# CVEs published 2018-11-17

20 CVEs were published on November 17, 2018: 0 critical, 0 high. Days are UTC.

- [CVE-2018-19349](https://cve.now/CVE-2018-19349.md): In SeaCMS v6.64, there is SQL injection via the admin\_makehtml.php topic parameter because of mishandling in include/mkhtml.func.php. (no CVSS)
- [CVE-2018-19350](https://cve.now/CVE-2018-19350.md): In SeaCMS v6.6.4, there is stored XSS via the member.php?action=chgpwdsubmit email parameter during a password change, as demonstrated by a (no CVSS)
- [CVE-2018-19341](https://cve.now/CVE-2018-19341.md): The u3d plugin 9.3.0.10809 (aka plugins\\U3DBrowser.fpi) in FoxitReader.exe in Foxit Reader 9.3.0.10826 allows remote attackers to cause a de (no CVSS)
- [CVE-2018-19342](https://cve.now/CVE-2018-19342.md): The u3d plugin 9.3.0.10809 (aka plugins\\U3DBrowser.fpi) in FoxitReader.exe in Foxit Reader 9.3.0.10826 allows remote attackers to cause a de (no CVSS)
- [CVE-2018-19343](https://cve.now/CVE-2018-19343.md): The u3d plugin 9.3.0.10809 (aka plugins\\U3DBrowser.fpi) in FoxitReader.exe in Foxit Reader 9.3.0.10826 allows remote attackers to cause a de (no CVSS)
- [CVE-2018-19344](https://cve.now/CVE-2018-19344.md): The u3d plugin 9.3.0.10809 (aka plugins\\U3DBrowser.fpi) in FoxitReader.exe in Foxit Reader 9.3.0.10826 allows remote attackers to cause a de (no CVSS)
- [CVE-2018-19345](https://cve.now/CVE-2018-19345.md): The u3d plugin 9.3.0.10809 (aka plugins\\U3DBrowser.fpi) in FoxitReader.exe in Foxit Reader 9.3.0.10826 allows remote attackers to cause a de (no CVSS)
- [CVE-2018-19346](https://cve.now/CVE-2018-19346.md): The u3d plugin 9.3.0.10809 (aka plugins\\U3DBrowser.fpi) in FoxitReader.exe in Foxit Reader 9.3.0.10826 allows remote attackers to cause a de (no CVSS)
- [CVE-2018-19347](https://cve.now/CVE-2018-19347.md): The u3d plugin 9.3.0.10809 (aka plugins\\U3DBrowser.fpi) in FoxitReader.exe in Foxit Reader 9.3.0.10826 allows remote attackers to cause a de (no CVSS)
- [CVE-2018-19348](https://cve.now/CVE-2018-19348.md): The u3d plugin 9.3.0.10809 (aka plugins\\U3DBrowser.fpi) in FoxitReader.exe in Foxit Reader 9.3.0.10826 allows remote attackers to cause a de (no CVSS)
- [CVE-2018-19333](https://cve.now/CVE-2018-19333.md): pkg/sentry/kernel/shm/shm.go in Google gVisor before 2018-11-01 allows attackers to overwrite memory locations in processes running as root (no CVSS)
- [CVE-2018-19340](https://cve.now/CVE-2018-19340.md): Guriddo Form PHP 5.3 has XSS via the demos/jqform/defaultnodb/default.php OrderID, ShipName, ShipAddress, ShipCity, ShipPostalCode, ShipCoun (no CVSS)
- [CVE-2018-19327](https://cve.now/CVE-2018-19327.md): An issue was discovered in JTBC(PHP) 3.0.1.7. (no CVSS)
- [CVE-2018-19328](https://cve.now/CVE-2018-19328.md): LAOBANCMS 2.0 allows install/mysql\_hy.php?riqi=../ Directory Traversal. (no CVSS)
- [CVE-2018-19329](https://cve.now/CVE-2018-19329.md): GreenCMS v2.3.0603 allows remote authenticated administrators to delete arbitrary files by modifying a base64-encoded pathname in an m=admin (no CVSS)
- [CVE-2018-19331](https://cve.now/CVE-2018-19331.md): An issue was discovered in S-CMS v1.5. (no CVSS)
- [CVE-2018-19332](https://cve.now/CVE-2018-19332.md): An issue was discovered in S-CMS v1.5. (no CVSS)
- [CVE-2018-19326](https://cve.now/CVE-2018-19326.md): Zyxel VMG1312-B10D devices before 5.13(AAXA.8)C0 allow ../ Directory Traversal, as demonstrated by reading /etc/passwd. (no CVSS)
- [CVE-2018-19274](https://cve.now/CVE-2018-19274.md): Passing an absolute path to a file\_exists check in phpBB before 3.2.4 allows Remote Code Execution through Object Injection by employing Pha (no CVSS, phpbb/phpbb)
- [CVE-2018-19324](https://cve.now/CVE-2018-19324.md): kimsQ Rb 2.3.0 allows XSS via the second input field to the /?r=home&mod=mypage&page=info URI. (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2018-11-17
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.