# CVEs published 2018-12-12

81 CVEs were published on December 12, 2018: 0 critical, 3 high. 2 are now in CISA KEV. Days are UTC.

- [CVE-2018-6706](https://cve.now/CVE-2018-6706.md): McAfee Agent (MA) non-Windows versions incorrect use of temporary file vulnerability (CVSS 2.3, McAfee Agent (MA) for Linux)
- [CVE-2018-6704](https://cve.now/CVE-2018-6704.md): McAfee Agent for Linux Privilege Escalation vulnerability (CVSS 4.7, McAfee Agent (MA) for Linux)
- [CVE-2018-6705](https://cve.now/CVE-2018-6705.md): McAfee Agent (MA) for Linux Privilege Escalation vulnerability (CVSS 2.3, McAfee Agent (MA) for Linux)
- [CVE-2018-15717](https://cve.now/CVE-2018-15717.md): Open Dental before version 18.4 stores user passwords as base64 encoded MD5 hashes. (no CVSS, Open Dental)
- [CVE-2018-15718](https://cve.now/CVE-2018-15718.md): Open Dental before version 18.4 transmits the entire user database over the network when a remote unauthenticated user accesses the… (no CVSS, Open Dental)
- [CVE-2018-15719](https://cve.now/CVE-2018-15719.md): Open Dental before version 18.4 installs a mysql database and uses the default credentials of "root" with a blank password. (no CVSS, Open Dental)
- [CVE-2018-20102](https://cve.now/CVE-2018-20102.md): An out-of-bounds read in dns\_validate\_dns\_response in dns.c was discovered in HAProxy through 1.8.14. (no CVSS)
- [CVE-2018-20103](https://cve.now/CVE-2018-20103.md): An issue was discovered in dns.c in HAProxy through 1.8.14. (no CVSS)
- [CVE-2018-11457](https://cve.now/CVE-2018-11457.md): A vulnerability has been identified in SINUMERIK 828D V4.7 (All versions \< V4.7 SP6 HF1), SINUMERIK 840D sl V4.7 (All versions \< V4.7 SP6… (no CVSS, Siemens AG SINUMERIK 828D V4.7, SINUMERIK 840D sl V4.7, SIN…)
- [CVE-2018-11458](https://cve.now/CVE-2018-11458.md): A vulnerability has been identified in SINUMERIK 828D V4.7 (All versions \< V4.7 SP6 HF1), SINUMERIK 840D sl V4.7 (All versions \< V4.7 SP6… (no CVSS, Siemens AG SINUMERIK 828D V4.7, SINUMERIK 840D sl V4.7, SIN…)
- [CVE-2018-11459](https://cve.now/CVE-2018-11459.md): A vulnerability has been identified in SINUMERIK 808D V4.7 (All versions), SINUMERIK 808D V4.8 (All versions), SINUMERIK 828D V4.7 (All… (no CVSS, Siemens AG SINUMERIK 808D V4.7, SINUMERIK 808D V4.8, SINUME…)
- [CVE-2018-11460](https://cve.now/CVE-2018-11460.md): A vulnerability has been identified in SINUMERIK 808D V4.7 (All versions), SINUMERIK 808D V4.8 (All versions), SINUMERIK 828D V4.7 (All… (no CVSS, Siemens AG SINUMERIK 808D V4.7, SINUMERIK 808D V4.8, SINUME…)
- [CVE-2018-11461](https://cve.now/CVE-2018-11461.md): A vulnerability has been identified in SINUMERIK 808D V4.7 (All versions), SINUMERIK 808D V4.8 (All versions), SINUMERIK 828D V4.7 (All… (no CVSS, Siemens AG SINUMERIK 808D V4.7, SINUMERIK 808D V4.8, SINUME…)
- [CVE-2018-11462](https://cve.now/CVE-2018-11462.md): A vulnerability has been identified in SINUMERIK 808D V4.7 (All versions), SINUMERIK 808D V4.8 (All versions), SINUMERIK 828D V4.7 (All… (no CVSS, Siemens AG SINUMERIK 808D V4.7, SINUMERIK 808D V4.8, SINUME…)
- [CVE-2018-11463](https://cve.now/CVE-2018-11463.md): A vulnerability has been identified in SINUMERIK 808D V4.7 (All versions), SINUMERIK 808D V4.8 (All versions), SINUMERIK 828D V4.7 (All… (no CVSS, Siemens AG SINUMERIK 808D V4.7, SINUMERIK 808D V4.8, SINUME…)
- [CVE-2018-11464](https://cve.now/CVE-2018-11464.md): A vulnerability has been identified in SINUMERIK 828D V4.7 (All versions \< V4.7 SP6 HF1), SINUMERIK 840D sl V4.7 (All versions \< V4.7 SP6… (no CVSS, Siemens AG SINUMERIK 828D V4.7, SINUMERIK 840D sl V4.7, SIN…)
