# CVEs published 2018-11-20

36 CVEs were published on November 20, 2018: 0 critical, 1 high. Days are UTC.

- [CVE-2018-19376](https://cve.now/CVE-2018-19376.md): An issue was discovered in GreenCMS v2.3.0603. (no CVSS)
- [CVE-2018-19388](https://cve.now/CVE-2018-19388.md): FoxitReader.exe in Foxit Reader 9.3.0.10826 allows remote attackers to cause a denial of service (out-of-bounds read, access violation, and (no CVSS)
- [CVE-2018-19389](https://cve.now/CVE-2018-19389.md): FoxitReader.exe in Foxit Reader 9.3.0.10826 allows remote attackers to cause a denial of service (Break instruction exception and applicatio (no CVSS)
- [CVE-2018-19390](https://cve.now/CVE-2018-19390.md): FoxitReader.exe in Foxit Reader 9.3.0.10826 allows remote attackers to cause a denial of service (Break instruction exception and applicatio (no CVSS)
- [CVE-2018-19395](https://cve.now/CVE-2018-19395.md): ext/standard/var.c in PHP 5.x through 7.1.24 on Windows allows attackers to cause a denial of service (NULL pointer dereference and applicat (no CVSS)
- [CVE-2018-19396](https://cve.now/CVE-2018-19396.md): ext/standard/var\_unserializer.c in PHP 5.x through 7.1.24 allows attackers to cause a denial of service (application crash) via an unseriali (no CVSS)
- [CVE-2018-12037](https://cve.now/CVE-2018-12037.md): An issue was discovered on Samsung 840 EVO and 850 EVO devices (only in "ATA high" mode, not vulnerable in "TCG" or "ATA max" mode), Samsung (no CVSS)
- [CVE-2018-12038](https://cve.now/CVE-2018-12038.md): An issue was discovered on Samsung 840 EVO devices. (no CVSS)
- [CVE-2018-16222](https://cve.now/CVE-2018-16222.md): Cleartext Storage of credentials in the iSmartAlarmData.xml configuration file in the iSmartAlarm application through 2.0.8 for Android allo (no CVSS)
- [CVE-2018-16223](https://cve.now/CVE-2018-16223.md): Insecure Cryptographic Storage of credentials in com.vestiacom.qbeecamera\_preferences.xml in the QBee Cam application through 1.0.5 for Andr (no CVSS)
- [CVE-2018-16224](https://cve.now/CVE-2018-16224.md): Incorrect access control for the diagnostic files of the iSmartAlarm Cube One through 2.2.4.10 allows an attacker to retrieve them via a spe (no CVSS)
- [CVE-2018-18439](https://cve.now/CVE-2018-18439.md): DENX U-Boot through 2018.09-rc1 has a remotely exploitable buffer overflow via a malicious TFTP server because TFTP traffic is mishandled. (no CVSS)
- [CVE-2018-18440](https://cve.now/CVE-2018-18440.md): DENX U-Boot through 2018.09-rc1 has a locally exploitable buffer overflow via a crafted kernel image because filesystem loading is mishandle (no CVSS)
- [CVE-2018-18561](https://cve.now/CVE-2018-18561.md): An issue was discovered in Roche Accu-Chek Inform II Base Unit / Base Unit Hub before 03.01.04 and CoaguChek / cobas h232 Handheld Base Unit (no CVSS)
- [CVE-2018-18562](https://cve.now/CVE-2018-18562.md): An issue was discovered in Roche Accu-Chek Inform II Base Unit / Base Unit Hub before 03.01.04 and CoaguChek / cobas h232 Handheld Base Unit (no CVSS)
- [CVE-2018-18563](https://cve.now/CVE-2018-18563.md): An issue was discovered in Roche Accu-Chek Inform II Instrument before 03.06.00 (Serial number below 14000) and 04.x before 04.03.00 (Serial (no CVSS)
- [CVE-2018-18564](https://cve.now/CVE-2018-18564.md): An issue was discovered in Roche Accu-Chek Inform II Instrument before 03.06.00 (Serial number below 14000) and 04.x before 04.03.00 (Serial (no CVSS)
- [CVE-2018-18565](https://cve.now/CVE-2018-18565.md): An issue was discovered in Roche Accu-Chek Inform II Instrument before 03.06.00 (Serial number below 14000) and 04.x before 04.03.00 (Serial (no CVSS)
