# CVEs published 2018-11-21

15 CVEs were published on November 21, 2018: 1 critical, 0 high. 1 is now in CISA KEV. Days are UTC.

- [CVE-2018-19420](https://cve.now/CVE-2018-19420.md): In GetSimpleCMS 3.3.15, admin/upload.php blocks .html uploads but there are several alternative cases in which HTML can be executed, such as (no CVSS)
- [CVE-2018-19421](https://cve.now/CVE-2018-19421.md): In GetSimpleCMS 3.3.15, admin/upload.php blocks .html uploads but Internet Explorer render HTML elements in a .eml file, because of admin/up (no CVSS)
- [CVE-2018-19423](https://cve.now/CVE-2018-19423.md): Codiad 2.8.4 allows remote authenticated administrators to execute arbitrary code by uploading an executable file. (no CVSS)
- [CVE-2018-19424](https://cve.now/CVE-2018-19424.md): ClipperCMS 1.3.3 allows remote authenticated administrators to upload .htaccess files. (no CVSS)
- [CVE-2018-19416](https://cve.now/CVE-2018-19416.md): An issue was discovered in sysstat 12.1.1. (no CVSS)
- [CVE-2018-19417](https://cve.now/CVE-2018-19417.md): An issue was discovered in the MQTT server in Contiki-NG before 4.2. (no CVSS)
- [CVE-2018-19409](https://cve.now/CVE-2018-19409.md): An issue was discovered in Artifex Ghostscript before 9.26. (no CVSS)
- [CVE-2018-19410](https://cve.now/CVE-2018-19410.md): PRTG Network Monitor before 18.2.40.1683 allows remote unauthenticated attackers to create users with read-write privileges (including admin (CVSS 9.8, KEV)
- [CVE-2018-19411](https://cve.now/CVE-2018-19411.md): PRTG Network Monitor before 18.2.40.1683 allows an authenticated user with a read-only account to create another user with a read-write acco (no CVSS)
- [CVE-2009-5153](https://cve.now/CVE-2009-5153.md): In Novell NetWare before 6.5 SP8, a stack buffer overflow in processing of CALLIT RPC calls in the NFS Portmapper daemon in PKERNEL.NLM allo (no CVSS)
- [CVE-2018-1843](https://cve.now/CVE-2018-1843.md): The Identity and Access Management (IAM) services (IBM Cloud Private 3.1.0) do not use a secure channel, such as SSL, to exchange informatio (CVSS 4.1, IBM Cloud Private)
- [CVE-2018-19404](https://cve.now/CVE-2018-19404.md): In YXcms 1.4.7, protected/apps/appmanage/controller/indexController.php allow remote authenticated Administrators to execute any PHP code by (no CVSS)
- [CVE-2018-19406](https://cve.now/CVE-2018-19406.md): kvm\_pv\_send\_ipi in arch/x86/kvm/lapic.c in the Linux kernel through 4.19.2 allows local users to cause a denial of service (NULL pointer der (no CVSS)
- [CVE-2018-19407](https://cve.now/CVE-2018-19407.md): The vcpu\_scan\_ioapic function in arch/x86/kvm/x86.c in the Linux kernel through 4.19.2 allows local users to cause a denial of service (NULL (no CVSS)
- [CVE-2018-19422](https://cve.now/CVE-2018-19422.md): /panel/uploads in Subrion CMS 4.2.1 allows remote attackers to execute arbitrary PHP code via a .pht or .phar file, because the .htaccess fi (no CVSS, intelliants/subrion)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2018-11-21
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.