# CVEs published 2018-11-30

37 CVEs were published on November 30, 2018: 0 critical, 2 high. Days are UTC.

- [CVE-2018-15715](https://cve.now/CVE-2018-15715.md): Zoom clients on Windows (before version 4.1.34814.1119), Mac OS (before version 4.1.34801.1116), and Linux (2.4.129780.0915 and below) are v (no CVSS, Zoom)
- [CVE-2018-15716](https://cve.now/CVE-2018-15716.md): NUUO NVRMini2 version 3.9.1 is vulnerable to authenticated remote command injection. (no CVSS, NUUO NVRMini2)
- [CVE-2018-16476](https://cve.now/CVE-2018-16476.md): A Broken Access Control vulnerability in Active Job versions \>= 4.2.0 allows an attacker to craft user input which can cause Active Job to d (no CVSS, https://github.com/rails/rails · activejob)
- [CVE-2018-16477](https://cve.now/CVE-2018-16477.md): A bypass vulnerability in Active Storage \>= 5.2.0 for Google Cloud Storage and Disk services allow an attacker to modify the \`content-dispos (no CVSS, https://github.com/rails/rails · activestorage)
- [CVE-2018-7806](https://cve.now/CVE-2018-7806.md): Data Center Operation allows for the upload of a zip file from its user interface to the server. (no CVSS, Schneider Electric SE Data Center Operation all versions)
- [CVE-2018-7807](https://cve.now/CVE-2018-7807.md): Data Center Expert, versions 7.5.0 and earlier, allows for the upload of a zip file from its user interface to the server. (no CVSS, Schneider Electric SE Data Center Expert versions 7.5.0 and…)
- [CVE-2018-7809](https://cve.now/CVE-2018-7809.md): An Unverified Password Change vulnerability exists in the embedded web servers in all Modicon M340, Premium, Quantum PLCs and BMXNOR0200 whi (no CVSS, Schneider Electric SE Embedded Web Servers in all Modicon M…)
- [CVE-2018-7810](https://cve.now/CVE-2018-7810.md): An Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability exists in the embedded web servers in (no CVSS, Schneider Electric SE Embedded Web Servers in all Modicon M…)
- [CVE-2018-7811](https://cve.now/CVE-2018-7811.md): An Unverified Password Change vulnerability exists in the embedded web servers in all Modicon M340, Premium, Quantum PLCs and BMXNOR0200 whi (no CVSS, Schneider Electric SE Embedded Web Servers in all Modicon M…)
- [CVE-2018-7830](https://cve.now/CVE-2018-7830.md): Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Response Splitting') vulnerability exists in the embedded web servers in al (no CVSS, Schneider Electric SE Embedded Web Servers in all Modicon M…)
- [CVE-2018-7831](https://cve.now/CVE-2018-7831.md): An Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability exists in the embedded web servers in all Mod (no CVSS, Schneider Electric SE Embedded Web Servers in all Modicon M…)
- [CVE-2018-15835](https://cve.now/CVE-2018-15835.md): Android 1.0 through 9.0 has Insecure Permissions. (no CVSS)
- [CVE-2018-18860](https://cve.now/CVE-2018-18860.md): A local privilege escalation vulnerability has been identified in the SwitchVPN client 2.1012.03 for macOS. (no CVSS)
- [CVE-2018-18983](https://cve.now/CVE-2018-18983.md): VT-Designer Version 2.1.7.31 is vulnerable by the program reading the contents of a file (which is already in memory) into another heap-base (no CVSS)
- [CVE-2018-18987](https://cve.now/CVE-2018-18987.md): VT-Designer Version 2.1.7.31 is vulnerable by the program populating objects with user supplied input via a file without first checking for (no CVSS)
- [CVE-2018-19290](https://cve.now/CVE-2018-19290.md): In modules/HELPBOT\_MODULE in Budabot 0.6 through 4.0, lax syntax validation allows remote attackers to perform a command injection attack ag (no CVSS)
- [CVE-2018-15767](https://cve.now/CVE-2018-15767.md): Improper Authorization Vulnerability (no CVSS, Dell OpenManage Network Manager)
- [CVE-2018-15768](https://cve.now/CVE-2018-15768.md): Insecure MySQL Configuration Vulnerability (no CVSS, Dell OpenManage Network Manager)