- [CVE-2018-18715](https://cve.now/CVE-2018-18715.md): Zoho ManageEngine OpManager 12.3 before 123219 has stored XSS. (no CVSS)
- [CVE-2018-18716](https://cve.now/CVE-2018-18716.md): Zoho ManageEngine OpManager 12.3 before 123219 has a Self XSS Vulnerability. (no CVSS)
- [CVE-2018-18772](https://cve.now/CVE-2018-18772.md): CentOS-WebPanel.com (aka CWP) CentOS Web Panel through 0.9.8.740 allows CSRF via admin/index.php?module=send\_ssh, as demonstrated by executi (no CVSS)
- [CVE-2018-18773](https://cve.now/CVE-2018-18773.md): CentOS-WebPanel.com (aka CWP) CentOS Web Panel through 0.9.8.740 allows CSRF via admin/index.php?module=rootpwd, as demonstrated by changing (no CVSS)
- [CVE-2018-18774](https://cve.now/CVE-2018-18774.md): CentOS-WebPanel.com (aka CWP) CentOS Web Panel through 0.9.8.740 allows XSS via the admin/index.php module parameter. (no CVSS)
- [CVE-2018-18856](https://cve.now/CVE-2018-18856.md): Multiple local privilege escalation vulnerabilities have been identified in the LiquidVPN client through 1.37 for macOS. (no CVSS)
- [CVE-2018-18857](https://cve.now/CVE-2018-18857.md): Multiple local privilege escalation vulnerabilities have been identified in the LiquidVPN client through 1.37 for macOS. (no CVSS)
- [CVE-2018-18858](https://cve.now/CVE-2018-18858.md): Multiple local privilege escalation vulnerabilities have been identified in the LiquidVPN client through 1.37 for macOS. (no CVSS)
- [CVE-2018-18859](https://cve.now/CVE-2018-18859.md): Multiple local privilege escalation vulnerabilities have been identified in the LiquidVPN client through 1.37 for macOS. (no CVSS)
- [CVE-2018-18861](https://cve.now/CVE-2018-18861.md): Buffer overflow in PCMan FTP Server 2.0.7 allows for remote code execution via the APPE command. (no CVSS)
- [CVE-2018-18864](https://cve.now/CVE-2018-18864.md): Loadbalancer.org Enterprise VA MAX before 8.3.3 has XSS because Apache HTTP Server logs are displayed. (no CVSS)
- [CVE-2018-18865](https://cve.now/CVE-2018-18865.md): The Royal browser extensions TS before 4.3.60728 (Release Date 2018-07-28) and TSX before 3.3.1 (Release Date 2018-09-13) allow Credentials (no CVSS)
- [CVE-2018-17948](https://cve.now/CVE-2018-17948.md): An open redirect vulnerability exists in the Access Manager Identity Provider prior to 4.4 SP3. (no CVSS, Access Manager)
- [CVE-2018-1779](https://cve.now/CVE-2018-1779.md): IBM API Connect 2018.1 through 2018.3.7 could allow an unauthenticated attacker to cause a denial of service due to not setting limits on JS (CVSS 7.5, IBM API Connect)
- [CVE-2018-10099](https://cve.now/CVE-2018-10099.md): Google Monorail before 2018-04-04 has a Cross-Site Search (XS-Search) vulnerability because CSV downloads are affected by CSRF, and calculat (no CVSS)
- [CVE-2018-19334](https://cve.now/CVE-2018-19334.md): Google Monorail before 2018-05-04 has a Cross-Site Search (XS-Search) vulnerability because CSV downloads are affected by CSRF, and calculat (no CVSS)
- [CVE-2018-19335](https://cve.now/CVE-2018-19335.md): Google Monorail before 2018-06-07 has a Cross-Site Search (XS-Search) vulnerability because CSV downloads are affected by CSRF, and calculat (no CVSS)
- [CVE-2018-19367](https://cve.now/CVE-2018-19367.md): Portainer through 1.19.2 provides an API endpoint (/api/users/admin/check) to verify that the admin user is already created. (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2018-11-20
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.