# CVEs published 2018-12-24

41 CVEs were published on December 24, 2018: 0 critical, 2 high. Days are UTC.

- [CVE-2018-20436](https://cve.now/CVE-2018-20436.md): The "secret chat" feature in Telegram 4.9.1 for Android has a "side channel" in which Telegram servers send GET requests for URLs typed… (no CVSS)
- [CVE-2018-20247](https://cve.now/CVE-2018-20247.md): In Foxit Quick PDF Library (all versions prior to 16.12), issue where loading a malformed or malicious PDF containing a recursive page… (no CVSS, Foxit Quick PDF Library)
- [CVE-2018-20248](https://cve.now/CVE-2018-20248.md): In Foxit Quick PDF Library (all versions prior to 16.12), issue where loading a malformed or malicious PDF containing invalid xref table… (no CVSS, Foxit Quick PDF Library)
- [CVE-2018-20249](https://cve.now/CVE-2018-20249.md): In Foxit Quick PDF Library (all versions prior to 16.12), issue where loading a malformed or malicious PDF containing invalid xref entries… (no CVSS, Foxit Quick PDF Library)
- [CVE-2018-18698](https://cve.now/CVE-2018-18698.md): An issue was discovered on Xiaomi Mi A1 tissot\_sprout:8.1.0/OPM1.171019.026/V9.6.4.0.ODHMIFE devices. (no CVSS)
- [CVE-2018-18959](https://cve.now/CVE-2018-18959.md): An issue was discovered on Epson WorkForce WF-2861 10.48 LQ22I3, 10.51.LQ20I6 and 10.52.LQ17IA devices. (no CVSS)
- [CVE-2018-18960](https://cve.now/CVE-2018-18960.md): An issue was discovered on Epson WorkForce WF-2861 10.48 LQ22I3, 10.51.LQ20I6 and 10.52.LQ17IA devices. (no CVSS)
- [CVE-2018-19232](https://cve.now/CVE-2018-19232.md): The web service on Epson WorkForce WF-2861 10.48 LQ22I3(Recovery-mode), WF-2861 10.51.LQ20I6, and WF-2861 10.52.LQ17IA devices allows… (no CVSS)
- [CVE-2018-19248](https://cve.now/CVE-2018-19248.md): The web service on Epson WorkForce WF-2861 10.48 LQ22I3(Recovery-mode), WF-2861 10.51.LQ20I6, and WF-2861 10.52.LQ17IA devices allows… (no CVSS)
- [CVE-2018-7793](https://cve.now/CVE-2018-7793.md): A Credential Management vulnerability exists in FoxView HMI SCADA (All Foxboro DCS, Foxboro Evo, and IA Series versions prior to Foxboro… (no CVSS, Schneider Electric SE FoxView HMI SCADA (All Foxboro DCS, F…)
- [CVE-2018-7796](https://cve.now/CVE-2018-7796.md): A Buffer Error vulnerability exists in PowerSuite 2, all released versions (VW3A8104 & Patches), which could cause an overflow in the… (no CVSS, Schneider Electric SE PowerSuite 2, All released versions)
- [CVE-2018-7800](https://cve.now/CVE-2018-7800.md): A Hard-coded Credentials vulnerability exists in EVLink Parking, v3.2.0-12\_v1 and earlier, which could enable an attacker to gain access… (no CVSS, Schneider Electric SE EVLink Parking v3.2.0-12\_v1 and earli…)
- [CVE-2018-7801](https://cve.now/CVE-2018-7801.md): A Code Injection vulnerability exists in EVLink Parking, v3.2.0-12\_v1 and earlier, which could enable access with maximum privileges when… (no CVSS, Schneider Electric SE EVLink Parking v3.2.0-12\_v1 and earli…)
- [CVE-2018-7802](https://cve.now/CVE-2018-7802.md): A SQL Injection vulnerability exists in EVLink Parking, v3.2.0-12\_v1 and earlier, which could give access to the web interface with full… (no CVSS, Schneider Electric SE EVLink Parking v3.2.0-12\_v1 and earli…)
- [CVE-2018-7832](https://cve.now/CVE-2018-7832.md): An Improper Input Validation vulnerability exists in Pro-Face GP-Pro EX v4.08 and previous versions which could cause the execution… (no CVSS, Schneider Electric SE Pro-Face GP-Pro EX v4.08 and previous…)
- [CVE-2018-7835](https://cve.now/CVE-2018-7835.md): An Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability exists in IIoT Monitor 3.1.38 which could… (no CVSS, Schneider Electric SE IIoT Monitor)
- [CVE-2018-7836](https://cve.now/CVE-2018-7836.md): An unrestricted Upload of File with Dangerous Type vulnerability exists on numerous methods of the IIoT Monitor 3.1.38 software that could… (no CVSS, Schneider Electric SE IIoT Monitor)
- [CVE-2018-7837](https://cve.now/CVE-2018-7837.md): An Improper Restriction of XML External Entity Reference ('XXE') vulnerability exists on numerous methods of the IIoT Monitor 3.1.38… (no CVSS, Schneider Electric SE IIoT Monitor)
- [CVE-2018-8917](https://cve.now/CVE-2018-8917.md): Cross-site scripting (XSS) vulnerability in info.cgi in Synology DiskStation Manager (DSM) before 6.1.6-15266 allows remote attackers to… (CVSS 6.5, Synology DiskStation Manager)
