# CVEs published 2018-12-03

54 CVEs were published on December 3, 2018: 0 critical, 7 high. Days are UTC.

- [CVE-2018-14695](https://cve.now/CVE-2018-14695.md): Incorrect access control in the /mysql/api/diags.php endpoint in Drobo 5N2 NAS version 4.0.5-13.28.96115 allows unauthenticated attackers to (no CVSS)
- [CVE-2018-14696](https://cve.now/CVE-2018-14696.md): Incorrect access control in the /mysql/api/drobo.php endpoint in Drobo 5N2 NAS version 4.0.5-13.28.96115 allows unauthenticated attackers to (no CVSS)
- [CVE-2018-14697](https://cve.now/CVE-2018-14697.md): Cross-site scripting in the /DroboAccess/enable\_user endpoint in Drobo 5N2 NAS version 4.0.5-13.28.96115 allows attackers to execute JavaScr (no CVSS)
- [CVE-2018-14698](https://cve.now/CVE-2018-14698.md): Cross-site scripting in the /DroboAccess/delete\_user endpoint in Drobo 5N2 NAS version 4.0.5-13.28.96115 allows attackers to execute JavaScr (no CVSS)
- [CVE-2018-14699](https://cve.now/CVE-2018-14699.md): System command injection in the /DroboAccess/enable\_user endpoint in Drobo 5N2 NAS version 4.0.5-13.28.96115 allows unauthenticated attacker (no CVSS)
- [CVE-2018-14700](https://cve.now/CVE-2018-14700.md): Incorrect access control in the /mysql/api/logfile.php endpoint in Drobo 5N2 NAS version 4.0.5-13.28.96115 allows unauthenticated attackers (no CVSS)
- [CVE-2018-14701](https://cve.now/CVE-2018-14701.md): System command injection in the /DroboAccess/delete\_user endpoint in Drobo 5N2 NAS version 4.0.5-13.28.96115 allows unauthenticated attacker (no CVSS)
- [CVE-2018-14702](https://cve.now/CVE-2018-14702.md): Incorrect access control in the /drobopix/api/drobo.php endpoint in Drobo 5N2 NAS version 4.0.5-13.28.96115 allows unauthenticated attackers (no CVSS)
- [CVE-2018-14703](https://cve.now/CVE-2018-14703.md): Incorrect access control in the /mysql/api/droboapp/data endpoint in Drobo 5N2 NAS version 4.0.5-13.28.96115 allows unauthenticated attacker (no CVSS)
- [CVE-2018-14704](https://cve.now/CVE-2018-14704.md): Cross-site scripting in the MySQL API error page in Drobo 5N2 NAS version 4.0.5-13.28.96115 allows attackers to execute JavaScript via a mal (no CVSS)
- [CVE-2018-14706](https://cve.now/CVE-2018-14706.md): System command injection in the /DroboPix/api/drobopix/demo endpoint on Drobo 5N2 NAS version 4.0.5-13.28.96115 allows unauthenticated attac (no CVSS)
- [CVE-2018-14707](https://cve.now/CVE-2018-14707.md): Directory traversal in the Drobo Pix web application on Drobo 5N2 NAS version 4.0.5-13.28.96115 allows unauthenticated attackers to upload f (no CVSS)
- [CVE-2018-14708](https://cve.now/CVE-2018-14708.md): An insecure transport protocol used by Drobo Dashboard API on Drobo 5N2 NAS version 4.0.5-13.28.96115 allows attackers to intercept network (no CVSS)
- [CVE-2018-14709](https://cve.now/CVE-2018-14709.md): Incorrect access control in the Dashboard API on Drobo 5N2 NAS version 4.0.5-13.28.96115 allows attackers to bypass authentication due to in (no CVSS)
- [CVE-2018-3854](https://cve.now/CVE-2018-3854.md): An exploitable information disclosure vulnerability exists in the password protection functionality of Quicken Deluxe 2018 for Mac version 5 (CVSS 7.1)
- [CVE-2018-4019](https://cve.now/CVE-2018-4019.md): An exploitable command injection vulnerability exists in the way Netgate pfSense CE 2.4.4-RELEASE processes the parameters of a specific POS (CVSS 7.2, Netgate pfSense)
- [CVE-2018-4020](https://cve.now/CVE-2018-4020.md): An exploitable command injection vulnerability exists in the way Netgate pfSense CE 2.4.4-RELEASE processes the parameters of a specific POS (CVSS 7.2, Netgate pfSense)
- [CVE-2018-4021](https://cve.now/CVE-2018-4021.md): An exploitable command injection vulnerability exists in the way Netgate pfSense CE 2.4.4-RELEASE processes the parameters of a specific POS (CVSS 7.2, Netgate pfSense)
- [CVE-2018-6439](https://cve.now/CVE-2018-6439.md): A Vulnerability in the configdownload command of Brocade Fabric OS command line interface (CLI) versions before 8.2.1, 8.1.2f, 8.0.2f, 7.4.2 (CVSS 7.8, Brocade Communications Systems Brocade Fabric OS)
