# CVEs published 2018-11-27

96 CVEs were published on November 27, 2018: 0 critical, 2 high. Days are UTC.

- [CVE-2018-0721](https://cve.now/CVE-2018-0721.md): Security Advisory for Vulnerabilities in QTS (CVSS 7.7, QNAP Systems QTS)
- [CVE-2018-7946](https://cve.now/CVE-2018-7946.md): There is an information leak vulnerability in some Huawei smartphones. (no CVSS, Huawei Technologies Co. Huawei Honor 7A, Huawei Honor 9 Lite)
- [CVE-2018-7958](https://cve.now/CVE-2018-7958.md): There is an anonymous TLS cipher suites supported vulnerability in Huawei eSpace product. (no CVSS, Huawei Technologies Co. eSpace)
- [CVE-2018-7959](https://cve.now/CVE-2018-7959.md): There is a short key vulnerability in Huawei eSpace product. (no CVSS, Huawei Technologies Co. eSpace)
- [CVE-2018-7960](https://cve.now/CVE-2018-7960.md): There is a SRTP icon display vulnerability in Huawei eSpace product. (no CVSS, Huawei Technologies Co. eSpace)
- [CVE-2018-7961](https://cve.now/CVE-2018-7961.md): There is a smart SMS verification code vulnerability in some Huawei smart phones. (no CVSS, Huawei Technologies Co. Emily-AL00A)
- [CVE-2018-7977](https://cve.now/CVE-2018-7977.md): There is an information leakage vulnerability on several Huawei products. (no CVSS, Huawei Technologies Co. FusionSphere OpenStack)
- [CVE-2018-7988](https://cve.now/CVE-2018-7988.md): There is a Factory Reset Protection (FRP) bypass vulnerability on several smartphones. (no CVSS, Huawei Technologies Co. Huawei nova 2 Plus, Huawei Mate9 Pro)
- [CVE-2018-0719](https://cve.now/CVE-2018-0719.md): Security Advisory for Vulnerabilities in QTS (CVSS 5.5, QNAP Systems QTS)
- [CVE-2018-10142](https://cve.now/CVE-2018-10142.md): The Expedition Migration tool 1.0.106 and earlier may allow an unauthenticated attacker to enumerate files on the operating system. (no CVSS, Palo Alto Networks Expedition)
- [CVE-2018-13022](https://cve.now/CVE-2018-13022.md): Cross-site scripting vulnerability in the API 404 page on Xiaomi Mi Router 3 version 2.22.15 allows attackers to execute arbitrary JavaScrip (no CVSS)
- [CVE-2018-13023](https://cve.now/CVE-2018-13023.md): System command injection vulnerability in wifi\_access in Xiaomi Mi Router 3 version 2.22.15 allows attackers to execute system commands via (no CVSS)
- [CVE-2018-13306](https://cve.now/CVE-2018-13306.md): System command injection in formDlna in TOTOLINK A3002RU version 1.0.8 allows attackers to execute system commands via the "ftpUser" POST pa (no CVSS)
- [CVE-2018-13307](https://cve.now/CVE-2018-13307.md): System command injection in fromNtp in TOTOLINK A3002RU version 1.0.8 allows attackers to execute system commands via the "ntpServerIp2" POS (no CVSS)
- [CVE-2018-13314](https://cve.now/CVE-2018-13314.md): System command injection in formAliasIp in TOTOLINK A3002RU version 1.0.8 allows attackers to execute system commands via the "ipAddr" POST (no CVSS)
- [CVE-2018-13316](https://cve.now/CVE-2018-13316.md): System command injection in formAliasIp in TOTOLINK A3002RU version 1.0.8 allows attackers to execute system commands via the "subnet" POST (no CVSS)
- [CVE-2018-13329](https://cve.now/CVE-2018-13329.md): Cross-site scripting in ajaxdata.php in TerraMaster TOS version 3.1.03 allows attackers to execute JavaScript via the "lines" URL parameter. (no CVSS)
- [CVE-2018-13330](https://cve.now/CVE-2018-13330.md): System command injection in ajaxdata.php in TerraMaster TOS version 3.1.03 allows attackers to execute system commands during group creation (no CVSS)
- [CVE-2018-13331](https://cve.now/CVE-2018-13331.md): Cross-site scripting in Control Panel in TerraMaster TOS version 3.1.03 allows attackers to execute JavaScript when viewing users by placing (no CVSS)
