# CVEs published 2018-11-14

157 CVEs were published on November 14, 2018: 0 critical, 4 high. 4 are now in CISA KEV. Days are UTC.

- [CVE-2018-17960](https://cve.now/CVE-2018-17960.md): CKEditor 4.x before 4.11.0 allows user-assisted XSS involving a source-mode paste. (no CVSS, ckeditor · typo3/cms-core +1)
- [CVE-2018-19278](https://cve.now/CVE-2018-19278.md): Buffer overflow in DNS SRV and NAPTR lookups in Digium Asterisk 15.x before 15.6.2 and 16.x before 16.0.1 allows remote attackers to crash A (no CVSS)
- [CVE-2018-19279](https://cve.now/CVE-2018-19279.md): PRIMX ZoneCentral before 6.1.2236 on Windows sometimes leaks the plaintext of NTFS files. (no CVSS)
- [CVE-2018-19280](https://cve.now/CVE-2018-19280.md): Centreon 3.4.x (fixed in Centreon 18.10.0) has XSS via the resource name or macro expression of a poller macro. (no CVSS, centreon/centreon)
- [CVE-2018-19281](https://cve.now/CVE-2018-19281.md): Centreon 3.4.x (fixed in Centreon 18.10.0 and Centreon web 2.8.27) allows SNMP trap SQL Injection. (no CVSS, centreon/centreon)
- [CVE-2018-5495](https://cve.now/CVE-2018-5495.md): All StorageGRID Webscale versions are susceptible to a vulnerability which could permit an unauthenticated attacker to communicate with syst (no CVSS, NetApp StorageGRID Webscale)
- [CVE-2018-15708](https://cve.now/CVE-2018-15708.md): Snoopy 1.0 in Nagios XI 5.5.6 allows remote unauthenticated attackers to execute arbitrary commands via a crafted HTTP request. (no CVSS, Nagios XI)
- [CVE-2018-15709](https://cve.now/CVE-2018-15709.md): Nagios XI 5.5.6 allows remote authenticated attackers to execute arbitrary commands via a crafted HTTP request. (no CVSS, Nagios XI)
- [CVE-2018-15710](https://cve.now/CVE-2018-15710.md): Nagios XI 5.5.6 allows local authenticated attackers to escalate privileges to root via Autodiscover\_new.php. (no CVSS, Nagios XI)
- [CVE-2018-15711](https://cve.now/CVE-2018-15711.md): Nagios XI 5.5.6 allows remote authenticated attackers to reset and regenerate the API key of more privileged users. (no CVSS, Nagios XI)
- [CVE-2018-15712](https://cve.now/CVE-2018-15712.md): Nagios XI 5.5.6 allows reflected cross site scripting from remote unauthenticated attackers via the host parameter in api\_tool.php. (no CVSS, Nagios XI)
- [CVE-2018-15713](https://cve.now/CVE-2018-15713.md): Nagios XI 5.5.6 allows persistent cross site scripting from remote authenticated attackers via the stored email address in admin/users.php. (no CVSS, Nagios XI)
- [CVE-2018-15714](https://cve.now/CVE-2018-15714.md): Nagios XI 5.5.6 allows reflected cross site scripting from remote unauthenticated attackers via the oname and oname2 parameters. (no CVSS, Nagios XI)
- [CVE-2018-9347](https://cve.now/CVE-2018-9347.md): In function SMF\_ParseMetaEvent of file eas\_smf.c there is incorrect input validation causing an infinite loop. (no CVSS, Google Android)
- [CVE-2018-9457](https://cve.now/CVE-2018-9457.md): In onCheckedChanged of BluetoothPairingController.java, there is a possible way to retrieve contact information due to a permissions bypass. (no CVSS, Google Android)
- [CVE-2018-9521](https://cve.now/CVE-2018-9521.md): In parseMPEGCCData of NuPlayer2CCDecoder.cpp, there is a possible out of bounds write due to an incorrect bounds check. (no CVSS, Google Android)
- [CVE-2018-9522](https://cve.now/CVE-2018-9522.md): In the serialization functions of StatsLogEventWrapper.java, there is a possible out-of-bounds write due to unnecessary functionality which (no CVSS, Google Android)
- [CVE-2018-9523](https://cve.now/CVE-2018-9523.md): In Parcel.writeMapInternal of Parcel.java, there is a possible parcel serialization/deserialization mismatch due to improper input validatio (no CVSS, Google Android)
- [CVE-2018-9524](https://cve.now/CVE-2018-9524.md): In functionality implemented in System UI, there are insufficient protections implemented around overlay windows. (no CVSS, Google Android)
- [CVE-2018-9525](https://cve.now/CVE-2018-9525.md): In the AndroidManifest.xml file defining the SliceBroadcastReceiver handler for com.android.settings.slice.action.WIFI\_CHANGED, there is a p (no CVSS, Google Android)
- [CVE-2018-9526](https://cve.now/CVE-2018-9526.md): In device configuration data, there is an improperly configured setting. (no CVSS, Google Android)
