CVEs published December 4, 2018
80 CVEs were published on December 4, 2018: 0 critical, 1 high.
- Published
- 80
- Critical
- 0
- High
- 1
- Medium
- 0
- Low
- 0
- Unrated
- 79
- Now in CISA KEV
- 0
- Fix available
- 21
Most affected products
- Google Chrome
- 21
- FreeBSD
- 4
- CX-One
- 2
- Huawei Technologies Co. Huawei P20
- 1
- Huawei Technologies Co. Huawei VIP App
- 1
- intelliants/subrion
- 1
- NetApp Data ONTAP operating in 7-Mode
- 1
- SCADA WebServer
- 1
- simplehttpserver
- 1
- VMware ESXi
- 1
High 1
Medium, low and unrated 79
- CVE-2018-17939An issue was discovered in GitLab Community and Enterprise Edition 11.1.x before 11.1.8, 11.2.x before 11.2.5, and 11.3.x before 11.3.2.
- CVE-2018-17975An issue was discovered in GitLab Community Edition 11.x before 11.1.8, 11.2.x before 11.2.5, and 11.3.x before 11.3.2.
- CVE-2018-17976An issue was discovered in GitLab Community Edition 11.x before 11.1.8, 11.2.x before 11.2.5, and 11.3.x before 11.3.2.
- CVE-2018-18640An issue was discovered in GitLab Community and Enterprise Edition before 11.2.7, 11.3.x before 11.3.8, and 11.4.x before 11.4.3.
- CVE-2018-18641An issue was discovered in GitLab Community and Enterprise Edition before 11.2.7, 11.3.x before 11.3.8, and 11.4.x before 11.4.3.
- CVE-2018-18642An issue was discovered in GitLab Community and Enterprise Edition before 11.2.7, 11.3.x before 11.3.8, and 11.4.x before 11.4.3.
- CVE-2018-18644An issue was discovered in GitLab Community and Enterprise Edition 11.x before 11.2.7, 11.3.x before 11.3.8, and 11.4.x before 11.4.3.
- CVE-2018-18645An issue was discovered in GitLab Community and Enterprise Edition before 11.2.7, 11.3.x before 11.3.8, and 11.4.x before 11.4.3.
- CVE-2018-18646An issue was discovered in GitLab Community and Enterprise Edition before 11.2.7, 11.3.x before 11.3.8, and 11.4.x before 11.4.3.
- CVE-2018-18647An issue was discovered in GitLab Community and Enterprise Edition before 11.2.7, 11.3.x before 11.3.8, and 11.4.x before 11.4.3.
- CVE-2018-18648An issue was discovered in GitLab Community and Enterprise Edition before 11.2.7, 11.3.x before 11.3.8, and 11.4.x before 11.4.3.
- CVE-2018-18843The Kubernetes integration in GitLab Enterprise Edition 11.x before 11.2.8, 11.3.x before 11.3.9, and 11.4.x before 11.4.4 has SSRF.
- CVE-2018-18989In CX-One Versions 4.42 and prior (CX-Programmer Versions 9.66 and prior and CX-Server Versions 5.0.23 and prior), when processing project fCX-One
- CVE-2018-18993Two stack-based buffer overflow vulnerabilities have been discovered in CX-One Versions 4.42 and prior (CX-Programmer Versions 9.66 and prioCX-One
- CVE-2018-17160In FreeBSD before 11.2-STABLE(r341486) and 11.2-RELEASE-p6, insufficient bounds checking in one of the device models provided by bhyve can pFreeBSD
- CVE-2018-18991Reflected cross-site scripting (non-persistent) in SCADA WebServer (Versions prior to 2.03.0001) could allow an attacker to send a crafted USCADA WebServer
- CVE-2018-5496Data ONTAP operating in 7-Mode versions prior to 8.2.5P2 are susceptible to a vulnerability which discloses sensitive information to an unauNetApp Data ONTAP operating in 7-Mode
- CVE-2018-0468A vulnerability in the configuration of a local database installed as part of the Cisco Energy Management Suite (CEMS) could allow an authen
- CVE-2018-7956Huawei VIP App is a mobile app for Malaysia customers that purchased P20 Series, Nova 3/3i and Mate 20.Huawei Technologies Co. Huawei VIP App
- CVE-2018-7987There is an out-of-bounds write vulnerability on Huawei P20 smartphones with versions before 8.1.0.171(C00).Huawei Technologies Co. Huawei P20
- CVE-2018-11347The YunoHost 2.7.2 through 2.7.14 web application is affected by one HTTP Response Header Injection.
- CVE-2018-11348Two XSS vulnerabilities are located in the profile edition page of the user panel of the YunoHost 2.7.2 through 2.7.14 web application.
