# CVEs published 2018-12-03

54 CVEs were published on December 3, 2018: 0 critical, 7 high. Days are UTC.

- [CVE-2018-14695](https://cve.now/CVE-2018-14695.md): Incorrect access control in the /mysql/api/diags.php endpoint in Drobo 5N2 NAS version 4.0.5-13.28.96115 allows unauthenticated attackers… (no CVSS)
- [CVE-2018-14696](https://cve.now/CVE-2018-14696.md): Incorrect access control in the /mysql/api/drobo.php endpoint in Drobo 5N2 NAS version 4.0.5-13.28.96115 allows unauthenticated attackers… (no CVSS)
- [CVE-2018-14697](https://cve.now/CVE-2018-14697.md): Cross-site scripting in the /DroboAccess/enable\_user endpoint in Drobo 5N2 NAS version 4.0.5-13.28.96115 allows attackers to execute… (no CVSS)
- [CVE-2018-14698](https://cve.now/CVE-2018-14698.md): Cross-site scripting in the /DroboAccess/delete\_user endpoint in Drobo 5N2 NAS version 4.0.5-13.28.96115 allows attackers to execute… (no CVSS)
- [CVE-2018-14699](https://cve.now/CVE-2018-14699.md): System command injection in the /DroboAccess/enable\_user endpoint in Drobo 5N2 NAS version 4.0.5-13.28.96115 allows unauthenticated… (no CVSS)
- [CVE-2018-14700](https://cve.now/CVE-2018-14700.md): Incorrect access control in the /mysql/api/logfile.php endpoint in Drobo 5N2 NAS version 4.0.5-13.28.96115 allows unauthenticated… (no CVSS)
- [CVE-2018-14701](https://cve.now/CVE-2018-14701.md): System command injection in the /DroboAccess/delete\_user endpoint in Drobo 5N2 NAS version 4.0.5-13.28.96115 allows unauthenticated… (no CVSS)
- [CVE-2018-14702](https://cve.now/CVE-2018-14702.md): Incorrect access control in the /drobopix/api/drobo.php endpoint in Drobo 5N2 NAS version 4.0.5-13.28.96115 allows unauthenticated… (no CVSS)
- [CVE-2018-14703](https://cve.now/CVE-2018-14703.md): Incorrect access control in the /mysql/api/droboapp/data endpoint in Drobo 5N2 NAS version 4.0.5-13.28.96115 allows unauthenticated… (no CVSS)
- [CVE-2018-14704](https://cve.now/CVE-2018-14704.md): Cross-site scripting in the MySQL API error page in Drobo 5N2 NAS version 4.0.5-13.28.96115 allows attackers to execute JavaScript via a… (no CVSS)
- [CVE-2018-14706](https://cve.now/CVE-2018-14706.md): System command injection in the /DroboPix/api/drobopix/demo endpoint on Drobo 5N2 NAS version 4.0.5-13.28.96115 allows unauthenticated… (no CVSS)
- [CVE-2018-14707](https://cve.now/CVE-2018-14707.md): Directory traversal in the Drobo Pix web application on Drobo 5N2 NAS version 4.0.5-13.28.96115 allows unauthenticated attackers to upload… (no CVSS)
- [CVE-2018-14708](https://cve.now/CVE-2018-14708.md): An insecure transport protocol used by Drobo Dashboard API on Drobo 5N2 NAS version 4.0.5-13.28.96115 allows attackers to intercept… (no CVSS)
- [CVE-2018-14709](https://cve.now/CVE-2018-14709.md): Incorrect access control in the Dashboard API on Drobo 5N2 NAS version 4.0.5-13.28.96115 allows attackers to bypass authentication due to… (no CVSS)
- [CVE-2018-3854](https://cve.now/CVE-2018-3854.md): An exploitable information disclosure vulnerability exists in the password protection functionality of Quicken Deluxe 2018 for Mac version… (CVSS 7.1)
- [CVE-2018-4019](https://cve.now/CVE-2018-4019.md): An exploitable command injection vulnerability exists in the way Netgate pfSense CE 2.4.4-RELEASE processes the parameters of a specific… (CVSS 7.2, Netgate pfSense)
- [CVE-2018-4020](https://cve.now/CVE-2018-4020.md): An exploitable command injection vulnerability exists in the way Netgate pfSense CE 2.4.4-RELEASE processes the parameters of a specific… (CVSS 7.2, Netgate pfSense)
- [CVE-2018-4021](https://cve.now/CVE-2018-4021.md): An exploitable command injection vulnerability exists in the way Netgate pfSense CE 2.4.4-RELEASE processes the parameters of a specific… (CVSS 7.2, Netgate pfSense)
- [CVE-2018-6439](https://cve.now/CVE-2018-6439.md): A Vulnerability in the configdownload command of Brocade Fabric OS command line interface (CLI) versions before 8.2.1, 8.1.2f, 8.0.2f… (CVSS 7.8, Brocade Communications Systems Brocade Fabric OS)
