# CVEs published 2018-12-20

136 CVEs were published on December 20, 2018: 1 critical, 8 high. 1 is now in CISA KEV. Days are UTC.

- [CVE-2017-9732](https://cve.now/CVE-2017-9732.md): The read\_packet function in knc (Kerberised NetCat) before 1.11-1 is vulnerable to denial of service (memory exhaustion) that can be… (no CVSS)
- [CVE-2018-12651](https://cve.now/CVE-2018-12651.md): A Reflected Cross Site Scripting (XSS) Vulnerability was discovered in Adrenalin 5.4 HRMS Software. (no CVSS)
- [CVE-2018-14846](https://cve.now/CVE-2018-14846.md): The Mondula Multi Step Form plugin before 1.2.8 for WordPress has multiple stored XSS via wp-admin/admin-ajax.php. (no CVSS)
- [CVE-2018-16627](https://cve.now/CVE-2018-16627.md): panel/login in Kirby v2.5.12 allows Host header injection via the "forget password" feature. (no CVSS)
- [CVE-2018-17244](https://cve.now/CVE-2018-17244.md): Elasticsearch Security versions 6.4.0 to 6.4.2 contain an error in the way request headers are applied to requests when using the Active… (no CVSS, Elasticsearch · org.elasticsearch:elasticsearch)
- [CVE-2018-17245](https://cve.now/CVE-2018-17245.md): Kibana versions 4.0 to 4.6, 5.0 to 5.6.12, and 6.0 to 6.4.2 contain an error in the way authorization credentials are used when generating… (no CVSS, Elastic Kibana)
- [CVE-2018-17246](https://cve.now/CVE-2018-17246.md): Kibana versions before 6.4.3 and 5.6.13 contain an arbitrary file inclusion flaw in the Console plugin. (no CVSS, Elastic Kibana)
- [CVE-2018-17247](https://cve.now/CVE-2018-17247.md): Elasticsearch Security versions 6.5.0 and 6.5.1 contain an XXE flaw in Machine Learning's find\_file\_structure API. (no CVSS, Elasticsearch · org.elasticsearch:elasticsearch)
- [CVE-2018-18388](https://cve.now/CVE-2018-18388.md): eScan Agent Application (MWAGENT.EXE) 4.0.2.98 in MicroWorld Technologies eScan 14.0 allows remote or local attackers to execute arbitrary… (no CVSS)
- [CVE-2018-18399](https://cve.now/CVE-2018-18399.md): SQL injection vulnerability in the "ContentPlaceHolder1\_uxTitle" component in ArchiveNews.aspx in jco.ir KARMA 6.0.0 allows a remote… (no CVSS)
- [CVE-2018-18441](https://cve.now/CVE-2018-18441.md): D-Link DCS series Wi-Fi cameras expose sensitive information regarding the device configuration. (no CVSS)
- [CVE-2018-18442](https://cve.now/CVE-2018-18442.md): D-Link DCS-825L devices with firmware 1.08 do not employ a suitable mechanism to prevent denial-of-service (DoS) attacks. (no CVSS)
- [CVE-2018-18629](https://cve.now/CVE-2018-18629.md): An issue was discovered in the Keybase command-line client before 2.8.0-20181023124437 for Linux. (no CVSS)
- [CVE-2018-18767](https://cve.now/CVE-2018-18767.md): An issue was discovered in D-Link 'myDlink Baby App' version 2.04.06. (no CVSS)
- [CVE-2018-19134](https://cve.now/CVE-2018-19134.md): In Artifex Ghostscript through 9.25, the setpattern operator did not properly validate certain types. (no CVSS)
- [CVE-2018-19239](https://cve.now/CVE-2018-19239.md): TRENDnet TEW-673GRU v1.00b40 devices have an OS command injection vulnerability in the start\_arpping function of the timer binary, which… (no CVSS)
- [CVE-2018-19240](https://cve.now/CVE-2018-19240.md): Buffer overflow in network.cgi on TRENDnet TV-IP110WN V1.2.2 build 68, V1.2.2.65, and V1.2.2 build 64 and TV-IP121WN V1.2.2 build 28… (no CVSS)
- [CVE-2018-19241](https://cve.now/CVE-2018-19241.md): Buffer overflow in video.cgi on TRENDnet TV-IP110WN V1.2.2 build 68, V1.2.2.65, and V1.2.2 build 64 and TV-IP121WN V1.2.2 build 28 devices… (no CVSS)