- [CVE-2018-8918](https://cve.now/CVE-2018-8918.md): Cross-site scripting (XSS) vulnerability in info.cgi in Synology Router Manager (SRM) before 1.1.7-6941 allows remote attackers to inject… (CVSS 6.5, Synology Router Manager)
- [CVE-2018-8919](https://cve.now/CVE-2018-8919.md): Information exposure vulnerability in SYNO.Core.Desktop.SessionData in Synology DiskStation Manager (DSM) before 6.1.6-15266 allows remote… (CVSS 8.3, Synology DiskStation Manager)
- [CVE-2018-8920](https://cve.now/CVE-2018-8920.md): Improper neutralization of escape vulnerability in Log Exporter in Synology DiskStation Manager (DSM) before 6.1.6-15266 allows remote… (CVSS 5.9, Synology DiskStation Manager)
- [CVE-2018-15465](https://cve.now/CVE-2018-15465.md): Cisco Adaptive Security Appliance Software Privilege Escalation Vulnerability (CVSS 8.1, Cisco Adaptive Security Appliance (ASA) Software)
- [CVE-2018-17197](https://cve.now/CVE-2018-17197.md): A carefully crafted or corrupt sqlite file can cause an infinite loop in Apache Tika's SQLite3Parser in versions 1.8-1.19.1 of Apache Tika. (no CVSS, Apache Software Foundation Apache Tika · org.apache.tika:ti…)
- [CVE-2018-20433](https://cve.now/CVE-2018-20433.md): c3p0 0.9.5.2 allows XXE in extractXmlConfigFromInputStream in com/mchange/v2/c3p0/cfg/C3P0ConfigXmlUtils.java during initialization. (no CVSS, com.mchange:c3p0)
- [CVE-2018-19357](https://cve.now/CVE-2018-19357.md): XMPlay 3.8.3 allows remote attackers to execute arbitrary code or cause a denial of service (stack-based buffer overflow) via a crafted… (no CVSS)
- [CVE-2018-20425](https://cve.now/CVE-2018-20425.md): libming 0.4.8 has a NULL pointer dereference in the pushdup function of the decompile.c file. (no CVSS)
- [CVE-2018-20426](https://cve.now/CVE-2018-20426.md): libming 0.4.8 has a NULL pointer dereference in the newVar3 function of the decompile.c file, a different vulnerability than CVE-2018-7866. (no CVSS)
- [CVE-2018-20427](https://cve.now/CVE-2018-20427.md): libming 0.4.8 has a NULL pointer dereference in the getInt function of the decompile.c file, a different vulnerability than CVE-2018-9132. (no CVSS)
- [CVE-2018-20428](https://cve.now/CVE-2018-20428.md): libming 0.4.8 has a NULL pointer dereference in the strlenext function of the decompile.c file, a different vulnerability than… (no CVSS)
- [CVE-2018-20429](https://cve.now/CVE-2018-20429.md): libming 0.4.8 has a NULL pointer dereference in the getName function of the decompile.c file, a different vulnerability than CVE-2018-7872… (no CVSS)
- [CVE-2018-20430](https://cve.now/CVE-2018-20430.md): GNU Libextractor through 1.8 has an out-of-bounds read vulnerability in the function history\_extract() in plugins/ole2\_extractor.c… (no CVSS)
- [CVE-2018-20431](https://cve.now/CVE-2018-20431.md): GNU Libextractor through 1.8 has a NULL Pointer Dereference vulnerability in the function process\_metadata() in plugins/ole2\_extractor.c. (no CVSS)
- [CVE-2018-20418](https://cve.now/CVE-2018-20418.md): index.php?p=admin/actions/entries/save-entry in Craft CMS 3.0.25 allows XSS by saving a new title from the console tab. (no CVSS, craftcms/cms)
- [CVE-2018-20422](https://cve.now/CVE-2018-20422.md): Discuz! DiscuzX 3.4, when WeChat login is enabled, allows remote attackers to bypass authentication by leveraging a non-empty… (no CVSS)
- [CVE-2018-20423](https://cve.now/CVE-2018-20423.md): Discuz! DiscuzX 3.4, when WeChat login is enabled, allows remote attackers to bypass a "disabled registration" setting by adding a… (no CVSS)
- [CVE-2018-20424](https://cve.now/CVE-2018-20424.md): Discuz! DiscuzX 3.4, when WeChat login is enabled, allows remote attackers to delete the common\_member\_wechatmp data structure via an… (no CVSS)
- [CVE-2018-20419](https://cve.now/CVE-2018-20419.md): DouCo DouPHP 1.5 has upload/admin/manager.php?rec=insert CSRF to add an administrator account. (no CVSS)
- [CVE-2018-20420](https://cve.now/CVE-2018-20420.md): In webERP 4.15, Z\_CreateCompanyTemplateFile.php has Incorrect Access Control, leading to the overwrite of an existing .sql file on the… (no CVSS)
- [CVE-2018-20421](https://cve.now/CVE-2018-20421.md): Go Ethereum (aka geth) 1.8.19 allows attackers to cause a denial of service (memory consumption) by rewriting the length of a dynamic… (no CVSS)
- [CVE-2018-20410](https://cve.now/CVE-2018-20410.md): WellinTech KingSCADA before 3.7.0.0.1 contains a stack-based buffer overflow. (no CVSS)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/archive/2018-12-24
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.