# CVEs published 2018-11-28

41 CVEs were published on November 28, 2018: 1 critical, 2 high. Days are UTC.

- [CVE-2018-17930](https://cve.now/CVE-2018-17930.md): A stack-based buffer overflow vulnerability has been identified in Teledyne DALSA Sherlock Version 7.2.7.4 and prior, which may allow… (no CVSS, ICS-CERT Teledyne DALSA Sherlock)
- [CVE-2018-18203](https://cve.now/CVE-2018-18203.md): A vulnerability in the update mechanism of Subaru StarLink Harman head units 2017, 2018, and 2019 may give an attacker (with physical… (no CVSS)
- [CVE-2018-19370](https://cve.now/CVE-2018-19370.md): A Race condition vulnerability in unzip\_file in admin/import/class-import-settings.php in the Yoast SEO (wordpress-seo) plugin before… (no CVSS)
- [CVE-2018-19651](https://cve.now/CVE-2018-19651.md): admin/functions/remote.php in Interspire Email Marketer through 6.1.6 has Server Side Request Forgery (SSRF) via a what=importurl&url=… (no CVSS)
- [CVE-2018-5559](https://cve.now/CVE-2018-5559.md): In Rapid7 Komand version 0.41.0 and prior, certain endpoints that are able to list the always encrypted-at-rest connection data could… (CVSS 3.4, Rapid7 Komand)
- [CVE-2018-15441](https://cve.now/CVE-2018-15441.md): Cisco Prime License Manager SQL Injection Vulnerability (CVSS 9.4, Cisco Prime License Manager)
- [CVE-2018-12116](https://cve.now/CVE-2018-12116.md): Node.js: All versions prior to Node.js 6.15.0 and 8.14.0: HTTP request splitting: If Node.js can be convinced to use unsanitized user-provid (no CVSS, The Node.js Project Node.js)
- [CVE-2018-12120](https://cve.now/CVE-2018-12120.md): Node.js: All versions prior to Node.js 6.15.0: Debugger port 5858 listens on any interface by default: When the debugger is enabled with \`no (no CVSS, The Node.js Project Node.js)
- [CVE-2018-12121](https://cve.now/CVE-2018-12121.md): Node.js: All versions prior to Node.js 6.15.0, 8.14.0, 10.14.0 and 11.3.0: Denial of Service with large HTTP headers: By using a combination (no CVSS, The Node.js Project Node.js)
- [CVE-2018-12122](https://cve.now/CVE-2018-12122.md): Node.js: All versions prior to Node.js 6.15.0, 8.14.0, 10.14.0 and 11.3.0: Slowloris HTTP Denial of Service: An attacker can cause a Denial (no CVSS, The Node.js Project Node.js)
- [CVE-2018-12123](https://cve.now/CVE-2018-12123.md): Node.js: All versions prior to Node.js 6.15.0, 8.14.0, 10.14.0 and 11.3.0: Hostname spoofing in URL parser for javascript protocol: If a Nod (no CVSS, The Node.js Project Node.js)
- [CVE-2018-1584](https://cve.now/CVE-2018-1584.md): IBM Maximo Asset Management 7.6 is vulnerable to cross-site scripting. (CVSS 5.4, IBM Maximo Asset Management)
- [CVE-2018-19646](https://cve.now/CVE-2018-19646.md): The Python CGI scripts in PWS in Imperva SecureSphere 13.0.10, 13.1.10, and 13.2.10 allow remote attackers to execute arbitrary OS… (no CVSS)
- [CVE-2018-14746](https://cve.now/CVE-2018-14746.md): Command Injection vulnerability in QTS 4.3.5 build 20181013, QTS 4.3.4 build 20181008, QTS 4.3.3 build 20180829, QTS 4.2.6 build 20180829… (no CVSS, QNAP QTS)
- [CVE-2018-14747](https://cve.now/CVE-2018-14747.md): NULL Pointer Dereference vulnerability in QTS 4.3.5 build 20181013, QTS 4.3.4 build 20181008, QTS 4.3.3 build 20180829, QTS 4.2.6 build… (no CVSS, QNAP QTS)
- [CVE-2018-14748](https://cve.now/CVE-2018-14748.md): Improper Authorization vulnerability in QTS 4.3.5 build 20181013, QTS 4.3.4 build 20181008, QTS 4.3.3 build 20180829, QTS 4.2.6 build… (no CVSS, QNAP QTS)
- [CVE-2018-14749](https://cve.now/CVE-2018-14749.md): Buffer Overflow vulnerability in QTS 4.3.5 build 20181013, QTS 4.3.4 build 20181008, QTS 4.3.3 build 20180829, QTS 4.2.6 build 20180829… (no CVSS, QNAP QTS)
- [CVE-2018-17156](https://cve.now/CVE-2018-17156.md): In FreeBSD before 11.2-STABLE(r340268) and 11.2-RELEASE-p5, due to incorrectly accounting for padding on 64-bit platforms, a buffer… (no CVSS, FreeBSD)
- [CVE-2017-18315](https://cve.now/CVE-2017-18315.md): Buffer over-read vulnerabilities in an older version of ASN.1 parser in Snapdragon Mobile in versions SD 600. (no CVSS, Qualcomm Snapdragon Mobile)
- [CVE-2017-18316](https://cve.now/CVE-2017-18316.md): Secure application can access QSEE kernel memory through Ontario kernel driver in Snapdragon Automobile, Snapdragon Mobile and Snapdragon… (no CVSS, Qualcomm Snapdragon Automobile, Snapdragon Mobile, Snapdrag…)
- [CVE-2017-18317](https://cve.now/CVE-2017-18317.md): Restrictions related to the modem (sim lock, sim kill) can be bypassed by manipulating the system to issue a deactivation flow sequence in… (no CVSS, Qualcomm Snapdragon Automobile, Snapdragon Mobile)