- [CVE-2018-19242](https://cve.now/CVE-2018-19242.md): Buffer overflow in apply.cgi on TRENDnet TEW-632BRP 1.010B32 and TEW-673GRU devices allows attackers to hijack the control flow to any… (no CVSS)
- [CVE-2018-20124](https://cve.now/CVE-2018-20124.md): hw/rdma/rdma\_backend.c in QEMU allows guest OS users to trigger out-of-bounds access via a PvrdmaSqWqe ring element with a large num\_sge… (no CVSS)
- [CVE-2018-20191](https://cve.now/CVE-2018-20191.md): hw/rdma/vmw/pvrdma\_main.c in QEMU does not implement a read operation (such as uar\_read by analogy to uar\_write), which allows attackers… (no CVSS)
- [CVE-2018-1160](https://cve.now/CVE-2018-1160.md): Netatalk before 3.1.12 is vulnerable to an out of bounds write in dsi\_opensess.c. (CVSS 9.8, Netatalk)
- [CVE-2018-15720](https://cve.now/CVE-2018-15720.md): Logitech Harmony Hub before version 4.15.206 contained two hard-coded accounts in the XMPP server that gave remote users access to the… (no CVSS, Logitech Harmony Hub)
- [CVE-2018-15721](https://cve.now/CVE-2018-15721.md): The XMPP server in Logitech Harmony Hub before version 4.15.206 is vulnerable to authentication bypass via a crafted XMPP request. (no CVSS, Logitech Harmony Hub)
- [CVE-2018-15722](https://cve.now/CVE-2018-15722.md): The Logitech Harmony Hub before version 4.15.206 is vulnerable to OS command injection via the time update request. (no CVSS, Logitech Harmony Hub)
- [CVE-2018-15723](https://cve.now/CVE-2018-15723.md): The Logitech Harmony Hub before version 4.15.206 is vulnerable to application level command injection via crafted HTTP request. (no CVSS, Logitech Harmony Hub)
- [CVE-2018-18871](https://cve.now/CVE-2018-18871.md): Missing password verification in the web interface on Gigaset Maxwell Basic VoIP phones with firmware 2.22.7 would allow a remote attacker… (no CVSS)
- [CVE-2018-19005](https://cve.now/CVE-2018-19005.md): Cscape, Version 9.80.75.3 SP3 and prior. (no CVSS, Cscape)
- [CVE-2018-20125](https://cve.now/CVE-2018-20125.md): hw/rdma/vmw/pvrdma\_cmd.c in QEMU allows attackers to cause a denial of service (NULL pointer dereference or excessive memory allocation)… (no CVSS)
- [CVE-2018-20126](https://cve.now/CVE-2018-20126.md): hw/rdma/vmw/pvrdma\_cmd.c in QEMU allows create\_cq and create\_qp memory leaks because errors are mishandled. (no CVSS)
- [CVE-2018-20216](https://cve.now/CVE-2018-20216.md): QEMU can have an infinite loop in hw/rdma/vmw/pvrdma\_dev\_ring.c because return values are not checked (and -1 is mishandled). (no CVSS)
- [CVE-2018-1000883](https://cve.now/CVE-2018-1000883.md): Elixir Plug Plug version All contains a Header Injection vulnerability in Connection that can result in Given a cookie value, Headers can… (no CVSS, plug)
- [CVE-2018-1000884](https://cve.now/CVE-2018-1000884.md): Vesta CP version Prior to commit f6f6f9cfbbf2979e301956d1c6ab5c44386822c0 -- any release prior to 0.9.8-18 contains a CWE-208 /… (no CVSS)
- [CVE-2018-1000885](https://cve.now/CVE-2018-1000885.md): PHKP version including commit 88fd9cfdf14ea4b6ac3e3967feea7bcaabb6f03b contains a Improper Neutralization of Special Elements used in a… (no CVSS)
- [CVE-2018-1000886](https://cve.now/CVE-2018-1000886.md): nasm version 2.14.01rc5, 2.15 contains a Buffer Overflow vulnerability in asm/stdscan.c:130 that can result in Stack-overflow caused by… (no CVSS)
- [CVE-2018-15329](https://cve.now/CVE-2018-15329.md): On BIG-IP 14.0.0-14.0.0.2, 13.0.0-13.1.1.1, or 12.1.0-12.1.3.7, or Enterprise Manager 3.1.1, when authenticated administrative users run… (no CVSS, F5 Networks BIG-IP (LTM, AAM, AFM, Analytics, APM, ASM, DNS…)
