers to execute JavaScript via the "filename" URL…
- CVE-2018-13361User enumeration in usertable.php in TerraMaster TOS version 3.1.03 allows attackers to list all system users via the "modgroup" parameter.
- CVE-2018-13418System command injection in ajaxdata.php in TerraMaster TOS 3.1.03 allows attackers to execute system commands via the "newname" parameter.
- CVE-2018-14892Missing protections against Cross-Site Request Forgery in the web application in ZyXEL NSA325 V2 version 4.81 allow attackers to perform…
- CVE-2018-14893A system command injection vulnerability in zyshclient in ZyXEL NSA325 V2 version 4.81 allows attackers to execute system commands via the…
- CVE-2018-16130System command injection in request_mitv in Xiaomi Mi Router 3 version 2.22.15 allows attackers to execute arbitrary system commands via…
- CVE-2018-17256Persistent cross-site scripting (XSS) vulnerability in Umbraco CMS 7.12.3 allows authenticated users to inject arbitrary web script via…CyberSecurity Philippines - CERT UmbracoCMS · umbraco
- CVE-2018-17934NUUO CMS All versions 3.3 and prior the application allows external input to construct a pathname that is able to be resolved outside the…NUUO CMS
- CVE-2018-17936NUUO CMS All versions 3.3 and prior the application allows the upload of arbitrary files that can modify or overwrite configuration files…NUUO CMS
- CVE-2018-18982NUUO CMS All versions 3.3 and prior the web server application allows injection of arbitrary SQL characters, which can be used to inject…NUUO CMS
- CVE-2017-11078In all android releases(Android for MSM, Firefox OS for MSM, QRD Android) from CAF using the linux kernel, while processing the boot image…
- CVE-2018-11260In all android releases(Android for MSM, Firefox OS for MSM, QRD Android) from CAF using the linux kernel, while processing a fast Initial…
- CVE-2018-11261In all android releases(Android for MSM, Firefox OS for MSM, QRD Android) from CAF using the linux kernel, there is a possible…
- CVE-2018-11266In all android releases(Android for MSM, Firefox OS for MSM, QRD Android) from CAF using the linux kernel, improper input validation can…
- CVE-2018-11823In all android releases(Android for MSM, Firefox OS for MSM, QRD Android) from CAF using the linux kernel, freeing device memory in driver…
- CVE-2018-11906In all android releases(Android for MSM, Firefox OS for MSM, QRD Android) from CAF using the linux kernel, there is a security concern…
- CVE-2018-11907In all android releases(Android for MSM, Firefox OS for MSM, QRD Android) from CAF using the linux kernel, improper access control can…
- CVE-2018-11908In all android releases(Android for MSM, Firefox OS for MSM, QRD Android) from CAF using the linux kernel, improper access control can…
- CVE-2018-11909In all android releases(Android for MSM, Firefox OS for MSM, QRD Android) from CAF using the linux kernel, improper access control can…
- CVE-2018-11910In all android releases(Android for MSM, Firefox OS for MSM, QRD Android) from CAF using the linux kernel, improper access control can…
- CVE-2018-11911In all android releases(Android for MSM, Firefox OS for MSM, QRD Android) from CAF using the linux kernel, improper configuration of…
- CVE-2018-11912In all android releases(Android for MSM, Firefox OS for MSM, QRD Android) from CAF using the linux kernel, improper configuration of…
- CVE-2018-11913In all android releases(Android for MSM, Firefox OS for MSM, QRD Android) from CAF using the linux kernel, improper configuration of dev…
- CVE-2018-11914In all android releases(Android for MSM, Firefox OS for MSM, QRD Android) from CAF using the linux kernel, improper access control can…
- CVE-2018-11918In all android releases(Android for MSM, Firefox OS for MSM, QRD Android) from CAF using the linux kernel, memory allocated is…
- CVE-2018-11919In all android releases(Android for MSM, Firefox OS for MSM, QRD Android) from CAF using the linux kernel, there is a potential heap…
- CVE-2018-11943In all android releases(Android for MSM, Firefox OS for MSM, QRD Android) from CAF using the linux kernel, while processing fastboot flash…