- [CVE-2018-13332](https://cve.now/CVE-2018-13332.md): Directory Traversal in the explorer application in TerraMaster TOS version 3.1.03 allows attackers to upload files to arbitrary locations vi (no CVSS)
- [CVE-2018-13333](https://cve.now/CVE-2018-13333.md): Cross-site scripting in File Manager in TerraMaster TOS version 3.1.03 allows attackers to execute JavaScript in the permissions window by p (no CVSS)
- [CVE-2018-13334](https://cve.now/CVE-2018-13334.md): Cross-site scripting in handle.php in TerraMaster TOS version 3.1.03 allows attackers to execute JavaScript via the "options\[sysname\]" param (no CVSS)
- [CVE-2018-13335](https://cve.now/CVE-2018-13335.md): Cross-site scripting in Control Panel in TerraMaster TOS version 3.1.03 allows attackers to execute JavaScript when viewing shared folders v (no CVSS)
- [CVE-2018-13336](https://cve.now/CVE-2018-13336.md): System command injection in ajaxdata.php in TerraMaster TOS version 3.1.03 allows attackers to execute system commands via the "pwd" paramet (no CVSS)
- [CVE-2018-13337](https://cve.now/CVE-2018-13337.md): Session Fixation in the web application for TerraMaster TOS version 3.1.03 allows attackers to control users' session cookies via JavaScript (no CVSS)
- [CVE-2018-13338](https://cve.now/CVE-2018-13338.md): System command injection in ajaxdata.php in TerraMaster TOS version 3.1.03 allows attackers to execute system commands via the "username" pa (no CVSS)
- [CVE-2018-13349](https://cve.now/CVE-2018-13349.md): Cross-site scripting in the web application taskbar in TerraMaster TOS version 3.1.03 allows attackers to execute JavaScript via the user's (no CVSS)
- [CVE-2018-13350](https://cve.now/CVE-2018-13350.md): SQL injection in logtable.php in TerraMaster TOS version 3.1.03 allows attackers to execute SQL queries via the "Event" parameter. (no CVSS)
- [CVE-2018-13351](https://cve.now/CVE-2018-13351.md): Cross-site scripting in Control Panel in TerraMaster TOS version 3.1.03 allows attackers to execute JavaScript via the edit password form. (no CVSS)
- [CVE-2018-13352](https://cve.now/CVE-2018-13352.md): Session Exposure in the web application for TerraMaster TOS version 3.1.03 allows attackers to view active session tokens in a world-readabl (no CVSS)
- [CVE-2018-13353](https://cve.now/CVE-2018-13353.md): System command injection in ajaxdata.php in TerraMaster TOS version 3.1.03 allows attackers to execute commands via the "checkport" paramete (no CVSS)
- [CVE-2018-13354](https://cve.now/CVE-2018-13354.md): System command injection in logtable.php in TerraMaster TOS version 3.1.03 allows attackers to execute system commands via the "Event" param (no CVSS)
- [CVE-2018-13355](https://cve.now/CVE-2018-13355.md): Incorrect access controls in ajaxdata.php in TerraMaster TOS version 3.1.03 allow attackers to create user groups without proper authorizati (no CVSS)
- [CVE-2018-13356](https://cve.now/CVE-2018-13356.md): Incorrect access control on ajaxdata.php in TerraMaster TOS version 3.1.03 allows attackers to elevate user permissions. (no CVSS)
- [CVE-2018-13357](https://cve.now/CVE-2018-13357.md): Cross-site scripting in Control Panel in TerraMaster TOS version 3.1.03 allows attackers to execute JavaScript when viewing Shared Folders v (no CVSS)
- [CVE-2018-13358](https://cve.now/CVE-2018-13358.md): System command injection in ajaxdata.php in TerraMaster TOS version 3.1.03 allows attackers to execute system commands via the "checkName" p (no CVSS)
- [CVE-2018-13359](https://cve.now/CVE-2018-13359.md): Cross-site scripting in usertable.php in TerraMaster TOS version 3.1.03 allows attackers to execute JavaScript via the "modgroup" parameter. (no CVSS)
- [CVE-2018-13360](https://cve.now/CVE-2018-13360.md): Cross-site scripting in Text Editor in TerraMaster TOS version 3.1.03 allows attackers to execute JavaScript via the "filename" URL paramete (no CVSS)
