CVEs published December 5, 2018
29 CVEs were published on December 5, 2018: 1 critical, 4 high.
- Published
- 29
- Critical
- 1
- High
- 4
- Medium
- 6
- Low
- 1
- Unrated
- 17
- Now in CISA KEV
- 0
- Fix available
- 6
Most affected products
- IBM QRadar SIEM
- 6
- Cloud Foundry NFS Volume Release
- 1
- Dell Encryption
- 1
- IBM Campaign
- 1
- IBM Maximo Asset Management
- 1
- Intel Integrated Performance Primitives
- 1
- Kubernetes · github.com/kubernetes/kubernetes
- 1
- Kubernetes · k8s.io/kubernetes
- 1
- Kubernetes Minikube · k8s.io/minikube
- 1
- org.openrefine:main
- 1
Critical 1
High 4
- CVE-2018-1002103In Minikube versions 0.3.0-0.29.0, minikube exposes the Kubernetes Dashboard listening on the VM IP at port 30000.Kubernetes Minikube · k8s.io/minikube
- CVE-2018-15797NFS Volume release errand leaks cf admin credentials in logsCloud Foundry NFS Volume Release
- CVE-2018-1730IBM QRadar SIEM 7.2 and 7.3 is vulnerable to a XML External Entity Injection (XXE) attack when processing XML data.IBM QRadar SIEM
- CVE-2018-1941IBM Campaign 9.1.0 and 9.1.2 could allow a local user to obtain admini privileges due to the application not validating access permissions.IBM Campaign
Medium, low and unrated 24
- CVE-2018-16791In SolarWinds SFTP/SCP Server through 2018-09-10, the configuration file is world readable and writable, and stores user passwords in an ins
- CVE-2018-16792SolarWinds SFTP/SCP server through 2018-09-10 is vulnerable to XXE via a world readable and writable configuration file that allows an attac
- CVE-2018-18312Perl before 5.26.3 and 5.28.0 before 5.28.1 has a buffer overflow via a crafted regular expression that triggers invalid write operations.
- CVE-2018-19608Arm Mbed TLS before 2.14.1, before 2.7.8, and before 2.1.17 allows a local unprivileged attacker to recover the plaintext of RSA decryption,
- CVE-2018-19650Local attackers can trigger a stack-based buffer overflow on vulnerable installations of Antiy-AVL ATool security management v1.0.0.22.
- CVE-2018-19753Tarantella Enterprise before 3.11 allows Directory Traversal.
- CVE-2018-19754Tarantella Enterprise before 3.11 allows bypassing Access Control.
- CVE-2018-1002101In Kubernetes versions 1.9.0-1.9.9, 1.10.0-1.10.5, and 1.11.0-1.11.1, user input was handled insecurely while setting up volume mounts on WiKubernetes · k8s.io/kubernetes
- CVE-2018-12155Data leakage in cryptographic libraries for Intel IPP before 2019 update1 release may allow an authenticated user to potentially enable infoIntel Integrated Performance Primitives
- CVE-2018-19877login.php in Adiscon LogAnalyzer before 4.1.7 has XSS via the Login Button Referer field.
- CVE-2018-19876cairo 1.16.0, in cairo_ft_apply_variations() in cairo-ft-font.c, would free memory using a free function incompatible with WebKit's fastMall
- CVE-2018-15773Dell Encryption Enterprise \ Dell Data Protection Encryption Information Disclosure VulnerabilityDell Encryption
- CVE-2017-1622IBM QRadar SIEM 7.2.8 and 7.3 does not validate, or incorrectly validates, a certificate.IBM QRadar SIEM
- CVE-2018-1568IBM QRadar SIEM 7.2 and 7.3 allows web pages to be stored locally which can be read by another user on the system.IBM QRadar SIEM
- CVE-2018-1648IBM QRadar SIEM 7.2 and 7.3 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive info
- CVE-2018-1650IBM QRadar SIEM 7.2 and 7.3 uses hard-coded credentials which could allow an attacker to bypass the authentication configured by the adminisIBM QRadar SIEM
- CVE-2018-1697IBM Maximo Asset Management 7.6 could allow an authenticated user to enumerate usernames using a specially crafted HTTP request.IBM Maximo Asset Management
- CVE-2018-1728IBM QRadar SIEM 7.2 and 7.3 is vulnerable to cross-site scripting.IBM QRadar SIEM
- CVE-2018-1732IBM QRadar Advisor with Watson 1.14.0 discloses sensitive information to unauthorized users.IBM QRadar SIEM
- CVE-2018-19857The CAF demuxer in modules/demux/caf.c in VideoLAN VLC media player 3.0.4 may read memory from an uninitialized pointer when processing magi
- CVE-2018-19859OpenRefine before 3.2 beta allows directory traversal via a relative pathname in a ZIP archive.org.openrefine:main
- CVE-2018-19864NUUO NVRmini2 Network Video Recorder firmware through 3.9.1 allows remote attackers to execute arbitrary code or cause a denial of service (
- CVE-2018-19865A keystroke logging issue was discovered in Virtual Keyboard in Qt 5.7.x, 5.8.x, 5.9.x, 5.10.x, and 5.11.x before 5.11.3.
- CVE-2018-19786HashiCorp Vault before 1.0.0 writes the master key to the server log in certain unusual or misconfigured scenarios in which incorrect data c