- [CVE-2018-6440](https://cve.now/CVE-2018-6440.md): A vulnerability in the proxy service of Brocade Fabric OS versions before 8.2.1, 8.1.2f, 8.0.2f, 7.4.2d could allow remote unauthenticated a (no CVSS, Brocade Communications Systems Brocade Fabric OS)
- [CVE-2018-19826](https://cve.now/CVE-2018-19826.md): In inspect.cpp in LibSass 3.5.5, a high memory footprint caused by an endless loop (containing a Sass::Inspect::operator()(Sass::String\_Quot (no CVSS)
- [CVE-2018-19827](https://cve.now/CVE-2018-19827.md): In LibSass 3.5.5, a use-after-free vulnerability exists in the SharedPtr class in SharedPtr.cpp (or SharedPtr.hpp) that may cause a denial o (no CVSS)
- [CVE-2018-19835](https://cve.now/CVE-2018-19835.md): Metinfo 6.1.3 has reflected XSS via the admin/column/move.php lang\_columnerr4 parameter. (no CVSS)
- [CVE-2018-19836](https://cve.now/CVE-2018-19836.md): In Metinfo 6.1.3, include/interface/applogin.php allows setting arbitrary HTTP headers (including the Cookie header), and common.inc.php all (no CVSS)
- [CVE-2018-16863](https://cve.now/CVE-2018-16863.md): It was found that RHSA-2018:2918 did not fully fix CVE-2018-16509. (CVSS 7.3, Artifex ghostscript)
- [CVE-2018-19824](https://cve.now/CVE-2018-19824.md): In the Linux kernel through 4.19.6, a local user could exploit a use-after-free in the ALSA driver by supplying a malicious USB Sound device (no CVSS)
- [CVE-2018-1002000](https://cve.now/CVE-2018-1002000.md): There is blind SQL injection in WordPress Arigato Autoresponder and Newsletter v2.5.1.8 These vulnerabilities require administrative privile (no CVSS, Kiboko Labs https://calendarscripts.info/ Arigato Autorespo…)
- [CVE-2018-1002001](https://cve.now/CVE-2018-1002001.md): There is a reflected XSS vulnerability in WordPress Arigato Autoresponder and News letter v2.5.1.8 This vulnerability requires administrativ (no CVSS, Kiboko Labs https://calendarscripts.info/ Arigato Autorespo…)
- [CVE-2018-1002002](https://cve.now/CVE-2018-1002002.md): There is a reflected XSS vulnerability in WordPress Arigato Autoresponder and News letter v2.5.1.8 This vulnerability requires administrativ (no CVSS, Kiboko Labs https://calendarscripts.info/ Arigato Autorespo…)
- [CVE-2018-1002003](https://cve.now/CVE-2018-1002003.md): There is a reflected XSS vulnerability in WordPress Arigato Autoresponder and News letter v2.5.1.8 This vulnerability requires administrativ (no CVSS, Kiboko Labs https://calendarscripts.info/ Arigato Autorespo…)
- [CVE-2018-1002004](https://cve.now/CVE-2018-1002004.md): There is a reflected XSS vulnerability in WordPress Arigato Autoresponder and News letter v2.5.1.8 This vulnerability requires administrativ (no CVSS, Kiboko Labs https://calendarscripts.info/ Arigato Autorespo…)
- [CVE-2018-1002005](https://cve.now/CVE-2018-1002005.md): These vulnerabilities require administrative privileges to exploit. (no CVSS, Kiboko Labs https://calendarscripts.info/ Arigato Autorespo…)
- [CVE-2018-1002006](https://cve.now/CVE-2018-1002006.md): These vulnerabilities require administrative privileges to exploit. (no CVSS, Kiboko Labs https://calendarscripts.info/ Arigato Autorespo…)
- [CVE-2018-1002007](https://cve.now/CVE-2018-1002007.md): There is a reflected XSS vulnerability in WordPress Arigato Autoresponder and News letter v2.5.1.8 This vulnerability requires administrativ (no CVSS, Kiboko Labs https://calendarscripts.info/ Arigato Autorespo…)
- [CVE-2018-1002008](https://cve.now/CVE-2018-1002008.md): There is a reflected XSS vulnerability in WordPress Arigato Autoresponder and News letter v2.5.1.8 This vulnerability requires administrativ (no CVSS, Kiboko Labs https://calendarscripts.info/ Arigato Autorespo…)
- [CVE-2018-1002009](https://cve.now/CVE-2018-1002009.md): There is a reflected XSS vulnerability in WordPress Arigato Autoresponder and News letter v2.5.1.8 This vulnerability requires administrativ (no CVSS, Kiboko Labs https://calendarscripts.info/ Arigato Autorespo…)
- [CVE-2018-1840](https://cve.now/CVE-2018-1840.md): IBM WebSphere Application Server 8.5 and 9.0 could allow a remote attacker to gain elevated privileges on the system, caused when a security (CVSS 6.0, IBM WebSphere Application Server)