- [CVE-2018-13361](https://cve.now/CVE-2018-13361.md): User enumeration in usertable.php in TerraMaster TOS version 3.1.03 allows attackers to list all system users via the "modgroup" parameter. (no CVSS)
- [CVE-2018-13418](https://cve.now/CVE-2018-13418.md): System command injection in ajaxdata.php in TerraMaster TOS 3.1.03 allows attackers to execute system commands via the "newname" parameter. (no CVSS)
- [CVE-2018-14892](https://cve.now/CVE-2018-14892.md): Missing protections against Cross-Site Request Forgery in the web application in ZyXEL NSA325 V2 version 4.81 allow attackers to perform sta (no CVSS)
- [CVE-2018-14893](https://cve.now/CVE-2018-14893.md): A system command injection vulnerability in zyshclient in ZyXEL NSA325 V2 version 4.81 allows attackers to execute system commands via the w (no CVSS)
- [CVE-2018-16130](https://cve.now/CVE-2018-16130.md): System command injection in request\_mitv in Xiaomi Mi Router 3 version 2.22.15 allows attackers to execute arbitrary system commands via the (no CVSS)
- [CVE-2018-17256](https://cve.now/CVE-2018-17256.md): Persistent cross-site scripting (XSS) vulnerability in Umbraco CMS 7.12.3 allows authenticated users to inject arbitrary web script via the (no CVSS, CyberSecurity Philippines - CERT UmbracoCMS · umbraco)
- [CVE-2018-17934](https://cve.now/CVE-2018-17934.md): NUUO CMS All versions 3.3 and prior the application allows external input to construct a pathname that is able to be resolved outside the in (no CVSS, NUUO CMS)
- [CVE-2018-17936](https://cve.now/CVE-2018-17936.md): NUUO CMS All versions 3.3 and prior the application allows the upload of arbitrary files that can modify or overwrite configuration files to (no CVSS, NUUO CMS)
- [CVE-2018-18982](https://cve.now/CVE-2018-18982.md): NUUO CMS All versions 3.3 and prior the web server application allows injection of arbitrary SQL characters, which can be used to inject SQL (no CVSS, NUUO CMS)
- [CVE-2017-11078](https://cve.now/CVE-2017-11078.md): In all android releases(Android for MSM, Firefox OS for MSM, QRD Android) from CAF using the linux kernel, while processing the boot image h (no CVSS)
- [CVE-2018-11260](https://cve.now/CVE-2018-11260.md): In all android releases(Android for MSM, Firefox OS for MSM, QRD Android) from CAF using the linux kernel, while processing a fast Initial l (no CVSS)
- [CVE-2018-11261](https://cve.now/CVE-2018-11261.md): In all android releases(Android for MSM, Firefox OS for MSM, QRD Android) from CAF using the linux kernel, there is a possible Use-after-fre (no CVSS)
- [CVE-2018-11266](https://cve.now/CVE-2018-11266.md): In all android releases(Android for MSM, Firefox OS for MSM, QRD Android) from CAF using the linux kernel, improper input validation can lea (no CVSS)
- [CVE-2018-11823](https://cve.now/CVE-2018-11823.md): In all android releases(Android for MSM, Firefox OS for MSM, QRD Android) from CAF using the linux kernel, freeing device memory in driver p (no CVSS)
- [CVE-2018-11906](https://cve.now/CVE-2018-11906.md): In all android releases(Android for MSM, Firefox OS for MSM, QRD Android) from CAF using the linux kernel, there is a security concern with (no CVSS)
- [CVE-2018-11907](https://cve.now/CVE-2018-11907.md): In all android releases(Android for MSM, Firefox OS for MSM, QRD Android) from CAF using the linux kernel, improper access control can lead (no CVSS)
- [CVE-2018-11908](https://cve.now/CVE-2018-11908.md): In all android releases(Android for MSM, Firefox OS for MSM, QRD Android) from CAF using the linux kernel, improper access control can lead (no CVSS)
- [CVE-2018-11909](https://cve.now/CVE-2018-11909.md): In all android releases(Android for MSM, Firefox OS for MSM, QRD Android) from CAF using the linux kernel, improper access control can lead (no CVSS)
