# CVEs published 2018-12-04

80 CVEs were published on December 4, 2018: 0 critical, 1 high. Days are UTC.

- [CVE-2018-17939](https://cve.now/CVE-2018-17939.md): An issue was discovered in GitLab Community and Enterprise Edition 11.1.x before 11.1.8, 11.2.x before 11.2.5, and 11.3.x before 11.3.2. (no CVSS)
- [CVE-2018-17975](https://cve.now/CVE-2018-17975.md): An issue was discovered in GitLab Community Edition 11.x before 11.1.8, 11.2.x before 11.2.5, and 11.3.x before 11.3.2. (no CVSS)
- [CVE-2018-17976](https://cve.now/CVE-2018-17976.md): An issue was discovered in GitLab Community Edition 11.x before 11.1.8, 11.2.x before 11.2.5, and 11.3.x before 11.3.2. (no CVSS)
- [CVE-2018-18640](https://cve.now/CVE-2018-18640.md): An issue was discovered in GitLab Community and Enterprise Edition before 11.2.7, 11.3.x before 11.3.8, and 11.4.x before 11.4.3. (no CVSS)
- [CVE-2018-18641](https://cve.now/CVE-2018-18641.md): An issue was discovered in GitLab Community and Enterprise Edition before 11.2.7, 11.3.x before 11.3.8, and 11.4.x before 11.4.3. (no CVSS)
- [CVE-2018-18642](https://cve.now/CVE-2018-18642.md): An issue was discovered in GitLab Community and Enterprise Edition before 11.2.7, 11.3.x before 11.3.8, and 11.4.x before 11.4.3. (no CVSS)
- [CVE-2018-18644](https://cve.now/CVE-2018-18644.md): An issue was discovered in GitLab Community and Enterprise Edition 11.x before 11.2.7, 11.3.x before 11.3.8, and 11.4.x before 11.4.3. (no CVSS)
- [CVE-2018-18645](https://cve.now/CVE-2018-18645.md): An issue was discovered in GitLab Community and Enterprise Edition before 11.2.7, 11.3.x before 11.3.8, and 11.4.x before 11.4.3. (no CVSS)
- [CVE-2018-18646](https://cve.now/CVE-2018-18646.md): An issue was discovered in GitLab Community and Enterprise Edition before 11.2.7, 11.3.x before 11.3.8, and 11.4.x before 11.4.3. (no CVSS)
- [CVE-2018-18647](https://cve.now/CVE-2018-18647.md): An issue was discovered in GitLab Community and Enterprise Edition before 11.2.7, 11.3.x before 11.3.8, and 11.4.x before 11.4.3. (no CVSS)
- [CVE-2018-18648](https://cve.now/CVE-2018-18648.md): An issue was discovered in GitLab Community and Enterprise Edition before 11.2.7, 11.3.x before 11.3.8, and 11.4.x before 11.4.3. (no CVSS)
- [CVE-2018-18843](https://cve.now/CVE-2018-18843.md): The Kubernetes integration in GitLab Enterprise Edition 11.x before 11.2.8, 11.3.x before 11.3.9, and 11.4.x before 11.4.4 has SSRF. (no CVSS)
- [CVE-2018-18989](https://cve.now/CVE-2018-18989.md): In CX-One Versions 4.42 and prior (CX-Programmer Versions 9.66 and prior and CX-Server Versions 5.0.23 and prior), when processing project f (no CVSS, CX-One)
- [CVE-2018-18993](https://cve.now/CVE-2018-18993.md): Two stack-based buffer overflow vulnerabilities have been discovered in CX-One Versions 4.42 and prior (CX-Programmer Versions 9.66 and prio (no CVSS, CX-One)
- [CVE-2018-17160](https://cve.now/CVE-2018-17160.md): In FreeBSD before 11.2-STABLE(r341486) and 11.2-RELEASE-p6, insufficient bounds checking in one of the device models provided by bhyve can p (no CVSS, FreeBSD)
- [CVE-2018-18991](https://cve.now/CVE-2018-18991.md): Reflected cross-site scripting (non-persistent) in SCADA WebServer (Versions prior to 2.03.0001) could allow an attacker to send a crafted U (no CVSS, SCADA WebServer)
