CVEs published November 30, 2018
37 CVEs were published on November 30, 2018: 0 critical, 2 high.
- Published
- 37
- Critical
- 0
- High
- 2
- Medium
- 3
- Low
- 0
- Unrated
- 32
- Now in CISA KEV
- 0
- Fix available
- 8
Most affected products
- Schneider Electric SE Embedded Web Servers in all Modicon M…
- 5
- Dell OpenManage Network Manager
- 2
- IBM StoredIQ
- 2
- Lenovo LXCI for VMware
- 2
- [UNKNOWN] keycloak · org.keycloak:keycloak-core
- 1
- https://github.com/rails/rails · activejob
- 1
- https://github.com/rails/rails · activestorage
- 1
- IBM DB2 for Linux, UNIX and Windows
- 1
- Lenovo LXCI for VMware · Lenovo LXCI for Microsoft System C…
- 1
- NUUO NVRMini2
- 1
High 2
- CVE-2018-3948An exploitable denial-of-service vulnerability exists in the URI-parsing functionality of the TP-Link TL-R600VPN HTTP server.TP-Link
- CVE-2018-1897IBM DB2 for Linux, UNIX and Windows 9.7, 10.1, 10.5., and 11.1 db2pdcfg is vulnerable to a stack based buffer overflow, caused by improper bIBM DB2 for Linux, UNIX and Windows
Medium, low and unrated 35
- CVE-2018-15715Zoom clients on Windows (before version 4.1.34814.1119), Mac OS (before version 4.1.34801.1116), and Linux (2.4.129780.0915 and below) are vZoom
- CVE-2018-15716NUUO NVRMini2 version 3.9.1 is vulnerable to authenticated remote command injection.NUUO NVRMini2
- CVE-2018-16476A Broken Access Control vulnerability in Active Job versions >= 4.2.0 allows an attacker to craft user input which can cause Active Job to dhttps://github.com/rails/rails · activejob
- CVE-2018-16477A bypass vulnerability in Active Storage >= 5.2.0 for Google Cloud Storage and Disk services allow an attacker to modify the `content-disposhttps://github.com/rails/rails · activestorage
- CVE-2018-7806Data Center Operation allows for the upload of a zip file from its user interface to the server.Schneider Electric SE Data Center Operation all versions
- CVE-2018-7807Data Center Expert, versions 7.5.0 and earlier, allows for the upload of a zip file from its user interface to the server.Schneider Electric SE Data Center Expert versions 7.5.0 and…
- CVE-2018-7809An Unverified Password Change vulnerability exists in the embedded web servers in all Modicon M340, Premium, Quantum PLCs and BMXNOR0200 whiSchneider Electric SE Embedded Web Servers in all Modicon M…
- CVE-2018-7810An Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability exists in the embedded web servers in Schneider Electric SE Embedded Web Servers in all Modicon M…
- CVE-2018-7811An Unverified Password Change vulnerability exists in the embedded web servers in all Modicon M340, Premium, Quantum PLCs and BMXNOR0200 whiSchneider Electric SE Embedded Web Servers in all Modicon M…
- CVE-2018-7830Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Response Splitting') vulnerability exists in the embedded web servers in alSchneider Electric SE Embedded Web Servers in all Modicon M…
- CVE-2018-7831An Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability exists in the embedded web servers in all ModSchneider Electric SE Embedded Web Servers in all Modicon M…
- CVE-2018-15835Android 1.0 through 9.0 has Insecure Permissions.
- CVE-2018-18860A local privilege escalation vulnerability has been identified in the SwitchVPN client 2.1012.03 for macOS.
- CVE-2018-18983VT-Designer Version 2.1.7.31 is vulnerable by the program reading the contents of a file (which is already in memory) into another heap-base
- CVE-2018-18987VT-Designer Version 2.1.7.31 is vulnerable by the program populating objects with user supplied input via a file without first checking for
- CVE-2018-19290In modules/HELPBOT_MODULE in Budabot 0.6 through 4.0, lax syntax validation allows remote attackers to perform a command injection attack ag
- CVE-2018-15767Improper Authorization VulnerabilityDell OpenManage Network Manager
- CVE-2018-15768Insecure MySQL Configuration VulnerabilityDell OpenManage Network Manager
- CVE-2018-1927IBM StoredIQ 7.6 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions traIBM StoredIQ
- CVE-2018-1928IBM StoredIQ 7.6.0 does not implement proper authorization of user roles due to which it was possible for a low privileged user to access thIBM StoredIQ
- CVE-2018-0716Cross-site scripting vulnerability in QTS 4.2.6 build 20180711, QTS 4.3.3: Qsync Central 3.0.2, QTS 4.3.4: Qsync Central 3.0.3, QTS 4.3.5: QQNAP Qsync Central
- CVE-2018-16093LXCI for VMwareLenovo LXCI for VMware
- CVE-2018-16097LXCI for VMware and LXCI for Microsoft System CenterLenovo LXCI for VMware · Lenovo LXCI for Microsoft System C…
- CVE-2018-9072LXCI for VMwareLenovo LXCI for VMware
- CVE-2018-14637The SAML broker consumer endpoint in Keycloak before version 4.6.0.Final ignores expiration conditions on SAML assertions.[UNKNOWN] keycloak · org.keycloak:keycloak-core
- CVE-2018-19777In Artifex MuPDF 1.14.0, there is an infinite loop in the function svg_dev_end_tile in fitz/svg-device.c, as demonstrated by mutool.
- CVE-2018-19755There is an illegal address access at asm/preproc.c (function: is_mmacro) in Netwide Assembler (NASM) 2.14rc16 that will cause a denial of s
- CVE-2018-19756There is a heap-based buffer over-read at stb_image.h (function: stbi__tga_load) in libsixel 1.8.2 that will cause a denial of service.
- CVE-2018-19757There is a NULL pointer dereference at function sixel_helper_set_additional_message (status.c) in libsixel 1.8.2 that will cause a denial of
- CVE-2018-19758There is a heap-based buffer over-read at wav.c in wav_write_header in libsndfile 1.0.28 that will cause a denial of service.
- CVE-2018-19759There is a heap-based buffer over-read at stb_image_write.h (function: stbi_write_png_to_mem) in libsixel 1.8.2 that will cause a denial of
- CVE-2018-19760cfg_init in confuse.c in libConfuse 3.2.2 has a memory leak.
- CVE-2018-19761There is an illegal address access at fromsixel.c (function: sixel_decode_raw_impl) in libsixel 1.8.2 that will cause a denial of service.
- CVE-2018-19762There is a heap-based buffer overflow at fromsixel.c (function: image_buffer_resize) in libsixel 1.8.2 that will cause a denial of service o
- CVE-2018-19763There is a heap-based buffer over-read at writer.c (function: write_png_to_file) in libsixel 1.8.2 that will cause a denial of service.