- [CVE-2018-9527](https://cve.now/CVE-2018-9527.md): In vorbis\_book\_decodev\_set of codebook.c there is a possible out of bounds write due to missing bounds check. (no CVSS, Google Android)
- [CVE-2018-9528](https://cve.now/CVE-2018-9528.md): In ixheaacd\_over\_lap\_add1\_armv8 of ixheaacd\_overlap\_add1.s there is a possible out of bounds write due to a missing bounds check. (no CVSS, Google Android)
- [CVE-2018-9529](https://cve.now/CVE-2018-9529.md): In ixheaacd\_individual\_ch\_stream of ixheaacd\_channel.c there is a possible out of bounds write due to a missing bounds check. (no CVSS, Google Android)
- [CVE-2018-9530](https://cve.now/CVE-2018-9530.md): In ixheaacd\_tns\_ar\_filter\_dec of ixheaacd\_aac\_tns.c there is a possible out of bounds write due to a missing bounds check. (no CVSS, Google Android)
- [CVE-2018-9531](https://cve.now/CVE-2018-9531.md): In AudioSpecificConfig\_Parse of tpdec\_asc.cpp, there is a possible out-of-bounds write due to a missing bounds check. (no CVSS, Google Android)
- [CVE-2018-9532](https://cve.now/CVE-2018-9532.md): In ixheaacd\_extract\_frame\_info\_ld of ixheaacd\_env\_extr.c there is a possible out of bounds write due to a missing bounds check. (no CVSS, Google Android)
- [CVE-2018-9533](https://cve.now/CVE-2018-9533.md): In ixheaacd\_dec\_data\_init of ixheaacd\_create.c there is a possible out of write read due to a missing bounds check. (no CVSS, Google Android)
- [CVE-2018-9534](https://cve.now/CVE-2018-9534.md): In ixheaacd\_mps\_getstridemap of ixheaacd\_mps\_parse.c there is a possible out of bounds write due to a missing bounds check. (no CVSS, Google Android)
- [CVE-2018-9535](https://cve.now/CVE-2018-9535.md): In ixheaacd\_reset\_acelp\_data\_fix of ixheaacd\_lpc.c there is a possible out of bounds write due to a missing bounds check. (no CVSS, Google Android)
- [CVE-2018-9536](https://cve.now/CVE-2018-9536.md): In numerous functions of libFDK, there are possible out of bounds writes due to incorrect bounds checks. (no CVSS, Google Android)
- [CVE-2018-9537](https://cve.now/CVE-2018-9537.md): In CAacDecoder\_DecodeFrame of aacdecode.cpp, there is a possible out-of-bounds write due to a missing bounds check. (no CVSS, Google Android)
- [CVE-2018-9539](https://cve.now/CVE-2018-9539.md): In the ClearKey CAS descrambler, there is a possible use after free due to a race condition. (no CVSS, Google Android)
- [CVE-2018-9540](https://cve.now/CVE-2018-9540.md): In avrc\_ctrl\_pars\_vendor\_rsp of avrc\_pars\_ct.c, there is a possible out of bounds read due to a missing bounds check. (no CVSS, Google Android)
- [CVE-2018-9541](https://cve.now/CVE-2018-9541.md): In avrc\_pars\_vendor\_rsp of avcr\_pars\_ct.cc, there is a possible out-of-bounds read due to a missing bounds check. (no CVSS, Google Android)
- [CVE-2018-9542](https://cve.now/CVE-2018-9542.md): In avrc\_pars\_vendor\_rsp of avrc\_pars\_ct.cc, there is a possible out of bounds read due to a missing bounds check. (no CVSS, Google Android)
- [CVE-2018-9543](https://cve.now/CVE-2018-9543.md): In trim\_device of f2fs\_format\_utils.c, it is possible that the data partition is not wiped during a factory reset. (no CVSS, Google Android)
- [CVE-2018-9544](https://cve.now/CVE-2018-9544.md): In register\_app of btif\_hd.cc, there is a possible out-of-bounds read due to a missing bounds check. (no CVSS, Google Android)
- [CVE-2018-9545](https://cve.now/CVE-2018-9545.md): In BTA\_HdRegisterApp of bta\_hd\_api.cc, there is a possible out-of-bound write due to a missing bounds check. (no CVSS, Google Android)
- [CVE-2018-9580](https://cve.now/CVE-2018-9580.md): A Elevation of privilege vulnerability in the HTC bootloader. (no CVSS, Google Android)
- [CVE-2018-17462](https://cve.now/CVE-2018-17462.md): Incorrect refcounting in AppCache in Google Chrome prior to 70.0.3538.67 allowed a remote attacker to perform a sandbox escape via a crafted (no CVSS, Google Chrome)
- [CVE-2018-17463](https://cve.now/CVE-2018-17463.md): Incorrect side effect annotation in V8 in Google Chrome prior to 70.0.3538.64 allowed a remote attacker to execute arbitrary code inside a s (CVSS 8.8, KEV, Google Chrome)