- CVE-2018-12305Cross-site scripting in File Explorer in ASUSTOR ADM version 3.1.1 allows attackers to execute JavaScript by uploading SVG images with embed
- CVE-2018-12306Directory Traversal in File Explorer in ASUSTOR ADM version 3.1.1 allows attackers to view arbitrary files by modifying the "file1" URL para
- CVE-2018-12307OS command injection in user.cgi in ASUSTOR ADM version 3.1.1 allows attackers to execute system commands as root via the "name" POST parame
- CVE-2018-12308Encryption key disclosure in share.cgi in ASUSTOR ADM version 3.1.1 allows attackers to obtain the encryption key via the "encrypt_key" URL
- CVE-2018-12309Directory Traversal in upload.cgi in ASUSTOR ADM version 3.1.1 allows attackers to upload files to arbitrary locations by modifying the "pat
- CVE-2018-12310Cross-site scripting in the Login page in ASUSTOR ADM version 3.1.1 allows attackers to execute JavaScript via the System Announcement featu
- CVE-2018-12311Cross-site scripting vulnerability in File Explorer in ASUSTOR ADM version 3.1.1 allows attackers to execute arbitrary JavaScript when a fil
- CVE-2018-12312OS command injection in user.cgi in ASUSTOR ADM version 3.1.1 allows attackers to execute system commands as root via the "secret_key" URL p
- CVE-2018-12313OS command injection in snmp.cgi in ASUSTOR ADM version 3.1.1 allows attackers to execute system commands without authentication via the "ro
- CVE-2018-12314Directory Traversal in downloadwallpaper.cgi in ASUSTOR ADM version 3.1.1 allows attackers to download arbitrary files by manipulating the "
- CVE-2018-12315Missing verification of a password in ASUSTOR ADM version 3.1.1 allows attackers to change account passwords without entering the current pa
- CVE-2018-12316OS Command Injection in upload.cgi in ASUSTOR ADM version 3.1.1 allows attackers to execute system commands by modifying the filename POST p
- CVE-2018-12317OS command injection in group.cgi in ASUSTOR ADM version 3.1.1 allows attackers to execute system commands as root by modifying the "name" P
- CVE-2018-12318Information disclosure in the SNMP settings page in ASUSTOR ADM version 3.1.1 allows attackers to obtain the SNMP password in cleartext.
- CVE-2018-12319Denial-of-service in the login page of ASUSTOR ADM 3.1.1 allows attackers to prevent users from signing in by placing malformed text in the
- CVE-2018-6085Re-entry of a destructor in Networking Disk Cache in Google Chrome prior to 66.0.3359.117 allowed a remote attacker to execute arbitrary codGoogle Chrome
- CVE-2018-6086A double-eviction in the Incognito mode cache that lead to a user-after-free in Networking Disk Cache in Google Chrome prior to 66.0.3359.11Google Chrome
- CVE-2018-6087A use-after-free in WebAssembly in Google Chrome prior to 66.0.3359.117 allowed a remote attacker to execute arbitrary code inside a sandboxGoogle Chrome
- CVE-2018-6088An iterator-invalidation bug in PDFium in Google Chrome prior to 66.0.3359.117 allowed a remote attacker to execute arbitrary code inside a Google Chrome
- CVE-2018-6089A lack of CORS checks, after a Service Worker redirected to a cross-origin PDF, in Service Worker in Google Chrome prior to 66.0.3359.117 alGoogle Chrome
- CVE-2018-6090An integer overflow that lead to a heap buffer-overflow in Skia in Google Chrome prior to 66.0.3359.117 allowed a remote attacker to executeGoogle Chrome
- CVE-2018-6092An integer overflow on 32-bit systems in WebAssembly in Google Chrome prior to 66.0.3359.117 allowed a remote attacker to execute arbitrary Google Chrome
- CVE-2018-6094Inline metadata in GarbageCollection in Google Chrome prior to 66.0.3359.117 allowed a remote attacker to potentially exploit heap corruptioGoogle Chrome
- CVE-2018-6095Inappropriate dismissal of file picker on keyboard events in Blink in Google Chrome prior to 66.0.3359.117 allowed a remote attacker to readGoogle Chrome
- CVE-2018-6098Incorrect handling of confusable characters in URL Formatter in Google Chrome prior to 66.0.3359.117 allowed a remote attacker to perform doGoogle Chrome
- CVE-2018-6099A lack of CORS checks in Blink in Google Chrome prior to 66.0.3359.117 allowed a remote attacker to leak limited cross-origin data via a craGoogle Chrome
- CVE-2018-6101A lack of host validation in DevTools in Google Chrome prior to 66.0.3359.117 allowed a remote attacker to execute arbitrary code via a crafGoogle Chrome