- [CVE-2018-15330](https://cve.now/CVE-2018-15330.md): On BIG-IP 14.0.0-14.0.0.2, 13.0.0-13.1.1.1, or 12.1.0-12.1.3.7, when a virtual server using the inflate functionality to process a gzip… (no CVSS, F5 Networks BIG-IP)
- [CVE-2018-15331](https://cve.now/CVE-2018-15331.md): On BIG-IP AAM 13.0.0 or 12.1.0-12.1.3.7, the dcdb\_convert utility used by BIG-IP AAM fails to drop group permissions when executing helper… (no CVSS, F5 Networks BIG-IP)
- [CVE-2018-8888](https://cve.now/CVE-2018-8888.md): A stored cross-site scripting (XSS) vulnerability in the Management Console of BlackBerry UEM versions earlier than 12.10.0 could allow an… (no CVSS, BlackBerry UEM)
- [CVE-2018-8891](https://cve.now/CVE-2018-8891.md): Multiple stored cross-site scripting (XSS) vulnerabilities in the Management Console of BlackBerry UEM versions earlier than 12.9.1 could… (no CVSS, BlackBerry UEM)
- [CVE-2018-8892](https://cve.now/CVE-2018-8892.md): A cross-site request forgery (CSRF) vulnerability in the Management Console of BlackBerry UEM versions earlier than 12.9.1 could allow an… (no CVSS, BlackBerry UEM)
- [CVE-2018-1000867](https://cve.now/CVE-2018-1000867.md): WeBid version up to current version 1.2.2 contains a SQL Injection vulnerability in All five yourauctions\*.php scripts that can result in… (no CVSS)
- [CVE-2018-1000868](https://cve.now/CVE-2018-1000868.md): WeBid version up to current version 1.2.2 contains a Cross Site Scripting (XSS) vulnerability in user\_login.php, register.php that can… (no CVSS)
- [CVE-2018-1000869](https://cve.now/CVE-2018-1000869.md): phpIPAM version 1.3.2 contains a CWE-89 vulnerability in /app/admin/nat/item-add-submit.php that can result in SQL Injection.. (no CVSS)
- [CVE-2018-1000870](https://cve.now/CVE-2018-1000870.md): PHPipam version 1.3.2 and earlier contains a CWE-79 vulnerability in /app/admin/users/print-user.php that can result in Execute code in… (no CVSS)
- [CVE-2018-1000871](https://cve.now/CVE-2018-1000871.md): HotelDruid HotelDruid 2.3.0 version 2.3.0 and earlier contains a SQL Injection vulnerability in "id\_utente\_mod" parameter in… (no CVSS)
- [CVE-2018-1000872](https://cve.now/CVE-2018-1000872.md): OpenKMIP PyKMIP version All versions before 0.8.0 contains a CWE 399: Resource Management Errors (similar issue to CVE-2015-5262)… (no CVSS, pykmip)
- [CVE-2018-1000873](https://cve.now/CVE-2018-1000873.md): Fasterxml Jackson version Before 2.9.8 contains a CWE-20: Improper Input Validation vulnerability in Jackson-Modules-Java8 that can result… (no CVSS, com.fasterxml.jackson.datatype:jackson-datatype-jsr310)
- [CVE-2018-1000874](https://cve.now/CVE-2018-1000874.md): PHP cebe markdown parser version 1.2.0 and earlier contains a Cross Site Scripting (XSS) vulnerability in all distributed parsers allowing… (CVSS 6.1)
- [CVE-2018-1000875](https://cve.now/CVE-2018-1000875.md): Berkeley Open Infrastructure for Network Computing BOINC Server and Website Code version 0.9-1.0.2 contains a CWE-302: Authentication… (no CVSS)
- [CVE-2018-1000876](https://cve.now/CVE-2018-1000876.md): binutils version 2.32 and earlier contains a Integer Overflow vulnerability in objdump… (no CVSS)
- [CVE-2018-1000877](https://cve.now/CVE-2018-1000877.md): libarchive version commit 416694915449219d505531b1096384f3237dd6cc onwards (release v3.1.0 onwards) contains a CWE-415: Double Free… (no CVSS)
