CVEs published November 27, 2018
96 CVEs were published on November 27, 2018: 0 critical, 2 high.
- Published
- 96
- Critical
- 0
- High
- 2
- Medium
- 1
- Low
- 0
- Unrated
- 93
- Now in CISA KEV
- 0
- Fix available
- 11
Most affected products
- Lenovo ThinkSystem SMM
- 9
- Huawei Technologies Co. eSpace
- 3
- NUUO CMS
- 3
- Nvidia GeForce Experience
- 3
- QNAP Systems QTS
- 2
- Apache Software Foundation Apache Hadoop · org.apache.hadoo…
- 1
- CyberSecurity Philippines - CERT UmbracoCMS · umbraco
- 1
- Fortinet FortiOS
- 1
- Huawei Technologies Co. Emily-AL00A
- 1
- Huawei Technologies Co. FusionSphere OpenStack
- 1
High 2
Medium, low and unrated 94
- CVE-2018-7946There is an information leak vulnerability in some Huawei smartphones.Huawei Technologies Co. Huawei Honor 7A, Huawei Honor 9 Lite
- CVE-2018-7958There is an anonymous TLS cipher suites supported vulnerability in Huawei eSpace product.Huawei Technologies Co. eSpace
- CVE-2018-7959There is a short key vulnerability in Huawei eSpace product.Huawei Technologies Co. eSpace
- CVE-2018-7960There is a SRTP icon display vulnerability in Huawei eSpace product.Huawei Technologies Co. eSpace
- CVE-2018-7961There is a smart SMS verification code vulnerability in some Huawei smart phones.Huawei Technologies Co. Emily-AL00A
- CVE-2018-7977There is an information leakage vulnerability on several Huawei products.Huawei Technologies Co. FusionSphere OpenStack
- CVE-2018-7988There is a Factory Reset Protection (FRP) bypass vulnerability on several smartphones.Huawei Technologies Co. Huawei nova 2 Plus, Huawei Mate9 Pro
- CVE-2018-0719Security Advisory for Vulnerabilities in QTSQNAP Systems QTS
- CVE-2018-10142The Expedition Migration tool 1.0.106 and earlier may allow an unauthenticated attacker to enumerate files on the operating system.Palo Alto Networks Expedition
- CVE-2018-13022Cross-site scripting vulnerability in the API 404 page on Xiaomi Mi Router 3 version 2.22.15 allows attackers to execute arbitrary JavaScrip
- CVE-2018-13023System command injection vulnerability in wifi_access in Xiaomi Mi Router 3 version 2.22.15 allows attackers to execute system commands via
- CVE-2018-13306System command injection in formDlna in TOTOLINK A3002RU version 1.0.8 allows attackers to execute system commands via the "ftpUser" POST pa
- CVE-2018-13307System command injection in fromNtp in TOTOLINK A3002RU version 1.0.8 allows attackers to execute system commands via the "ntpServerIp2" POS
- CVE-2018-13314System command injection in formAliasIp in TOTOLINK A3002RU version 1.0.8 allows attackers to execute system commands via the "ipAddr" POST
- CVE-2018-13316System command injection in formAliasIp in TOTOLINK A3002RU version 1.0.8 allows attackers to execute system commands via the "subnet" POST
- CVE-2018-13329Cross-site scripting in ajaxdata.php in TerraMaster TOS version 3.1.03 allows attackers to execute JavaScript via the "lines" URL parameter.