- [CVE-2018-11465](https://cve.now/CVE-2018-11465.md): A vulnerability has been identified in SINUMERIK 808D V4.7 (All versions), SINUMERIK 808D V4.8 (All versions), SINUMERIK 828D V4.7 (All… (no CVSS, Siemens AG SINUMERIK 808D V4.7, SINUMERIK 808D V4.8, SINUME…)
- [CVE-2018-11466](https://cve.now/CVE-2018-11466.md): A vulnerability has been identified in SINUMERIK 808D V4.7 (All versions), SINUMERIK 808D V4.8 (All versions), SINUMERIK 828D V4.7 (All… (no CVSS, Siemens AG SINUMERIK 808D V4.7, SINUMERIK 808D V4.8, SINUME…)
- [CVE-2018-13816](https://cve.now/CVE-2018-13816.md): A vulnerability has been identified in TIM 1531 IRC (All version \< V2.0). (no CVSS, Siemens AG TIM 1531 IRC)
- [CVE-2018-1474](https://cve.now/CVE-2018-1474.md): IBM BigFix Platform 9.2.0 through 9.2.14 and 9.5 through 9.5.9 is vulnerable to HTTP response splitting attacks, caused by improper… (CVSS 6.1, IBM BigFix Platform)
- [CVE-2018-1476](https://cve.now/CVE-2018-1476.md): IBM BigFix Platform 9.2.0 through 9.2.14 and 9.5 through 9.5.9 discloses sensitive information to unauthorized users. (CVSS 5.3, IBM BigFix Platform)
- [CVE-2018-1478](https://cve.now/CVE-2018-1478.md): IBM BigFix Platform 9.2.0 through 9.2.14 and 9.5 through 9.5.9 could allow a remote attacker to hijack the clicking action of the victim. (CVSS 6.1, IBM BigFix Platform)
- [CVE-2018-1480](https://cve.now/CVE-2018-1480.md): IBM BigFix Platform 9.2.0 through 9.2.14 and 9.5 through 9.5.9 does not set the 'HttpOnly' attribute on authorization tokens or session… (CVSS 4.0, IBM BigFix Platform)
- [CVE-2018-1481](https://cve.now/CVE-2018-1481.md): IBM BigFix Platform 9.2.0 through 9.2.14 and 9.5 through 9.5.9 stores sensitive information in URL parameters. (CVSS 3.7, IBM BigFix Platform)
- [CVE-2018-1484](https://cve.now/CVE-2018-1484.md): IBM BigFix Platform 9.2.0 through 9.2.14 and 9.5 through 9.5.9 does not set the secure attribute on authorization tokens or session cookies. (CVSS 3.7, IBM BigFix Platform)
- [CVE-2018-1485](https://cve.now/CVE-2018-1485.md): IBM BigFix Platform 9.2.0 through 9.2.14 and 9.5 through 9.5.9 does not renew a session variable after a successful authentication which… (CVSS 3.1, IBM BigFix Platform)
- [CVE-2018-1901](https://cve.now/CVE-2018-1901.md): IBM WebSphere Application Server 8.5 and 9.0 could allow a remote attacker to temporarily gain elevated privileges on the system, caused… (CVSS 5.0, IBM WebSphere Application Server)
- [CVE-2018-1926](https://cve.now/CVE-2018-1926.md): IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 Admin Console is vulnerable to cross-site request forgery, caused by improper… (CVSS 4.3, IBM WebSphere Application Server)
- [CVE-2018-20101](https://cve.now/CVE-2018-20101.md): The codection "Import users from CSV with meta" plugin before 1.12.1 for WordPress allows XSS via the value of a cell. (no CVSS)
- [CVE-2018-15328](https://cve.now/CVE-2018-15328.md): On BIG-IP 14.0.x, 13.x, 12.x, and 11.x, Enterprise Manager 3.1.1, BIG-IQ 6.x, 5.x, and 4.x, and iWorkflow 2.x, the passphrases for SNMPv3… (no CVSS, F5 Networks BIG-IP (LTM, AAM, AFM, Analytics, APM, ASM, DNS…)
- [CVE-2018-17949](https://cve.now/CVE-2018-17949.md): Cross site scripting vulnerability in iManager prior to 3.1 SP2. (no CVSS, Micro Focus NetIQ iManager 3.1 SP2)
