CVEs published December 6, 2018
75 CVEs were published on December 6, 2018: 0 critical, 3 high.
- Published
- 75
- Critical
- 0
- High
- 3
- Medium
- 5
- Low
- 0
- Unrated
- 67
- Now in CISA KEV
- 0
- Fix available
- 0
Most affected products
- Google Android
- 20
- IBM i2 Enterprise Insight Analysis
- 3
- McAfee True Key
- 3
- F5 Networks BIG-IP (APM), BIG-IP APM Clients, BIG-IP Edge C…
- 1
- IBM Connections
- 1
- IBM Financial Transaction Manager
- 1
- org.craftercms:crafter-studio
- 1
- Symantec Norton Password Manager
- 1
High 3
Medium, low and unrated 72
- CVE-2018-16522Amazon Web Services (AWS) FreeRTOS through 1.3.1 has an uninitialized pointer free in SOCKETS_SetSockOpt.
- CVE-2018-16523Amazon Web Services (AWS) FreeRTOS through 1.3.1, FreeRTOS up to V10.0.1 (with FreeRTOS+TCP), and WITTENSTEIN WHIS Connect middleware TCP/IP
- CVE-2018-16524Amazon Web Services (AWS) FreeRTOS through 1.3.1, FreeRTOS up to V10.0.1 (with FreeRTOS+TCP), and WITTENSTEIN WHIS Connect middleware TCP/IP
- CVE-2018-16525Amazon Web Services (AWS) FreeRTOS through 1.3.1, FreeRTOS up to V10.0.1 (with FreeRTOS+TCP), and WITTENSTEIN WHIS Connect middleware TCP/IP
- CVE-2018-16526Amazon Web Services (AWS) FreeRTOS through 1.3.1, FreeRTOS up to V10.0.1 (with FreeRTOS+TCP), and WITTENSTEIN WHIS Connect middleware TCP/IP
- CVE-2018-16527Amazon Web Services (AWS) FreeRTOS through 1.3.1, FreeRTOS up to V10.0.1 (with FreeRTOS+TCP), and WITTENSTEIN WHIS Connect middleware TCP/IP
- CVE-2018-16528Amazon Web Services (AWS) FreeRTOS through 1.3.1 allows remote attackers to execute arbitrary code because of mbedTLS context object corrupt
- CVE-2018-16598An issue was discovered in Amazon Web Services (AWS) FreeRTOS through 1.3.1, FreeRTOS up to V10.0.1 (with FreeRTOS+TCP), and WITTENSTEIN WHI
- CVE-2018-16599An issue was discovered in Amazon Web Services (AWS) FreeRTOS through 1.3.1, FreeRTOS up to V10.0.1 (with FreeRTOS+TCP), and WITTENSTEIN WHI
- CVE-2018-16600An issue was discovered in Amazon Web Services (AWS) FreeRTOS through 1.3.1, FreeRTOS up to V10.0.1 (with FreeRTOS+TCP), and WITTENSTEIN WHI
- CVE-2018-16601An issue was discovered in Amazon Web Services (AWS) FreeRTOS through 1.3.1, FreeRTOS up to V10.0.1 (with FreeRTOS+TCP), and WITTENSTEIN WHI
- CVE-2018-16602An issue was discovered in Amazon Web Services (AWS) FreeRTOS through 1.3.1, FreeRTOS up to V10.0.1 (with FreeRTOS+TCP), and WITTENSTEIN WHI
- CVE-2018-16603An issue was discovered in Amazon Web Services (AWS) FreeRTOS through 1.3.1, FreeRTOS up to V10.0.1 (with FreeRTOS+TCP), and WITTENSTEIN WHI
- CVE-2018-19659An exploitable authenticated command-injection vulnerability exists in the web server functionality of Moxa NPort W2x50A products with firmw
- CVE-2018-19660An exploitable authenticated command-injection vulnerability exists in the web server functionality of Moxa NPort W2x50A products with firmw
- CVE-2018-19665The Bluetooth subsystem in QEMU mishandles negative values for length variables, leading to memory corruption.
- CVE-2018-19923An issue was discovered in Sales & Company Management System (SCMS) through 2018-06-06.
- CVE-2018-19924An issue was discovered in Sales & Company Management System (SCMS) through 2018-06-06.
