CVEs published December 11, 2018
53 CVEs were published on December 11, 2018: 2 critical, 2 high. 2 are now in CISA KEV.
- Published
- 53
- Critical
- 2
- High
- 2
- Medium
- 4
- Low
- 0
- Unrated
- 45
- Now in CISA KEV
- 2
- Fix available
- 32
Most affected products
- Google Chrome
- 26
- phpmyadmin/phpmyadmin
- 3
- IBM Curam Social Program Management
- 2
- SAP NetWeaver AS Java
- 2
- IBM DataPower Gateways · IBM MQ Appliance
- 1
- IBM WebSphere Application Server
- 1
- McAfee Agent
- 1
- ro.pippo:pippo-core
- 1
- SAP Basis
- 1
- SAP Business One Service Layer
- 1
Critical 2
High 2
- CVE-2018-1904IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 could allow remote attackers to execute arbitrary Java code through an administrativIBM WebSphere Application Server
- CVE-2018-17480Execution of user supplied Javascript during array deserialization leading to an out of bounds write in V8 in Google Chrome prior to 71.0.35Google Chrome
Medium, low and unrated 49
- CVE-2018-2486SAP Marketing (UICUAN (1.20, 1.30, 1.40), SAPSCORE (1.13, 1.14)) does not sufficiently encode user-controlled inputs, resulting in Cross-SitSAP Marketing
- CVE-2018-2492SAML 2.0 functionality in SAP NetWeaver AS Java, does not sufficiently validate XML documents received from an untrusted source.SAP NetWeaver Application Server
- CVE-2018-2494Necessary authorization checks for an authenticated user, resulting in escalation of privileges, have been fixed in SAP Basis AS ABAP of SAPSAP Basis
- CVE-2018-2497The security audit log of SAP HANA, versions 1.0 and 2.0, does not log SELECT events if these events are part of a statement with the syntaxSAP HANA
- CVE-2018-2500Under certain conditions SAP Mobile Secure Android client (before version 6.60.19942.0 SP28 1711) allows an attacker to access information wSAP Mobile Secure for Android
- CVE-2018-2502TRACE method is enabled in SAP Business One Service Layer .SAP Business One Service Layer
- CVE-2018-2503By default, the SAP NetWeaver AS Java keystore service does not sufficiently restrict the access to resources that should be protected.SAP NetWeaver AS Java
- CVE-2018-2504SAP NetWeaver AS Java Web Container service does not validate against whitelist the HTTP host header which can result in HTTP Host Header MaSAP NetWeaver AS Java
- CVE-2018-2505SAP Commerce does not sufficiently validate user-controlled inputs, resulting in Cross-Site Scripting (XSS) vulnerability in storefronts thaSAP Commerce
- CVE-2018-18810TIBCO Managed File Transfer Credentials DisclosureTIBCO Software TIBCO Managed File Transfer Command Center ·…
- CVE-2018-20064doorGets 7.0 allows remote attackers to write to arbitrary files via directory traversal, as demonstrated by a dg-user/?controller=theme&act
- CVE-2018-19968An attacker can exploit phpMyAdmin before 4.8.4 to leak the contents of a local file because of an error in the transformation feature.phpmyadmin/phpmyadmin
- CVE-2018-19969phpMyAdmin 4.7.x and 4.8.x versions prior to 4.8.4 are affected by a series of CSRF flaws.phpmyadmin/phpmyadmin
- CVE-2018-19970In phpMyAdmin before 4.8.4, an XSS vulnerability was found in the navigation tree, where an attacker can deliver a payload to a user throughphpmyadmin/phpmyadmin
- CVE-2018-20060urllib3 before version 1.23 does not remove the Authorization HTTP header when following a cross-origin redirect (i.e., a redirect that diffurllib3
- CVE-2018-20061A SQL injection issue was discovered in ERPNext 10.x and 11.x through 11.0.3-beta.29.