- [CVE-2018-5496](https://cve.now/CVE-2018-5496.md): Data ONTAP operating in 7-Mode versions prior to 8.2.5P2 are susceptible to a vulnerability which discloses sensitive information to an unau (no CVSS, NetApp Data ONTAP operating in 7-Mode)
- [CVE-2018-0468](https://cve.now/CVE-2018-0468.md): A vulnerability in the configuration of a local database installed as part of the Cisco Energy Management Suite (CEMS) could allow an authen (no CVSS)
- [CVE-2018-7956](https://cve.now/CVE-2018-7956.md): Huawei VIP App is a mobile app for Malaysia customers that purchased P20 Series, Nova 3/3i and Mate 20. (no CVSS, Huawei Technologies Co. Huawei VIP App)
- [CVE-2018-7987](https://cve.now/CVE-2018-7987.md): There is an out-of-bounds write vulnerability on Huawei P20 smartphones with versions before 8.1.0.171(C00). (no CVSS, Huawei Technologies Co. Huawei P20)
- [CVE-2018-11347](https://cve.now/CVE-2018-11347.md): The YunoHost 2.7.2 through 2.7.14 web application is affected by one HTTP Response Header Injection. (no CVSS)
- [CVE-2018-11348](https://cve.now/CVE-2018-11348.md): Two XSS vulnerabilities are located in the profile edition page of the user panel of the YunoHost 2.7.2 through 2.7.14 web application. (no CVSS)
- [CVE-2018-12305](https://cve.now/CVE-2018-12305.md): Cross-site scripting in File Explorer in ASUSTOR ADM version 3.1.1 allows attackers to execute JavaScript by uploading SVG images with embed (no CVSS)
- [CVE-2018-12306](https://cve.now/CVE-2018-12306.md): Directory Traversal in File Explorer in ASUSTOR ADM version 3.1.1 allows attackers to view arbitrary files by modifying the "file1" URL para (no CVSS)
- [CVE-2018-12307](https://cve.now/CVE-2018-12307.md): OS command injection in user.cgi in ASUSTOR ADM version 3.1.1 allows attackers to execute system commands as root via the "name" POST parame (no CVSS)
- [CVE-2018-12308](https://cve.now/CVE-2018-12308.md): Encryption key disclosure in share.cgi in ASUSTOR ADM version 3.1.1 allows attackers to obtain the encryption key via the "encrypt\_key" URL (no CVSS)
- [CVE-2018-12309](https://cve.now/CVE-2018-12309.md): Directory Traversal in upload.cgi in ASUSTOR ADM version 3.1.1 allows attackers to upload files to arbitrary locations by modifying the "pat (no CVSS)
- [CVE-2018-12310](https://cve.now/CVE-2018-12310.md): Cross-site scripting in the Login page in ASUSTOR ADM version 3.1.1 allows attackers to execute JavaScript via the System Announcement featu (no CVSS)
- [CVE-2018-12311](https://cve.now/CVE-2018-12311.md): Cross-site scripting vulnerability in File Explorer in ASUSTOR ADM version 3.1.1 allows attackers to execute arbitrary JavaScript when a fil (no CVSS)
- [CVE-2018-12312](https://cve.now/CVE-2018-12312.md): OS command injection in user.cgi in ASUSTOR ADM version 3.1.1 allows attackers to execute system commands as root via the "secret\_key" URL p (no CVSS)
- [CVE-2018-12313](https://cve.now/CVE-2018-12313.md): OS command injection in snmp.cgi in ASUSTOR ADM version 3.1.1 allows attackers to execute system commands without authentication via the "ro (no CVSS)
- [CVE-2018-12314](https://cve.now/CVE-2018-12314.md): Directory Traversal in downloadwallpaper.cgi in ASUSTOR ADM version 3.1.1 allows attackers to download arbitrary files by manipulating the " (no CVSS)