- [CVE-2018-17950](https://cve.now/CVE-2018-17950.md): Incorrect enforcement of authorization checks in eDirectory prior to 9.1 SP2 (no CVSS, Micro Focus NetIQ eDirectory 9.1 SP2)
- [CVE-2018-17952](https://cve.now/CVE-2018-17952.md): Cross site scripting vulnerability in eDirectory prior to 9.1 SP2 (no CVSS, Micro Focus NetIQ eDirectory 9.1 SP2)
- [CVE-2018-8650](https://cve.now/CVE-2018-8650.md): A cross-site-scripting (XSS) vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web… (CVSS 5.4, Microsoft SharePoint)
- [CVE-2018-16867](https://cve.now/CVE-2018-16867.md): A flaw was found in qemu Media Transfer Protocol (MTP) before version 3.1.0. (CVSS 7.0, \[UNKNOWN\] QEMU:)
- [CVE-2018-20094](https://cve.now/CVE-2018-20094.md): An issue was discovered in XXL-CONF 1.6.0. (no CVSS, com.xuxueli:xxl-conf-admin)
- [CVE-2018-20095](https://cve.now/CVE-2018-20095.md): An issue was discovered in EnsureCapacity in Core/Ap4Array.h in Bento4 1.5.1-627. (no CVSS)
- [CVE-2018-20096](https://cve.now/CVE-2018-20096.md): There is a heap-based buffer over-read in the Exiv2::tEXtToDataBuf function of pngimage.cpp in Exiv2 0.27-RC3. (no CVSS, exiv2)
- [CVE-2018-20098](https://cve.now/CVE-2018-20098.md): There is a heap-based buffer over-read in Exiv2::Jp2Image::encodeJp2Header of jp2image.cpp in Exiv2 0.27-RC3. (no CVSS, exiv2)
- [CVE-2018-20099](https://cve.now/CVE-2018-20099.md): There is an infinite loop in Exiv2::Jp2Image::encodeJp2Header of jp2image.cpp in Exiv2 0.27-RC3. (no CVSS, exiv2)
- [CVE-2018-18397](https://cve.now/CVE-2018-18397.md): The userfaultfd implementation in the Linux kernel before 4.19.7 mishandles access control for certain UFFDIO\_ ioctl calls, as… (no CVSS)
- [CVE-2018-10143](https://cve.now/CVE-2018-10143.md): The Palo Alto Networks Expedition Migration tool 1.0.107 and earlier may allow an unauthenticated attacker with remote access to run… (no CVSS, Palo Alto Networks Expedition)
- [CVE-2018-20097](https://cve.now/CVE-2018-20097.md): There is a SEGV in Exiv2::Internal::TiffParserWorker::findPrimaryGroups of tiffimage\_int.cpp in Exiv2 0.27-RC3. (no CVSS, exiv2)
- [CVE-2018-8477](https://cve.now/CVE-2018-8477.md): An information disclosure vulnerability exists when the Windows kernel improperly handles objects in memory, aka "Windows Kernel… (no CVSS, Microsoft Windows)
- [CVE-2018-8514](https://cve.now/CVE-2018-8514.md): An information disclosure vulnerability exists when Remote Procedure Call runtime improperly initializes objects in memory, aka "Remote… (no CVSS, Microsoft Windows)
- [CVE-2018-8517](https://cve.now/CVE-2018-8517.md): A denial of service vulnerability exists when .NET Framework improperly handles special web requests, aka ".NET Framework Denial Of… (no CVSS, Microsoft .NET Framework)
- [CVE-2018-8540](https://cve.now/CVE-2018-8540.md): A remote code execution vulnerability exists when the Microsoft .NET Framework fails to validate input properly, aka ".NET Framework… (no CVSS, Microsoft .NET Framework)
- [CVE-2018-8580](https://cve.now/CVE-2018-8580.md): An information disclosure vulnerability exists where certain modes of the search function in Microsoft SharePoint Server are vulnerable to… (no CVSS, Microsoft SharePoint)
- [CVE-2018-8583](https://cve.now/CVE-2018-8583.md): A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka… (no CVSS, Microsoft Edge · Microsoft ChakraCore +1)
- [CVE-2018-8587](https://cve.now/CVE-2018-8587.md): A remote code execution vulnerability exists in Microsoft Outlook software when it fails to properly handle objects in memory, aka… (no CVSS, Microsoft Office · Microsoft Outlook)