- [CVE-2018-1000878](https://cve.now/CVE-2018-1000878.md): libarchive version commit 416694915449219d505531b1096384f3237dd6cc onwards (release v3.1.0 onwards) contains a CWE-416: Use After Free… (no CVSS)
- [CVE-2018-1000879](https://cve.now/CVE-2018-1000879.md): libarchive version commit 379867ecb330b3a952fb7bfa7bffb7bbd5547205 onwards (release v3.3.0 onwards) contains a CWE-476: NULL Pointer Derefer (no CVSS)
- [CVE-2018-1000880](https://cve.now/CVE-2018-1000880.md): libarchive version commit 9693801580c0cf7c70e862d305270a16b52826a7 onwards (release v3.2.0 onwards) contains a CWE-20: Improper Input Valida (no CVSS)
- [CVE-2018-1000881](https://cve.now/CVE-2018-1000881.md): Traccar Traccar Server version 4.0 and earlier contains a CWE-94: Improper Control of Generation of Code ('Code Injection') vulnerability… (no CVSS)
- [CVE-2018-1000882](https://cve.now/CVE-2018-1000882.md): WeBid version up to current version 1.2.2 contains a Directory Traversal vulnerability in getthumb.php that can result in Arbitrary Image… (no CVSS)
- [CVE-2018-19233](https://cve.now/CVE-2018-19233.md): COMPAREX Miss Marple Enterprise Edition before 2.0 allows local users to execute arbitrary code by reading the user name and encrypted… (no CVSS)
- [CVE-2018-19234](https://cve.now/CVE-2018-19234.md): The Miss Marple Updater Service in COMPAREX Miss Marple Enterprise Edition before 2.0 allows remote attackers to execute arbitrary code… (no CVSS)
- [CVE-2018-1000854](https://cve.now/CVE-2018-1000854.md): esigate.org esigate version 5.2 and earlier contains a CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream… (no CVSS, org.esigate:esigate-core)
- [CVE-2018-1000855](https://cve.now/CVE-2018-1000855.md): easymon version 1.4 and earlier contains a Cross Site Scripting (XSS) vulnerability in Endpoint where monitoring is mounted that can… (no CVSS, easymon)
- [CVE-2018-1000856](https://cve.now/CVE-2018-1000856.md): DomainMOD version 4.09.03 and above. (no CVSS)
- [CVE-2018-1000857](https://cve.now/CVE-2018-1000857.md): log-user-session version 0.7 and earlier contains a Directory Traversal vulnerability in Main SUID-binary /usr/local/bin/log-user-session… (no CVSS)
- [CVE-2018-1000858](https://cve.now/CVE-2018-1000858.md): GnuPG version 2.1.12 - 2.2.11 contains a Cross ite Request Forgery (CSRF) vulnerability in dirmngr that can result in Attacker controlled… (no CVSS)
- [CVE-2018-1000860](https://cve.now/CVE-2018-1000860.md): phpipam version 1.3.2 and earlier contains a Cross Site Scripting (XSS) vulnerability in The value of the phpipamredirect cookie is copied… (no CVSS)
- [CVE-2017-9704](https://cve.now/CVE-2017-9704.md): In all android releases(Android for MSM, Firefox OS for MSM, QRD Android) from CAF using the linux kernel, There is no synchronization… (no CVSS, Qualcomm Android for MSM, Firefox OS for MSM, QRD Android)
- [CVE-2018-1000811](https://cve.now/CVE-2018-1000811.md): bludit version 3.0.0 contains a Unrestricted Upload of File with Dangerous Type vulnerability in Content Upload in Pages Editor that can… (no CVSS)
- [CVE-2018-1000812](https://cve.now/CVE-2018-1000812.md): Artica Integria IMS version 5.0 MR56 Package 58, likely earlier versions contains a CWE-640: Weak Password Recovery Mechanism for… (no CVSS)
- [CVE-2018-1000813](https://cve.now/CVE-2018-1000813.md): Backdrop CMS version 1.11.0 and earlier contains a Cross Site Scripting (XSS) vulnerability in Sanitization of custom class names used on… (no CVSS)
- [CVE-2018-1000814](https://cve.now/CVE-2018-1000814.md): aio-libs aiohttp-session version 2.6.0 and earlier contains a Other/Unknown vulnerability in EncryptedCookieStorage and NaClCookieStorage… (no CVSS, aiohttp-session)