- [CVE-2018-17464](https://cve.now/CVE-2018-17464.md): Incorrect handling of history on iOS in Navigation in Google Chrome prior to 70.0.3538.67 allowed a remote attacker to spoof the contents of (no CVSS, Google Chrome)
- [CVE-2018-17465](https://cve.now/CVE-2018-17465.md): Incorrect implementation of object trimming in V8 in Google Chrome prior to 70.0.3538.67 allowed a remote attacker to potentially exploit ob (no CVSS, Google Chrome)
- [CVE-2018-17466](https://cve.now/CVE-2018-17466.md): Incorrect texture handling in Angle in Google Chrome prior to 70.0.3538.67 allowed a remote attacker to perform an out of bounds memory read (no CVSS, Google Chrome)
- [CVE-2018-17467](https://cve.now/CVE-2018-17467.md): Insufficiently quick clearing of stale rendered content in Navigation in Google Chrome prior to 70.0.3538.67 allowed a remote attacker to sp (no CVSS, Google Chrome)
- [CVE-2018-17468](https://cve.now/CVE-2018-17468.md): Incorrect handling of timer information during navigation in Blink in Google Chrome prior to 70.0.3538.67 allowed a remote attacker to obtai (no CVSS, Google Chrome)
- [CVE-2018-17469](https://cve.now/CVE-2018-17469.md): Incorrect handling of PDF filter chains in PDFium in Google Chrome prior to 70.0.3538.67 allowed a remote attacker to perform an out of boun (no CVSS, Google Chrome)
- [CVE-2018-17471](https://cve.now/CVE-2018-17471.md): Incorrect dialog placement in WebContents in Google Chrome prior to 70.0.3538.67 allowed a remote attacker to obscure the full screen warnin (no CVSS, Google Chrome)
- [CVE-2018-17472](https://cve.now/CVE-2018-17472.md): Incorrect handling of googlechrome:// URL scheme on iOS in Intents in Google Chrome prior to 70.0.3538.67 allowed a remote attacker to escap (no CVSS, Google Chrome)
- [CVE-2018-17473](https://cve.now/CVE-2018-17473.md): Incorrect handling of confusable characters in Omnibox in Google Chrome prior to 70.0.3538.67 allowed a remote attacker to spoof the content (no CVSS, Google Chrome)
- [CVE-2018-17474](https://cve.now/CVE-2018-17474.md): Use after free in HTMLImportsController in Blink in Google Chrome prior to 70.0.3538.67 allowed a remote attacker to potentially exploit hea (no CVSS, Google Chrome)
- [CVE-2018-17475](https://cve.now/CVE-2018-17475.md): Incorrect handling of history on iOS in Navigation in Google Chrome prior to 70.0.3538.67 allowed a remote attacker to spoof the contents of (no CVSS, Google Chrome)
- [CVE-2018-17476](https://cve.now/CVE-2018-17476.md): Incorrect dialog placement in Cast UI in Google Chrome prior to 70.0.3538.67 allowed a remote attacker to obscure the full screen warning vi (no CVSS, Google Chrome)
- [CVE-2018-17477](https://cve.now/CVE-2018-17477.md): Incorrect dialog placement in Extensions in Google Chrome prior to 70.0.3538.67 allowed a remote attacker to spoof the contents of extension (no CVSS, Google Chrome)
- [CVE-2018-6057](https://cve.now/CVE-2018-6057.md): Lack of special casing of Android ashmem in Google Chrome prior to 65.0.3325.146 allowed a remote attacker who had compromised the renderer (no CVSS, Google Chrome)
- [CVE-2018-6060](https://cve.now/CVE-2018-6060.md): Use after free in WebAudio in Google Chrome prior to 65.0.3325.146 allowed a remote attacker to potentially exploit heap corruption via a cr (no CVSS, Google Chrome)
- [CVE-2018-6061](https://cve.now/CVE-2018-6061.md): A race in the handling of SharedArrayBuffers in WebAssembly in Google Chrome prior to 65.0.3325.146 allowed a remote attacker to potentially (no CVSS, Google Chrome)
- [CVE-2018-6062](https://cve.now/CVE-2018-6062.md): Heap overflow write in Skia in Google Chrome prior to 65.0.3325.146 allowed a remote attacker to perform an out of bounds memory write via a (no CVSS, Google Chrome)
- [CVE-2018-6063](https://cve.now/CVE-2018-6063.md): Incorrect use of mojo::WrapSharedMemoryHandle in Mojo in Google Chrome prior to 65.0.3325.146 allowed a remote attacker who had compromised (no CVSS, Google Chrome)
- [CVE-2018-6064](https://cve.now/CVE-2018-6064.md): Type Confusion in the implementation of \_\_defineGetter\_\_ in V8 in Google Chrome prior to 65.0.3325.146 allowed a remote attacker to potentia (no CVSS, Google Chrome)
- [CVE-2018-6065](https://cve.now/CVE-2018-6065.md): Integer overflow in computing the required allocation size when instantiating a new javascript object in V8 in Google Chrome prior to 65.0.3 (CVSS 8.8, KEV, Google Chrome)
