CVEs published December 24, 2018
41 CVEs were published on December 24, 2018: 0 critical, 2 high. Browse them by severity, product and exploitation status.
- Published
- 41
- Critical
- 0
- High
- 2
- Medium
- 3
- Low
- 0
- Unrated
- 36
- Now in CISA KEV
- 0
- Fix available
- 6
Most affected products
- Foxit Quick PDF Library
- 3
- Schneider Electric SE EVLink Parking v3.2.0-12_v1 and earli…
- 3
- Schneider Electric SE IIoT Monitor
- 3
- Synology DiskStation Manager
- 3
- Apache Software Foundation Apache Tika · org.apache.tika:ti…
- 1
- Cisco Adaptive Security Appliance (ASA) Software
- 1
- com.mchange:c3p0
- 1
- craftcms/cms
- 1
- Schneider Electric SE FoxView HMI SCADA (All Foxboro DCS, F…
- 1
- Schneider Electric SE PowerSuite 2, All released versions
- 1
High 2
- CVE-2018-8919Information exposure vulnerability in SYNO.Core.Desktop.SessionData in Synology DiskStation Manager (DSM) before 6.1.6-15266 allows remote…Synology DiskStation Manager
- CVE-2018-15465Cisco Adaptive Security Appliance Software Privilege Escalation VulnerabilityCisco Adaptive Security Appliance (ASA) Software
Medium, low and unrated 39
- CVE-2018-20436The "secret chat" feature in Telegram 4.9.1 for Android has a "side channel" in which Telegram servers send GET requests for URLs typed…
- CVE-2018-20247In Foxit Quick PDF Library (all versions prior to 16.12), issue where loading a malformed or malicious PDF containing a recursive page…Foxit Quick PDF Library
- CVE-2018-20248In Foxit Quick PDF Library (all versions prior to 16.12), issue where loading a malformed or malicious PDF containing invalid xref table…Foxit Quick PDF Library
- CVE-2018-20249In Foxit Quick PDF Library (all versions prior to 16.12), issue where loading a malformed or malicious PDF containing invalid xref entries…Foxit Quick PDF Library
- CVE-2018-18698An issue was discovered on Xiaomi Mi A1 tissot_sprout:8.1.0/OPM1.171019.026/V9.6.4.0.ODHMIFE devices.
- CVE-2018-18959An issue was discovered on Epson WorkForce WF-2861 10.48 LQ22I3, 10.51.LQ20I6 and 10.52.LQ17IA devices.
- CVE-2018-18960An issue was discovered on Epson WorkForce WF-2861 10.48 LQ22I3, 10.51.LQ20I6 and 10.52.LQ17IA devices.
- CVE-2018-19232The web service on Epson WorkForce WF-2861 10.48 LQ22I3(Recovery-mode), WF-2861 10.51.LQ20I6, and WF-2861 10.52.LQ17IA devices allows…
- CVE-2018-19248The web service on Epson WorkForce WF-2861 10.48 LQ22I3(Recovery-mode), WF-2861 10.51.LQ20I6, and WF-2861 10.52.LQ17IA devices allows…
- CVE-2018-7793A Credential Management vulnerability exists in FoxView HMI SCADA (All Foxboro DCS, Foxboro Evo, and IA Series versions prior to Foxboro…Schneider Electric SE FoxView HMI SCADA (All Foxboro DCS, F…
- CVE-2018-7796A Buffer Error vulnerability exists in PowerSuite 2, all released versions (VW3A8104 & Patches), which could cause an overflow in the…Schneider Electric SE PowerSuite 2, All released versions
- CVE-2018-7800A Hard-coded Credentials vulnerability exists in EVLink Parking, v3.2.0-12_v1 and earlier, which could enable an attacker to gain access…Schneider Electric SE EVLink Parking v3.2.0-12_v1 and earli…
- CVE-2018-7801A Code Injection vulnerability exists in EVLink Parking, v3.2.0-12_v1 and earlier, which could enable access with maximum privileges when…Schneider Electric SE EVLink Parking v3.2.0-12_v1 and earli…
- CVE-2018-7802A SQL Injection vulnerability exists in EVLink Parking, v3.2.0-12_v1 and earlier, which could give access to the web interface with full…Schneider Electric SE EVLink Parking v3.2.0-12_v1 and earli…
- CVE-2018-7832An Improper Input Validation vulnerability exists in Pro-Face GP-Pro EX v4.08 and previous versions which could cause the execution…Schneider Electric SE Pro-Face GP-Pro EX v4.08 and previous…