- [CVE-2018-12315](https://cve.now/CVE-2018-12315.md): Missing verification of a password in ASUSTOR ADM version 3.1.1 allows attackers to change account passwords without entering the current pa (no CVSS)
- [CVE-2018-12316](https://cve.now/CVE-2018-12316.md): OS Command Injection in upload.cgi in ASUSTOR ADM version 3.1.1 allows attackers to execute system commands by modifying the filename POST p (no CVSS)
- [CVE-2018-12317](https://cve.now/CVE-2018-12317.md): OS command injection in group.cgi in ASUSTOR ADM version 3.1.1 allows attackers to execute system commands as root by modifying the "name" P (no CVSS)
- [CVE-2018-12318](https://cve.now/CVE-2018-12318.md): Information disclosure in the SNMP settings page in ASUSTOR ADM version 3.1.1 allows attackers to obtain the SNMP password in cleartext. (no CVSS)
- [CVE-2018-12319](https://cve.now/CVE-2018-12319.md): Denial-of-service in the login page of ASUSTOR ADM 3.1.1 allows attackers to prevent users from signing in by placing malformed text in the (no CVSS)
- [CVE-2018-6085](https://cve.now/CVE-2018-6085.md): Re-entry of a destructor in Networking Disk Cache in Google Chrome prior to 66.0.3359.117 allowed a remote attacker to execute arbitrary cod (no CVSS, Google Chrome)
- [CVE-2018-6086](https://cve.now/CVE-2018-6086.md): A double-eviction in the Incognito mode cache that lead to a user-after-free in Networking Disk Cache in Google Chrome prior to 66.0.3359.11 (no CVSS, Google Chrome)
- [CVE-2018-6087](https://cve.now/CVE-2018-6087.md): A use-after-free in WebAssembly in Google Chrome prior to 66.0.3359.117 allowed a remote attacker to execute arbitrary code inside a sandbox (no CVSS, Google Chrome)
- [CVE-2018-6088](https://cve.now/CVE-2018-6088.md): An iterator-invalidation bug in PDFium in Google Chrome prior to 66.0.3359.117 allowed a remote attacker to execute arbitrary code inside a (no CVSS, Google Chrome)
- [CVE-2018-6089](https://cve.now/CVE-2018-6089.md): A lack of CORS checks, after a Service Worker redirected to a cross-origin PDF, in Service Worker in Google Chrome prior to 66.0.3359.117 al (no CVSS, Google Chrome)
- [CVE-2018-6090](https://cve.now/CVE-2018-6090.md): An integer overflow that lead to a heap buffer-overflow in Skia in Google Chrome prior to 66.0.3359.117 allowed a remote attacker to execute (no CVSS, Google Chrome)
- [CVE-2018-6092](https://cve.now/CVE-2018-6092.md): An integer overflow on 32-bit systems in WebAssembly in Google Chrome prior to 66.0.3359.117 allowed a remote attacker to execute arbitrary (no CVSS, Google Chrome)
- [CVE-2018-6094](https://cve.now/CVE-2018-6094.md): Inline metadata in GarbageCollection in Google Chrome prior to 66.0.3359.117 allowed a remote attacker to potentially exploit heap corruptio (no CVSS, Google Chrome)
- [CVE-2018-6095](https://cve.now/CVE-2018-6095.md): Inappropriate dismissal of file picker on keyboard events in Blink in Google Chrome prior to 66.0.3359.117 allowed a remote attacker to read (no CVSS, Google Chrome)
- [CVE-2018-6098](https://cve.now/CVE-2018-6098.md): Incorrect handling of confusable characters in URL Formatter in Google Chrome prior to 66.0.3359.117 allowed a remote attacker to perform do (no CVSS, Google Chrome)