- [CVE-2018-6066](https://cve.now/CVE-2018-6066.md): Lack of CORS checking by ResourceFetcher/ResourceLoader in Blink in Google Chrome prior to 65.0.3325.146 allowed a remote attacker to leak c (no CVSS, Google Chrome)
- [CVE-2018-6067](https://cve.now/CVE-2018-6067.md): Incorrect IPC serialization in Skia in Google Chrome prior to 65.0.3325.146 allowed a remote attacker to potentially exploit heap corruption (no CVSS, Google Chrome)
- [CVE-2018-6068](https://cve.now/CVE-2018-6068.md): Object lifecycle issue in Chrome Custom Tab in Google Chrome prior to 65.0.3325.146 allowed a remote attacker to spoof the contents of the O (no CVSS, Google Chrome)
- [CVE-2018-6069](https://cve.now/CVE-2018-6069.md): Stack buffer overflow in Skia in Google Chrome prior to 65.0.3325.146 allowed a remote attacker to perform an out of bounds memory read via (no CVSS, Google Chrome)
- [CVE-2018-6070](https://cve.now/CVE-2018-6070.md): Lack of CSP enforcement on WebUI pages in Bink in Google Chrome prior to 65.0.3325.146 allowed an attacker who convinced a user to install a (no CVSS, Google Chrome)
- [CVE-2018-6071](https://cve.now/CVE-2018-6071.md): An integer overflow in Skia in Google Chrome prior to 65.0.3325.146 allowed a remote attacker to perform an out of bounds memory read via a (no CVSS, Google Chrome)
- [CVE-2018-6072](https://cve.now/CVE-2018-6072.md): An integer overflow leading to use after free in PDFium in Google Chrome prior to 65.0.3325.146 allowed a remote attacker to potentially exp (no CVSS)
- [CVE-2018-6073](https://cve.now/CVE-2018-6073.md): A heap buffer overflow in WebGL in Google Chrome prior to 65.0.3325.146 allowed a remote attacker to perform an out of bounds memory write v (no CVSS, Google Chrome)
- [CVE-2018-6074](https://cve.now/CVE-2018-6074.md): Failure to apply Mark-of-the-Web in Downloads in Google Chrome prior to 65.0.3325.146 allowed a remote attacker to bypass OS level controls (no CVSS, Google Chrome)
- [CVE-2018-6075](https://cve.now/CVE-2018-6075.md): Incorrect handling of specified filenames in file downloads in Google Chrome prior to 65.0.3325.146 allowed a remote attacker to leak cross- (no CVSS, Google Chrome)
- [CVE-2018-6076](https://cve.now/CVE-2018-6076.md): Insufficient encoding of URL fragment identifiers in Blink in Google Chrome prior to 65.0.3325.146 allowed a remote attacker to perform a DO (no CVSS, Google Chrome)
- [CVE-2018-6077](https://cve.now/CVE-2018-6077.md): Displacement map filters being applied to cross-origin images in Blink SVG rendering in Google Chrome prior to 65.0.3325.146 allowed a remot (no CVSS, Google Chrome)
- [CVE-2018-6078](https://cve.now/CVE-2018-6078.md): Incorrect handling of confusable characters in Omnibox in Google Chrome prior to 65.0.3325.146 allowed a remote attacker to spoof the conten (no CVSS, Google Chrome)
- [CVE-2018-6079](https://cve.now/CVE-2018-6079.md): Inappropriate sharing of TEXTURE\_2D\_ARRAY/TEXTURE\_3D data between tabs in WebGL in Google Chrome prior to 65.0.3325.146 allowed a remote att (no CVSS, Google Chrome)
- [CVE-2018-6080](https://cve.now/CVE-2018-6080.md): Lack of access control checks in Instrumentation in Google Chrome prior to 65.0.3325.146 allowed a remote attacker who had compromised the r (no CVSS, Google Chrome)
- [CVE-2018-6081](https://cve.now/CVE-2018-6081.md): XSS vulnerabilities in Interstitials in Google Chrome prior to 65.0.3325.146 allowed an attacker who convinced a user to install a malicious (no CVSS, Google Chrome)
- [CVE-2018-6082](https://cve.now/CVE-2018-6082.md): Including port 22 in the list of allowed FTP ports in Networking in Google Chrome prior to 65.0.3325.146 allowed a remote attacker to potent (no CVSS)
- [CVE-2018-6083](https://cve.now/CVE-2018-6083.md): Failure to disallow PWA installation from CSP sandboxed pages in AppManifest in Google Chrome prior to 65.0.3325.146 allowed a remote attack (no CVSS, Google Chrome)
- [CVE-2018-7357](https://cve.now/CVE-2018-7357.md): ZTE ZXHN H168N product with versions V2.2.0\_PK1.2T5, V2.2.0\_PK1.2T2, V2.2.0\_PK11T7 and V2.2.0\_PK11T have an improper access control vulnerab (CVSS 6.5, ZTE ZXHN H168N)