- CVE-2018-1652IBM DataPower Gateway 7.1.0.0 through 7.1.0.19, 7.2.0.0 through 7.2.0.16, 7.5.0.0 through 7.5.0.10, 7.5.1.0 through 7.5.1.9, 7.5.2.0 throughIBM DataPower Gateways · IBM MQ Appliance
- CVE-2018-1654IBM Curam Social Program Management 6.0.5, 6.1.1, 6.2.0, 7.0.1, and 7.0.3 could allow a remote attacker to conduct phishing attacks, using aIBM Curam Social Program Management
- CVE-2018-1900IBM Curam Social Program Management 6.0.5, 6.1.1, 6.2.0, 7.0.1, and 7.0.3 is vulnerable to cross-site scripting.IBM Curam Social Program Management
- CVE-2018-17481Incorrect object lifecycle handling in PDFium in Google Chrome prior to 71.0.3578.98 allowed a remote attacker to potentially exploit heap cGoogle Chrome
- CVE-2018-18335Heap buffer overflow in Skia in Google Chrome prior to 71.0.3578.80 allowed a remote attacker to potentially exploit heap corruption via a cGoogle Chrome
- CVE-2018-18336Incorrect object lifecycle in PDFium in Google Chrome prior to 71.0.3578.80 allowed a remote attacker to potentially exploit heap corruptionGoogle Chrome
- CVE-2018-18337Incorrect handling of stylesheets leading to a use after free in Blink in Google Chrome prior to 71.0.3578.80 allowed a remote attacker to pGoogle Chrome
- CVE-2018-18338Incorrect, thread-unsafe use of SkImage in Canvas in Google Chrome prior to 71.0.3578.80 allowed a remote attacker to potentially exploit heGoogle Chrome
- CVE-2018-18339Incorrect object lifecycle in WebAudio in Google Chrome prior to 71.0.3578.80 allowed a remote attacker to potentially exploit heap corruptiGoogle Chrome
- CVE-2018-18340Incorrect object lifecycle in MediaRecorder in Google Chrome prior to 71.0.3578.80 allowed a remote attacker to potentially exploit heap corGoogle Chrome
- CVE-2018-18341An integer overflow leading to a heap buffer overflow in Blink in Google Chrome prior to 71.0.3578.80 allowed a remote attacker to potentialGoogle Chrome
- CVE-2018-18342Execution of user supplied Javascript during object deserialization can update object length leading to an out of bounds write in V8 in GoogGoogle Chrome
- CVE-2018-18343Incorrect handing of paths leading to a use after free in Skia in Google Chrome prior to 71.0.3578.80 allowed a remote attacker to potentialGoogle Chrome
- CVE-2018-18344Inappropriate allowance of the setDownloadBehavior devtools protocol feature in Extensions in Google Chrome prior to 71.0.3578.80 allowed a
- CVE-2018-18345Incorrect handling of blob URLS in Site Isolation in Google Chrome prior to 71.0.3578.80 allowed a remote attacker who had compromised the rGoogle Chrome
- CVE-2018-18346Incorrect handling of alert box display in Blink in Google Chrome prior to 71.0.3578.80 allowed a remote attacker to present confusing browsGoogle Chrome
- CVE-2018-18347Incorrect handling of failed navigations with invalid URLs in Navigation in Google Chrome prior to 71.0.3578.80 allowed a remote attacker toGoogle Chrome
- CVE-2018-18348Incorrect handling of bidirectional domain names with RTL characters in Omnibox in Google Chrome prior to 71.0.3578.80 allowed a remote attaGoogle Chrome
- CVE-2018-18349Remote frame navigations was incorrectly permitted to local resources in Blink in Google Chrome prior to 71.0.3578.80 allowed an attacker whGoogle Chrome
- CVE-2018-18350Incorrect handling of CSP enforcement during navigations in Blink in Google Chrome prior to 71.0.3578.80 allowed a remote attacker to bypassGoogle Chrome
- CVE-2018-18351Lack of proper validation of ancestor frames site when sending lax cookies in Navigation in Google Chrome prior to 71.0.3578.80 allowed a reGoogle Chrome
- CVE-2018-18352Service works could inappropriately gain access to cross origin audio in Media in Google Chrome prior to 71.0.3578.80 allowed a remote attacGoogle Chrome
- CVE-2018-18353Failure to dismiss http auth dialogs on navigation in Network Authentication in Google Chrome on Android prior to 71.0.3578.80 allowed a remGoogle Chrome
- CVE-2018-18354Insufficient validate of external protocols in Shell Integration in Google Chrome on Windows prior to 71.0.3578.80 allowed a remote attackerGoogle Chrome
- CVE-2018-18355Incorrect handling of confusable characters in URL Formatter in Google Chrome prior to 71.0.3578.80 allowed a remote attacker to spoof the cGoogle Chrome
- CVE-2018-18356An integer overflow in path handling lead to a use after free in Skia in Google Chrome prior to 71.0.3578.80 allowed a remote attacker to poGoogle Chrome
- CVE-2018-18357Incorrect handling of confusable characters in URL Formatter in Google Chrome prior to 71.0.3578.80 allowed a remote attacker to spoof the cGoogle Chrome
- CVE-2018-18358Lack of special casing of localhost in WPAD files in Google Chrome prior to 71.0.3578.80 allowed an attacker on the local network segment toGoogle Chrome
- CVE-2018-18359Incorrect handling of Reflect.construct in V8 in Google Chrome prior to 71.0.3578.80 allowed a remote attacker to perform an out of bounds mGoogle Chrome
- CVE-2018-20059jaxb/JaxbEngine.java in Pippo 1.11.0 allows XXE.ro.pippo:pippo-core
- CVE-2018-20056An issue was discovered in /bin/boa on D-Link DIR-619L Rev.B 2.06B1 and DIR-605L Rev.B 2.12B1 devices.
- CVE-2018-20057An issue was discovered in /bin/boa on D-Link DIR-619L Rev.B 2.06B1 and DIR-605L Rev.B 2.12B1 devices.
- CVE-2018-20058In Evernote before 7.6 on macOS, there is a local file path traversal issue in attachment previewing, aka MACOSNOTE-28634.