- [CVE-2018-1000815](https://cve.now/CVE-2018-1000815.md): Brave Software Inc. (no CVSS)
- [CVE-2018-1000816](https://cve.now/CVE-2018-1000816.md): Grafana version confirmed for 5.2.4 and 5.3.0 contains a Cross Site Scripting (XSS) vulnerability in Influxdb and Graphite query editor… (no CVSS, github.com/grafana/grafana)
- [CVE-2018-1000817](https://cve.now/CVE-2018-1000817.md): Asset Pipeline Grails Plugin Asset-pipeline plugin version Prior to 2.14.1.1, 2.15.1 and 3.0.6 contains a Incorrect Access Control… (no CVSS, org.grails.plugins:asset-pipeline)
- [CVE-2018-1000820](https://cve.now/CVE-2018-1000820.md): neo4j-contrib neo4j-apoc-procedures version before commit 45bc09c contains a XML External Entity (XXE) vulnerability in XML Parser that… (no CVSS, org.neo4j.procedure:apoc)
- [CVE-2018-1000821](https://cve.now/CVE-2018-1000821.md): MicroMathematics version before commit 5c05ac8 contains a XML External Entity (XXE) vulnerability in SMathStudio files that can result in… (no CVSS)
- [CVE-2018-1000822](https://cve.now/CVE-2018-1000822.md): codelibs fess version before commit faa265b contains a XML External Entity (XXE) vulnerability in GSA XML file parser that can result in… (no CVSS, org.codelibs.fess:fess)
- [CVE-2018-1000823](https://cve.now/CVE-2018-1000823.md): exist version \<= 5.0.0-RC4 contains a XML External Entity (XXE) vulnerability in XML Parser for REST Server that can result in Disclosure… (no CVSS, org.exist-db:exist-core)
- [CVE-2018-1000824](https://cve.now/CVE-2018-1000824.md): MegaMek version \< v0.45.1 contains a Other/Unknown vulnerability in Object Stream Connection that can result in Disclosure of confidential… (no CVSS)
- [CVE-2018-1000825](https://cve.now/CVE-2018-1000825.md): FreeCol version \<= nightly-2018-08-22 contains a XML External Entity (XXE) vulnerability in FreeColXMLReader parser that can result in… (no CVSS)
- [CVE-2018-1000826](https://cve.now/CVE-2018-1000826.md): Microweber version \<= 1.0.7 contains a Cross Site Scripting (XSS) vulnerability in Admin login form template that can result in Execution… (no CVSS, microweber/microweber)
- [CVE-2018-1000827](https://cve.now/CVE-2018-1000827.md): Ubilling version \<= 0.9.2 contains a Other/Unknown vulnerability in user-controlled parameter that can result in Disclosure of… (no CVSS)
- [CVE-2018-1000828](https://cve.now/CVE-2018-1000828.md): FrostWire version \<= frostwire-desktop-6.7.4-build-272 contains a XML External Entity (XXE) vulnerability in Man in the middle on update… (no CVSS)
- [CVE-2018-1000829](https://cve.now/CVE-2018-1000829.md): Anyplace version before commit 80359b4 contains a XML External Entity (XXE) vulnerability in Man in the middle on map API call that can… (no CVSS)
- [CVE-2018-1000830](https://cve.now/CVE-2018-1000830.md): XR3Player version \<= V3.124 contains a XML External Entity (XXE) vulnerability in Playlist parser that can result in Disclosure of… (no CVSS)
- [CVE-2018-1000831](https://cve.now/CVE-2018-1000831.md): K9Mail version \<= v5.600 contains a XML External Entity (XXE) vulnerability in WebDAV response parser that can result in Disclosure of… (no CVSS)
- [CVE-2018-1000832](https://cve.now/CVE-2018-1000832.md): ZoneMinder version \<= 1.32.2 contains a Other/Unknown vulnerability in User-controlled parameter that can result in Disclosure of… (no CVSS)
- [CVE-2018-1000833](https://cve.now/CVE-2018-1000833.md): ZoneMinder version \<= 1.32.2 contains a Other/Unknown vulnerability in User-controlled parameter that can result in Disclosure of… (no CVSS)