- CVE-2018-6102Missing confusable characters in Internationalization in Google Chrome prior to 66.0.3359.117 allowed a remote attacker to spoof the contentGoogle Chrome
- CVE-2018-6103A stagnant permission prompt in Prompts in Google Chrome prior to 66.0.3359.117 allowed a remote attacker to bypass permission policy via a Google Chrome
- CVE-2018-6104Incorrect handling of confusable characters in URL Formatter in Google Chrome prior to 66.0.3359.117 allowed a remote attacker to perform doGoogle Chrome
- CVE-2018-6105Incorrect handling of confusable characters in Omnibox in Google Chrome prior to 66.0.3359.117 allowed a remote attacker to perform domain sGoogle Chrome
- CVE-2018-6107Incorrect handling of confusable characters in URL Formatter in Google Chrome prior to 66.0.3359.117 allowed a remote attacker to perform doGoogle Chrome
- CVE-2018-6108Incorrect handling of confusable characters in URL Formatter in Google Chrome prior to 66.0.3359.117 allowed a remote attacker to perform doGoogle Chrome
- CVE-2018-6115Inappropriate setting of the SEE_MASK_FLAG_NO_UI flag in file downloads in Google Chrome prior to 66.0.3359.117 allowed a remote attacker toGoogle Chrome
- CVE-2018-6116A nullptr dereference in WebAssembly in Google Chrome prior to 66.0.3359.117 allowed a remote attacker to potentially perform out of bounds Google Chrome
- CVE-2018-6152The implementation of the Page.downloadBehavior backend unconditionally marked downloaded files as safe, regardless of file type in Google CGoogle Chrome
- CVE-2018-16628panel/login in Kirby v2.5.12 allows XSS via a blog name.
- CVE-2018-16629panel/uploads/#elf_l1_XA in Subrion CMS v4.2.1 allows XSS via an SVG file with JavaScript in a SCRIPT element.intelliants/subrion
- CVE-2018-16631Subrion CMS v4.2.1 allows XSS via the panel/configuration/general/ SITE TITLE parameter.
- CVE-2018-16633Pluck v4.7.7 allows XSS via the admin.php?action=editpage&page= page title.
- CVE-2018-16634Pluck v4.7.7 allows CSRF via admin.php?action=settings.
- CVE-2018-19854An issue was discovered in the Linux kernel before 4.19.3.
- CVE-2018-17157In FreeBSD before 11.2-STABLE(r340854) and 11.2-RELEASE-p5, an integer overflow error when handling opcodes can cause memory corruption by sFreeBSD
- CVE-2018-17158In FreeBSD before 11.2-STABLE(r340854) and 11.2-RELEASE-p5, an integer overflow error can occur when handling the client address length fielFreeBSD
- CVE-2018-17159In FreeBSD before 11.2-STABLE(r340854) and 11.2-RELEASE-p5, the NFS server lacks a bounds check in the READDIRPLUS NFS request.FreeBSD
- CVE-2018-16478A Path Traversal in simplehttpserver versions <=0.2.1 allows to list any file in another folder of web root.simplehttpserver
- CVE-2018-6981VMware ESXi 6.7 without ESXi670-201811401-BG and VMware ESXi 6.5 without ESXi650-201811301-BG, VMware ESXi 6.0 without ESXi600-201811401-BG,VMware ESXi, VMware Workstation, and VMware Fusion
- CVE-2018-6982VMware ESXi 6.7 without ESXi670-201811401-BG and VMware ESXi 6.5 without ESXi650-201811301-BG contain uninitialized stack memory usage in thVMware ESXi
- CVE-2018-19837In LibSass prior to 3.5.5, Sass::Eval::operator()(Sass::Binary_Expression*) inside eval.cpp allows attackers to cause a denial-of-service re
- CVE-2018-19838In LibSass prior to 3.5.5, functions inside ast.cpp for IMPLEMENT_AST_OPERATORS expansion allow attackers to cause a denial-of-service resul
- CVE-2018-19839In LibSass prior to 3.5.5, the function handle_error in sass_context.cpp allows attackers to cause a denial-of-service resulting from a heap
- CVE-2018-19840The function WavpackPackInit in pack_utils.c in libwavpack.a in WavPack through 5.1.0 allows attackers to cause a denial-of-service (resourc
- CVE-2018-19841The function WavpackVerifySingleBlock in open_utils.c in libwavpack.a in WavPack through 5.1.0 allows attackers to cause a denial-of-service
- CVE-2018-19842getToken in libr/asm/p/asm_x86_nz.c in radare2 before 3.1.0 allows attackers to cause a denial of service (stack-based buffer over-read) via
- CVE-2018-19843opmov in libr/asm/p/asm_x86_nz.c in radare2 before 3.1.0 allows attackers to cause a denial of service (buffer over-read) via crafted x86 as
- CVE-2018-19849An issue was discovered in YzmCMS 5.2.
- CVE-2018-19853An issue was discovered in hitshop through 2014-07-15.