# CVEs published 2018-11-29

44 CVEs were published on November 29, 2018: 0 critical, 0 high. Days are UTC.

- [CVE-2018-19497](https://cve.now/CVE-2018-19497.md): In The Sleuth Kit (TSK) through 4.6.4, hfs\_cat\_traverse in tsk/fs/hfs.c does not properly determine when a key length is too large, which al (no CVSS)
- [CVE-2018-19527](https://cve.now/CVE-2018-19527.md): i4 assistant 7.85 allows XSS via a crafted machine name field within iOS settings. (no CVSS)
- [CVE-2018-18619](https://cve.now/CVE-2018-18619.md): internal/advanced\_comment\_system/admin.php in Advanced Comment System 1.0 is prone to an SQL injection vulnerability because it fails to suf (no CVSS)
- [CVE-2018-19749](https://cve.now/CVE-2018-19749.md): DomainMOD through 4.11.01 has XSS via the assets/add/account-owner.php Owner name field. (no CVSS)
- [CVE-2018-19750](https://cve.now/CVE-2018-19750.md): DomainMOD through 4.11.01 has XSS via the admin/domain-fields/ notes field in an Add Custom Field action for Custom Domain Fields. (no CVSS)
- [CVE-2018-19751](https://cve.now/CVE-2018-19751.md): DomainMOD through 4.11.01 has XSS via the admin/ssl-fields/add.php notes field for Custom SSL Fields. (no CVSS)
- [CVE-2018-19752](https://cve.now/CVE-2018-19752.md): DomainMOD through 4.11.01 has XSS via the assets/add/registrar.php notes field for the Registrar. (no CVSS)
- [CVE-2018-15537](https://cve.now/CVE-2018-15537.md): Unrestricted file upload (with remote code execution) in OCS Inventory NG ocsreports allows a privileged user to gain access to the server v (no CVSS)
- [CVE-2018-19120](https://cve.now/CVE-2018-19120.md): The HTML thumbnailer plugin in KDE Applications before 18.12.0 allows attackers to trigger outbound TCP connections to arbitrary IP addresse (no CVSS)
- [CVE-2018-19748](https://cve.now/CVE-2018-19748.md): app/plug/attachment/controller/admincontroller.php in SDCMS 1.6 allows reading arbitrary files via a /?m=plug&c=admin&a=index&p=attachment&r (no CVSS)
- [CVE-2018-15978](https://cve.now/CVE-2018-15978.md): Flash Player versions 31.0.0.122 and earlier have an out-of-bounds read vulnerability. (no CVSS)
- [CVE-2018-15979](https://cve.now/CVE-2018-15979.md): Adobe Acrobat and Reader versions 2019.008.20080 and earlier, 2017.011.30105 and earlier, and 2015.006.30456 and earlier have a ntlm sso has (no CVSS, Adobe Acrobat and Reader)
- [CVE-2018-15980](https://cve.now/CVE-2018-15980.md): Adobe Photoshop CC versions 19.1.6 and earlier have an out-of-bounds read vulnerability. (no CVSS, Adobe Photoshop CC)
- [CVE-2018-15981](https://cve.now/CVE-2018-15981.md): Flash Player versions 31.0.0.148 and earlier have a type confusion vulnerability. (no CVSS, Adobe Flash Player)
- [CVE-2018-10851](https://cve.now/CVE-2018-10851.md): PowerDNS Authoritative Server 3.3.0 up to 4.1.4 excluding 4.1.5 and 4.0.6, and PowerDNS Recursor 3.2 up to 4.1.4 excluding 4.1.5 and 4.0.9, (CVSS 5.3, The PowerDNS Project pdns · The PowerDNS Project pdns-recur…)
- [CVE-2018-14626](https://cve.now/CVE-2018-14626.md): PowerDNS Authoritative Server 4.1.0 up to 4.1.4 inclusive and PowerDNS Recursor 4.0.0 up to 4.1.4 inclusive are vulnerable to a packet cache (CVSS 5.3, The PowerDNS Project pdns · The PowerDNS Project pdns-recur…)
- [CVE-2018-19692](https://cve.now/CVE-2018-19692.md): An issue was discovered in tp5cms through 2017-05-25. (no CVSS)
- [CVE-2018-19693](https://cve.now/CVE-2018-19693.md): An issue was discovered in tp5cms through 2017-05-25. (no CVSS)
- [CVE-2018-8789](https://cve.now/CVE-2018-8789.md): FreeRDP prior to version 2.0.0-rc4 contains several Out-Of-Bounds Reads in the NTLM Authentication module that results in a Denial of Servic (no CVSS, Check Point Software Technologies FreeRDP)
- [CVE-2018-16859](https://cve.now/CVE-2018-16859.md): Execution of Ansible playbooks on Windows platforms with PowerShell ScriptBlock logging and Module logging enabled can allow for 'become' pa (CVSS 4.2, Red Hat ansible · ansible)
- [CVE-2018-1762](https://cve.now/CVE-2018-1762.md): IBM Rational Collaborative Lifecycle Management 5.0 through 5.0.2 and 6.0 through 6.0.6 are vulnerable to cross-site scripting. (CVSS 5.4, IBM Rational Collaborative Lifecycle Management)
- [CVE-2018-8784](https://cve.now/CVE-2018-8784.md): FreeRDP prior to version 2.0.0-rc4 contains a Heap-Based Buffer Overflow in function zgfx\_decompress\_segment() that results in a memory corr (no CVSS, Check Point Software Technologies FreeRDP)