- CVE-2018-13330System command injection in ajaxdata.php in TerraMaster TOS version 3.1.03 allows attackers to execute system commands during group creation
- CVE-2018-13331Cross-site scripting in Control Panel in TerraMaster TOS version 3.1.03 allows attackers to execute JavaScript when viewing users by placing
- CVE-2018-13332Directory Traversal in the explorer application in TerraMaster TOS version 3.1.03 allows attackers to upload files to arbitrary locations vi
- CVE-2018-13333Cross-site scripting in File Manager in TerraMaster TOS version 3.1.03 allows attackers to execute JavaScript in the permissions window by p
- CVE-2018-13334Cross-site scripting in handle.php in TerraMaster TOS version 3.1.03 allows attackers to execute JavaScript via the "options[sysname]" param
- CVE-2018-13335Cross-site scripting in Control Panel in TerraMaster TOS version 3.1.03 allows attackers to execute JavaScript when viewing shared folders v
- CVE-2018-13336System command injection in ajaxdata.php in TerraMaster TOS version 3.1.03 allows attackers to execute system commands via the "pwd" paramet
- CVE-2018-13337Session Fixation in the web application for TerraMaster TOS version 3.1.03 allows attackers to control users' session cookies via JavaScript
- CVE-2018-13338System command injection in ajaxdata.php in TerraMaster TOS version 3.1.03 allows attackers to execute system commands via the "username" pa
- CVE-2018-13349Cross-site scripting in the web application taskbar in TerraMaster TOS version 3.1.03 allows attackers to execute JavaScript via the user's
- CVE-2018-13350SQL injection in logtable.php in TerraMaster TOS version 3.1.03 allows attackers to execute SQL queries via the "Event" parameter.
- CVE-2018-13351Cross-site scripting in Control Panel in TerraMaster TOS version 3.1.03 allows attackers to execute JavaScript via the edit password form.
- CVE-2018-13352Session Exposure in the web application for TerraMaster TOS version 3.1.03 allows attackers to view active session tokens in a world-readabl
- CVE-2018-13353System command injection in ajaxdata.php in TerraMaster TOS version 3.1.03 allows attackers to execute commands via the "checkport" paramete
- CVE-2018-13354System command injection in logtable.php in TerraMaster TOS version 3.1.03 allows attackers to execute system commands via the "Event" param
- CVE-2018-13355Incorrect access controls in ajaxdata.php in TerraMaster TOS version 3.1.03 allow attackers to create user groups without proper authorizati
- CVE-2018-13356Incorrect access control on ajaxdata.php in TerraMaster TOS version 3.1.03 allows attackers to elevate user permissions.
- CVE-2018-13357Cross-site scripting in Control Panel in TerraMaster TOS version 3.1.03 allows attackers to execute JavaScript when viewing Shared Folders v
- CVE-2018-13358System command injection in ajaxdata.php in TerraMaster TOS version 3.1.03 allows attackers to execute system commands via the "checkName" p
- CVE-2018-13359Cross-site scripting in usertable.php in TerraMaster TOS version 3.1.03 allows attackers to execute JavaScript via the "modgroup" parameter.
- CVE-2018-13360Cross-site scripting in Text Editor in TerraMaster TOS version 3.1.03 allows attackers to execute JavaScript via the "filename" URL paramete
- CVE-2018-13361User enumeration in usertable.php in TerraMaster TOS version 3.1.03 allows attackers to list all system users via the "modgroup" parameter.
- CVE-2018-13418System command injection in ajaxdata.php in TerraMaster TOS 3.1.03 allows attackers to execute system commands via the "newname" parameter.
