CVEs published November 28, 2018
41 CVEs were published on November 28, 2018: 1 critical, 2 high.
- Published
- 41
- Critical
- 1
- High
- 2
- Medium
- 5
- Low
- 1
- Unrated
- 32
- Now in CISA KEV
- 0
- Fix available
- 1
Most affected products
- Qualcomm Snapdragon Automobile, Snapdragon Mobile, Snapdrag…
- 8
- [UNKNOWN] samba
- 6
- The Node.js Project Node.js
- 5
- QNAP QTS
- 4
- Qualcomm Snapdragon Automobile, Snapdragon Mobile
- 4
- Qualcomm Snapdragon Mobile
- 2
- showdoc/showdoc
- 2
- Cisco Prime License Manager
- 1
- FreeBSD
- 1
- IBM Maximo Asset Management
- 1
Critical 1
High 2
- CVE-2018-16853Samba from version 4.7.0 has a vulnerability that allows a user in a Samba AD domain to crash the KDC when Samba is built in the non-default[UNKNOWN] samba
- CVE-2018-16857Samba from version 4.9.0 and before version 4.9.3 that have AD DC configurations watching for bad passwords (to restrict brute forcing of pa[UNKNOWN] samba
Medium, low and unrated 38
- CVE-2018-17930A stack-based buffer overflow vulnerability has been identified in Teledyne DALSA Sherlock Version 7.2.7.4 and prior, which may allow remoteICS-CERT Teledyne DALSA Sherlock
- CVE-2018-18203A vulnerability in the update mechanism of Subaru StarLink Harman head units 2017, 2018, and 2019 may give an attacker (with physical access
- CVE-2018-19370A Race condition vulnerability in unzip_file in admin/import/class-import-settings.php in the Yoast SEO (wordpress-seo) plugin before 9.2.0
- CVE-2018-19651admin/functions/remote.php in Interspire Email Marketer through 6.1.6 has Server Side Request Forgery (SSRF) via a what=importurl&url= reque
- CVE-2018-5559In Rapid7 Komand version 0.41.0 and prior, certain endpoints that are able to list the always encrypted-at-rest connection data could returnRapid7 Komand
- CVE-2018-12116Node.js: All versions prior to Node.js 6.15.0 and 8.14.0: HTTP request splitting: If Node.js can be convinced to use unsanitized user-providThe Node.js Project Node.js
- CVE-2018-12120Node.js: All versions prior to Node.js 6.15.0: Debugger port 5858 listens on any interface by default: When the debugger is enabled with `noThe Node.js Project Node.js
- CVE-2018-12121Node.js: All versions prior to Node.js 6.15.0, 8.14.0, 10.14.0 and 11.3.0: Denial of Service with large HTTP headers: By using a combinationThe Node.js Project Node.js
- CVE-2018-12122Node.js: All versions prior to Node.js 6.15.0, 8.14.0, 10.14.0 and 11.3.0: Slowloris HTTP Denial of Service: An attacker can cause a Denial The Node.js Project Node.js
- CVE-2018-12123Node.js: All versions prior to Node.js 6.15.0, 8.14.0, 10.14.0 and 11.3.0: Hostname spoofing in URL parser for javascript protocol: If a NodThe Node.js Project Node.js
- CVE-2018-1584IBM Maximo Asset Management 7.6 is vulnerable to cross-site scripting.IBM Maximo Asset Management
- CVE-2018-19646The Python CGI scripts in PWS in Imperva SecureSphere 13.0.10, 13.1.10, and 13.2.10 allow remote attackers to execute arbitrary OS commands
- CVE-2018-14746Command Injection vulnerability in QTS 4.3.5 build 20181013, QTS 4.3.4 build 20181008, QTS 4.3.3 build 20180829, QTS 4.2.6 build 20180829 anQNAP QTS
- CVE-2018-14747NULL Pointer Dereference vulnerability in QTS 4.3.5 build 20181013, QTS 4.3.4 build 20181008, QTS 4.3.3 build 20180829, QTS 4.2.6 build 2018QNAP QTS
- CVE-2018-14748Improper Authorization vulnerability in QTS 4.3.5 build 20181013, QTS 4.3.4 build 20181008, QTS 4.3.3 build 20180829, QTS 4.2.6 build 201808QNAP QTS
- CVE-2018-14749Buffer Overflow vulnerability in QTS 4.3.5 build 20181013, QTS 4.3.4 build 20181008, QTS 4.3.3 build 20180829, QTS 4.2.6 build 20180829 and QNAP QTS
- CVE-2018-17156In FreeBSD before 11.2-STABLE(r340268) and 11.2-RELEASE-p5, due to incorrectly accounting for padding on 64-bit platforms, a buffer underwriFreeBSD
