CVEs published December 17, 2018
78 CVEs were published on December 17, 2018: 0 critical, 0 high. Browse them by severity, product and exploitation status.
- Published
- 78
- Critical
- 0
- High
- 0
- Medium
- 3
- Low
- 2
- Unrated
- 73
- Now in CISA KEV
- 0
- Fix available
- 7
Most affected products
- IBM Security Guardium
- 5
- rendertron
- 4
- Schneider Electric SE Embedded Web Servers in all Modicon M…
- 3
- bolt/bolt
- 1
- github.com/sylabs/singularity
- 1
- keystone
- 1
- Schneider Electric SE Power Monitoring Expert, Energy Exper…
- 1
- ymlref
- 1
Medium, low and unrated 78
- CVE-2018-7797A URL redirection vulnerability exists in Power Monitoring Expert, Energy Expert (formerly Power Manager) - EcoStruxure Power Monitoring…Schneider Electric SE Power Monitoring Expert, Energy Exper…
- CVE-2018-7804A URL Redirection to Untrusted Site vulnerability exists in the embedded web servers in all Modicon M340, Premium, Quantum PLCs and…Schneider Electric SE Embedded Web Servers in all Modicon M…
- CVE-2018-7812An Information Exposure through Discrepancy vulnerability exists in the embedded web servers in all Modicon M340, Premium, Quantum PLCs…Schneider Electric SE Embedded Web Servers in all Modicon M…
- CVE-2018-7833An Improper Check for Unusual or Exceptional Conditions vulnerability exists in the embedded web servers in all Modicon M340, Premium…Schneider Electric SE Embedded Web Servers in all Modicon M…
- CVE-2018-20189In GraphicsMagick 1.3.31, the ReadDIBImage function of coders/dib.c has a vulnerability allowing a crash and denial of service via a dib…
- CVE-2018-20190In LibSass 3.5.5, a NULL Pointer Dereference in the function Sass::Eval::operator()(Sass::Supports_Operator*) in eval.cpp may cause a…
- CVE-2018-20188FUEL CMS 1.4.3 has CSRF via users/create/ to add an administrator account.
- CVE-2018-14852Out-of-bounds array access in dhd_rx_frame in drivers/net/wireless/bcmdhd4358/dhd_linux.c in the bcmdhd4358 Wi-Fi driver on the Samsung…
- CVE-2018-14853A NULL pointer dereference in dhd_prot_txdata_write_flush in drivers/net/wireless/bcmdhd4358/dhd_msgbuf.c in the bcmdhd4358 Wi-Fi driver…
- CVE-2018-14854Buffer overflow in dhd_bus_flow_ring_delete_response in drivers/net/wireless/bcmdhd4358/dhd_pcie.c in the bcmdhd4358 Wi-Fi driver on the…
- CVE-2018-14855Buffer overflow in dhd_bus_flow_ring_flush_response in drivers/net/wireless/bcmdhd4358/dhd_pcie.c in the bcmdhd4358 Wi-Fi driver on the…
- CVE-2018-14856Buffer overflow in dhd_bus_flow_ring_create_response in drivers/net/wireless/bcmdhd4358/dhd_pcie.c in the bcmdhd4358 Wi-Fi driver on the…
- CVE-2018-16596A stack-based buffer overflow in the LAN UPnP service running on UDP port 1900 of Swisscom Internet-Box (2, Standard, and Plus) prior to…
- CVE-2018-18555A sandbox escape issue was discovered in VyOS 1.1.8.
- CVE-2018-18556A privilege escalation issue was discovered in VyOS 1.1.8.
- CVE-2018-19036An issue was discovered in several Bosch IP cameras for firmware versions 6.32 and higher.
- CVE-2018-19828Artica Integria IMS 5.0.83 has XSS via the search_string parameter.
- CVE-2018-19933Bolt CMS <3.6.2 allows XSS via text input click preview button as demonstrated by the Title field of a Configured and New Entry.bolt/bolt
- CVE-2018-19936PrinterOn Enterprise 4.1.4 allows Arbitrary File Deletion.
