CVEs published December 10, 2018
32 CVEs were published on December 10, 2018: 1 critical, 2 high. 1 is now in CISA KEV.
- Published
- 32
- Critical
- 1
- High
- 2
- Medium
- 1
- Low
- 1
- Unrated
- 27
- Now in CISA KEV
- 1
- Fix available
- 8
Most affected products
- org.jenkins-ci.main:jenkins-core
- 4
- Cloud Foundry Bits Service Release
- 1
- IBM WebSphere Application Server
- 1
- org.bedework:bw-webdav
- 1
- org.jenkins-ci.plugins:script-security
- 1
- org.jenkins-ci.plugins.workflow:workflow-cps · org.jenkins-…
- 1
- Pivotal RabbitMq for PCF
- 1
- Qualcomm Snapdragon Mobile, Snapdragon Wear
- 1
- Signal
- 1
Critical 1
High 2
Medium, low and unrated 29
- CVE-2018-20050Mishandling of an empty string on the Jooan JA-Q1H Wi-Fi camera with firmware 21.0.0.91 allows remote attackers to cause a denial of service
- CVE-2018-20051Mishandling of '>' on the Jooan JA-Q1H Wi-Fi camera with firmware 21.0.0.91 allows remote attackers to cause a denial of service (crash and
- CVE-2018-20029The nxfs.sys driver in the DokanFS library 0.6.0 in NoMachine before 6.4.6 on Windows 10 allows local users to cause a denial of service (BS
- CVE-2018-15805Accusoft PrizmDoc HTML5 Document Viewer before 13.5 contains an XML external entity (XXE) vulnerability, allowing an attacker to read arbitr
- CVE-2018-16635Blackcat CMS 1.3.2 allows XSS via the willkommen.php?lang=DE page title at backend/pages/modify.php.
- CVE-2018-16636Nucleus CMS 3.70 allows HTML Injection via the index.php body parameter.
- CVE-2018-3988Signal Messenger for Android 4.24.8 may expose private information when using "disappearing messages." If a user uses the photo feature avaiSignal
- CVE-2016-10502While generating trusted application id, An integer overflow can occur giving the trusted application an invalid identity in Snapdragon MobiQualcomm Snapdragon Mobile, Snapdragon Wear
- CVE-2018-1000862An information exposure vulnerability exists in Jenkins 2.153 and earlier, LTS 2.138.3 and earlier in DirectoryBrowserSupport.java that alloorg.jenkins-ci.main:jenkins-core
- CVE-2018-1000863A data modification vulnerability exists in Jenkins 2.153 and earlier, LTS 2.138.3 and earlier in User.java, IdStrategy.java that allows attorg.jenkins-ci.main:jenkins-core
- CVE-2018-1000864A denial of service vulnerability exists in Jenkins 2.153 and earlier, LTS 2.138.3 and earlier in CronTab.java that allows attackers with Ovorg.jenkins-ci.main:jenkins-core
- CVE-2018-1000865A sandbox bypass vulnerability exists in Script Security Plugin 1.47 and earlier in groovy-sandbox/src/main/java/org/kohsuke/groovy/sandbox/org.jenkins-ci.plugins:script-security
- CVE-2018-1000866A sandbox bypass vulnerability exists in Pipeline: Groovy Plugin 2.59 and earlier in groovy-sandbox/src/main/java/org/kohsuke/groovy/sandboxorg.jenkins-ci.plugins.workflow:workflow-cps · org.jenkins-…
- CVE-2018-1671IBM Curam Social Program Management 7.0.3 is vulnerable to HTML injection.
- CVE-2018-1957IBM WebSphere Application Server 9 could allow sensitive information to be available caused by mishandling of data by the application based IBM WebSphere Application Server
- CVE-2018-20009DomainMOD 4.11.01 has XSS via the assets/add/ssl-provider.php SSL Provider Name or SSL Provider URL field.
- CVE-2018-20010DomainMOD 4.11.01 has XSS via the assets/add/ssl-provider-account.php username field.
- CVE-2018-20011DomainMOD 4.11.01 has XSS via the assets/add/category.php Category Name or Stakeholder field.
- CVE-2018-20012PHPCMF 4.1.3 has XSS via the first input field to the index.php?s=member&c=register&m=index URI.
- CVE-2018-20015YzmCMS v5.2 has admin/role/add.html CSRF.
- CVE-2018-20017SEMCMS 3.5 has XSS via the first text box to the SEMCMS_Main.php URI.
- CVE-2018-20018S-CMS V3.0 has SQL injection via the S_id parameter, as demonstrated by the /1/?type=productinfo&S_id=140 URI.
- CVE-2018-20004An issue has been found in Mini-XML (aka mxml) 2.12.
- CVE-2018-20005An issue has been found in Mini-XML (aka mxml) 2.12.
- CVE-2018-20006An issue was discovered in PHPok v5.0.055.
- CVE-2018-20000Apereo Bedework bw-webdav before 4.0.3 allows XXE attacks, as demonstrated by an invite-reply document that reads a local file, related to worg.bedework:bw-webdav
- CVE-2018-20001In Libav 12.3, there is a floating point exception in the range_decode_culshift function (called from range_decode_bits) in libavcodec/apede
- CVE-2018-20002The _bfd_generic_read_minisymbols function in syms.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutil
- CVE-2018-19991VeryNginx 0.3.3 allows remote attackers to bypass the Web Application Firewall feature because there is no error handler (for get_uri_args o