- [CVE-2018-1000834](https://cve.now/CVE-2018-1000834.md): runelite version \<= runelite-parent-1.4.23 contains a XML External Entity (XXE) vulnerability in Man in the middle runscape services call… (no CVSS)
- [CVE-2018-1000835](https://cve.now/CVE-2018-1000835.md): KeePassDX version \<= 2.5.0.0beta17 contains a XML External Entity (XXE) vulnerability in kdbx file parser that can result in Disclosure of… (no CVSS)
- [CVE-2018-1000836](https://cve.now/CVE-2018-1000836.md): bw-calendar-engine version \<= bw-calendar-engine-3.12.0 contains a XML External Entity (XXE) vulnerability in IscheduleClient XML Parser… (no CVSS, org.bedework.caleng:bw-calendar-engine)
- [CVE-2018-1000837](https://cve.now/CVE-2018-1000837.md): UML Designer version \<= 8.0.0 contains a XML External Entity (XXE) vulnerability in XML parser for plugins that can result in Disclosure… (no CVSS)
- [CVE-2018-1000838](https://cve.now/CVE-2018-1000838.md): autopsy version \<= 4.9.0 contains a XML External Entity (XXE) vulnerability in CaseMetadata XML Parser that can result in Disclosure of… (no CVSS)
- [CVE-2018-1000839](https://cve.now/CVE-2018-1000839.md): LH-EHR version REL-2\_0\_0 contains a Arbitrary File Upload vulnerability in Profile picture upload that can result in Remote Code Execution. (no CVSS)
- [CVE-2018-1000840](https://cve.now/CVE-2018-1000840.md): Processing Foundation Processing version 3.4 and earlier contains a XML External Entity (XXE) vulnerability in loadXML() function that can… (no CVSS)
- [CVE-2018-1000841](https://cve.now/CVE-2018-1000841.md): Zend.To version Prior to 5.15-1 contains a Cross Site Scripting (XSS) vulnerability in The verify.php page that can result in An attacker… (no CVSS)
- [CVE-2018-1000842](https://cve.now/CVE-2018-1000842.md): FatFreeCRM version \<=0.14.1, \>=0.15.0 \<=0.15.1, \>=0.16.0 \<=0.16.3, \>=0.17.0 \<=0.17.2, ==0.18.0 contains a Cross Site Scripting (XSS)… (no CVSS, fat\_free\_crm)
- [CVE-2018-1000843](https://cve.now/CVE-2018-1000843.md): Luigi version prior to version 2.8.0; after commit 53b52e12745075a8acc016d33945d9d6a7a6aaeb; after GitHub PR spotify/luigi/pull/1870… (no CVSS, luigi)
- [CVE-2018-1000844](https://cve.now/CVE-2018-1000844.md): Square Open Source Retrofit version Prior to commit 4a693c5aeeef2be6c7ecf80e7b5ec79f6ab59437 contains a XML External Entity (XXE)… (no CVSS, com.squareup.retrofit2:retrofit)
- [CVE-2018-1000846](https://cve.now/CVE-2018-1000846.md): FreshDNS version 1.0.3 and earlier contains a Cross ite Request Forgery (CSRF) vulnerability in All (authenticated) API calls in index.php… (no CVSS)
- [CVE-2018-1000847](https://cve.now/CVE-2018-1000847.md): FreshDNS version 1.0.3 and prior contains a Cross Site Scripting (XSS) vulnerability in Account data form; Zone editor that can result in… (no CVSS)
- [CVE-2018-1000848](https://cve.now/CVE-2018-1000848.md): Wampserver version prior to version 3.1.5 contains a Cross Site Scripting (XSS) vulnerability in index.php localhost page that can result… (no CVSS)
- [CVE-2018-1000849](https://cve.now/CVE-2018-1000849.md): Alpine Linux version Versions prior to 2.6.10, 2.7.6, and 2.10.1 contains a Other/Unknown vulnerability in apk-tools (Alpine Linux'… (no CVSS)
- [CVE-2018-1000850](https://cve.now/CVE-2018-1000850.md): Square Retrofit version versions from (including) 2.0 and 2.5.0 (excluding) contains a Directory Traversal vulnerability in RequestBuilder… (no CVSS, com.squareup.retrofit2:retrofit)
