CVEs published December 3, 2018
54 CVEs were published on December 3, 2018: 0 critical, 7 high.
- Published
- 54
- Critical
- 0
- High
- 7
- Medium
- 4
- Low
- 0
- Unrated
- 43
- Now in CISA KEV
- 0
- Fix available
- 1
Most affected products
- Kiboko Labs https://calendarscripts.info/ Arigato Autorespo…
- 10
- Hewlett Packard Enterprise HPE Intelligent Management Center
- 3
- Netgate pfSense
- 3
- Brocade Communications Systems Brocade Fabric OS
- 2
- [UNKNOWN] gnutls
- 1
- [UNKNOWN] nettle
- 1
- [UNKNOWN] pdns-recursor
- 1
- Artifex ghostscript
- 1
- Facebook HHVM
- 1
- Hewlett Packard Enterprise HPE Integrated Lights-Out 5 (iLO…
- 1
High 7
- CVE-2018-3854An exploitable information disclosure vulnerability exists in the password protection functionality of Quicken Deluxe 2018 for Mac version 5
- CVE-2018-4019An exploitable command injection vulnerability exists in the way Netgate pfSense CE 2.4.4-RELEASE processes the parameters of a specific POSNetgate pfSense
- CVE-2018-4020An exploitable command injection vulnerability exists in the way Netgate pfSense CE 2.4.4-RELEASE processes the parameters of a specific POSNetgate pfSense
- CVE-2018-4021An exploitable command injection vulnerability exists in the way Netgate pfSense CE 2.4.4-RELEASE processes the parameters of a specific POSNetgate pfSense
- CVE-2018-6439A Vulnerability in the configdownload command of Brocade Fabric OS command line interface (CLI) versions before 8.2.1, 8.1.2f, 8.0.2f, 7.4.2Brocade Communications Systems Brocade Fabric OS
- CVE-2018-16863It was found that RHSA-2018:2918 did not fully fix CVE-2018-16509.Artifex ghostscript
- CVE-2018-16855An issue has been found in PowerDNS Recursor before version 4.1.8 where a remote attacker sending a DNS query can trigger an out-of-bounds m[UNKNOWN] pdns-recursor
Medium, low and unrated 47
- CVE-2018-14695Incorrect access control in the /mysql/api/diags.php endpoint in Drobo 5N2 NAS version 4.0.5-13.28.96115 allows unauthenticated attackers to
- CVE-2018-14696Incorrect access control in the /mysql/api/drobo.php endpoint in Drobo 5N2 NAS version 4.0.5-13.28.96115 allows unauthenticated attackers to
- CVE-2018-14697Cross-site scripting in the /DroboAccess/enable_user endpoint in Drobo 5N2 NAS version 4.0.5-13.28.96115 allows attackers to execute JavaScr
- CVE-2018-14698Cross-site scripting in the /DroboAccess/delete_user endpoint in Drobo 5N2 NAS version 4.0.5-13.28.96115 allows attackers to execute JavaScr
- CVE-2018-14699System command injection in the /DroboAccess/enable_user endpoint in Drobo 5N2 NAS version 4.0.5-13.28.96115 allows unauthenticated attacker
- CVE-2018-14700Incorrect access control in the /mysql/api/logfile.php endpoint in Drobo 5N2 NAS version 4.0.5-13.28.96115 allows unauthenticated attackers
- CVE-2018-14701System command injection in the /DroboAccess/delete_user endpoint in Drobo 5N2 NAS version 4.0.5-13.28.96115 allows unauthenticated attacker
- CVE-2018-14702Incorrect access control in the /drobopix/api/drobo.php endpoint in Drobo 5N2 NAS version 4.0.5-13.28.96115 allows unauthenticated attackers
- CVE-2018-14703Incorrect access control in the /mysql/api/droboapp/data endpoint in Drobo 5N2 NAS version 4.0.5-13.28.96115 allows unauthenticated attacker
- CVE-2018-14704Cross-site scripting in the MySQL API error page in Drobo 5N2 NAS version 4.0.5-13.28.96115 allows attackers to execute JavaScript via a mal
- CVE-2018-14706System command injection in the /DroboPix/api/drobopix/demo endpoint on Drobo 5N2 NAS version 4.0.5-13.28.96115 allows unauthenticated attac
- CVE-2018-14707Directory traversal in the Drobo Pix web application on Drobo 5N2 NAS version 4.0.5-13.28.96115 allows unauthenticated attackers to upload f
- CVE-2018-14708An insecure transport protocol used by Drobo Dashboard API on Drobo 5N2 NAS version 4.0.5-13.28.96115 allows attackers to intercept network
- CVE-2018-14709Incorrect access control in the Dashboard API on Drobo 5N2 NAS version 4.0.5-13.28.96115 allows attackers to bypass authentication due to in
- CVE-2018-6440A vulnerability in the proxy service of Brocade Fabric OS versions before 8.2.1, 8.1.2f, 8.0.2f, 7.4.2d could allow remote unauthenticated aBrocade Communications Systems Brocade Fabric OS
- CVE-2018-19826In inspect.cpp in LibSass 3.5.5, a high memory footprint caused by an endless loop (containing a Sass::Inspect::operator()(Sass::String_Quot
- CVE-2018-19827In LibSass 3.5.5, a use-after-free vulnerability exists in the SharedPtr class in SharedPtr.cpp (or SharedPtr.hpp) that may cause a denial o
- CVE-2018-19835Metinfo 6.1.3 has reflected XSS via the admin/column/move.php lang_columnerr4 parameter.