- CVE-2018-19925An issue was discovered in Sales & Company Management System (SCMS) through 2018-06-06.
- CVE-2018-19926Zenitel Norway IP-StationWeb before 4.2.3.9 allows reflected XSS via the goform/ PATH_INFO.
- CVE-2018-19927Zenitel Norway IP-StationWeb before 4.2.3.9 allows stored XSS via the Display Name for Station Status or Account Settings, related to the go
- CVE-2018-19921Zoho ManageEngine OpManager 12.3 before 123237 has XSS in the domain controller.
- CVE-2018-19922Persistent Cross-Site Scripting (XSS) in the advancedsetup_websiteblocking.html Website Blocking page of the Actiontec C1000A router with fi
- CVE-2018-19919Pixelimity 1.0 has Persistent XSS via the admin/portfolio.php data[title] parameter, as demonstrated by a crafted onload attribute of an SVG
- CVE-2018-18362Norton Password Manager for Android (formerly Norton Identity Safe) may be susceptible to a cross site scripting (XSS) exploit, which is a tSymantec Norton Password Manager
- CVE-2018-19913DomainMOD through 4.11.01 has XSS via the assets/add/registrar-accounts.php UserName, Reseller ID, or notes field.
- CVE-2018-19914DomainMOD through 4.11.01 has XSS via the assets/add/dns.php Profile Name or notes field.
- CVE-2018-19915DomainMOD through 4.11.01 has XSS via the assets/edit/host.php Web Host Name or Web Host URL field.
- CVE-2018-19911FreeSWITCH through 1.8.2, when mod_xml_rpc is enabled, allows remote attackers to execute arbitrary commands via the api/system or txtapi/sy
- CVE-2018-19908An issue was discovered in MISP 2.4.9x before 2.4.99.
- CVE-2018-1504IBM i2 Enterprise Insight Analysis 2.1.7 could allow a remote attacker to hijack the clicking action of the victim.IBM i2 Enterprise Insight Analysis
- CVE-2018-1505IBM i2 Enterprise Insight Analysis 2.1.7 allows web pages to be stored locally which can be read by another user on the system.IBM i2 Enterprise Insight Analysis
- CVE-2018-1525IBM i2 Enterprise Insight Analysis 2.1.7 could allow a remote attacker to obtain sensitive information, caused by the failure to properly enIBM i2 Enterprise Insight Analysis
- CVE-2018-15332The svpn component of the F5 BIG-IP APM client prior to version 7.1.7.2 for Linux and macOS runs as a privileged process and can allow an unF5 Networks BIG-IP (APM), BIG-IP APM Clients, BIG-IP Edge C…
- CVE-2018-1871IBM Financial Transaction Manager for Digital Payments for Multi-Platform 3.0.0, 3.0.2, and 3.0.5 is vulnerable to cross-site scripting.IBM Financial Transaction Manager
- CVE-2018-1935IBM Connections 5.0, 5.5, and 6.0 could allow an authenticated user to obtain sensitive information from invalid request error messages.IBM Connections
- CVE-2018-9538In V4L2SliceVideoDecodeAccelerator::Dequeue of v4l2_slice_video_decode_accelerator.cc, there is a possible out of bounds read of a function Google Android
- CVE-2018-9547In unflatten of GraphicBuffer.cpp, there is a possible bad fd close due to improper input validation.Google Android
- CVE-2018-9548In multiple functions of ContentProvider.java, there is a possible permission bypass due to a missing URI validation.Google Android
- CVE-2018-9549In lppTransposer of lpp_tran.cpp there is a possible out of bounds write due to missing bounds check.Google Android
- CVE-2018-9550In CAacDecoder_Init of aacdecoder.cpp, there is a possible out of bounds write due to a missing bounds check.Google Android
- CVE-2018-9551In CAacDecoder_Init of aacdecoder.cpp, there is a possible out-of-bound write due to a missing bounds check.Google Android
- CVE-2018-9552In ihevcd_sao_shift_ctb of ihevcd_sao.c there is a possible out of bounds write due to missing bounds check.Google Android
- CVE-2018-9553In MasteringMetadata::Parse of mkvparser.cc there is a possible double free due to an insecure default value.Google Android
- CVE-2018-9554In dumpExtractors of IMediaExtractor.cp, there is a possible disclosure of recently accessed media files due to a permissions bypass.Google Android