- CVE-2018-19974In YARA 3.8.1, bytecode in a specially crafted compiled rule can read uninitialized data from VM scratch memory in libyara/exec.c.
- CVE-2018-19975In YARA 3.8.1, bytecode in a specially crafted compiled rule can read data from any arbitrary address in memory, in libyara/exec.c.
- CVE-2018-19976In YARA 3.8.1, bytecode in a specially crafted compiled rule is exposed to information about its environment, in libyara/exec.c.
- CVE-2018-20092PTC ThingWorx Platform through 8.3.0 is vulnerable to a directory traversal attack on ZIP files via a POST request.
- CVE-2018-20123pvrdma_realize in hw/rdma/vmw/pvrdma_main.c in QEMU has a Memory leak after an initialisation error.
- CVE-2018-20133ymlref allows code injection.ymlref
Show all 78 entriesShow fewer entries
- CVE-2018-20184In GraphicsMagick 1.4 snapshot-20181209 Q8, there is a heap-based buffer overflow in the WriteTGAImage function of tga.c, which allows…
- CVE-2018-20185In GraphicsMagick 1.4 snapshot-20181209 Q8 on 32-bit platforms, there is a heap-based buffer over-read in the ReadBMPImage function of…
- CVE-2018-20186An issue was discovered in Bento4 1.5.1-627.
- CVE-2017-1265IBM Security Guardium 10.0, 10.0.1, 10.1, 10.1.2, 10.1.3, 10.1.4, and 10.5 does not validate, or incorrectly validates, a certificate.IBM Security Guardium
- CVE-2017-1272IBM Security Guardium 10.0 and 10.5 stores sensitive information in URL parameters.IBM Security Guardium
- CVE-2017-1597IBM Security Guardium 10.0, 10.0.1, 10.1, 10.1.2, 10.1.3, 10.1.4, and 10.5 Database Activity Monitor does not require that users should…IBM Security Guardium
- CVE-2018-1889IBM Security Guardium 10.0 and 10.5 is vulnerable to cross-site scripting.IBM Security Guardium
- CVE-2018-1891IBM Security Guardium 10 and 10.5 is vulnerable to cross-site scripting.IBM Security Guardium
- CVE-2018-18245Nagios Core 4.4.2 has XSS via the alert summary reports of plugin results, as demonstrated by a SCRIPT element delivered by a modified…
- CVE-2018-18246Icinga Web 2 before 2.6.2 has CSRF via /icingaweb2/config/moduledisable?name=monitoring to disable the monitoring module, or via…
- CVE-2018-18247Icinga Web 2 before 2.6.2 has XSS via the /icingaweb2/navigation/add icon parameter.
- CVE-2018-18248Icinga Web 2 has XSS via the /icingaweb2/monitoring/list/services dir parameter, the /icingaweb2/user/list query string, the…
- CVE-2018-18249Icinga Web 2 before 2.6.2 allows injection of PHP ini-file directives via vectors involving environment variables as the channel to send…
- CVE-2018-18250Icinga Web 2 before 2.6.2 allows parameters that break navigation dashlets, as demonstrated by a single '$' character as the Name of a…
- CVE-2018-19295Sylabs Singularity 2.4 to 2.6 allows local users to conduct Improper Input Validation attacks.github.com/sylabs/singularity
- CVE-2018-19649XSS exists in InfoVista VistaPortal SE Version 5.1 (build 51029).
- CVE-2018-19765Cross Site Scripting exists in InfoVista VistaPortal SE Version 5.1 (build 51029).
- CVE-2018-19766Cross Site Scripting exists in InfoVista VistaPortal SE Version 5.1 (build 51029).
- CVE-2018-19767Cross Site Scripting exists in InfoVista VistaPortal SE Version 5.1 (build 51029).
- CVE-2018-19768Cross Site Scripting exists in InfoVista VistaPortal SE Version 5.1 (build 51029).
- CVE-2018-19769Cross Site Scripting exists in InfoVista VistaPortal SE Version 5.1 (build 51029).