- CVE-2018-19836In Metinfo 6.1.3, include/interface/applogin.php allows setting arbitrary HTTP headers (including the Cookie header), and common.inc.php all
- CVE-2018-19824In the Linux kernel through 4.19.6, a local user could exploit a use-after-free in the ALSA driver by supplying a malicious USB Sound device
- CVE-2018-1002000There is blind SQL injection in WordPress Arigato Autoresponder and Newsletter v2.5.1.8 These vulnerabilities require administrative privileKiboko Labs https://calendarscripts.info/ Arigato Autorespo…
- CVE-2018-1002001There is a reflected XSS vulnerability in WordPress Arigato Autoresponder and News letter v2.5.1.8 This vulnerability requires administrativKiboko Labs https://calendarscripts.info/ Arigato Autorespo…
- CVE-2018-1002002There is a reflected XSS vulnerability in WordPress Arigato Autoresponder and News letter v2.5.1.8 This vulnerability requires administrativKiboko Labs https://calendarscripts.info/ Arigato Autorespo…
- CVE-2018-1002003There is a reflected XSS vulnerability in WordPress Arigato Autoresponder and News letter v2.5.1.8 This vulnerability requires administrativKiboko Labs https://calendarscripts.info/ Arigato Autorespo…
- CVE-2018-1002004There is a reflected XSS vulnerability in WordPress Arigato Autoresponder and News letter v2.5.1.8 This vulnerability requires administrativKiboko Labs https://calendarscripts.info/ Arigato Autorespo…
- CVE-2018-1002005These vulnerabilities require administrative privileges to exploit.Kiboko Labs https://calendarscripts.info/ Arigato Autorespo…
- CVE-2018-1002006These vulnerabilities require administrative privileges to exploit.Kiboko Labs https://calendarscripts.info/ Arigato Autorespo…
- CVE-2018-1002007There is a reflected XSS vulnerability in WordPress Arigato Autoresponder and News letter v2.5.1.8 This vulnerability requires administrativKiboko Labs https://calendarscripts.info/ Arigato Autorespo…
- CVE-2018-1002008There is a reflected XSS vulnerability in WordPress Arigato Autoresponder and News letter v2.5.1.8 This vulnerability requires administrativKiboko Labs https://calendarscripts.info/ Arigato Autorespo…
- CVE-2018-1002009There is a reflected XSS vulnerability in WordPress Arigato Autoresponder and News letter v2.5.1.8 This vulnerability requires administrativKiboko Labs https://calendarscripts.info/ Arigato Autorespo…
- CVE-2018-1840IBM WebSphere Application Server 8.5 and 9.0 could allow a remote attacker to gain elevated privileges on the system, caused when a securityIBM WebSphere Application Server
- CVE-2018-7112The HPE-provided Windows firmware installer for certain Gen9, Gen8, G7,and G6 HPE servers allows local disclosure of privileged information.Hewlett Packard Enterprise Windows firmware installer for G…
- CVE-2018-7113A security vulnerability in HPE Integrated Lights-Out 5 (iLO 5) prior to v1.37 could be locally exploited to bypass the security restrictionHewlett Packard Enterprise HPE Integrated Lights-Out 5 (iLO…
- CVE-2018-7114HPE Intelligent Management Center (IMC) prior to IMC PLAT 7.3 (E0605P06) is vulnerable to remote buffer overflow in dbman leading to code exHewlett Packard Enterprise HPE Intelligent Management Center
- CVE-2018-7115HPE Intelligent Management Center (IMC) prior to IMC PLAT 7.3 (E0605P06) is vulnerable to a remote buffer overflow in dbman.exe opcode 10001Hewlett Packard Enterprise HPE Intelligent Management Center
- CVE-2018-7116HPE Intelligent Management Center (IMC) prior to IMC PLAT 7.3 (E0605P06) is vulnerable to a remote denial of service via dbman Opcode 10003 Hewlett Packard Enterprise HPE Intelligent Management Center
- CVE-2018-16868A Bleichenbacher type side-channel based padding oracle attack was found in the way gnutls handles verification of RSA decrypted PKCS#1 v1.5[UNKNOWN] gnutls
- CVE-2018-16869A Bleichenbacher type side-channel based padding oracle attack was found in the way nettle handles endian conversion of RSA decrypted PKCS#1[UNKNOWN] nettle
- CVE-2018-6332A potential denial-of-service issue in the Proxygen handling of invalid HTTP2 settings which can cause the server to spend disproportionate Facebook HHVM
- CVE-2018-19788A flaw was found in PolicyKit (aka polkit) 0.115 that allows a user with a uid greater than INT_MAX to successfully execute any systemctl co
- CVE-2018-19791The server in LiteSpeed OpenLiteSpeed before 1.5.0 RC6 does not correctly handle requests for byte sequences, allowing an attacker to amplif
- CVE-2018-19792The server in LiteSpeed OpenLiteSpeed before 1.5.0 RC6 allows local users to cause a denial of service (buffer overflow) or possibly have un
- CVE-2018-19793jiacrontab 1.4.5 allows remote attackers to execute arbitrary commands via the crontab/task/edit?addr=localhost%3a20001 command and args par
- CVE-2018-19794Cross-site scripting (XSS) vulnerability in UiV2Public.index in Internet2 Grouper 2.2 and 2.3 allows remote attackers to inject arbitrary we
- CVE-2018-19795ChipsBank UMPTool saves the password to the NAND with a simple substitution cipher, which allows attackers to get full access when having ph
- CVE-2018-19796An open redirect in the Ninja Forms plugin before 3.3.19.1 for WordPress allows Remote Attackers to redirect a user via the lib/StepProcessi
- CVE-2018-19797In LibSass 3.5.5, a NULL Pointer Dereference in the function Sass::Selector_List::populate_extends in SharedPtr.hpp (used by ast.cpp and ast