- CVE-2018-11946In all android releases(Android for MSM, Firefox OS for MSM, QRD Android) from CAF using the linux kernel, the UPnP daemon should not be…
- CVE-2018-11956In all android releases(Android for MSM, Firefox OS for MSM, QRD Android) from CAF using the linux kernel, improper mounting lead to…
- CVE-2018-11995In all android releases(Android for MSM, Firefox OS for MSM, QRD Android) from CAF using the linux kernel, a partition name-check variable…
- CVE-2018-12241The Symantec Security Analytics (SA) 7.x prior to 7.3.4 Web UI is susceptible to a reflected cross-site scripting (XSS) vulnerability.Symantec Security Analytics
- CVE-2018-5856In all android releases(Android for MSM, Firefox OS for MSM, QRD Android) from CAF using the linux kernel, due to a race condition, a Use…
- CVE-2018-5861In all android releases(Android for MSM, Firefox OS for MSM, QRD Android) from CAF using the linux kernel, existing checks in place on…
- CVE-2018-5904In all android releases(Android for MSM, Firefox OS for MSM, QRD Android) from CAF using the linux kernel, while list traversal in LPM…
- CVE-2018-5906In all android releases(Android for MSM, Firefox OS for MSM, QRD Android) from CAF using the linux kernel, there is a possible buffer…
- CVE-2018-5908In all android releases(Android for MSM, Firefox OS for MSM, QRD Android) from CAF using the linux kernel, there is a possible buffer…
- CVE-2018-5909In all android releases(Android for MSM, Firefox OS for MSM, QRD Android) from CAF using the linux kernel, buffer overflow occur may occur…
- CVE-2018-5910In all android releases(Android for MSM, Firefox OS for MSM, QRD Android) from CAF using the linux kernel, a memory corruption can occur…
- CVE-2018-5919In all android releases(Android for MSM, Firefox OS for MSM, QRD Android) from CAF using the linux kernel, a use after free issue in WLAN…
- CVE-2018-6263NVIDIA GeForce Experience contains a vulnerability in all versions prior to 3.16 on Windows in which an attacker who has access to a local…Nvidia GeForce Experience
- CVE-2018-6265NVIDIA GeForce Experience contains a vulnerability in all versions prior to 3.16 during application installation on Windows 7 in elevated…Nvidia GeForce Experience
- CVE-2018-6266NVIDIA GeForce Experience contains a vulnerability in all versions prior to 3.16 on Windows where a local user may obtain third party…Nvidia GeForce Experience
- CVE-2018-6983VMware Workstation (15.x before 15.0.2 and 14.x before 14.1.5) and Fusion (11.x before 11.0.2 and 10.x before 10.1.5) contain an integer…VMware Workstation and Fusion
- CVE-2018-19609ShowDoc 2.4.1 allows remote attackers to obtain sensitive information by navigating with a modified page_id, as demonstrated by reading…showdoc/showdoc
- CVE-2018-13376An uninitialized memory buffer leak exists in Fortinet FortiOS 5.6.1 to 5.6.3, 5.4.6 to 5.4.7, 5.2 all versions under web proxy's…Fortinet FortiOS
- CVE-2018-11766In Apache Hadoop 2.7.4 to 2.7.6, the security fix for CVE-2016-6811 is incomplete.Apache Software Foundation Apache Hadoop · org.apache.hadoo…
- CVE-2018-16089System Management Module VulnerabilitiesLenovo ThinkSystem SMM
- CVE-2018-16090System Management Module VulnerabilitiesLenovo ThinkSystem SMM
- CVE-2018-16091System Management Module VulnerabilitiesLenovo ThinkSystem SMM
- CVE-2018-16092System Management Module VulnerabilitiesLenovo ThinkSystem SMM
- CVE-2018-16094System Management Module VulnerabilitiesLenovo ThinkSystem SMM
- CVE-2018-16095System Management Module VulnerabilitiesLenovo ThinkSystem SMM
- CVE-2018-16096System Management Module VulnerabilitiesLenovo ThinkSystem SMM
- CVE-2018-9083System Management Module VulnerabilitiesLenovo ThinkSystem SMM
- CVE-2018-9084System Management Module VulnerabilitiesLenovo ThinkSystem SMM
- CVE-2018-19587In Cesanta Mongoose 6.13, a SIGSEGV exists in the mongoose.c mg_mqtt_add_session() function.
- CVE-2018-19595PbootCMS V1.3.1 build 2018-11-14 allows remote attackers to execute arbitrary code via use of "eval" with mixed case, as demonstrated by…
- CVE-2018-19607Exiv2::isoSpeed in easyaccess.cpp in Exiv2 v0.27-RC2 allows remote attackers to cause a denial of service (NULL pointer dereference and…