# CVEs published 2018-11-23

13 CVEs were published on November 23, 2018: 0 critical, 0 high. Days are UTC.

- [CVE-2018-19499](https://cve.now/CVE-2018-19499.md): Vanilla before 2.5.5 and 2.6.x before 2.6.2 allows Remote Code Execution because authenticated administrators have a reachable call to unser (no CVSS)
- [CVE-2018-19502](https://cve.now/CVE-2018-19502.md): An issue was discovered in Freeware Advanced Audio Decoder 2 (FAAD2) 2.8.1. (no CVSS)
- [CVE-2018-19503](https://cve.now/CVE-2018-19503.md): An issue was discovered in Freeware Advanced Audio Decoder 2 (FAAD2) 2.8.1. (no CVSS)
- [CVE-2018-19504](https://cve.now/CVE-2018-19504.md): An issue was discovered in Freeware Advanced Audio Decoder 2 (FAAD2) 2.8.1. (no CVSS)
- [CVE-2018-19490](https://cve.now/CVE-2018-19490.md): An issue was discovered in datafile.c in Gnuplot 5.2.5. (no CVSS)
- [CVE-2018-19491](https://cve.now/CVE-2018-19491.md): An issue was discovered in post.trm in Gnuplot 5.2.5. (no CVSS)
- [CVE-2018-19492](https://cve.now/CVE-2018-19492.md): An issue was discovered in cairo.trm in Gnuplot 5.2.5. (no CVSS)
- [CVE-2018-19486](https://cve.now/CVE-2018-19486.md): Git before 2.19.2 on Linux and UNIX executes commands from the current working directory (as if '.' were at the end of $PATH) in certain cas (no CVSS)
- [CVE-2018-19468](https://cve.now/CVE-2018-19468.md): HuCart 5.7.4 has SQL injection in get\_ip() in system/class/helper\_class.php via the X-Forwarded-For HTTP header to the user/index.php?load=l (no CVSS)
- [CVE-2018-19469](https://cve.now/CVE-2018-19469.md): ArticleCMS through 2017-02-19 has XSS via the /update\_personal\_infomation realname or email parameter. (no CVSS)
- [CVE-2018-19475](https://cve.now/CVE-2018-19475.md): psi/zdevice2.c in Artifex Ghostscript before 9.26 allows remote attackers to bypass intended access restrictions because available stack spa (no CVSS)
- [CVE-2018-19476](https://cve.now/CVE-2018-19476.md): psi/zicc.c in Artifex Ghostscript before 9.26 allows remote attackers to bypass intended access restrictions because of a setcolorspace type (no CVSS)
- [CVE-2018-19477](https://cve.now/CVE-2018-19477.md): psi/zfjbig2.c in Artifex Ghostscript before 9.26 allows remote attackers to bypass intended access restrictions because of a JBIG2Decode typ (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2018-11-23
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.