CVEs published November 29, 2018
44 CVEs were published on November 29, 2018: 0 critical, 0 high.
- Published
- 44
- Critical
- 0
- High
- 0
- Medium
- 4
- Low
- 0
- Unrated
- 40
- Now in CISA KEV
- 0
- Fix available
- 1
Most affected products
- Check Point Software Technologies FreeRDP
- 6
- Norton; Symantec Endpoint Protection (SEP); Symantec Endpoi…
- 2
- The PowerDNS Project pdns · The PowerDNS Project pdns-recur…
- 2
- Adobe Acrobat and Reader
- 1
- Adobe Flash Player
- 1
- Adobe Photoshop CC
- 1
- IBM Rational Collaborative Lifecycle Management
- 1
- Red Hat ansible · ansible
- 1
- Symantec Endpoint Protection
- 1
Medium, low and unrated 44
- CVE-2018-19497In The Sleuth Kit (TSK) through 4.6.4, hfs_cat_traverse in tsk/fs/hfs.c does not properly determine when a key length is too large, which al
- CVE-2018-19527i4 assistant 7.85 allows XSS via a crafted machine name field within iOS settings.
- CVE-2018-18619internal/advanced_comment_system/admin.php in Advanced Comment System 1.0 is prone to an SQL injection vulnerability because it fails to suf
- CVE-2018-19749DomainMOD through 4.11.01 has XSS via the assets/add/account-owner.php Owner name field.
- CVE-2018-19750DomainMOD through 4.11.01 has XSS via the admin/domain-fields/ notes field in an Add Custom Field action for Custom Domain Fields.
- CVE-2018-19751DomainMOD through 4.11.01 has XSS via the admin/ssl-fields/add.php notes field for Custom SSL Fields.
- CVE-2018-19752DomainMOD through 4.11.01 has XSS via the assets/add/registrar.php notes field for the Registrar.
- CVE-2018-15537Unrestricted file upload (with remote code execution) in OCS Inventory NG ocsreports allows a privileged user to gain access to the server v
- CVE-2018-19120The HTML thumbnailer plugin in KDE Applications before 18.12.0 allows attackers to trigger outbound TCP connections to arbitrary IP addresse
- CVE-2018-19748app/plug/attachment/controller/admincontroller.php in SDCMS 1.6 allows reading arbitrary files via a /?m=plug&c=admin&a=index&p=attachment&r
- CVE-2018-15978Flash Player versions 31.0.0.122 and earlier have an out-of-bounds read vulnerability.
- CVE-2018-15979Adobe Acrobat and Reader versions 2019.008.20080 and earlier, 2017.011.30105 and earlier, and 2015.006.30456 and earlier have a ntlm sso hasAdobe Acrobat and Reader
- CVE-2018-15980Adobe Photoshop CC versions 19.1.6 and earlier have an out-of-bounds read vulnerability.Adobe Photoshop CC
- CVE-2018-15981Flash Player versions 31.0.0.148 and earlier have a type confusion vulnerability.Adobe Flash Player
- CVE-2018-10851PowerDNS Authoritative Server 3.3.0 up to 4.1.4 excluding 4.1.5 and 4.0.6, and PowerDNS Recursor 3.2 up to 4.1.4 excluding 4.1.5 and 4.0.9, The PowerDNS Project pdns · The PowerDNS Project pdns-recur…
- CVE-2018-14626PowerDNS Authoritative Server 4.1.0 up to 4.1.4 inclusive and PowerDNS Recursor 4.0.0 up to 4.1.4 inclusive are vulnerable to a packet cacheThe PowerDNS Project pdns · The PowerDNS Project pdns-recur…
- CVE-2018-19692An issue was discovered in tp5cms through 2017-05-25.
- CVE-2018-19693An issue was discovered in tp5cms through 2017-05-25.
