# CVEs published 2018-12-05

29 CVEs were published on December 5, 2018: 1 critical, 4 high. Days are UTC.

- [CVE-2018-16791](https://cve.now/CVE-2018-16791.md): In SolarWinds SFTP/SCP Server through 2018-09-10, the configuration file is world readable and writable, and stores user passwords in an ins (no CVSS)
- [CVE-2018-16792](https://cve.now/CVE-2018-16792.md): SolarWinds SFTP/SCP server through 2018-09-10 is vulnerable to XXE via a world readable and writable configuration file that allows an attac (no CVSS)
- [CVE-2018-18312](https://cve.now/CVE-2018-18312.md): Perl before 5.26.3 and 5.28.0 before 5.28.1 has a buffer overflow via a crafted regular expression that triggers invalid write operations. (no CVSS)
- [CVE-2018-19608](https://cve.now/CVE-2018-19608.md): Arm Mbed TLS before 2.14.1, before 2.7.8, and before 2.1.17 allows a local unprivileged attacker to recover the plaintext of RSA decryption, (no CVSS)
- [CVE-2018-19650](https://cve.now/CVE-2018-19650.md): Local attackers can trigger a stack-based buffer overflow on vulnerable installations of Antiy-AVL ATool security management v1.0.0.22. (no CVSS)
- [CVE-2018-19753](https://cve.now/CVE-2018-19753.md): Tarantella Enterprise before 3.11 allows Directory Traversal. (no CVSS)
- [CVE-2018-19754](https://cve.now/CVE-2018-19754.md): Tarantella Enterprise before 3.11 allows bypassing Access Control. (no CVSS)
- [CVE-2018-1002101](https://cve.now/CVE-2018-1002101.md): In Kubernetes versions 1.9.0-1.9.9, 1.10.0-1.10.5, and 1.11.0-1.11.1, user input was handled insecurely while setting up volume mounts on Wi (CVSS 5.9, Kubernetes · k8s.io/kubernetes)
- [CVE-2018-1002103](https://cve.now/CVE-2018-1002103.md): In Minikube versions 0.3.0-0.29.0, minikube exposes the Kubernetes Dashboard listening on the VM IP at port 30000. (CVSS 8.1, Kubernetes Minikube · k8s.io/minikube)
- [CVE-2018-1002105](https://cve.now/CVE-2018-1002105.md): In all Kubernetes versions prior to v1.10.11, v1.11.5, and v1.12.3, incorrect handling of error responses to proxied upgrade requests in the (CVSS 9.8, Kubernetes · github.com/kubernetes/kubernetes)
- [CVE-2018-12155](https://cve.now/CVE-2018-12155.md): Data leakage in cryptographic libraries for Intel IPP before 2019 update1 release may allow an authenticated user to potentially enable info (no CVSS, Intel Integrated Performance Primitives)
- [CVE-2018-19877](https://cve.now/CVE-2018-19877.md): login.php in Adiscon LogAnalyzer before 4.1.7 has XSS via the Login Button Referer field. (no CVSS)
- [CVE-2018-19876](https://cve.now/CVE-2018-19876.md): cairo 1.16.0, in cairo\_ft\_apply\_variations() in cairo-ft-font.c, would free memory using a free function incompatible with WebKit's fastMall (no CVSS)
- [CVE-2018-15773](https://cve.now/CVE-2018-15773.md): Dell Encryption Enterprise \\ Dell Data Protection Encryption Information Disclosure Vulnerability (no CVSS, Dell Encryption)
- [CVE-2018-15797](https://cve.now/CVE-2018-15797.md): NFS Volume release errand leaks cf admin credentials in logs (CVSS 8.4, Cloud Foundry NFS Volume Release)
- [CVE-2017-1622](https://cve.now/CVE-2017-1622.md): IBM QRadar SIEM 7.2.8 and 7.3 does not validate, or incorrectly validates, a certificate. (CVSS 3.7, IBM QRadar SIEM)
- [CVE-2018-1568](https://cve.now/CVE-2018-1568.md): IBM QRadar SIEM 7.2 and 7.3 allows web pages to be stored locally which can be read by another user on the system. (CVSS 4.0, IBM QRadar SIEM)
- [CVE-2018-1648](https://cve.now/CVE-2018-1648.md): IBM QRadar SIEM 7.2 and 7.3 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive info (no CVSS)
- [CVE-2018-1650](https://cve.now/CVE-2018-1650.md): IBM QRadar SIEM 7.2 and 7.3 uses hard-coded credentials which could allow an attacker to bypass the authentication configured by the adminis (CVSS 5.9, IBM QRadar SIEM)
- [CVE-2018-1697](https://cve.now/CVE-2018-1697.md): IBM Maximo Asset Management 7.6 could allow an authenticated user to enumerate usernames using a specially crafted HTTP request. (CVSS 4.3, IBM Maximo Asset Management)
- [CVE-2018-1728](https://cve.now/CVE-2018-1728.md): IBM QRadar SIEM 7.2 and 7.3 is vulnerable to cross-site scripting. (CVSS 5.4, IBM QRadar SIEM)
- [CVE-2018-1730](https://cve.now/CVE-2018-1730.md): IBM QRadar SIEM 7.2 and 7.3 is vulnerable to a XML External Entity Injection (XXE) attack when processing XML data. (CVSS 7.1, IBM QRadar SIEM)
- [CVE-2018-1732](https://cve.now/CVE-2018-1732.md): IBM QRadar Advisor with Watson 1.14.0 discloses sensitive information to unauthorized users. (CVSS 5.3, IBM QRadar SIEM)
- [CVE-2018-1941](https://cve.now/CVE-2018-1941.md): IBM Campaign 9.1.0 and 9.1.2 could allow a local user to obtain admini privileges due to the application not validating access permissions. (CVSS 8.4, IBM Campaign)
- [CVE-2018-19857](https://cve.now/CVE-2018-19857.md): The CAF demuxer in modules/demux/caf.c in VideoLAN VLC media player 3.0.4 may read memory from an uninitialized pointer when processing magi (no CVSS)
- [CVE-2018-19859](https://cve.now/CVE-2018-19859.md): OpenRefine before 3.2 beta allows directory traversal via a relative pathname in a ZIP archive. (no CVSS, org.openrefine:main)
- [CVE-2018-19864](https://cve.now/CVE-2018-19864.md): NUUO NVRmini2 Network Video Recorder firmware through 3.9.1 allows remote attackers to execute arbitrary code or cause a denial of service ( (no CVSS)
- [CVE-2018-19865](https://cve.now/CVE-2018-19865.md): A keystroke logging issue was discovered in Virtual Keyboard in Qt 5.7.x, 5.8.x, 5.9.x, 5.10.x, and 5.11.x before 5.11.3. (no CVSS)
- [CVE-2018-19786](https://cve.now/CVE-2018-19786.md): HashiCorp Vault before 1.0.0 writes the master key to the server log in certain unusual or misconfigured scenarios in which incorrect data c (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2018-12-05
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.