- [CVE-2018-8595](https://cve.now/CVE-2018-8595.md): An information disclosure vulnerability exists when the Windows GDI component improperly discloses the contents of its memory, aka… (no CVSS, Microsoft Windows)
- [CVE-2018-8596](https://cve.now/CVE-2018-8596.md): An information disclosure vulnerability exists when the Windows GDI component improperly discloses the contents of its memory, aka… (no CVSS, Microsoft Windows)
- [CVE-2018-8597](https://cve.now/CVE-2018-8597.md): A remote code execution vulnerability exists in Microsoft Excel software when the software fails to properly handle objects in memory, aka… (no CVSS, Microsoft Office · Microsoft Excel)
- [CVE-2018-8598](https://cve.now/CVE-2018-8598.md): An information disclosure vulnerability exists when Microsoft Excel improperly discloses the contents of its memory, aka "Microsoft Excel… (no CVSS, Microsoft Office · Microsoft Excel)
- [CVE-2018-8599](https://cve.now/CVE-2018-8599.md): An elevation of privilege vulnerability exists when the Diagnostics Hub Standard Collector Service improperly impersonates certain file… (no CVSS, Microsoft Visual Studio · Microsoft Windows Server +1)
- [CVE-2018-8604](https://cve.now/CVE-2018-8604.md): A tampering vulnerability exists when Microsoft Exchange Server fails to properly handle profile data, aka "Microsoft Exchange Server… (no CVSS, Microsoft Exchange Server)
- [CVE-2018-8611](https://cve.now/CVE-2018-8611.md): An elevation of privilege vulnerability exists when the Windows kernel fails to properly handle objects in memory, aka "Windows Kernel Eleva (CVSS 7.8, KEV, Microsoft Windows)
- [CVE-2018-8612](https://cve.now/CVE-2018-8612.md): A Denial Of Service vulnerability exists when Connected User Experiences and Telemetry Service fails to validate certain function values… (no CVSS, Microsoft Windows Server · Microsoft Windows)
- [CVE-2018-8617](https://cve.now/CVE-2018-8617.md): A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka… (no CVSS, Microsoft Edge · Microsoft ChakraCore +1)
- [CVE-2018-8618](https://cve.now/CVE-2018-8618.md): A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka… (no CVSS, Microsoft Edge · Microsoft ChakraCore +1)
- [CVE-2018-8619](https://cve.now/CVE-2018-8619.md): A remote code execution vulnerability exists when the Internet Explorer VBScript execution policy does not properly restrict VBScript… (no CVSS, Microsoft Internet Explorer)
- [CVE-2018-8621](https://cve.now/CVE-2018-8621.md): An information disclosure vulnerability exists when the Windows kernel improperly handles objects in memory, aka "Windows Kernel… (no CVSS, Microsoft Windows Server · Microsoft Windows)
- [CVE-2018-8622](https://cve.now/CVE-2018-8622.md): An information disclosure vulnerability exists when the Windows kernel improperly handles objects in memory, aka "Windows Kernel… (no CVSS, Microsoft Windows)
- [CVE-2018-8624](https://cve.now/CVE-2018-8624.md): A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka… (no CVSS, Microsoft Edge · Microsoft ChakraCore +1)
- [CVE-2018-8625](https://cve.now/CVE-2018-8625.md): A remote code execution vulnerability exists in the way that the VBScript engine handles objects in memory, aka "Windows VBScript Engine… (no CVSS, Microsoft Internet Explorer)
- [CVE-2018-8626](https://cve.now/CVE-2018-8626.md): A remote code execution vulnerability exists in Windows Domain Name System (DNS) servers when they fail to properly handle requests, aka… (no CVSS, Microsoft Windows Server 2012 R2 · Microsoft Windows Ser… +1)