- [CVE-2018-11910](https://cve.now/CVE-2018-11910.md): In all android releases(Android for MSM, Firefox OS for MSM, QRD Android) from CAF using the linux kernel, improper access control can lead (no CVSS)
- [CVE-2018-11911](https://cve.now/CVE-2018-11911.md): In all android releases(Android for MSM, Firefox OS for MSM, QRD Android) from CAF using the linux kernel, improper configuration of script (no CVSS)
- [CVE-2018-11912](https://cve.now/CVE-2018-11912.md): In all android releases(Android for MSM, Firefox OS for MSM, QRD Android) from CAF using the linux kernel, improper configuration of daemons (no CVSS)
- [CVE-2018-11913](https://cve.now/CVE-2018-11913.md): In all android releases(Android for MSM, Firefox OS for MSM, QRD Android) from CAF using the linux kernel, improper configuration of dev nod (no CVSS)
- [CVE-2018-11914](https://cve.now/CVE-2018-11914.md): In all android releases(Android for MSM, Firefox OS for MSM, QRD Android) from CAF using the linux kernel, improper access control can lead (no CVSS)
- [CVE-2018-11918](https://cve.now/CVE-2018-11918.md): In all android releases(Android for MSM, Firefox OS for MSM, QRD Android) from CAF using the linux kernel, memory allocated is automatically (no CVSS)
- [CVE-2018-11919](https://cve.now/CVE-2018-11919.md): In all android releases(Android for MSM, Firefox OS for MSM, QRD Android) from CAF using the linux kernel, there is a potential heap overflo (no CVSS)
- [CVE-2018-11943](https://cve.now/CVE-2018-11943.md): In all android releases(Android for MSM, Firefox OS for MSM, QRD Android) from CAF using the linux kernel, while processing fastboot flash c (no CVSS)
- [CVE-2018-11946](https://cve.now/CVE-2018-11946.md): In all android releases(Android for MSM, Firefox OS for MSM, QRD Android) from CAF using the linux kernel, the UPnP daemon should not be run (no CVSS)
- [CVE-2018-11956](https://cve.now/CVE-2018-11956.md): In all android releases(Android for MSM, Firefox OS for MSM, QRD Android) from CAF using the linux kernel, improper mounting lead to device (no CVSS)
- [CVE-2018-11995](https://cve.now/CVE-2018-11995.md): In all android releases(Android for MSM, Firefox OS for MSM, QRD Android) from CAF using the linux kernel, a partition name-check variable i (no CVSS)
- [CVE-2018-12241](https://cve.now/CVE-2018-12241.md): The Symantec Security Analytics (SA) 7.x prior to 7.3.4 Web UI is susceptible to a reflected cross-site scripting (XSS) vulnerability. (no CVSS, Symantec Security Analytics)
- [CVE-2018-5856](https://cve.now/CVE-2018-5856.md): In all android releases(Android for MSM, Firefox OS for MSM, QRD Android) from CAF using the linux kernel, due to a race condition, a Use Af (no CVSS)
- [CVE-2018-5861](https://cve.now/CVE-2018-5861.md): In all android releases(Android for MSM, Firefox OS for MSM, QRD Android) from CAF using the linux kernel, existing checks in place on parti (no CVSS)
- [CVE-2018-5904](https://cve.now/CVE-2018-5904.md): In all android releases(Android for MSM, Firefox OS for MSM, QRD Android) from CAF using the linux kernel, while list traversal in LPM statu (no CVSS)
- [CVE-2018-5906](https://cve.now/CVE-2018-5906.md): In all android releases(Android for MSM, Firefox OS for MSM, QRD Android) from CAF using the linux kernel, there is a possible buffer overfl (no CVSS)
- [CVE-2018-5908](https://cve.now/CVE-2018-5908.md): In all android releases(Android for MSM, Firefox OS for MSM, QRD Android) from CAF using the linux kernel, there is a possible buffer overfl (no CVSS)
- [CVE-2018-5909](https://cve.now/CVE-2018-5909.md): In all android releases(Android for MSM, Firefox OS for MSM, QRD Android) from CAF using the linux kernel, buffer overflow occur may occur i (no CVSS)
- [CVE-2018-5910](https://cve.now/CVE-2018-5910.md): In all android releases(Android for MSM, Firefox OS for MSM, QRD Android) from CAF using the linux kernel, a memory corruption can occur in (no CVSS)