- [CVE-2018-3948](https://cve.now/CVE-2018-3948.md): An exploitable denial-of-service vulnerability exists in the URI-parsing functionality of the TP-Link TL-R600VPN HTTP server. (CVSS 7.5, TP-Link)
- [CVE-2018-1897](https://cve.now/CVE-2018-1897.md): IBM DB2 for Linux, UNIX and Windows 9.7, 10.1, 10.5., and 11.1 db2pdcfg is vulnerable to a stack based buffer overflow, caused by improper b (CVSS 8.4, IBM DB2 for Linux, UNIX and Windows)
- [CVE-2018-1927](https://cve.now/CVE-2018-1927.md): IBM StoredIQ 7.6 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions tra (CVSS 6.5, IBM StoredIQ)
- [CVE-2018-1928](https://cve.now/CVE-2018-1928.md): IBM StoredIQ 7.6.0 does not implement proper authorization of user roles due to which it was possible for a low privileged user to access th (CVSS 6.7, IBM StoredIQ)
- [CVE-2018-0716](https://cve.now/CVE-2018-0716.md): Cross-site scripting vulnerability in QTS 4.2.6 build 20180711, QTS 4.3.3: Qsync Central 3.0.2, QTS 4.3.4: Qsync Central 3.0.3, QTS 4.3.5: Q (no CVSS, QNAP Qsync Central)
- [CVE-2018-16093](https://cve.now/CVE-2018-16093.md): LXCI for VMware (no CVSS, Lenovo LXCI for VMware)
- [CVE-2018-16097](https://cve.now/CVE-2018-16097.md): LXCI for VMware and LXCI for Microsoft System Center (no CVSS, Lenovo LXCI for VMware · Lenovo LXCI for Microsoft System C…)
- [CVE-2018-9072](https://cve.now/CVE-2018-9072.md): LXCI for VMware (no CVSS, Lenovo LXCI for VMware)
- [CVE-2018-14637](https://cve.now/CVE-2018-14637.md): The SAML broker consumer endpoint in Keycloak before version 4.6.0.Final ignores expiration conditions on SAML assertions. (CVSS 6.1, \[UNKNOWN\] keycloak · org.keycloak:keycloak-core)
- [CVE-2018-19777](https://cve.now/CVE-2018-19777.md): In Artifex MuPDF 1.14.0, there is an infinite loop in the function svg\_dev\_end\_tile in fitz/svg-device.c, as demonstrated by mutool. (no CVSS)
- [CVE-2018-19755](https://cve.now/CVE-2018-19755.md): There is an illegal address access at asm/preproc.c (function: is\_mmacro) in Netwide Assembler (NASM) 2.14rc16 that will cause a denial of s (no CVSS)
- [CVE-2018-19756](https://cve.now/CVE-2018-19756.md): There is a heap-based buffer over-read at stb\_image.h (function: stbi\_\_tga\_load) in libsixel 1.8.2 that will cause a denial of service. (no CVSS)
- [CVE-2018-19757](https://cve.now/CVE-2018-19757.md): There is a NULL pointer dereference at function sixel\_helper\_set\_additional\_message (status.c) in libsixel 1.8.2 that will cause a denial of (no CVSS)
- [CVE-2018-19758](https://cve.now/CVE-2018-19758.md): There is a heap-based buffer over-read at wav.c in wav\_write\_header in libsndfile 1.0.28 that will cause a denial of service. (no CVSS)
- [CVE-2018-19759](https://cve.now/CVE-2018-19759.md): There is a heap-based buffer over-read at stb\_image\_write.h (function: stbi\_write\_png\_to\_mem) in libsixel 1.8.2 that will cause a denial of (no CVSS)
- [CVE-2018-19760](https://cve.now/CVE-2018-19760.md): cfg\_init in confuse.c in libConfuse 3.2.2 has a memory leak. (no CVSS)
- [CVE-2018-19761](https://cve.now/CVE-2018-19761.md): There is an illegal address access at fromsixel.c (function: sixel\_decode\_raw\_impl) in libsixel 1.8.2 that will cause a denial of service. (no CVSS)
- [CVE-2018-19762](https://cve.now/CVE-2018-19762.md): There is a heap-based buffer overflow at fromsixel.c (function: image\_buffer\_resize) in libsixel 1.8.2 that will cause a denial of service o (no CVSS)
- [CVE-2018-19763](https://cve.now/CVE-2018-19763.md): There is a heap-based buffer over-read at writer.c (function: write\_png\_to\_file) in libsixel 1.8.2 that will cause a denial of service. (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2018-11-30
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.