- [CVE-2018-8627](https://cve.now/CVE-2018-8627.md): An information disclosure vulnerability exists when Microsoft Excel software reads out of bound memory due to an uninitialized variable… (no CVSS, Microsoft Office · Microsoft Excel)
- [CVE-2018-8628](https://cve.now/CVE-2018-8628.md): A remote code execution vulnerability exists in Microsoft PowerPoint software when the software fails to properly handle objects in… (no CVSS, Microsoft Office · Microsoft PowerPoint +1)
- [CVE-2018-8629](https://cve.now/CVE-2018-8629.md): A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka… (no CVSS, Microsoft Edge · Microsoft ChakraCore +1)
- [CVE-2018-8631](https://cve.now/CVE-2018-8631.md): A remote code execution vulnerability exists when Internet Explorer improperly accesses objects in memory, aka "Internet Explorer Memory… (no CVSS, Microsoft Internet Explorer)
- [CVE-2018-8634](https://cve.now/CVE-2018-8634.md): A remote code execution vulnerability exists in Windows where Microsoft text-to-speech fails to properly handle objects in the memory, aka… (no CVSS, Microsoft Windows Server · Microsoft Windows)
- [CVE-2018-8635](https://cve.now/CVE-2018-8635.md): An elevation of privilege vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted… (no CVSS, Microsoft SharePoint Server · Microsoft SharePoint)
- [CVE-2018-8636](https://cve.now/CVE-2018-8636.md): A remote code execution vulnerability exists in Microsoft Excel software when the software fails to properly handle objects in memory, aka… (no CVSS, Microsoft Office · Microsoft Excel)
- [CVE-2018-8637](https://cve.now/CVE-2018-8637.md): An information disclosure vulnerability exists in Windows kernel that could allow an attacker to retrieve information that could lead to a… (no CVSS, Microsoft Windows 10 Servers · Microsoft Windows)
- [CVE-2018-8638](https://cve.now/CVE-2018-8638.md): An information disclosure vulnerability exists when DirectX improperly handles objects in memory, aka "DirectX Information Disclosure… (no CVSS, Microsoft Windows)
- [CVE-2018-8639](https://cve.now/CVE-2018-8639.md): An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in memory, aka "Win32k (CVSS 8.4, KEV, Microsoft Windows)
- [CVE-2018-8641](https://cve.now/CVE-2018-8641.md): An elevation of privilege vulnerability exists in Windows when the Windows kernel-mode driver fails to properly handle objects in memory… (no CVSS, Microsoft Windows)
- [CVE-2018-8643](https://cve.now/CVE-2018-8643.md): A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Internet Explorer, aka… (no CVSS, Microsoft Internet Explorer)
- [CVE-2018-8649](https://cve.now/CVE-2018-8649.md): A denial of service vulnerability exists when Windows improperly handles objects in memory, aka "Windows Denial of Service Vulnerability."… (no CVSS, Microsoft Windows)
- [CVE-2018-8651](https://cve.now/CVE-2018-8651.md): A cross site scripting vulnerability exists when Microsoft Dynamics NAV does not properly sanitize a specially crafted web request to an… (no CVSS, Microsoft Dynamics NAV)
- [CVE-2018-8652](https://cve.now/CVE-2018-8652.md): A Cross-site Scripting (XSS) vulnerability exists when Windows Azure Pack does not properly sanitize user-provided input, aka "Windows… (no CVSS, Microsoft Windows Azure Pack Rollup)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/archive/2018-12-12
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.