- [CVE-2018-7358](https://cve.now/CVE-2018-7358.md): ZTE ZXHN H168N product with versions V2.2.0\_PK1.2T5, V2.2.0\_PK1.2T2, V2.2.0\_PK11T7 and V2.2.0\_PK11T have an improper change control vulnerab (CVSS 6.5, ZTE ZXHN H168N)
- [CVE-2018-12174](https://cve.now/CVE-2018-12174.md): Heap overflow in Intel Trace Analyzer 2018 in Intel Parallel Studio XE 2018 Update 3 may allow an authenticated user to potentially escalate (no CVSS, Intel Parallel Studio XE)
- [CVE-2018-3621](https://cve.now/CVE-2018-3621.md): Insufficient input validation in the Intel Driver & Support Assistant before 3.6.0.4 may allow an unauthenticated user to potentially enable (no CVSS, Intel Driver & Support Assistant)
- [CVE-2018-3635](https://cve.now/CVE-2018-3635.md): Insufficient input validation in installer in Intel Rapid Store Technology (RST) before version 16.7 may allow an unprivileged user to poten (no CVSS, Intel Rapid Store Technology)
- [CVE-2018-3696](https://cve.now/CVE-2018-3696.md): Authentication bypass in the Intel RAID Web Console 3 for Windows before 4.186 may allow an unprivileged user to potentially gain administra (no CVSS, Intel RAID Web Console v3 for Windows)
- [CVE-2018-3697](https://cve.now/CVE-2018-3697.md): Improper directory permissions in the installer for the Intel Media Server Studio may allow unprivileged users to potentially enable an esca (no CVSS, Intel Media Server Studio)
- [CVE-2018-3698](https://cve.now/CVE-2018-3698.md): Improper file permissions in the installer for the Intel Ready Mode Technology may allow an unprivileged user to potentially gain privileged (no CVSS, Intel Ready Mode Technology)
- [CVE-2018-3699](https://cve.now/CVE-2018-3699.md): Cross-site scripting in the Intel RAID Web Console v3 for Windows may allow an unauthenticated user to elevate privilege via remote access. (no CVSS, Intel RAID Web Console)
- [CVE-2018-19271](https://cve.now/CVE-2018-19271.md): Centreon 3.4.x (fixed in Centreon 18.10.0 and Centreon web 2.8.28) allows SQL Injection via the main.php searchH parameter. (no CVSS, centreon/centreon)
- [CVE-2018-19277](https://cve.now/CVE-2018-19277.md): securityScan() in PHPOffice PhpSpreadsheet through 1.5.0 allows a bypass of protection mechanisms for XXE via UTF-7 encoding in a .xlsx file (no CVSS, phpoffice/phpspreadsheet · phpoffice/phpexcel)
- [CVE-2018-19186](https://cve.now/CVE-2018-19186.md): The Amazon PAYFORT payfort-php-SDK payment gateway SDK through 2018-04-26 has XSS via the route.php paymentMethod parameter. (no CVSS)
- [CVE-2018-19187](https://cve.now/CVE-2018-19187.md): The Amazon PAYFORT payfort-php-SDK payment gateway SDK through 2018-04-26 has XSS via an arbitrary parameter name or value that is mishandle (no CVSS)
- [CVE-2018-19188](https://cve.now/CVE-2018-19188.md): The Amazon PAYFORT payfort-php-SDK payment gateway SDK through 2018-04-26 has XSS via the success.php fort\_id parameter. (no CVSS)
- [CVE-2018-19189](https://cve.now/CVE-2018-19189.md): The Amazon PAYFORT payfort-php-SDK payment gateway SDK through 2018-04-26 has XSS via an arbitrary parameter name or value that is mishandle (no CVSS)
- [CVE-2018-19190](https://cve.now/CVE-2018-19190.md): The Amazon PAYFORT payfort-php-SDK payment gateway SDK through 2018-04-26 has XSS via the error.php error\_msg parameter. (no CVSS)
- [CVE-2018-8256](https://cve.now/CVE-2018-8256.md): A remote code execution vulnerability exists when PowerShell improperly handles specially crafted files, aka "Microsoft PowerShell Remote Co (no CVSS, Microsoft Windows · Microsoft.PowerShell.Archive +1)
- [CVE-2018-8407](https://cve.now/CVE-2018-8407.md): An information disclosure vulnerability exists when "Kernel Remote Procedure Call Provider" driver improperly initializes objects in memory, (no CVSS, Microsoft Windows)
- [CVE-2018-8408](https://cve.now/CVE-2018-8408.md): An information disclosure vulnerability exists when the Windows kernel improperly initializes objects in memory, aka "Windows Kernel Informa (no CVSS, Microsoft Windows)
- [CVE-2018-8415](https://cve.now/CVE-2018-8415.md): A tampering vulnerability exists in PowerShell that could allow an attacker to execute unlogged code, aka "Microsoft PowerShell Tampering Vu (no CVSS, Microsoft Windows · Microsoft PowerShell Core)