- [CVE-2018-6099](https://cve.now/CVE-2018-6099.md): A lack of CORS checks in Blink in Google Chrome prior to 66.0.3359.117 allowed a remote attacker to leak limited cross-origin data via a cra (no CVSS, Google Chrome)
- [CVE-2018-6101](https://cve.now/CVE-2018-6101.md): A lack of host validation in DevTools in Google Chrome prior to 66.0.3359.117 allowed a remote attacker to execute arbitrary code via a craf (no CVSS, Google Chrome)
- [CVE-2018-6102](https://cve.now/CVE-2018-6102.md): Missing confusable characters in Internationalization in Google Chrome prior to 66.0.3359.117 allowed a remote attacker to spoof the content (no CVSS, Google Chrome)
- [CVE-2018-6103](https://cve.now/CVE-2018-6103.md): A stagnant permission prompt in Prompts in Google Chrome prior to 66.0.3359.117 allowed a remote attacker to bypass permission policy via a (no CVSS, Google Chrome)
- [CVE-2018-6104](https://cve.now/CVE-2018-6104.md): Incorrect handling of confusable characters in URL Formatter in Google Chrome prior to 66.0.3359.117 allowed a remote attacker to perform do (no CVSS, Google Chrome)
- [CVE-2018-6105](https://cve.now/CVE-2018-6105.md): Incorrect handling of confusable characters in Omnibox in Google Chrome prior to 66.0.3359.117 allowed a remote attacker to perform domain s (no CVSS, Google Chrome)
- [CVE-2018-6107](https://cve.now/CVE-2018-6107.md): Incorrect handling of confusable characters in URL Formatter in Google Chrome prior to 66.0.3359.117 allowed a remote attacker to perform do (no CVSS, Google Chrome)
- [CVE-2018-6108](https://cve.now/CVE-2018-6108.md): Incorrect handling of confusable characters in URL Formatter in Google Chrome prior to 66.0.3359.117 allowed a remote attacker to perform do (no CVSS, Google Chrome)
- [CVE-2018-6115](https://cve.now/CVE-2018-6115.md): Inappropriate setting of the SEE\_MASK\_FLAG\_NO\_UI flag in file downloads in Google Chrome prior to 66.0.3359.117 allowed a remote attacker to (no CVSS, Google Chrome)
- [CVE-2018-6116](https://cve.now/CVE-2018-6116.md): A nullptr dereference in WebAssembly in Google Chrome prior to 66.0.3359.117 allowed a remote attacker to potentially perform out of bounds (no CVSS, Google Chrome)
- [CVE-2018-6152](https://cve.now/CVE-2018-6152.md): The implementation of the Page.downloadBehavior backend unconditionally marked downloaded files as safe, regardless of file type in Google C (no CVSS, Google Chrome)
- [CVE-2018-16628](https://cve.now/CVE-2018-16628.md): panel/login in Kirby v2.5.12 allows XSS via a blog name. (no CVSS)
- [CVE-2018-16629](https://cve.now/CVE-2018-16629.md): panel/uploads/#elf\_l1\_XA in Subrion CMS v4.2.1 allows XSS via an SVG file with JavaScript in a SCRIPT element. (no CVSS, intelliants/subrion)
- [CVE-2018-16631](https://cve.now/CVE-2018-16631.md): Subrion CMS v4.2.1 allows XSS via the panel/configuration/general/ SITE TITLE parameter. (no CVSS)
- [CVE-2018-16633](https://cve.now/CVE-2018-16633.md): Pluck v4.7.7 allows XSS via the admin.php?action=editpage&page= page title. (no CVSS)
- [CVE-2018-16634](https://cve.now/CVE-2018-16634.md): Pluck v4.7.7 allows CSRF via admin.php?action=settings. (no CVSS)
- [CVE-2018-19591](https://cve.now/CVE-2018-19591.md): In the GNU C Library (aka glibc or libc6) through 2.28, attempting to resolve a crafted hostname via getaddrinfo() leads to the allocation o (CVSS 7.5)
