CVEs published November 26, 2018
60 CVEs were published on November 26, 2018: 0 critical, 2 high.
- Published
- 60
- Critical
- 0
- High
- 2
- Medium
- 5
- Low
- 0
- Unrated
- 53
- Now in CISA KEV
- 0
- Fix available
- 1
Most affected products
- Dell EMC Avamar · Dell EMC Integrated Data Protection Appli…
- 4
- [UNKNOWN] kernel:
- 2
- [UNKNOWN] dnsdist
- 1
- [UNKNOWN] moodle · moodle/moodle
- 1
- IBM Integration Bus · IBM WebSphere Message Broker
- 1
- IBM WebSphere Application Server
- 1
- TIBCO Software TIBCO Statistica Server
- 1
High 2
Medium, low and unrated 58
- CVE-2018-13308Cross-site scripting in notice_gen.htm in TOTOLINK A3002RU version 1.0.8 allows attackers to execute arbitrary JavaScript by modifying the "
- CVE-2018-13309Cross-site scripting in password.htm in TOTOLINK A3002RU version 1.0.8 allows attackers to execute arbitrary JavaScript via the user's passw
- CVE-2018-13310Cross-site scripting in password.htm in TOTOLINK A3002RU version 1.0.8 allows attackers to execute arbitrary JavaScript via the user's usern
- CVE-2018-13311System command injection in formDlna in TOTOLINK A3002RU version 1.0.8 allows attackers to execute system commands via the "sambaUser" POST
- CVE-2018-13312Cross-site scripting in notice_gen.htm in TOTOLINK A3002RU version 1.0.8 allows attackers to execute arbitrary JavaScript by modifying the "
- CVE-2018-13315Incorrect access control in formPasswordSetup in TOTOLINK A3002RU version 1.0.8 allows attackers to change the admin user's password via an
- CVE-2018-13317Password disclosure in password.htm in TOTOLINK A3002RU version 1.0.8 allows attackers to obtain the plaintext password for the admin user b
- CVE-2018-13318System command injection in User.create method in Buffalo TS5600D1206 version 3.61-0.10 allows attackers to execute system commands via the
- CVE-2018-13319Incorrect access control in get_portal_info in Buffalo TS5600D1206 version 3.61-0.10 allows attackers to determine sensitive device informat
- CVE-2018-13320System Command Injection in network.set_auth_settings in Buffalo TS5600D1206 version 3.70-0.10 allows attackers to execute system commands v
- CVE-2018-13321Incorrect access controls in nasapi in Buffalo TS5600D1206 version 3.61-0.10 allow attackers to call dangerous internal functions via the "m
- CVE-2018-13322Directory traversal in list_folders method in Buffalo TS5600D1206 version 3.61-0.10 allows attackers to list directory contents via the "pat
- CVE-2018-13323Cross-site scripting in detail.html in Buffalo TS5600D1206 version 3.61-0.10 allows attackers to execute JavaScript via the "username" cooki
- CVE-2018-13324Incorrect access control in nasapi in Buffalo TS5600D1206 version 3.61-0.10 allows attackers to bypass authentication by sending a modified
- CVE-2018-14663An issue has been found in PowerDNS DNSDist before 1.3.3 allowing a remote attacker to craft a DNS query with trailing data such that the ad[UNKNOWN] dnsdist
- CVE-2018-11066Dell EMC Avamar and Integrated Data Protection Appliance Remote Code Execution VulnerabilityDell EMC Avamar · Dell EMC Integrated Data Protection Appli…
- CVE-2018-11067Dell EMC Avamar and Integrated Data Protection Appliance Open Redirection VulnerabilityDell EMC Avamar · Dell EMC Integrated Data Protection Appli…
- CVE-2018-11076Dell EMC Avamar and Integrated Data Protection Appliance Information Exposure VulnerabilityDell EMC Avamar · Dell EMC Integrated Data Protection Appli…
- CVE-2018-11077Dell EMC Avamar and Integrated Data Protection Appliance Command Injection VulnerabilityDell EMC Avamar · Dell EMC Integrated Data Protection Appli…
- CVE-2018-19565A buffer over-read in crop_masked_pixels in dcraw through 9.28 could be used by attackers able to supply malicious files to crash an applica
- CVE-2018-19566A heap buffer over-read in parse_tiff_ifd in dcraw through 9.28 could be used by attackers able to supply malicious files to crash an applic
- CVE-2018-19567A floating point exception in parse_tiff_ifd in dcraw through 9.28 could be used by attackers able to supply malicious files to crash an app
- CVE-2018-19568A floating point exception in kodak_radc_load_raw in dcraw through 9.28 could be used by attackers able to supply malicious files to crash a
- CVE-2018-14646The Linux kernel before 4.15-rc8 was found to be vulnerable to a NULL pointer dereference bug in the __netlink_ns_capable() function in the [UNKNOWN] kernel:
- CVE-2018-16862A security flaw was found in the Linux kernel in a way that the cleancache subsystem clears an inode after the final file truncation (remova[UNKNOWN] kernel:
- CVE-2018-19564Stored XSS was discovered in the Easy Testimonials plugin 3.2 for WordPress.