- [CVE-2018-8416](https://cve.now/CVE-2018-8416.md): A tampering vulnerability exists when .NET Core improperly handles specially crafted files, aka ".NET Core Tampering Vulnerability." This af (no CVSS, Microsoft .NET Core · Microsoft.NETCore.App)
- [CVE-2018-8417](https://cve.now/CVE-2018-8417.md): A security feature bypass vulnerability exists in Microsoft JScript that could allow an attacker to bypass Device Guard, aka "Microsoft JScr (no CVSS, Microsoft Windows Server · Microsoft Windows)
- [CVE-2018-8450](https://cve.now/CVE-2018-8450.md): A remote code execution vulnerability exists when Windows Search handles objects in memory, aka "Windows Search Remote Code Execution Vulner (no CVSS, Microsoft Windows)
- [CVE-2018-8454](https://cve.now/CVE-2018-8454.md): An information disclosure vulnerability exists when Windows Audio Service fails to properly handle objects in memory, aka "Windows Audio Ser (no CVSS, Microsoft Windows 10 Servers · Microsoft Windows)
- [CVE-2018-8471](https://cve.now/CVE-2018-8471.md): An elevation of privilege vulnerability exists in the way that the Microsoft RemoteFX Virtual GPU miniport driver handles objects in memory, (no CVSS, Microsoft Windows Server · Microsoft Windows)
- [CVE-2018-8476](https://cve.now/CVE-2018-8476.md): A remote code execution vulnerability exists in the way that Windows Deployment Services TFTP Server handles objects in memory, aka "Windows (no CVSS, Microsoft Windows Server 2012 R2 · Microsoft Windows Ser… +1)
- [CVE-2018-8485](https://cve.now/CVE-2018-8485.md): An elevation of privilege vulnerability exists when DirectX improperly handles objects in memory, aka "DirectX Elevation of Privilege Vulner (no CVSS, Microsoft Windows Server 2012 R2 · Microsoft Windows RT +2)
- [CVE-2018-8522](https://cve.now/CVE-2018-8522.md): A remote code execution vulnerability exists in Microsoft Outlook software when it fails to properly handle objects in memory, aka "Microsof (no CVSS, Microsoft Office · Microsoft Outlook)
- [CVE-2018-8524](https://cve.now/CVE-2018-8524.md): A remote code execution vulnerability exists in Microsoft Outlook software when it fails to properly handle objects in memory, aka "Microsof (no CVSS, Microsoft Office · Microsoft Outlook)
- [CVE-2018-8539](https://cve.now/CVE-2018-8539.md): A remote code execution vulnerability exists in Microsoft Word software when it fails to properly handle objects in memory, aka "Microsoft W (no CVSS, Microsoft SharePoint Server · Microsoft Office)
- [CVE-2018-8541](https://cve.now/CVE-2018-8541.md): A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka "C (no CVSS, Microsoft Edge · Microsoft ChakraCore +1)
- [CVE-2018-8542](https://cve.now/CVE-2018-8542.md): A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka "C (no CVSS, Microsoft Edge · Microsoft ChakraCore +1)
- [CVE-2018-8543](https://cve.now/CVE-2018-8543.md): A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka "C (no CVSS, Microsoft Edge · Microsoft ChakraCore +1)
- [CVE-2018-8544](https://cve.now/CVE-2018-8544.md): A remote code execution vulnerability exists in the way that the VBScript engine handles objects in memory, aka "Windows VBScript Engine Rem (no CVSS, Microsoft Windows)
- [CVE-2018-8545](https://cve.now/CVE-2018-8545.md): An information disclosure vulnerability exists in the way that Microsoft Edge handles cross-origin requests, aka "Microsoft Edge Information (no CVSS, Microsoft Edge)
- [CVE-2018-8546](https://cve.now/CVE-2018-8546.md): A denial of service vulnerability exists in Skype for Business, aka "Microsoft Skype for Business Denial of Service Vulnerability." This aff (no CVSS, Microsoft Skype · Microsoft Office +1)
- [CVE-2018-8547](https://cve.now/CVE-2018-8547.md): A cross-site-scripting (XSS) vulnerability exists when an open source customization for Microsoft Active Directory Federation Services (AD F (no CVSS, Microsoft Windows Server 2012 R2 · Microsoft Windows RT +2)
- [CVE-2018-8549](https://cve.now/CVE-2018-8549.md): A security feature bypass exists when Windows incorrectly validates kernel driver signatures, aka "Windows Security Feature Bypass Vulnerabi (no CVSS)
- [CVE-2018-8550](https://cve.now/CVE-2018-8550.md): An elevation of privilege exists in Windows COM Aggregate Marshaler, aka "Windows COM Elevation of Privilege Vulnerability." This affects Wi (no CVSS)