- [CVE-2018-19854](https://cve.now/CVE-2018-19854.md): An issue was discovered in the Linux kernel before 4.19.3. (no CVSS)
- [CVE-2018-17157](https://cve.now/CVE-2018-17157.md): In FreeBSD before 11.2-STABLE(r340854) and 11.2-RELEASE-p5, an integer overflow error when handling opcodes can cause memory corruption by s (no CVSS, FreeBSD)
- [CVE-2018-17158](https://cve.now/CVE-2018-17158.md): In FreeBSD before 11.2-STABLE(r340854) and 11.2-RELEASE-p5, an integer overflow error can occur when handling the client address length fiel (no CVSS, FreeBSD)
- [CVE-2018-17159](https://cve.now/CVE-2018-17159.md): In FreeBSD before 11.2-STABLE(r340854) and 11.2-RELEASE-p5, the NFS server lacks a bounds check in the READDIRPLUS NFS request. (no CVSS, FreeBSD)
- [CVE-2018-16478](https://cve.now/CVE-2018-16478.md): A Path Traversal in simplehttpserver versions \<=0.2.1 allows to list any file in another folder of web root. (no CVSS, simplehttpserver)
- [CVE-2018-6981](https://cve.now/CVE-2018-6981.md): VMware ESXi 6.7 without ESXi670-201811401-BG and VMware ESXi 6.5 without ESXi650-201811301-BG, VMware ESXi 6.0 without ESXi600-201811401-BG, (no CVSS, VMware ESXi, VMware Workstation, and VMware Fusion)
- [CVE-2018-6982](https://cve.now/CVE-2018-6982.md): VMware ESXi 6.7 without ESXi670-201811401-BG and VMware ESXi 6.5 without ESXi650-201811301-BG contain uninitialized stack memory usage in th (no CVSS, VMware ESXi)
- [CVE-2018-19837](https://cve.now/CVE-2018-19837.md): In LibSass prior to 3.5.5, Sass::Eval::operator()(Sass::Binary\_Expression\*) inside eval.cpp allows attackers to cause a denial-of-service re (no CVSS)
- [CVE-2018-19838](https://cve.now/CVE-2018-19838.md): In LibSass prior to 3.5.5, functions inside ast.cpp for IMPLEMENT\_AST\_OPERATORS expansion allow attackers to cause a denial-of-service resul (no CVSS)
- [CVE-2018-19839](https://cve.now/CVE-2018-19839.md): In LibSass prior to 3.5.5, the function handle\_error in sass\_context.cpp allows attackers to cause a denial-of-service resulting from a heap (no CVSS)
- [CVE-2018-19840](https://cve.now/CVE-2018-19840.md): The function WavpackPackInit in pack\_utils.c in libwavpack.a in WavPack through 5.1.0 allows attackers to cause a denial-of-service (resourc (no CVSS)
- [CVE-2018-19841](https://cve.now/CVE-2018-19841.md): The function WavpackVerifySingleBlock in open\_utils.c in libwavpack.a in WavPack through 5.1.0 allows attackers to cause a denial-of-service (no CVSS)
- [CVE-2018-19842](https://cve.now/CVE-2018-19842.md): getToken in libr/asm/p/asm\_x86\_nz.c in radare2 before 3.1.0 allows attackers to cause a denial of service (stack-based buffer over-read) via (no CVSS)
- [CVE-2018-19843](https://cve.now/CVE-2018-19843.md): opmov in libr/asm/p/asm\_x86\_nz.c in radare2 before 3.1.0 allows attackers to cause a denial of service (buffer over-read) via crafted x86 as (no CVSS)
- [CVE-2018-19849](https://cve.now/CVE-2018-19849.md): An issue was discovered in YzmCMS 5.2. (no CVSS)
- [CVE-2018-19853](https://cve.now/CVE-2018-19853.md): An issue was discovered in hitshop through 2014-07-15. (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2018-12-04
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.