- CVE-2018-7835An Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability exists in IIoT Monitor 3.1.38 which could…Schneider Electric SE IIoT Monitor
- CVE-2018-7836An unrestricted Upload of File with Dangerous Type vulnerability exists on numerous methods of the IIoT Monitor 3.1.38 software that could…Schneider Electric SE IIoT Monitor
- CVE-2018-7837An Improper Restriction of XML External Entity Reference ('XXE') vulnerability exists on numerous methods of the IIoT Monitor 3.1.38…Schneider Electric SE IIoT Monitor
- CVE-2018-8917Cross-site scripting (XSS) vulnerability in info.cgi in Synology DiskStation Manager (DSM) before 6.1.6-15266 allows remote attackers to…Synology DiskStation Manager
- CVE-2018-8918Cross-site scripting (XSS) vulnerability in info.cgi in Synology Router Manager (SRM) before 1.1.7-6941 allows remote attackers to inject…Synology Router Manager
- CVE-2018-8920Improper neutralization of escape vulnerability in Log Exporter in Synology DiskStation Manager (DSM) before 6.1.6-15266 allows remote…Synology DiskStation Manager
- CVE-2018-17197A carefully crafted or corrupt sqlite file can cause an infinite loop in Apache Tika's SQLite3Parser in versions 1.8-1.19.1 of Apache Tika.Apache Software Foundation Apache Tika · org.apache.tika:ti…
- CVE-2018-20433c3p0 0.9.5.2 allows XXE in extractXmlConfigFromInputStream in com/mchange/v2/c3p0/cfg/C3P0ConfigXmlUtils.java during initialization.com.mchange:c3p0
- CVE-2018-19357XMPlay 3.8.3 allows remote attackers to execute arbitrary code or cause a denial of service (stack-based buffer overflow) via a crafted…
- CVE-2018-20425libming 0.4.8 has a NULL pointer dereference in the pushdup function of the decompile.c file.
Show all 39 entriesShow fewer entries
- CVE-2018-20426libming 0.4.8 has a NULL pointer dereference in the newVar3 function of the decompile.c file, a different vulnerability than CVE-2018-7866.
- CVE-2018-20427libming 0.4.8 has a NULL pointer dereference in the getInt function of the decompile.c file, a different vulnerability than CVE-2018-9132.
- CVE-2018-20428libming 0.4.8 has a NULL pointer dereference in the strlenext function of the decompile.c file, a different vulnerability than…
- CVE-2018-20429libming 0.4.8 has a NULL pointer dereference in the getName function of the decompile.c file, a different vulnerability than CVE-2018-7872…
- CVE-2018-20430GNU Libextractor through 1.8 has an out-of-bounds read vulnerability in the function history_extract() in plugins/ole2_extractor.c…
- CVE-2018-20431GNU Libextractor through 1.8 has a NULL Pointer Dereference vulnerability in the function process_metadata() in plugins/ole2_extractor.c.
- CVE-2018-20418index.php?p=admin/actions/entries/save-entry in Craft CMS 3.0.25 allows XSS by saving a new title from the console tab.craftcms/cms
- CVE-2018-20422Discuz! DiscuzX 3.4, when WeChat login is enabled, allows remote attackers to bypass authentication by leveraging a non-empty…
- CVE-2018-20423Discuz! DiscuzX 3.4, when WeChat login is enabled, allows remote attackers to bypass a "disabled registration" setting by adding a…
- CVE-2018-20424Discuz! DiscuzX 3.4, when WeChat login is enabled, allows remote attackers to delete the common_member_wechatmp data structure via an…
- CVE-2018-20419DouCo DouPHP 1.5 has upload/admin/manager.php?rec=insert CSRF to add an administrator account.
- CVE-2018-20420In webERP 4.15, Z_CreateCompanyTemplateFile.php has Incorrect Access Control, leading to the overwrite of an existing .sql file on the…
- CVE-2018-20421Go Ethereum (aka geth) 1.8.19 allows attackers to cause a denial of service (memory consumption) by rewriting the length of a dynamic…
- CVE-2018-20410WellinTech KingSCADA before 3.7.0.0.1 contains a stack-based buffer overflow.