- [CVE-2018-8785](https://cve.now/CVE-2018-8785.md): FreeRDP prior to version 2.0.0-rc4 contains a Heap-Based Buffer Overflow in function zgfx\_decompress() that results in a memory corruption a (no CVSS, Check Point Software Technologies FreeRDP)
- [CVE-2018-8786](https://cve.now/CVE-2018-8786.md): FreeRDP prior to version 2.0.0-rc4 contains an Integer Truncation that leads to a Heap-Based Buffer Overflow in function update\_read\_bitmap\_ (no CVSS, Check Point Software Technologies FreeRDP)
- [CVE-2018-8787](https://cve.now/CVE-2018-8787.md): FreeRDP prior to version 2.0.0-rc4 contains an Integer Overflow that leads to a Heap-Based Buffer Overflow in function gdi\_Bitmap\_Decompress (no CVSS, Check Point Software Technologies FreeRDP)
- [CVE-2018-8788](https://cve.now/CVE-2018-8788.md): FreeRDP prior to version 2.0.0-rc4 contains an Out-Of-Bounds Write of up to 4 bytes in function nsc\_rle\_decode() that results in a memory co (no CVSS, Check Point Software Technologies FreeRDP)
- [CVE-2018-11002](https://cve.now/CVE-2018-11002.md): Pulse Secure Desktop Client 5.3 up to and including R6.0 build 1769 on Windows has Insecure Permissions. (no CVSS)
- [CVE-2018-18649](https://cve.now/CVE-2018-18649.md): An issue was discovered in the wiki API in GitLab Community and Enterprise Edition before 11.2.7, 11.3.x before 11.3.8, and 11.4.x before 11 (no CVSS)
- [CVE-2018-12238](https://cve.now/CVE-2018-12238.md): Norton prior to 22.15; Symantec Endpoint Protection (SEP) prior to 12.1.7454.7000 & 14.2; Symantec Endpoint Protection Small Business Editio (no CVSS, Norton; Symantec Endpoint Protection (SEP); Symantec Endpoi…)
- [CVE-2018-12239](https://cve.now/CVE-2018-12239.md): Norton prior to 22.15; Symantec Endpoint Protection (SEP) prior to 12.1.7454.7000 & 14.2; Symantec Endpoint Protection Small Business Editio (no CVSS, Norton; Symantec Endpoint Protection (SEP); Symantec Endpoi…)
- [CVE-2018-12245](https://cve.now/CVE-2018-12245.md): Symantec Endpoint Protection prior to 14.2 MP1 may be susceptible to a DLL Preloading vulnerability, which in this case is an issue that can (no CVSS, Symantec Endpoint Protection)
- [CVE-2018-19661](https://cve.now/CVE-2018-19661.md): An issue was discovered in libsndfile 1.0.28. (no CVSS)
- [CVE-2018-19662](https://cve.now/CVE-2018-19662.md): An issue was discovered in libsndfile 1.0.28. (no CVSS)
- [CVE-2018-19664](https://cve.now/CVE-2018-19664.md): libjpeg-turbo 2.0.1 has a heap-based buffer over-read in the put\_pixel\_rows function in wrbmp.c, as demonstrated by djpeg. (no CVSS)
- [CVE-2018-19666](https://cve.now/CVE-2018-19666.md): The agent in OSSEC through 3.1.0 on Windows allows local users to gain NT AUTHORITY\\SYSTEM access via Directory Traversal by leveraging full (no CVSS)
- [CVE-2018-19654](https://cve.now/CVE-2018-19654.md): An issue was discovered in Sales & Company Management System (SCMS) through 2018-06-06. (no CVSS)
- [CVE-2018-19655](https://cve.now/CVE-2018-19655.md): A stack-based buffer overflow in the find\_green() function of dcraw through 9.28, as used in ufraw-batch and many other products, may allow (no CVSS)
- [CVE-2018-19622](https://cve.now/CVE-2018-19622.md): In Wireshark 2.6.0 to 2.6.4 and 2.4.0 to 2.4.10, the MMSE dissector could go into an infinite loop. (no CVSS)
- [CVE-2018-19623](https://cve.now/CVE-2018-19623.md): In Wireshark 2.6.0 to 2.6.4 and 2.4.0 to 2.4.10, the LBMPDM dissector could crash. (no CVSS)
- [CVE-2018-19624](https://cve.now/CVE-2018-19624.md): In Wireshark 2.6.0 to 2.6.4 and 2.4.0 to 2.4.10, the PVFS dissector could crash. (no CVSS)
- [CVE-2018-19625](https://cve.now/CVE-2018-19625.md): In Wireshark 2.6.0 to 2.6.4 and 2.4.0 to 2.4.10, the dissection engine could crash. (no CVSS)
- [CVE-2018-19626](https://cve.now/CVE-2018-19626.md): In Wireshark 2.6.0 to 2.6.4 and 2.4.0 to 2.4.10, the DCOM dissector could crash. (no CVSS)
- [CVE-2018-19627](https://cve.now/CVE-2018-19627.md): In Wireshark 2.6.0 to 2.6.4 and 2.4.0 to 2.4.10, the IxVeriWave file parser could crash. (no CVSS)
- [CVE-2018-19628](https://cve.now/CVE-2018-19628.md): In Wireshark 2.6.0 to 2.6.4, the ZigBee ZCL dissector could crash. (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2018-11-29
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.