- CVE-2017-18315Buffer over-read vulnerabilities in an older version of ASN.1 parser in Snapdragon Mobile in versions SD 600.Qualcomm Snapdragon Mobile
- CVE-2017-18316Secure application can access QSEE kernel memory through Ontario kernel driver in Snapdragon Automobile, Snapdragon Mobile and Snapdragon WeQualcomm Snapdragon Automobile, Snapdragon Mobile, Snapdrag…
- CVE-2017-18317Restrictions related to the modem (sim lock, sim kill) can be bypassed by manipulating the system to issue a deactivation flow sequence in SQualcomm Snapdragon Automobile, Snapdragon Mobile
- CVE-2017-18318Missing validation check on CRL issuer name in Snapdragon Automobile, Snapdragon Mobile in versions MSM8996AU, SD 410/12, SD 425, SD 430, SDQualcomm Snapdragon Automobile, Snapdragon Mobile
- CVE-2018-11264Possible buffer overflow in Ontario fingerprint code due to lack of input validation for the parameters coming into TZ from HLOS in SnapdragQualcomm Snapdragon Automobile, Snapdragon Mobile, Snapdrag…
- CVE-2018-11921Failure condition is not handled properly and the correct error code is not returned.Qualcomm Snapdragon Automobile, Snapdragon Mobile, Snapdrag…
- CVE-2018-11994SMMU secure camera logic allows secure camera controllers to access HLOS memory during session in Snapdragon Automobile, Snapdragon Mobile aQualcomm Snapdragon Automobile, Snapdragon Mobile, Snapdrag…
- CVE-2018-11996When a malformed command is sent to the device programmer, an out-of-bounds access can occur in Snapdragon Automobile, Snapdragon Mobile andQualcomm Snapdragon Automobile, Snapdragon Mobile, Snapdrag…
- CVE-2018-5870While loading a service image, an untrusted pointer dereference can occur in Snapdragon Mobile in versions SD 835, SDA660, SDX24.Qualcomm Snapdragon Mobile
- CVE-2018-5877In the device programmer target-side code for firehose, a string may not be properly NULL terminated can lead to a incorrect buffer size in Qualcomm Snapdragon Automobile, Snapdragon Mobile, Snapdrag…
- CVE-2018-5912Potential buffer overflow in Video due to lack of input validation in input and output values in Snapdragon Automobile, Snapdragon Mobile inQualcomm Snapdragon Automobile, Snapdragon Mobile
- CVE-2018-5916Buffer overread while decoding PDP modify request or network initiated secondary PDP activation in Snapdragon Automobile, Snapdragon Mobile Qualcomm Snapdragon Automobile, Snapdragon Mobile, Snapdrag…
- CVE-2018-5917Possible buffer overflow in OEM crypto function due to improper input validation in Snapdragon Automobile, Snapdragon Mobile in versions MSMQualcomm Snapdragon Automobile, Snapdragon Mobile
- CVE-2018-5918Possible buffer overflow in DRM Trusted application due to lack of check function return values in Snapdragon Automobile, Snapdragon Mobile Qualcomm Snapdragon Automobile, Snapdragon Mobile, Snapdrag…
- CVE-2018-14629A denial of service vulnerability was discovered in Samba's LDAP server before versions 4.7.12, 4.8.7, and 4.9.3.[UNKNOWN] samba
- CVE-2018-16841Samba from version 4.3.0 and before versions 4.7.12, 4.8.7 and 4.9.3 are vulnerable to a denial of service.[UNKNOWN] samba
- CVE-2018-16851Samba from version 4.0.0 and before versions 4.7.12, 4.8.7, 4.9.3 is vulnerable to a denial of service.[UNKNOWN] samba
- CVE-2018-16852Samba from version 4.9.0 and before version 4.9.3 is vulnerable to a NULL pointer de-reference.[UNKNOWN] samba
- CVE-2018-19630cgi_handle_request in uhttpd in OpenWrt through 18.06.1 and LEDE through 17.01 has unauthenticated reflected XSS via the URI, as demonstrate
- CVE-2018-19620ShowDoc 2.4.1 allows remote attackers to edit other users' notes by navigating with a modified page_id.showdoc/showdoc
- CVE-2018-19621server/index.php?s=/api/teamMember/save in ShowDoc 2.4.2 has a CSRF that can add members to a team.showdoc/showdoc