- CVE-2018-8789FreeRDP prior to version 2.0.0-rc4 contains several Out-Of-Bounds Reads in the NTLM Authentication module that results in a Denial of ServicCheck Point Software Technologies FreeRDP
- CVE-2018-16859Execution of Ansible playbooks on Windows platforms with PowerShell ScriptBlock logging and Module logging enabled can allow for 'become' paRed Hat ansible · ansible
- CVE-2018-1762IBM Rational Collaborative Lifecycle Management 5.0 through 5.0.2 and 6.0 through 6.0.6 are vulnerable to cross-site scripting.IBM Rational Collaborative Lifecycle Management
- CVE-2018-8784FreeRDP prior to version 2.0.0-rc4 contains a Heap-Based Buffer Overflow in function zgfx_decompress_segment() that results in a memory corrCheck Point Software Technologies FreeRDP
- CVE-2018-8785FreeRDP prior to version 2.0.0-rc4 contains a Heap-Based Buffer Overflow in function zgfx_decompress() that results in a memory corruption aCheck Point Software Technologies FreeRDP
- CVE-2018-8786FreeRDP prior to version 2.0.0-rc4 contains an Integer Truncation that leads to a Heap-Based Buffer Overflow in function update_read_bitmap_Check Point Software Technologies FreeRDP
- CVE-2018-8787FreeRDP prior to version 2.0.0-rc4 contains an Integer Overflow that leads to a Heap-Based Buffer Overflow in function gdi_Bitmap_DecompressCheck Point Software Technologies FreeRDP
- CVE-2018-8788FreeRDP prior to version 2.0.0-rc4 contains an Out-Of-Bounds Write of up to 4 bytes in function nsc_rle_decode() that results in a memory coCheck Point Software Technologies FreeRDP
- CVE-2018-11002Pulse Secure Desktop Client 5.3 up to and including R6.0 build 1769 on Windows has Insecure Permissions.
- CVE-2018-18649An issue was discovered in the wiki API in GitLab Community and Enterprise Edition before 11.2.7, 11.3.x before 11.3.8, and 11.4.x before 11
- CVE-2018-12238Norton prior to 22.15; Symantec Endpoint Protection (SEP) prior to 12.1.7454.7000 & 14.2; Symantec Endpoint Protection Small Business EditioNorton; Symantec Endpoint Protection (SEP); Symantec Endpoi…
- CVE-2018-12239Norton prior to 22.15; Symantec Endpoint Protection (SEP) prior to 12.1.7454.7000 & 14.2; Symantec Endpoint Protection Small Business EditioNorton; Symantec Endpoint Protection (SEP); Symantec Endpoi…
- CVE-2018-12245Symantec Endpoint Protection prior to 14.2 MP1 may be susceptible to a DLL Preloading vulnerability, which in this case is an issue that canSymantec Endpoint Protection
- CVE-2018-19661An issue was discovered in libsndfile 1.0.28.
- CVE-2018-19662An issue was discovered in libsndfile 1.0.28.
- CVE-2018-19664libjpeg-turbo 2.0.1 has a heap-based buffer over-read in the put_pixel_rows function in wrbmp.c, as demonstrated by djpeg.
- CVE-2018-19666The agent in OSSEC through 3.1.0 on Windows allows local users to gain NT AUTHORITY\SYSTEM access via Directory Traversal by leveraging full
- CVE-2018-19654An issue was discovered in Sales & Company Management System (SCMS) through 2018-06-06.
- CVE-2018-19655A stack-based buffer overflow in the find_green() function of dcraw through 9.28, as used in ufraw-batch and many other products, may allow
- CVE-2018-19622In Wireshark 2.6.0 to 2.6.4 and 2.4.0 to 2.4.10, the MMSE dissector could go into an infinite loop.
- CVE-2018-19623In Wireshark 2.6.0 to 2.6.4 and 2.4.0 to 2.4.10, the LBMPDM dissector could crash.
- CVE-2018-19624In Wireshark 2.6.0 to 2.6.4 and 2.4.0 to 2.4.10, the PVFS dissector could crash.
- CVE-2018-19625In Wireshark 2.6.0 to 2.6.4 and 2.4.0 to 2.4.10, the dissection engine could crash.
- CVE-2018-19626In Wireshark 2.6.0 to 2.6.4 and 2.4.0 to 2.4.10, the DCOM dissector could crash.
- CVE-2018-19627In Wireshark 2.6.0 to 2.6.4 and 2.4.0 to 2.4.10, the IxVeriWave file parser could crash.
- CVE-2018-19628In Wireshark 2.6.0 to 2.6.4, the ZigBee ZCL dissector could crash.