- CVE-2017-1418IBM Integration Bus 9.0.0.0, 9.0.0.11, 10.0.0.0, and 10.0.0.14 (including IBM WebSphere Message Broker 8.0.0.0 and 8.0.0.9) has insecure perIBM Integration Bus · IBM WebSphere Message Broker
- CVE-2018-16854A flaw was found in moodle versions 3.5 to 3.5.2, 3.4 to 3.4.5, 3.3 to 3.3.8, 3.1 to 3.1.14 and earlier.[UNKNOWN] moodle · moodle/moodle
- CVE-2018-19544JEECMS 9.3 has CSRF via the api/admin/content/save URI to add news.
- CVE-2018-19545JEECMS 9.3 has CSRF via the api/admin/role/save URI to add a user.
- CVE-2018-19546JTBC(PHP) 3.0.1.7 has CSRF via the console/xml/manage.php?type=action&action=edit URI, as demonstrated by an XSS payload in the content para
- CVE-2018-19547JTBC(PHP) 3.0.1.7 has XSS via the console/xml/manage.php?type=action&action=edit content parameter.
- CVE-2018-19548index.php?r=site%2Flogin in EduSec through 4.2.6 does not restrict sending a series of LoginForm[username] and LoginForm[password] parameter
- CVE-2018-19549Interspire Email Marketer through 6.1.6 has SQL Injection via a tagids Delete action to Dynamiccontenttags.php.
- CVE-2018-19550Interspire Email Marketer through 6.1.6 allows arbitrary file upload via a surveys_submit.php "create survey and submit survey" operation, w
- CVE-2018-19551Interspire Email Marketer through 6.1.6 has SQL Injection via a checkduplicatetags tagname request to Dynamiccontenttags.php.
- CVE-2018-19552Interspire Email Marketer through 6.1.6 has SQL Injection via a deleteblock blockid[] request to Dynamiccontenttags.php.
- CVE-2018-19553Interspire Email Marketer through 6.1.6 has SQL Injection via an updateblock sortorder request to Dynamiccontenttags.php
- CVE-2018-19554An issue was discovered in Dotcms through 5.0.3.
- CVE-2018-19555tp4a TELEPORT 3.1.0 has CSRF via user/do-reset-password to change any password, such as the administrator password.
- CVE-2018-19556zb_system/admin/index.php?act=UploadMng in Z-BlogPHP 1.5 mishandles file preview, leading to content spoofing.
- CVE-2018-19557An issue was discovered in arcms through 2018-03-19.
- CVE-2018-19558An issue was discovered in arcms through 2018-03-19.
- CVE-2018-19559CuppaCMS before 2018-11-12 has SQL Injection in administrator/classes/ajax/functions.php via the reference_id parameter.
- CVE-2018-19560BageCMS 3.1.3 has CSRF via upload/index.php?r=admini/admin/ownerUpdate to modify a user account.
- CVE-2018-19561sikcms 1.1 has CSRF via admin.php?m=Admin&c=Users&a=userAdd to add an administrator account.
- CVE-2018-19562An issue was discovered in PHPok 4.9.015.
- CVE-2018-19537TP-Link Archer C5 devices through V2_160201_US allow remote command execution via shell metacharacters on the wan_dyn_hostname line of a con
- CVE-2018-19539An issue was discovered in JasPer 2.0.14.
- CVE-2018-19540An issue was discovered in JasPer 1.900.8, 1.900.9, 1.900.10, 1.900.11, 1.900.12, 1.900.13, 1.900.14, 1.900.15, 1.900.16, 1.900.17, 1.900.18
- CVE-2018-19541An issue was discovered in JasPer 1.900.8, 1.900.9, 1.900.10, 1.900.11, 1.900.12, 1.900.13, 1.900.14, 1.900.15, 1.900.16, 1.900.17, 1.900.18
- CVE-2018-19542An issue was discovered in JasPer 2.0.14.
- CVE-2018-19543An issue was discovered in JasPer 2.0.14.
- CVE-2018-19528TP-Link TL-WR886N 7.0 1.1.0 devices allow remote attackers to cause a denial of service (Tlb Load Exception) via crafted DNS packets to port
- CVE-2018-19530HTTL (aka Hyper-Text Template Language) through 1.0.11 allows remote command execution because the decodeXml function uses XStream unsafely
- CVE-2018-19531HTTL (aka Hyper-Text Template Language) through 1.0.11 allows remote command execution because the decodeXml function uses java.beans.XMLEnc
- CVE-2018-19532A NULL pointer dereference vulnerability exists in the function PdfTranslator::setTarget() in pdftranslator.cpp of PoDoFo 0.9.6, while creat
- CVE-2018-19535In Exiv2 0.26 and previous versions, PngChunk::readRawProfile in pngchunk_int.cpp may cause a denial of service (application crash due to a