- [CVE-2017-18318](https://cve.now/CVE-2017-18318.md): Missing validation check on CRL issuer name in Snapdragon Automobile, Snapdragon Mobile in versions MSM8996AU, SD 410/12, SD 425, SD 430… (no CVSS, Qualcomm Snapdragon Automobile, Snapdragon Mobile)
- [CVE-2018-11264](https://cve.now/CVE-2018-11264.md): Possible buffer overflow in Ontario fingerprint code due to lack of input validation for the parameters coming into TZ from HLOS in… (no CVSS, Qualcomm Snapdragon Automobile, Snapdragon Mobile, Snapdrag…)
- [CVE-2018-11921](https://cve.now/CVE-2018-11921.md): Failure condition is not handled properly and the correct error code is not returned. (no CVSS, Qualcomm Snapdragon Automobile, Snapdragon Mobile, Snapdrag…)
- [CVE-2018-11994](https://cve.now/CVE-2018-11994.md): SMMU secure camera logic allows secure camera controllers to access HLOS memory during session in Snapdragon Automobile, Snapdragon Mobile… (no CVSS, Qualcomm Snapdragon Automobile, Snapdragon Mobile, Snapdrag…)
- [CVE-2018-11996](https://cve.now/CVE-2018-11996.md): When a malformed command is sent to the device programmer, an out-of-bounds access can occur in Snapdragon Automobile, Snapdragon Mobile… (no CVSS, Qualcomm Snapdragon Automobile, Snapdragon Mobile, Snapdrag…)
- [CVE-2018-5870](https://cve.now/CVE-2018-5870.md): While loading a service image, an untrusted pointer dereference can occur in Snapdragon Mobile in versions SD 835, SDA660, SDX24. (no CVSS, Qualcomm Snapdragon Mobile)
- [CVE-2018-5877](https://cve.now/CVE-2018-5877.md): In the device programmer target-side code for firehose, a string may not be properly NULL terminated can lead to a incorrect buffer size… (no CVSS, Qualcomm Snapdragon Automobile, Snapdragon Mobile, Snapdrag…)
- [CVE-2018-5912](https://cve.now/CVE-2018-5912.md): Potential buffer overflow in Video due to lack of input validation in input and output values in Snapdragon Automobile, Snapdragon Mobile… (no CVSS, Qualcomm Snapdragon Automobile, Snapdragon Mobile)
- [CVE-2018-5916](https://cve.now/CVE-2018-5916.md): Buffer overread while decoding PDP modify request or network initiated secondary PDP activation in Snapdragon Automobile, Snapdragon… (no CVSS, Qualcomm Snapdragon Automobile, Snapdragon Mobile, Snapdrag…)
- [CVE-2018-5917](https://cve.now/CVE-2018-5917.md): Possible buffer overflow in OEM crypto function due to improper input validation in Snapdragon Automobile, Snapdragon Mobile in versions… (no CVSS, Qualcomm Snapdragon Automobile, Snapdragon Mobile)
- [CVE-2018-5918](https://cve.now/CVE-2018-5918.md): Possible buffer overflow in DRM Trusted application due to lack of check function return values in Snapdragon Automobile, Snapdragon… (no CVSS, Qualcomm Snapdragon Automobile, Snapdragon Mobile, Snapdrag…)
- [CVE-2018-14629](https://cve.now/CVE-2018-14629.md): A denial of service vulnerability was discovered in Samba's LDAP server before versions 4.7.12, 4.8.7, and 4.9.3. (CVSS 6.5, \[UNKNOWN\] samba)
- [CVE-2018-16841](https://cve.now/CVE-2018-16841.md): Samba from version 4.3.0 and before versions 4.7.12, 4.8.7 and 4.9.3 are vulnerable to a denial of service. (CVSS 5.7, \[UNKNOWN\] samba)
- [CVE-2018-16851](https://cve.now/CVE-2018-16851.md): Samba from version 4.0.0 and before versions 4.7.12, 4.8.7, 4.9.3 is vulnerable to a denial of service. (CVSS 6.5, \[UNKNOWN\] samba)
- [CVE-2018-16852](https://cve.now/CVE-2018-16852.md): Samba from version 4.9.0 and before version 4.9.3 is vulnerable to a NULL pointer de-reference. (CVSS 6.5, \[UNKNOWN\] samba)
- [CVE-2018-16853](https://cve.now/CVE-2018-16853.md): Samba from version 4.7.0 has a vulnerability that allows a user in a Samba AD domain to crash the KDC when Samba is built in the… (CVSS 7.5, \[UNKNOWN\] samba)
- [CVE-2018-16857](https://cve.now/CVE-2018-16857.md): Samba from version 4.9.0 and before version 4.9.3 that have AD DC configurations watching for bad passwords (to restrict brute forcing of… (CVSS 7.4, \[UNKNOWN\] samba)
- [CVE-2018-19630](https://cve.now/CVE-2018-19630.md): cgi\_handle\_request in uhttpd in OpenWrt through 18.06.1 and LEDE through 17.01 has unauthenticated reflected XSS via the URI, as… (no CVSS)
- [CVE-2018-19620](https://cve.now/CVE-2018-19620.md): ShowDoc 2.4.1 allows remote attackers to edit other users' notes by navigating with a modified page\_id. (no CVSS, showdoc/showdoc)
- [CVE-2018-19621](https://cve.now/CVE-2018-19621.md): server/index.php?s=/api/teamMember/save in ShowDoc 2.4.2 has a CSRF that can add members to a team. (no CVSS, showdoc/showdoc)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/archive/2018-11-28
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.