- [CVE-2018-7112](https://cve.now/CVE-2018-7112.md): The HPE-provided Windows firmware installer for certain Gen9, Gen8, G7,and G6 HPE servers allows local disclosure of privileged information. (no CVSS, Hewlett Packard Enterprise Windows firmware installer for G…)
- [CVE-2018-7113](https://cve.now/CVE-2018-7113.md): A security vulnerability in HPE Integrated Lights-Out 5 (iLO 5) prior to v1.37 could be locally exploited to bypass the security restriction (no CVSS, Hewlett Packard Enterprise HPE Integrated Lights-Out 5 (iLO…)
- [CVE-2018-7114](https://cve.now/CVE-2018-7114.md): HPE Intelligent Management Center (IMC) prior to IMC PLAT 7.3 (E0605P06) is vulnerable to remote buffer overflow in dbman leading to code ex (no CVSS, Hewlett Packard Enterprise HPE Intelligent Management Center)
- [CVE-2018-7115](https://cve.now/CVE-2018-7115.md): HPE Intelligent Management Center (IMC) prior to IMC PLAT 7.3 (E0605P06) is vulnerable to a remote buffer overflow in dbman.exe opcode 10001 (no CVSS, Hewlett Packard Enterprise HPE Intelligent Management Center)
- [CVE-2018-7116](https://cve.now/CVE-2018-7116.md): HPE Intelligent Management Center (IMC) prior to IMC PLAT 7.3 (E0605P06) is vulnerable to a remote denial of service via dbman Opcode 10003 (no CVSS, Hewlett Packard Enterprise HPE Intelligent Management Center)
- [CVE-2018-16855](https://cve.now/CVE-2018-16855.md): An issue has been found in PowerDNS Recursor before version 4.1.8 where a remote attacker sending a DNS query can trigger an out-of-bounds m (CVSS 7.5, \[UNKNOWN\] pdns-recursor)
- [CVE-2018-16868](https://cve.now/CVE-2018-16868.md): A Bleichenbacher type side-channel based padding oracle attack was found in the way gnutls handles verification of RSA decrypted PKCS#1 v1.5 (CVSS 4.7, \[UNKNOWN\] gnutls)
- [CVE-2018-16869](https://cve.now/CVE-2018-16869.md): A Bleichenbacher type side-channel based padding oracle attack was found in the way nettle handles endian conversion of RSA decrypted PKCS#1 (CVSS 4.7, \[UNKNOWN\] nettle)
- [CVE-2018-6332](https://cve.now/CVE-2018-6332.md): A potential denial-of-service issue in the Proxygen handling of invalid HTTP2 settings which can cause the server to spend disproportionate (CVSS 5.9, Facebook HHVM)
- [CVE-2018-19788](https://cve.now/CVE-2018-19788.md): A flaw was found in PolicyKit (aka polkit) 0.115 that allows a user with a uid greater than INT\_MAX to successfully execute any systemctl co (no CVSS)
- [CVE-2018-19791](https://cve.now/CVE-2018-19791.md): The server in LiteSpeed OpenLiteSpeed before 1.5.0 RC6 does not correctly handle requests for byte sequences, allowing an attacker to amplif (no CVSS)
- [CVE-2018-19792](https://cve.now/CVE-2018-19792.md): The server in LiteSpeed OpenLiteSpeed before 1.5.0 RC6 allows local users to cause a denial of service (buffer overflow) or possibly have un (no CVSS)
- [CVE-2018-19793](https://cve.now/CVE-2018-19793.md): jiacrontab 1.4.5 allows remote attackers to execute arbitrary commands via the crontab/task/edit?addr=localhost%3a20001 command and args par (no CVSS)
- [CVE-2018-19794](https://cve.now/CVE-2018-19794.md): Cross-site scripting (XSS) vulnerability in UiV2Public.index in Internet2 Grouper 2.2 and 2.3 allows remote attackers to inject arbitrary we (no CVSS)
- [CVE-2018-19795](https://cve.now/CVE-2018-19795.md): ChipsBank UMPTool saves the password to the NAND with a simple substitution cipher, which allows attackers to get full access when having ph (no CVSS)
- [CVE-2018-19796](https://cve.now/CVE-2018-19796.md): An open redirect in the Ninja Forms plugin before 3.3.19.1 for WordPress allows Remote Attackers to redirect a user via the lib/StepProcessi (no CVSS)
- [CVE-2018-19797](https://cve.now/CVE-2018-19797.md): In LibSass 3.5.5, a NULL Pointer Dereference in the function Sass::Selector\_List::populate\_extends in SharedPtr.hpp (used by ast.cpp and ast (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2018-12-03
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.