- [CVE-2018-8551](https://cve.now/CVE-2018-8551.md): A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka "C (no CVSS, Microsoft Edge · Microsoft ChakraCore +1)
- [CVE-2018-8552](https://cve.now/CVE-2018-8552.md): An information disclosure vulnerability exists when VBScript improperly discloses the contents of its memory, which could provide an attacke (no CVSS, Microsoft Internet Explorer)
- [CVE-2018-8553](https://cve.now/CVE-2018-8553.md): A remote code execution vulnerability exists in the way that Microsoft Graphics Components handle objects in memory, aka "Microsoft Graphics (no CVSS, Microsoft Windows)
- [CVE-2018-8554](https://cve.now/CVE-2018-8554.md): An elevation of privilege vulnerability exists when DirectX improperly handles objects in memory, aka "DirectX Elevation of Privilege Vulner (no CVSS, Microsoft Windows 10 Servers · Microsoft Windows)
- [CVE-2018-8555](https://cve.now/CVE-2018-8555.md): A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka "C (no CVSS, Microsoft Edge · Microsoft ChakraCore +1)
- [CVE-2018-8556](https://cve.now/CVE-2018-8556.md): A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka "C (no CVSS, Microsoft Edge · Microsoft ChakraCore +1)
- [CVE-2018-8557](https://cve.now/CVE-2018-8557.md): A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka "C (no CVSS, Microsoft Edge · Microsoft ChakraCore +1)
- [CVE-2018-8558](https://cve.now/CVE-2018-8558.md): An information disclosure vulnerability exists when Microsoft Outlook fails to respect "Default link type" settings configured via the Share (no CVSS, Microsoft Office)
- [CVE-2018-8561](https://cve.now/CVE-2018-8561.md): An elevation of privilege vulnerability exists when DirectX improperly handles objects in memory, aka "DirectX Elevation of Privilege Vulner (no CVSS, Microsoft Windows Server 2012 R2 · Microsoft Windows RT +2)
- [CVE-2018-8562](https://cve.now/CVE-2018-8562.md): An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in memory, aka "Win32k (no CVSS, Microsoft Windows)
- [CVE-2018-8563](https://cve.now/CVE-2018-8563.md): An information disclosure vulnerability exists when DirectX improperly handles objects in memory, aka "DirectX Information Disclosure Vulner (no CVSS, Microsoft Windows)
- [CVE-2018-8564](https://cve.now/CVE-2018-8564.md): A spoofing vulnerability exists when Microsoft Edge improperly handles specific HTML content, aka "Microsoft Edge Spoofing Vulnerability." T (no CVSS, Microsoft Edge)
- [CVE-2018-8565](https://cve.now/CVE-2018-8565.md): An information disclosure vulnerability exists when the win32k component improperly provides kernel information, aka "Win32k Information Dis (no CVSS, Microsoft Windows)
- [CVE-2018-8566](https://cve.now/CVE-2018-8566.md): A security feature bypass vulnerability exists when Windows improperly suspends BitLocker Device Encryption, aka "BitLocker Security Feature (no CVSS, Microsoft Windows Server · Microsoft Windows)
- [CVE-2018-8567](https://cve.now/CVE-2018-8567.md): An elevation of privilege vulnerability exists when Microsoft Edge does not properly enforce cross-domain policies, which could allow an att (no CVSS, Microsoft Edge)
- [CVE-2018-8568](https://cve.now/CVE-2018-8568.md): An elevation of privilege vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request t (CVSS 5.4, Microsoft SharePoint Server · Microsoft SharePoint)
- [CVE-2018-8570](https://cve.now/CVE-2018-8570.md): A remote code execution vulnerability exists when Internet Explorer improperly accesses objects in memory, aka "Internet Explorer Memory Cor (no CVSS, Microsoft Internet Explorer)
- [CVE-2018-8572](https://cve.now/CVE-2018-8572.md): An elevation of privilege vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request t (no CVSS, Microsoft SharePoint Server · Microsoft SharePoint)
- [CVE-2018-8573](https://cve.now/CVE-2018-8573.md): A remote code execution vulnerability exists in Microsoft Word software when it fails to properly handle objects in memory, aka "Microsoft W (no CVSS, Microsoft Word · Microsoft Office)
- [CVE-2018-8574](https://cve.now/CVE-2018-8574.md): A remote code execution vulnerability exists in Microsoft Excel software when the software fails to properly handle objects in memory, aka " (no CVSS, Microsoft Office · Microsoft Excel)
