# CVEs published 2018-11-19

9 CVEs were published on November 19, 2018: 2 critical, 0 high. Days are UTC.

- [CVE-2018-17906](https://cve.now/CVE-2018-17906.md): Philips iSite and IntelliSpace PACS, iSite PACS, all versions, and IntelliSpace PACS, all versions. (no CVSS, Philips iSite and IntelliSpace PACS)
- [CVE-2018-9209](https://cve.now/CVE-2018-9209.md): Unauthenticated arbitrary file upload vulnerability in FineUploader php-traditional-server \<= v1.2.2 (no CVSS, FineUploader php-traditional-server · fineuploader/php-trad…)
- [CVE-2018-9207](https://cve.now/CVE-2018-9207.md): Arbitrary file upload in jQuery Upload File \<= 4.0.2 (no CVSS, hayageek jQuery Upload File · jquery-file-upload)
- [CVE-2018-15759](https://cve.now/CVE-2018-15759.md): On Demand Services SDK Timing Attack Vulnerability (CVSS 9.1, Pivotal On Demand Services SDK)
- [CVE-2018-15761](https://cve.now/CVE-2018-15761.md): UAA Privilege Escalation (CVSS 9.9, Cloud Foundry UAA · org.cloudfoundry.identity:cloudfoundry-…)
- [CVE-2018-17190](https://cve.now/CVE-2018-17190.md): In all versions of Apache Spark, its standalone resource manager accepts code to execute on a 'master' host, that then runs that code on 'wo (no CVSS, Apache Software Foundation Apache Spark · org.apache.spa… +1)
- [CVE-2018-1841](https://cve.now/CVE-2018-1841.md): IBM Cloud Private 2.1.0 could allow a local user to obtain the CA Private Key due to it being world readable in boot/master node. (CVSS 6.2, IBM Cloud Private)
- [CVE-2018-18519](https://cve.now/CVE-2018-18519.md): BestXsoftware Best Free Keylogger before 6.0.0 allows local users to gain privileges via a Trojan horse "%PROGRAMFILES%\\BFK 5.2.9\\syscrb.exe (no CVSS)
- [CVE-2018-19355](https://cve.now/CVE-2018-19355.md): modules/orderfiles/ajax/upload.php in the Customer Files Upload addon 2018-08-01 for PrestaShop (1.5 through 1.7) allows remote attackers to (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2018-11-19
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.