- [CVE-2018-6440](https://cve.now/CVE-2018-6440.md): A vulnerability in the proxy service of Brocade Fabric OS versions before 8.2.1, 8.1.2f, 8.0.2f, 7.4.2d could allow remote unauthenticated… (no CVSS, Brocade Communications Systems Brocade Fabric OS)
- [CVE-2018-19826](https://cve.now/CVE-2018-19826.md): In inspect.cpp in LibSass 3.5.5, a high memory footprint caused by an endless loop (containing a… (no CVSS)
- [CVE-2018-19827](https://cve.now/CVE-2018-19827.md): In LibSass 3.5.5, a use-after-free vulnerability exists in the SharedPtr class in SharedPtr.cpp (or SharedPtr.hpp) that may cause a denial… (no CVSS)
- [CVE-2018-19835](https://cve.now/CVE-2018-19835.md): Metinfo 6.1.3 has reflected XSS via the admin/column/move.php lang\_columnerr4 parameter. (no CVSS)
- [CVE-2018-19836](https://cve.now/CVE-2018-19836.md): In Metinfo 6.1.3, include/interface/applogin.php allows setting arbitrary HTTP headers (including the Cookie header), and common.inc.php… (no CVSS)
- [CVE-2018-16863](https://cve.now/CVE-2018-16863.md): It was found that RHSA-2018:2918 did not fully fix CVE-2018-16509. (CVSS 7.3, Artifex ghostscript)
- [CVE-2018-19824](https://cve.now/CVE-2018-19824.md): In the Linux kernel through 4.19.6, a local user could exploit a use-after-free in the ALSA driver by supplying a malicious USB Sound… (no CVSS)
- [CVE-2018-1002000](https://cve.now/CVE-2018-1002000.md): There is blind SQL injection in WordPress Arigato Autoresponder and Newsletter v2.5.1.8 These vulnerabilities require administrative… (no CVSS, Kiboko Labs https://calendarscripts.info/ Arigato Autorespo…)
- [CVE-2018-1002001](https://cve.now/CVE-2018-1002001.md): There is a reflected XSS vulnerability in WordPress Arigato Autoresponder and News letter v2.5.1.8 This vulnerability requires… (no CVSS, Kiboko Labs https://calendarscripts.info/ Arigato Autorespo…)
- [CVE-2018-1002002](https://cve.now/CVE-2018-1002002.md): There is a reflected XSS vulnerability in WordPress Arigato Autoresponder and News letter v2.5.1.8 This vulnerability requires… (no CVSS, Kiboko Labs https://calendarscripts.info/ Arigato Autorespo…)
- [CVE-2018-1002003](https://cve.now/CVE-2018-1002003.md): There is a reflected XSS vulnerability in WordPress Arigato Autoresponder and News letter v2.5.1.8 This vulnerability requires… (no CVSS, Kiboko Labs https://calendarscripts.info/ Arigato Autorespo…)
- [CVE-2018-1002004](https://cve.now/CVE-2018-1002004.md): There is a reflected XSS vulnerability in WordPress Arigato Autoresponder and News letter v2.5.1.8 This vulnerability requires… (no CVSS, Kiboko Labs https://calendarscripts.info/ Arigato Autorespo…)
- [CVE-2018-1002005](https://cve.now/CVE-2018-1002005.md): These vulnerabilities require administrative privileges to exploit. (no CVSS, Kiboko Labs https://calendarscripts.info/ Arigato Autorespo…)
- [CVE-2018-1002006](https://cve.now/CVE-2018-1002006.md): These vulnerabilities require administrative privileges to exploit. (no CVSS, Kiboko Labs https://calendarscripts.info/ Arigato Autorespo…)
- [CVE-2018-1002007](https://cve.now/CVE-2018-1002007.md): There is a reflected XSS vulnerability in WordPress Arigato Autoresponder and News letter v2.5.1.8 This vulnerability requires… (no CVSS, Kiboko Labs https://calendarscripts.info/ Arigato Autorespo…)
- [CVE-2018-1002008](https://cve.now/CVE-2018-1002008.md): There is a reflected XSS vulnerability in WordPress Arigato Autoresponder and News letter v2.5.1.8 This vulnerability requires… (no CVSS, Kiboko Labs https://calendarscripts.info/ Arigato Autorespo…)
- [CVE-2018-1002009](https://cve.now/CVE-2018-1002009.md): There is a reflected XSS vulnerability in WordPress Arigato Autoresponder and News letter v2.5.1.8 This vulnerability requires… (no CVSS, Kiboko Labs https://calendarscripts.info/ Arigato Autorespo…)
- [CVE-2018-1840](https://cve.now/CVE-2018-1840.md): IBM WebSphere Application Server 8.5 and 9.0 could allow a remote attacker to gain elevated privileges on the system, caused when a… (CVSS 6.0, IBM WebSphere Application Server)