- [CVE-2018-8575](https://cve.now/CVE-2018-8575.md): A remote code execution vulnerability exists in Microsoft Project software when it fails to properly handle objects in memory, aka "Microsof (no CVSS, Microsoft Project · Microsoft Office)
- [CVE-2018-8576](https://cve.now/CVE-2018-8576.md): A remote code execution vulnerability exists in Microsoft Outlook software when it fails to properly handle objects in memory, aka "Microsof (no CVSS, Microsoft Office · Microsoft Outlook)
- [CVE-2018-8577](https://cve.now/CVE-2018-8577.md): A remote code execution vulnerability exists in Microsoft Excel software when the software fails to properly handle objects in memory, aka " (no CVSS, Microsoft Office · Microsoft Excel)
- [CVE-2018-8578](https://cve.now/CVE-2018-8578.md): An information disclosure vulnerability exists when Microsoft SharePoint Server improperly discloses its folder structure when rendering spe (no CVSS, Microsoft SharePoint)
- [CVE-2018-8579](https://cve.now/CVE-2018-8579.md): An information disclosure vulnerability exists when attaching files to Outlook messages, aka "Microsoft Outlook Information Disclosure Vulne (no CVSS, Microsoft Office)
- [CVE-2018-8581](https://cve.now/CVE-2018-8581.md): An elevation of privilege vulnerability exists in Microsoft Exchange Server, aka "Microsoft Exchange Server Elevation of Privilege Vulnerabi (CVSS 7.4, KEV, Microsoft Exchange Server)
- [CVE-2018-8582](https://cve.now/CVE-2018-8582.md): A remote code execution vulnerability exists in the way that Microsoft Outlook parses specially modified rule export files, aka "Microsoft O (no CVSS, Microsoft Office · Microsoft Outlook)
- [CVE-2018-8584](https://cve.now/CVE-2018-8584.md): An elevation of privilege vulnerability exists when Windows improperly handles calls to Advanced Local Procedure Call (ALPC), aka "Windows A (no CVSS, Microsoft Windows Server · Microsoft Windows)
- [CVE-2018-8588](https://cve.now/CVE-2018-8588.md): A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka "C (no CVSS, Microsoft Edge · Microsoft ChakraCore +1)
- [CVE-2018-8589](https://cve.now/CVE-2018-8589.md): An elevation of privilege vulnerability exists when Windows improperly handles calls to Win32k.sys, aka "Windows Win32k Elevation of Privile (CVSS 7.8, KEV, Microsoft Windows Server · Microsoft Windows)
- [CVE-2018-8592](https://cve.now/CVE-2018-8592.md): An elevation of privilege vulnerability exists in Windows 10 version 1809 when installed from physical media (USB, DVD, etc, aka "Windows El (no CVSS, Microsoft Windows)
- [CVE-2018-8600](https://cve.now/CVE-2018-8600.md): A Cross-site Scripting (XSS) vulnerability exists when Azure App Services on Azure Stack does not properly sanitize user provided input, aka (no CVSS, Microsoft Azure App)
- [CVE-2018-8602](https://cve.now/CVE-2018-8602.md): A Cross-site Scripting (XSS) vulnerability exists when Team Foundation Server does not properly sanitize user provided input, aka "Team Foun (no CVSS, Microsoft Team)
- [CVE-2018-8605](https://cve.now/CVE-2018-8605.md): A cross site scripting vulnerability exists when Microsoft Dynamics 365 (on-premises) version 8 does not properly sanitize a specially craft (no CVSS)
- [CVE-2018-8606](https://cve.now/CVE-2018-8606.md): A cross site scripting vulnerability exists when Microsoft Dynamics 365 (on-premises) version 8 does not properly sanitize a specially craft (no CVSS, Microsoft Dynamics)
- [CVE-2018-8607](https://cve.now/CVE-2018-8607.md): A cross site scripting vulnerability exists when Microsoft Dynamics 365 (on-premises) version 8 does not properly sanitize a specially craft (no CVSS, Microsoft Dynamics)
- [CVE-2018-8608](https://cve.now/CVE-2018-8608.md): A cross site scripting vulnerability exists when Microsoft Dynamics 365 (on-premises) version 8 does not properly sanitize a specially craft (no CVSS, Microsoft Dynamics)
- [CVE-2018-8609](https://cve.now/CVE-2018-8609.md): A remote code execution vulnerability exists in Microsoft Dynamics 365 (on-premises) version 8 when the server fails to properly sanitize we (no CVSS, Microsoft Dynamics)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2018-11-14
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.