# CVEs published 2018-12-14

21 CVEs were published on December 14, 2018: 0 critical, 1 high. Days are UTC.

- [CVE-2018-20157](https://cve.now/CVE-2018-20157.md): The data import functionality in OpenRefine through 3.1 allows an XML External Entity (XXE) attack through a crafted (zip) file, allowing… (no CVSS)
- [CVE-2018-20154](https://cve.now/CVE-2018-20154.md): The WP Maintenance Mode plugin before 2.0.7 for WordPress allows remote authenticated users to discover all subscriber e-mail addresses. (no CVSS)
- [CVE-2018-20155](https://cve.now/CVE-2018-20155.md): The WP Maintenance Mode plugin before 2.0.7 for WordPress allows remote authenticated subscriber users to bypass intended access… (no CVSS)
- [CVE-2018-20156](https://cve.now/CVE-2018-20156.md): The WP Maintenance Mode plugin before 2.0.7 for WordPress allows remote authenticated "site administrator" users to execute arbitrary PHP… (no CVSS)
- [CVE-2018-19007](https://cve.now/CVE-2018-19007.md): In Geutebrueck GmbH E2 Camera Series versions prior to 1.12.0.25 the DDNS configuration (in the Network Configuration panel) is vulnerable… (no CVSS, Geutebrück GmbH E2 Camera Series versions prior…)
- [CVE-2018-20147](https://cve.now/CVE-2018-20147.md): In WordPress before 4.9.9 and 5.x before 5.0.1, authors could modify metadata to bypass intended restrictions on deleting files. (no CVSS)
- [CVE-2018-20148](https://cve.now/CVE-2018-20148.md): In WordPress before 4.9.9 and 5.x before 5.0.1, contributors could conduct PHP object injection attacks via crafted metadata in a… (no CVSS)
- [CVE-2018-20149](https://cve.now/CVE-2018-20149.md): In WordPress before 4.9.9 and 5.x before 5.0.1, when the Apache HTTP Server is used, authors could upload crafted files that bypass… (no CVSS)
- [CVE-2018-20150](https://cve.now/CVE-2018-20150.md): In WordPress before 4.9.9 and 5.x before 5.0.1, crafted URLs could trigger XSS for certain use cases involving plugins. (no CVSS)
- [CVE-2018-20151](https://cve.now/CVE-2018-20151.md): In WordPress before 4.9.9 and 5.x before 5.0.1, the user-activation page could be read by a search engine's web crawler if an unusual… (no CVSS)
- [CVE-2018-20152](https://cve.now/CVE-2018-20152.md): In WordPress before 4.9.9 and 5.x before 5.0.1, authors could bypass intended restrictions on post types via crafted input. (no CVSS)
- [CVE-2018-20153](https://cve.now/CVE-2018-20153.md): In WordPress before 4.9.9 and 5.x before 5.0.1, contributors could modify new comments made by users with greater privileges, possibly… (no CVSS)
- [CVE-2018-1848](https://cve.now/CVE-2018-1848.md): IBM Business Automation Workflow 18.0.0.0 and 18.0.0.1 is vulnerable to cross-site scripting. (CVSS 6.1, IBM Business Automation Workflow)
- [CVE-2018-1977](https://cve.now/CVE-2018-1977.md): IBM DB2 for Linux, UNIX and Windows 11.1 (includes DB2 Connect Server) contains a denial of service vulnerability. (CVSS 5.3, IBM DB2 for Linux, UNIX and Windows)
- [CVE-2018-18006](https://cve.now/CVE-2018-18006.md): Hardcoded credentials in the Ricoh myPrint application 2.9.2.4 for Windows and 2.2.7 for Android give access to any externally disclosed… (no CVSS)
- [CVE-2018-18984](https://cve.now/CVE-2018-18984.md): Medtronic 9790, 2090 CareLink, and 29901 Encore Programmers Missing Encryption of Sensitive Data (CVSS 4.6, Medtronic CareLink 9790 Programmer · Medtronic CareLink… +1)
- [CVE-2018-19003](https://cve.now/CVE-2018-19003.md): GE Mark VIe, EX2100e, EX2100e\_Reg, and LS2100e Versions 03.03.28C to 05.02.04C, EX2100e All versions prior to v04.09.00C, EX2100e\_Reg All… (no CVSS, GE Mark VIe, EX2100e, EX2100e\_Reg, and LS2100e)
- [CVE-2018-19413](https://cve.now/CVE-2018-19413.md): A vulnerability in the API of SonarSource SonarQube before 7.4 could allow an authenticated user to discover sensitive information such as… (no CVSS, org.sonarsource.sonarqube:sonar-plugin-api)
- [CVE-2018-16873](https://cve.now/CVE-2018-16873.md): In Go before 1.10.6 and 1.11.x before 1.11.3, the "go get" command is vulnerable to remote code execution when executed with the -u flag… (CVSS 7.5, \[UNKNOWN\] golang · toolchain)
- [CVE-2018-16874](https://cve.now/CVE-2018-16874.md): In Go before 1.10.6 and 1.11.x before 1.11.3, the "go get" command is vulnerable to directory traversal when executed with the import path… (CVSS 6.8, \[UNKNOWN\] golang · toolchain)
- [CVE-2018-16875](https://cve.now/CVE-2018-16875.md): The crypto/x509 package of Go before 1.10.6 and 1.11.x before 1.11.3 does not limit the amount of work performed for each chain… (CVSS 5.9, \[UNKNOWN\] golang · stdlib)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/archive/2018-12-14
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.