CVEs published November 20, 2018
36 CVEs were published on November 20, 2018: 0 critical, 1 high.
- Published
- 36
- Critical
- 0
- High
- 1
- Medium
- 0
- Low
- 0
- Unrated
- 35
- Now in CISA KEV
- 0
- Fix available
- 0
Most affected products
- Access Manager
- 1
- IBM API Connect
- 1
High 1
Medium, low and unrated 35
- CVE-2018-19376An issue was discovered in GreenCMS v2.3.0603.
- CVE-2018-19388FoxitReader.exe in Foxit Reader 9.3.0.10826 allows remote attackers to cause a denial of service (out-of-bounds read, access violation, and
- CVE-2018-19389FoxitReader.exe in Foxit Reader 9.3.0.10826 allows remote attackers to cause a denial of service (Break instruction exception and applicatio
- CVE-2018-19390FoxitReader.exe in Foxit Reader 9.3.0.10826 allows remote attackers to cause a denial of service (Break instruction exception and applicatio
- CVE-2018-19395ext/standard/var.c in PHP 5.x through 7.1.24 on Windows allows attackers to cause a denial of service (NULL pointer dereference and applicat
- CVE-2018-19396ext/standard/var_unserializer.c in PHP 5.x through 7.1.24 allows attackers to cause a denial of service (application crash) via an unseriali
- CVE-2018-12037An issue was discovered on Samsung 840 EVO and 850 EVO devices (only in "ATA high" mode, not vulnerable in "TCG" or "ATA max" mode), Samsung
- CVE-2018-12038An issue was discovered on Samsung 840 EVO devices.
- CVE-2018-16222Cleartext Storage of credentials in the iSmartAlarmData.xml configuration file in the iSmartAlarm application through 2.0.8 for Android allo
- CVE-2018-16223Insecure Cryptographic Storage of credentials in com.vestiacom.qbeecamera_preferences.xml in the QBee Cam application through 1.0.5 for Andr
- CVE-2018-16224Incorrect access control for the diagnostic files of the iSmartAlarm Cube One through 2.2.4.10 allows an attacker to retrieve them via a spe
- CVE-2018-18439DENX U-Boot through 2018.09-rc1 has a remotely exploitable buffer overflow via a malicious TFTP server because TFTP traffic is mishandled.
- CVE-2018-18440DENX U-Boot through 2018.09-rc1 has a locally exploitable buffer overflow via a crafted kernel image because filesystem loading is mishandle
- CVE-2018-18561An issue was discovered in Roche Accu-Chek Inform II Base Unit / Base Unit Hub before 03.01.04 and CoaguChek / cobas h232 Handheld Base Unit
- CVE-2018-18562An issue was discovered in Roche Accu-Chek Inform II Base Unit / Base Unit Hub before 03.01.04 and CoaguChek / cobas h232 Handheld Base Unit
- CVE-2018-18563An issue was discovered in Roche Accu-Chek Inform II Instrument before 03.06.00 (Serial number below 14000) and 04.x before 04.03.00 (Serial
- CVE-2018-18564An issue was discovered in Roche Accu-Chek Inform II Instrument before 03.06.00 (Serial number below 14000) and 04.x before 04.03.00 (Serial
- CVE-2018-18565An issue was discovered in Roche Accu-Chek Inform II Instrument before 03.06.00 (Serial number below 14000) and 04.x before 04.03.00 (Serial
- CVE-2018-18715Zoho ManageEngine OpManager 12.3 before 123219 has stored XSS.
- CVE-2018-18716Zoho ManageEngine OpManager 12.3 before 123219 has a Self XSS Vulnerability.
- CVE-2018-18772CentOS-WebPanel.com (aka CWP) CentOS Web Panel through 0.9.8.740 allows CSRF via admin/index.php?module=send_ssh, as demonstrated by executi
- CVE-2018-18773CentOS-WebPanel.com (aka CWP) CentOS Web Panel through 0.9.8.740 allows CSRF via admin/index.php?module=rootpwd, as demonstrated by changing
- CVE-2018-18774CentOS-WebPanel.com (aka CWP) CentOS Web Panel through 0.9.8.740 allows XSS via the admin/index.php module parameter.
- CVE-2018-18856Multiple local privilege escalation vulnerabilities have been identified in the LiquidVPN client through 1.37 for macOS.
- CVE-2018-18857Multiple local privilege escalation vulnerabilities have been identified in the LiquidVPN client through 1.37 for macOS.
- CVE-2018-18858Multiple local privilege escalation vulnerabilities have been identified in the LiquidVPN client through 1.37 for macOS.
- CVE-2018-18859Multiple local privilege escalation vulnerabilities have been identified in the LiquidVPN client through 1.37 for macOS.
- CVE-2018-18861Buffer overflow in PCMan FTP Server 2.0.7 allows for remote code execution via the APPE command.
- CVE-2018-18864Loadbalancer.org Enterprise VA MAX before 8.3.3 has XSS because Apache HTTP Server logs are displayed.
- CVE-2018-18865The Royal browser extensions TS before 4.3.60728 (Release Date 2018-07-28) and TSX before 3.3.1 (Release Date 2018-09-13) allow Credentials
- CVE-2018-17948An open redirect vulnerability exists in the Access Manager Identity Provider prior to 4.4 SP3.Access Manager
- CVE-2018-10099Google Monorail before 2018-04-04 has a Cross-Site Search (XS-Search) vulnerability because CSV downloads are affected by CSRF, and calculat
- CVE-2018-19334Google Monorail before 2018-05-04 has a Cross-Site Search (XS-Search) vulnerability because CSV downloads are affected by CSRF, and calculat
- CVE-2018-19335Google Monorail before 2018-06-07 has a Cross-Site Search (XS-Search) vulnerability because CSV downloads are affected by CSRF, and calculat
- CVE-2018-19367Portainer through 1.19.2 provides an API endpoint (/api/users/admin/check) to verify that the admin user is already created.