- [CVE-2018-1000851](https://cve.now/CVE-2018-1000851.md): Copay Bitcoin Wallet version 5.01 to 5.1.0 included. (no CVSS)
- [CVE-2018-1000852](https://cve.now/CVE-2018-1000852.md): FreeRDP FreeRDP 2.0.0-rc3 released version before commit 205c612820dac644d665b5bb1cdf437dc5ca01e3 contains a Other/Unknown vulnerability… (no CVSS)
- [CVE-2018-11960](https://cve.now/CVE-2018-11960.md): In all android releases(Android for MSM, Firefox OS for MSM, QRD Android) from CAF using the linux kernel, A use after free condition can… (no CVSS, Qualcomm Android for MSM, Firefox OS for MSM, QRD Android)
- [CVE-2018-11961](https://cve.now/CVE-2018-11961.md): In all android releases(Android for MSM, Firefox OS for MSM, QRD Android) from CAF using the linux kernel, Possibility of accessing out of… (no CVSS, Qualcomm Android for MSM, Firefox OS for MSM, QRD Android)
- [CVE-2018-11963](https://cve.now/CVE-2018-11963.md): In all android releases(Android for MSM, Firefox OS for MSM, QRD Android) from CAF using the linux kernel, Buffer overread may occur due… (no CVSS, Qualcomm Android for MSM, Firefox OS for MSM, QRD Android)
- [CVE-2018-11964](https://cve.now/CVE-2018-11964.md): In all android releases(Android for MSM, Firefox OS for MSM, QRD Android) from CAF using the linux kernel, Exposing the hashed content in… (no CVSS, Qualcomm Android for MSM, Firefox OS for MSM, QRD Android)
- [CVE-2018-11965](https://cve.now/CVE-2018-11965.md): In all android releases(Android for MSM, Firefox OS for MSM, QRD Android) from CAF using the linux kernel, Anyone can execute… (no CVSS, Qualcomm Android for MSM, Firefox OS for MSM, QRD Android)
- [CVE-2018-11983](https://cve.now/CVE-2018-11983.md): In all android releases(Android for MSM, Firefox OS for MSM, QRD Android) from CAF using the linux kernel, Error in kernel observed while… (no CVSS, Qualcomm Android for MSM, Firefox OS for MSM, QRD Android)
- [CVE-2018-11984](https://cve.now/CVE-2018-11984.md): In all android releases(Android for MSM, Firefox OS for MSM, QRD Android) from CAF using the linux kernel, A use after free condition and… (no CVSS, Qualcomm Android for MSM, Firefox OS for MSM, QRD Android)
- [CVE-2018-11985](https://cve.now/CVE-2018-11985.md): In all android releases(Android for MSM, Firefox OS for MSM, QRD Android) from CAF using the linux kernel, When allocating heap using user… (no CVSS, Qualcomm Android for MSM, Firefox OS for MSM, QRD Android)
- [CVE-2018-11986](https://cve.now/CVE-2018-11986.md): In all android releases(Android for MSM, Firefox OS for MSM, QRD Android) from CAF using the linux kernel, Possible buffer overflow in TX… (no CVSS, Qualcomm Android for MSM, Firefox OS for MSM, QRD Android)
- [CVE-2018-11987](https://cve.now/CVE-2018-11987.md): In all android releases(Android for MSM, Firefox OS for MSM, QRD Android) from CAF using the linux kernel, if there is an unlikely memory… (no CVSS, Qualcomm Android for MSM, Firefox OS for MSM, QRD Android)
- [CVE-2018-11988](https://cve.now/CVE-2018-11988.md): In all android releases(Android for MSM, Firefox OS for MSM, QRD Android) from CAF using the linux kernel, Un-trusted pointer de-reference… (no CVSS, Qualcomm Android for MSM, Firefox OS for MSM, QRD Android)
- [CVE-2018-1661](https://cve.now/CVE-2018-1661.md): IBM DataPower Gateways 7.5, 7.5.1, 7.5.2, and 7.6 is vulnerable to cross-site request forgery which could allow an attacker to execute… (CVSS 6.5, IBM DataPower Gateways)
- [CVE-2018-1677](https://cve.now/CVE-2018-1677.md): IBM DataPower Gateways 7.1, 7.2, 7.5, 7.5.1, 7.5.2, 7.6, and 7.7 and IBM MQ Appliance are vulnerable to a denial of service, caused by the… (CVSS 5.1, IBM DataPower Gateways)