- [CVE-2018-5919](https://cve.now/CVE-2018-5919.md): In all android releases(Android for MSM, Firefox OS for MSM, QRD Android) from CAF using the linux kernel, a use after free issue in WLAN ho (no CVSS)
- [CVE-2018-6263](https://cve.now/CVE-2018-6263.md): NVIDIA GeForce Experience contains a vulnerability in all versions prior to 3.16 on Windows in which an attacker who has access to a local u (no CVSS, Nvidia GeForce Experience)
- [CVE-2018-6265](https://cve.now/CVE-2018-6265.md): NVIDIA GeForce Experience contains a vulnerability in all versions prior to 3.16 during application installation on Windows 7 in elevated pr (no CVSS, Nvidia GeForce Experience)
- [CVE-2018-6266](https://cve.now/CVE-2018-6266.md): NVIDIA GeForce Experience contains a vulnerability in all versions prior to 3.16 on Windows where a local user may obtain third party integr (no CVSS, Nvidia GeForce Experience)
- [CVE-2018-6983](https://cve.now/CVE-2018-6983.md): VMware Workstation (15.x before 15.0.2 and 14.x before 14.1.5) and Fusion (11.x before 11.0.2 and 10.x before 10.1.5) contain an integer ove (no CVSS, VMware Workstation and Fusion)
- [CVE-2018-19609](https://cve.now/CVE-2018-19609.md): ShowDoc 2.4.1 allows remote attackers to obtain sensitive information by navigating with a modified page\_id, as demonstrated by reading note (no CVSS, showdoc/showdoc)
- [CVE-2018-13376](https://cve.now/CVE-2018-13376.md): An uninitialized memory buffer leak exists in Fortinet FortiOS 5.6.1 to 5.6.3, 5.4.6 to 5.4.7, 5.2 all versions under web proxy's disclaimer (no CVSS, Fortinet FortiOS)
- [CVE-2018-11766](https://cve.now/CVE-2018-11766.md): In Apache Hadoop 2.7.4 to 2.7.6, the security fix for CVE-2016-6811 is incomplete. (no CVSS, Apache Software Foundation Apache Hadoop · org.apache.hadoo…)
- [CVE-2018-16089](https://cve.now/CVE-2018-16089.md): System Management Module Vulnerabilities (no CVSS, Lenovo ThinkSystem SMM)
- [CVE-2018-16090](https://cve.now/CVE-2018-16090.md): System Management Module Vulnerabilities (no CVSS, Lenovo ThinkSystem SMM)
- [CVE-2018-16091](https://cve.now/CVE-2018-16091.md): System Management Module Vulnerabilities (no CVSS, Lenovo ThinkSystem SMM)
- [CVE-2018-16092](https://cve.now/CVE-2018-16092.md): System Management Module Vulnerabilities (no CVSS, Lenovo ThinkSystem SMM)
- [CVE-2018-16094](https://cve.now/CVE-2018-16094.md): System Management Module Vulnerabilities (no CVSS, Lenovo ThinkSystem SMM)
- [CVE-2018-16095](https://cve.now/CVE-2018-16095.md): System Management Module Vulnerabilities (no CVSS, Lenovo ThinkSystem SMM)
- [CVE-2018-16096](https://cve.now/CVE-2018-16096.md): System Management Module Vulnerabilities (no CVSS, Lenovo ThinkSystem SMM)
- [CVE-2018-9083](https://cve.now/CVE-2018-9083.md): System Management Module Vulnerabilities (no CVSS, Lenovo ThinkSystem SMM)
- [CVE-2018-9084](https://cve.now/CVE-2018-9084.md): System Management Module Vulnerabilities (no CVSS, Lenovo ThinkSystem SMM)
- [CVE-2018-17953](https://cve.now/CVE-2018-17953.md): pam\_access does not handle netmask matches correctly (CVSS 7.5, SUSE pam)
- [CVE-2018-19587](https://cve.now/CVE-2018-19587.md): In Cesanta Mongoose 6.13, a SIGSEGV exists in the mongoose.c mg\_mqtt\_add\_session() function. (no CVSS)
- [CVE-2018-19595](https://cve.now/CVE-2018-19595.md): PbootCMS V1.3.1 build 2018-11-14 allows remote attackers to execute arbitrary code via use of "eval" with mixed case, as demonstrated by an (no CVSS)
- [CVE-2018-19607](https://cve.now/CVE-2018-19607.md): Exiv2::isoSpeed in easyaccess.cpp in Exiv2 v0.27-RC2 allows remote attackers to cause a denial of service (NULL pointer dereference and appl (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2018-11-27
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.