- CVE-2018-19770Cross Site Scripting exists in InfoVista VistaPortal SE Version 5.1 (build 51029).
- CVE-2018-19771Cross Site Scripting exists in InfoVista VistaPortal SE Version 5.1 (build 51029).
- CVE-2018-19772Cross Site Scripting exists in InfoVista VistaPortal SE Version 5.1 (build 51029).
- CVE-2018-19773Cross Site Scripting exists in InfoVista VistaPortal SE Version 5.1 (build 51029).
- CVE-2018-19774Cross Site Scripting exists in InfoVista VistaPortal SE Version 5.1 (build 51029).
- CVE-2018-19775Cross Site Scripting exists in InfoVista VistaPortal SE Version 5.1 (build 51029).
- CVE-2018-19809Cross Site Scripting exists in InfoVista VistaPortal SE Version 5.1 (build 51029).
- CVE-2018-19810Cross Site Scripting exists in InfoVista VistaPortal SE Version 5.1 (build 51029).
- CVE-2018-19811Cross Site Scripting exists in InfoVista VistaPortal SE Version 5.1 (build 51029).
- CVE-2018-19812Cross Site Scripting exists in InfoVista VistaPortal SE Version 5.1 (build 51029).
- CVE-2018-19813Cross Site Scripting exists in InfoVista VistaPortal SE Version 5.1 (build 51029).
- CVE-2018-19814Cross Site Scripting exists in InfoVista VistaPortal SE Version 5.1 (build 51029).
- CVE-2018-19815Cross Site Scripting exists in InfoVista VistaPortal SE Version 5.1 (build 51029).
- CVE-2018-19816Cross Site Scripting exists in InfoVista VistaPortal SE Version 5.1 (build 51029).
- CVE-2018-19817Cross Site Scripting exists in InfoVista VistaPortal SE Version 5.1 (build 51029).
- CVE-2018-19818Cross Site Scripting exists in InfoVista VistaPortal SE Version 5.1 (build 51029).
- CVE-2018-19819Cross Site Scripting exists in InfoVista VistaPortal SE Version 5.1 (build 51029).
- CVE-2018-19820Cross Site Scripting exists in InfoVista VistaPortal SE Version 5.1 (build 51029).
- CVE-2018-19821Cross Site Scripting exists in InfoVista VistaPortal SE Version 5.1 (build 51029).
- CVE-2018-19822Cross Site Scripting exists in InfoVista VistaPortal SE Version 5.1 (build 51029).
- CVE-2018-20027The yaml_parse.load method in Pylearn2 allows code injection.
- CVE-2018-20171An issue was discovered in Nagios XI before 5.5.8.
- CVE-2018-20172An issue was discovered in Nagios XI before 5.5.8.
- CVE-2018-20173Zoho ManageEngine OpManager 12.3 before 123238 allows SQL injection via the getGraphData API.
- CVE-2017-18352Error reporting within Rendertron 1.0.0 allows reflected Cross Site Scripting (XSS) from invalid URLs.rendertron
- CVE-2017-18353Rendertron 1.0.0 includes an _ah/stop route to shutdown the Chrome instance responsible for serving render requests to all users.rendertron
- CVE-2017-18354Rendertron 1.0.0 allows for alternative protocols such as 'file://' introducing a Local File Inclusion (LFI) bug where arbitrary files can…rendertron
- CVE-2017-18355Installed packages are exposed by node_modules in Rendertron 1.0.0, allowing remote attackers to read absolute paths on the server by…rendertron
- CVE-2018-20169An issue was discovered in the Linux kernel before 4.19.9.
- CVE-2018-20170OpenStack Keystone through 14.0.1 has a user enumeration vulnerability because invalid usernames have much faster responses than valid…keystone
- CVE-2018-20167Terminology before 1.3.1 allows Remote Code Execution because popmedia is mishandled, as demonstrated by an unsafe "cat README.md" command…
- CVE-2018-20168Google gVisor before 2018-08-22 reuses a pagetable in a different level with the paging-structure cache intact, which allows attackers to…