- CVE-2018-14892Missing protections against Cross-Site Request Forgery in the web application in ZyXEL NSA325 V2 version 4.81 allow attackers to perform sta
- CVE-2018-14893A system command injection vulnerability in zyshclient in ZyXEL NSA325 V2 version 4.81 allows attackers to execute system commands via the w
- CVE-2018-16130System command injection in request_mitv in Xiaomi Mi Router 3 version 2.22.15 allows attackers to execute arbitrary system commands via the
- CVE-2018-17256Persistent cross-site scripting (XSS) vulnerability in Umbraco CMS 7.12.3 allows authenticated users to inject arbitrary web script via the CyberSecurity Philippines - CERT UmbracoCMS · umbraco
- CVE-2018-17934NUUO CMS All versions 3.3 and prior the application allows external input to construct a pathname that is able to be resolved outside the inNUUO CMS
- CVE-2018-17936NUUO CMS All versions 3.3 and prior the application allows the upload of arbitrary files that can modify or overwrite configuration files toNUUO CMS
- CVE-2018-18982NUUO CMS All versions 3.3 and prior the web server application allows injection of arbitrary SQL characters, which can be used to inject SQLNUUO CMS
- CVE-2017-11078In all android releases(Android for MSM, Firefox OS for MSM, QRD Android) from CAF using the linux kernel, while processing the boot image h
- CVE-2018-11260In all android releases(Android for MSM, Firefox OS for MSM, QRD Android) from CAF using the linux kernel, while processing a fast Initial l
- CVE-2018-11261In all android releases(Android for MSM, Firefox OS for MSM, QRD Android) from CAF using the linux kernel, there is a possible Use-after-fre
- CVE-2018-11266In all android releases(Android for MSM, Firefox OS for MSM, QRD Android) from CAF using the linux kernel, improper input validation can lea
- CVE-2018-11823In all android releases(Android for MSM, Firefox OS for MSM, QRD Android) from CAF using the linux kernel, freeing device memory in driver p
- CVE-2018-11906In all android releases(Android for MSM, Firefox OS for MSM, QRD Android) from CAF using the linux kernel, there is a security concern with
- CVE-2018-11907In all android releases(Android for MSM, Firefox OS for MSM, QRD Android) from CAF using the linux kernel, improper access control can lead
- CVE-2018-11908In all android releases(Android for MSM, Firefox OS for MSM, QRD Android) from CAF using the linux kernel, improper access control can lead
- CVE-2018-11909In all android releases(Android for MSM, Firefox OS for MSM, QRD Android) from CAF using the linux kernel, improper access control can lead
- CVE-2018-11910In all android releases(Android for MSM, Firefox OS for MSM, QRD Android) from CAF using the linux kernel, improper access control can lead
- CVE-2018-11911In all android releases(Android for MSM, Firefox OS for MSM, QRD Android) from CAF using the linux kernel, improper configuration of script
- CVE-2018-11912In all android releases(Android for MSM, Firefox OS for MSM, QRD Android) from CAF using the linux kernel, improper configuration of daemons
- CVE-2018-11913In all android releases(Android for MSM, Firefox OS for MSM, QRD Android) from CAF using the linux kernel, improper configuration of dev nod
- CVE-2018-11914In all android releases(Android for MSM, Firefox OS for MSM, QRD Android) from CAF using the linux kernel, improper access control can lead
- CVE-2018-11918In all android releases(Android for MSM, Firefox OS for MSM, QRD Android) from CAF using the linux kernel, memory allocated is automatically
- CVE-2018-11919In all android releases(Android for MSM, Firefox OS for MSM, QRD Android) from CAF using the linux kernel, there is a potential heap overflo
- CVE-2018-11943In all android releases(Android for MSM, Firefox OS for MSM, QRD Android) from CAF using the linux kernel, while processing fastboot flash c
- CVE-2018-11946In all android releases(Android for MSM, Firefox OS for MSM, QRD Android) from CAF using the linux kernel, the UPnP daemon should not be run