- [CVE-2018-1771](https://cve.now/CVE-2018-1771.md): IBM Domino 9.0 and 9.0.1 could allow an attacker to execute commands on the system by triggering a buffer overflow in the parsing of… (CVSS 8.4, IBM Domino)
- [CVE-2018-1778](https://cve.now/CVE-2018-1778.md): IBM LoopBack (IBM API Connect 2018.1, 2018.4.1, 5.0.8.0, and 5.0.8.4) could allow an attacker to bypass authentication if the AccessToken… (CVSS 7.7, IBM API Connect)
- [CVE-2018-1784](https://cve.now/CVE-2018-1784.md): IBM API Connect 5.0.0.0 and 5.0.8.4 is affected by a NoSQL Injection in MongoDB connector for the LoopBack framework. (CVSS 7.1, IBM API Connect)
- [CVE-2018-1973](https://cve.now/CVE-2018-1973.md): IBM API Connect 5.0.0.0 through 5.0.8.4 allows a user with limited 'API Administrator level access to give themselves full 'Administrator'… (CVSS 7.2, IBM API Connect)
- [CVE-2018-5198](https://cve.now/CVE-2018-5198.md): WIZVERA Veraport Race Condition Vulnerability (CVSS 8.0, WIZVERA Veraport)
- [CVE-2018-5199](https://cve.now/CVE-2018-5199.md): WIZVERA Remote Code Execution Vulnerability (CVSS 8.0, WIZVERA Veraport)
- [CVE-2018-5200](https://cve.now/CVE-2018-5200.md): KMPlayer Heap Overflow Vulnerability (CVSS 8.0, Pandora.tv KMPlayer)
- [CVE-2018-6669](https://cve.now/CVE-2018-6669.md): Bypass Application Control through an ASP.NET form (CVSS 6.3, McAfee Application and Change Control)
- [CVE-2018-7365](https://cve.now/CVE-2018-7365.md): All versions up to ZXCLOUD iRAI V5.01.05 of the ZTE uSmartView product are impacted by untrusted search path vulnerability, which may… (CVSS 5.1, ZTE uSmartView)
- [CVE-2018-8653](https://cve.now/CVE-2018-8653.md): A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Internet Explorer, aka "Scrip (CVSS 7.5, KEV, Microsoft Internet Explorer)
- [CVE-2018-20301](https://cve.now/CVE-2018-20301.md): An issue was discovered in Steve Pallen Coherence before 0.5.2 that is similar to a Mass Assignment vulnerability. (no CVSS, coherence)
- [CVE-2018-20306](https://cve.now/CVE-2018-20306.md): A stored cross-site scripting (XSS) vulnerability in the web administration user interface of Pulse Secure Virtual Traffic Manager may… (no CVSS)
- [CVE-2018-20307](https://cve.now/CVE-2018-20307.md): Pulse Secure Virtual Traffic Manager 9.9 versions prior to 9.9r2 and 10.4r1 allow a remote authenticated user to obtain sensitive… (no CVSS)
- [CVE-2018-20300](https://cve.now/CVE-2018-20300.md): Empire CMS 7.5 allows remote attackers to execute arbitrary PHP code via the ftemp parameter in an enews=EditMemberForm action because… (no CVSS)
- [CVE-2018-20302](https://cve.now/CVE-2018-20302.md): An XSS issue was discovered in Steve Pallen Xain before 0.6.2 via the order parameter. (no CVSS, xain)
- [CVE-2018-20303](https://cve.now/CVE-2018-20303.md): In pkg/tool/path.go in Gogs before 0.11.82.1218, a directory traversal in the file-upload functionality can allow an attacker to create a… (no CVSS, gogs.io/gogs)
- [CVE-2018-20304](https://cve.now/CVE-2018-20304.md): wbook\_addworksheet in workbook.c in libexcel.a in libexcel 0.01 allows attackers to cause a denial of service (SEGV) via a long second… (no CVSS)
- [CVE-2018-20305](https://cve.now/CVE-2018-20305.md): D-Link DIR-816 A2 1.10 B05 devices allow arbitrary remote code execution without authentication via the newpass parameter. (no CVSS)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/archive/2018-12-20
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.