- [CVE-2018-7112](https://cve.now/CVE-2018-7112.md): The HPE-provided Windows firmware installer for certain Gen9, Gen8, G7,and G6 HPE servers allows local disclosure of privileged information. (no CVSS, Hewlett Packard Enterprise Windows firmware installer for G…)
- [CVE-2018-7113](https://cve.now/CVE-2018-7113.md): A security vulnerability in HPE Integrated Lights-Out 5 (iLO 5) prior to v1.37 could be locally exploited to bypass the security… (no CVSS, Hewlett Packard Enterprise HPE Integrated Lights-Out 5 (iLO…)
- [CVE-2018-7114](https://cve.now/CVE-2018-7114.md): HPE Intelligent Management Center (IMC) prior to IMC PLAT 7.3 (E0605P06) is vulnerable to remote buffer overflow in dbman leading to code… (no CVSS, Hewlett Packard Enterprise HPE Intelligent Management Center)
- [CVE-2018-7115](https://cve.now/CVE-2018-7115.md): HPE Intelligent Management Center (IMC) prior to IMC PLAT 7.3 (E0605P06) is vulnerable to a remote buffer overflow in dbman.exe opcode… (no CVSS, Hewlett Packard Enterprise HPE Intelligent Management Center)
- [CVE-2018-7116](https://cve.now/CVE-2018-7116.md): HPE Intelligent Management Center (IMC) prior to IMC PLAT 7.3 (E0605P06) is vulnerable to a remote denial of service via dbman Opcode… (no CVSS, Hewlett Packard Enterprise HPE Intelligent Management Center)
- [CVE-2018-16855](https://cve.now/CVE-2018-16855.md): An issue has been found in PowerDNS Recursor before version 4.1.8 where a remote attacker sending a DNS query can trigger an out-of-bounds… (CVSS 7.5, \[UNKNOWN\] pdns-recursor)
- [CVE-2018-16868](https://cve.now/CVE-2018-16868.md): A Bleichenbacher type side-channel based padding oracle attack was found in the way gnutls handles verification of RSA decrypted PKCS#1… (CVSS 4.7, \[UNKNOWN\] gnutls)
- [CVE-2018-16869](https://cve.now/CVE-2018-16869.md): A Bleichenbacher type side-channel based padding oracle attack was found in the way nettle handles endian conversion of RSA decrypted… (CVSS 4.7, \[UNKNOWN\] nettle)
- [CVE-2018-6332](https://cve.now/CVE-2018-6332.md): A potential denial-of-service issue in the Proxygen handling of invalid HTTP2 settings which can cause the server to spend… (CVSS 5.9, Facebook HHVM)
- [CVE-2018-19788](https://cve.now/CVE-2018-19788.md): A flaw was found in PolicyKit (aka polkit) 0.115 that allows a user with a uid greater than INT\_MAX to successfully execute any systemctl… (no CVSS)
- [CVE-2018-19791](https://cve.now/CVE-2018-19791.md): The server in LiteSpeed OpenLiteSpeed before 1.5.0 RC6 does not correctly handle requests for byte sequences, allowing an attacker to… (no CVSS)
- [CVE-2018-19792](https://cve.now/CVE-2018-19792.md): The server in LiteSpeed OpenLiteSpeed before 1.5.0 RC6 allows local users to cause a denial of service (buffer overflow) or possibly have… (no CVSS)
- [CVE-2018-19793](https://cve.now/CVE-2018-19793.md): jiacrontab 1.4.5 allows remote attackers to execute arbitrary commands via the crontab/task/edit?addr=localhost%3a20001 command and args… (no CVSS)
- [CVE-2018-19794](https://cve.now/CVE-2018-19794.md): Cross-site scripting (XSS) vulnerability in UiV2Public.index in Internet2 Grouper 2.2 and 2.3 allows remote attackers to inject arbitrary… (no CVSS)
- [CVE-2018-19795](https://cve.now/CVE-2018-19795.md): ChipsBank UMPTool saves the password to the NAND with a simple substitution cipher, which allows attackers to get full access when having… (no CVSS)
- [CVE-2018-19796](https://cve.now/CVE-2018-19796.md): An open redirect in the Ninja Forms plugin before 3.3.19.1 for WordPress allows Remote Attackers to redirect a user via the… (no CVSS)
- [CVE-2018-19797](https://cve.now/CVE-2018-19797.md): In LibSass 3.5.5, a NULL Pointer Dereference in the function Sass::Selector\_List::populate\_extends in SharedPtr.hpp (used by ast.cpp and… (no CVSS)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/archive/2018-12-03
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.