- CVE-2018-9555In l2c_lcc_proc_pdu of l2c_fcr.cc, there is a possible out of bounds write due to a missing bounds check.Google Android
- CVE-2018-9556In ParsePayloadHeader of payload_metadata.cc, there is a possible out of bounds write due to an integer overflow.Google Android
- CVE-2018-9557In really_install_package of install.cpp, there is a possible free of arbitrary memory due to uninitialized data.Google Android
- CVE-2018-9558In rw_t2t_handle_tlv_detect of rw_t2t_ndef.cc, there is a possible out-of-bounds write due to a missing bounds check.Google Android
- CVE-2018-9559In persist_set_key and other functions of cryptfs.cpp, there is a possible out-of-bounds write due to an uncaught error.Google Android
- CVE-2018-9560In HID_DevAddRecord of hidd_api.cc, there is a possible out-of-bounds write due to a missing bounds check.Google Android
- CVE-2018-9562In bta_ag_do_disc of bta_ag_sdp.cc, there is a possible out-of-bound read due to an incorrect parameter size.Google Android
- CVE-2018-9565In readBytes of xltdecwbxml.c, there is a possible out of bounds read due to an integer overflow.Google Android
- CVE-2018-9566In process_service_search_rsp of sdp_discovery.c, there is a possible out of bounds read due to a missing bounds check.Google Android
- CVE-2018-9567On Pixel devices there is a bug causing verified boot to show the same certificate fingerprint despite using different signing keys.Google Android
- CVE-2018-9568In sk_clone_lock of sock.c, there is a possible memory corruption due to type confusion.Google Android
- CVE-2018-19907A Server-Side Template Injection issue was discovered in Crafter CMS 3.0.18.org.craftercms:crafter-studio
- CVE-2018-19894ThinkCMF X2.2.2 has SQL Injection via the functions check() and delete() in CommentadminController.class.php and is exploitable with the man
- CVE-2018-19895ThinkCMF X2.2.2 has SQL Injection via the function edit_post() in NavController.class.php and is exploitable with the manager privilege via
- CVE-2018-19896ThinkCMF X2.2.2 has SQL Injection via the function delete() in SlideController.class.php and is exploitable with the manager privilege via t
- CVE-2018-19897ThinkCMF X2.2.2 has SQL Injection via the function _listorders() in AdminbaseController.class.php and is exploitable with the manager privil
- CVE-2018-19898ThinkCMF X2.2.2 has SQL Injection via the method edit_post in ArticleController.class.php and is exploitable by normal authenticated users v
- CVE-2018-19892DomainMOD through 4.11.01 has XSS via the admin/dw/add-server.php DisplayName, HostName, or UserName field.
- CVE-2018-19893SearchController.php in PbootCMS 1.2.1 has SQL injection via the index.php/Search/index.html query string.
- CVE-2018-19881In Artifex MuPDF 1.14.0, svg/svg-run.c allows remote attackers to cause a denial of service (recursive calls followed by a fitz/xml.c fz_xml
- CVE-2018-19882In Artifex MuPDF 1.14.0, the svg_run_image function in svg/svg-run.c allows remote attackers to cause a denial of service (href_att NULL poi
- CVE-2018-19886An invalid memory address dereference was discovered in the huffcode function (libfaac/huff2.c) in Freeware Advanced Audio Coder (FAAC) 1.29
- CVE-2018-19887An invalid memory address dereference was discovered in the huffcode function (libfaac/huff2.c) in Freeware Advanced Audio Coder (FAAC) 1.29
- CVE-2018-19888An invalid memory address dereference was discovered in the huffcode function (libfaac/huff2.c) in Freeware Advanced Audio Coder (FAAC) 1.29
- CVE-2018-19889An invalid memory address dereference was discovered in the huffcode function (libfaac/huff2.c) in Freeware Advanced Audio Coder (FAAC) 1.29
- CVE-2018-19890An invalid memory address dereference was discovered in the huffcode function (libfaac/huff2.c) in Freeware Advanced Audio Coder (FAAC) 1.29
- CVE-2018-19891An invalid memory address dereference was discovered in the huffcode function (libfaac/huff2.c) in Freeware Advanced Audio Coder (FAAC) 1.29