# CVEs published 2018-12-01

8 CVEs were published on December 1, 2018: 0 critical, 6 high. Days are UTC.

- [CVE-2018-4040](https://cve.now/CVE-2018-4040.md): An exploitable uninitialized pointer vulnerability exists in the rich text format parser of Atlantis Word Processor, version 3.2.7.2. (CVSS 8.8, Talos Atlantis Word Processor)
- [CVE-2018-4039](https://cve.now/CVE-2018-4039.md): An exploitable out-of-bounds write vulnerability exists in the PNG implementation of Atlantis Word Processor, version 3.2.7.2. (CVSS 8.8, Talos Atlantis Word Processor)
- [CVE-2018-4038](https://cve.now/CVE-2018-4038.md): An exploitable arbitrary write vulnerability exists in the open document format parser of the Atlantis Word Processor, version 3.2.7.2, whil (CVSS 8.8, Talos Atlantis Word Processor)
- [CVE-2018-3951](https://cve.now/CVE-2018-3951.md): An exploitable remote code execution vulnerability exists in the HTTP header-parsing function of the TP-Link TL-R600VPN HTTP Server. (CVSS 7.2, Talos TP-Link)
- [CVE-2018-3950](https://cve.now/CVE-2018-3950.md): An exploitable remote code execution vulnerability exists in the ping and tracert functionality of the TP-Link TL-R600VPN HWv3 FRNv1.3.0 and (CVSS 7.2, Talos TP-Link)
- [CVE-2018-3949](https://cve.now/CVE-2018-3949.md): An exploitable information disclosure vulnerability exists in the HTTP server functionality of the TP-Link TL-R600VPN. (CVSS 7.5, Talos TP-Link)
- [CVE-2018-19784](https://cve.now/CVE-2018-19784.md): The str\_rot\_pass function in vendor/atholn1600/php-proxy/src/helpers.php in PHP-Proxy 5.1.0 uses weak cryptography, which makes it easier fo (no CVSS, athlon1600/php-proxy)
- [CVE-2018-19785](https://cve.now/CVE-2018-19785.md): PHP-Proxy through 5.1.0 has Cross-Site Scripting (XSS) via the URL field in index.php. (no CVSS, athlon1600/php-proxy-app)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2018-12-01
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.