- CVE-2018-11956In all android releases(Android for MSM, Firefox OS for MSM, QRD Android) from CAF using the linux kernel, improper mounting lead to device
- CVE-2018-11995In all android releases(Android for MSM, Firefox OS for MSM, QRD Android) from CAF using the linux kernel, a partition name-check variable i
- CVE-2018-12241The Symantec Security Analytics (SA) 7.x prior to 7.3.4 Web UI is susceptible to a reflected cross-site scripting (XSS) vulnerability.Symantec Security Analytics
- CVE-2018-5856In all android releases(Android for MSM, Firefox OS for MSM, QRD Android) from CAF using the linux kernel, due to a race condition, a Use Af
- CVE-2018-5861In all android releases(Android for MSM, Firefox OS for MSM, QRD Android) from CAF using the linux kernel, existing checks in place on parti
- CVE-2018-5904In all android releases(Android for MSM, Firefox OS for MSM, QRD Android) from CAF using the linux kernel, while list traversal in LPM statu
- CVE-2018-5906In all android releases(Android for MSM, Firefox OS for MSM, QRD Android) from CAF using the linux kernel, there is a possible buffer overfl
- CVE-2018-5908In all android releases(Android for MSM, Firefox OS for MSM, QRD Android) from CAF using the linux kernel, there is a possible buffer overfl
- CVE-2018-5909In all android releases(Android for MSM, Firefox OS for MSM, QRD Android) from CAF using the linux kernel, buffer overflow occur may occur i
- CVE-2018-5910In all android releases(Android for MSM, Firefox OS for MSM, QRD Android) from CAF using the linux kernel, a memory corruption can occur in
- CVE-2018-5919In all android releases(Android for MSM, Firefox OS for MSM, QRD Android) from CAF using the linux kernel, a use after free issue in WLAN ho
- CVE-2018-6263NVIDIA GeForce Experience contains a vulnerability in all versions prior to 3.16 on Windows in which an attacker who has access to a local uNvidia GeForce Experience
- CVE-2018-6265NVIDIA GeForce Experience contains a vulnerability in all versions prior to 3.16 during application installation on Windows 7 in elevated prNvidia GeForce Experience
- CVE-2018-6266NVIDIA GeForce Experience contains a vulnerability in all versions prior to 3.16 on Windows where a local user may obtain third party integrNvidia GeForce Experience
- CVE-2018-6983VMware Workstation (15.x before 15.0.2 and 14.x before 14.1.5) and Fusion (11.x before 11.0.2 and 10.x before 10.1.5) contain an integer oveVMware Workstation and Fusion
- CVE-2018-19609ShowDoc 2.4.1 allows remote attackers to obtain sensitive information by navigating with a modified page_id, as demonstrated by reading noteshowdoc/showdoc
- CVE-2018-13376An uninitialized memory buffer leak exists in Fortinet FortiOS 5.6.1 to 5.6.3, 5.4.6 to 5.4.7, 5.2 all versions under web proxy's disclaimerFortinet FortiOS
- CVE-2018-11766In Apache Hadoop 2.7.4 to 2.7.6, the security fix for CVE-2016-6811 is incomplete.Apache Software Foundation Apache Hadoop · org.apache.hadoo…
- CVE-2018-16089System Management Module VulnerabilitiesLenovo ThinkSystem SMM
- CVE-2018-16090System Management Module VulnerabilitiesLenovo ThinkSystem SMM
- CVE-2018-16091System Management Module VulnerabilitiesLenovo ThinkSystem SMM
- CVE-2018-16092System Management Module VulnerabilitiesLenovo ThinkSystem SMM
- CVE-2018-16094System Management Module VulnerabilitiesLenovo ThinkSystem SMM
- CVE-2018-16095System Management Module VulnerabilitiesLenovo ThinkSystem SMM
- CVE-2018-16096System Management Module VulnerabilitiesLenovo ThinkSystem SMM
- CVE-2018-9083System Management Module VulnerabilitiesLenovo ThinkSystem SMM
- CVE-2018-9084System Management Module VulnerabilitiesLenovo ThinkSystem SMM
- CVE-2018-19587In Cesanta Mongoose 6.13, a SIGSEGV exists in the mongoose.c mg_mqtt_add_session() function.
- CVE-2018-19595PbootCMS V1.3.1 build 2018-11-14 allows remote attackers to execute arbitrary code via use of "eval" with mixed case, as demonstrated by an
- CVE-2018-19607Exiv2::isoSpeed in easyaccess.cpp in Exiv2 v0.27-RC2 allows remote attackers to cause a denial of service (NULL pointer dereference and appl