CVEs published December 12, 2018
81 CVEs were published on December 12, 2018: 0 critical, 3 high. 2 are now in CISA KEV.
- Published
- 81
- Critical
- 0
- High
- 3
- Medium
- 8
- Low
- 5
- Unrated
- 65
- Now in CISA KEV
- 2
- Fix available
- 5
Most affected products
- Microsoft Windows
- 10
- IBM BigFix Platform
- 7
- Siemens AG SINUMERIK 808D V4.7, SINUMERIK 808D V4.8, SINUME…
- 7
- Microsoft Edge · Microsoft ChakraCore +1
- 5
- exiv2
- 4
- Microsoft Internet Explorer
- 4
- Microsoft Office · Microsoft Excel
- 4
- McAfee Agent (MA) for Linux
- 3
- Microsoft Windows Server · Microsoft Windows
- 3
- Open Dental
- 3
High 3
- CVE-2018-16867A flaw was found in qemu Media Transfer Protocol (MTP) before version 3.1.0.[UNKNOWN] QEMU:
- CVE-2018-8611An elevation of privilege vulnerability exists when the Windows kernel fails to properly handle objects in memory, aka "Windows Kernel ElevaMicrosoft Windows
- CVE-2018-8639An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in memory, aka "Win32k Microsoft Windows
Medium, low and unrated 78
- CVE-2018-6706McAfee Agent (MA) non-Windows versions incorrect use of temporary file vulnerabilityMcAfee Agent (MA) for Linux
- CVE-2018-6704McAfee Agent for Linux Privilege Escalation vulnerabilityMcAfee Agent (MA) for Linux
- CVE-2018-6705McAfee Agent (MA) for Linux Privilege Escalation vulnerabilityMcAfee Agent (MA) for Linux
- CVE-2018-15717Open Dental before version 18.4 stores user passwords as base64 encoded MD5 hashes.Open Dental
- CVE-2018-15718Open Dental before version 18.4 transmits the entire user database over the network when a remote unauthenticated user accesses the command Open Dental
- CVE-2018-15719Open Dental before version 18.4 installs a mysql database and uses the default credentials of "root" with a blank password.Open Dental
- CVE-2018-20102An out-of-bounds read in dns_validate_dns_response in dns.c was discovered in HAProxy through 1.8.14.
- CVE-2018-20103An issue was discovered in dns.c in HAProxy through 1.8.14.
- CVE-2018-11457A vulnerability has been identified in SINUMERIK 828D V4.7 (All versions < V4.7 SP6 HF1), SINUMERIK 840D sl V4.7 (All versions < V4.7 SP6 HFSiemens AG SINUMERIK 828D V4.7, SINUMERIK 840D sl V4.7, SIN…
- CVE-2018-11458A vulnerability has been identified in SINUMERIK 828D V4.7 (All versions < V4.7 SP6 HF1), SINUMERIK 840D sl V4.7 (All versions < V4.7 SP6 HFSiemens AG SINUMERIK 828D V4.7, SINUMERIK 840D sl V4.7, SIN…
- CVE-2018-11459A vulnerability has been identified in SINUMERIK 808D V4.7 (All versions), SINUMERIK 808D V4.8 (All versions), SINUMERIK 828D V4.7 (All versSiemens AG SINUMERIK 808D V4.7, SINUMERIK 808D V4.8, SINUME…
- CVE-2018-11460A vulnerability has been identified in SINUMERIK 808D V4.7 (All versions), SINUMERIK 808D V4.8 (All versions), SINUMERIK 828D V4.7 (All versSiemens AG SINUMERIK 808D V4.7, SINUMERIK 808D V4.8, SINUME…
- CVE-2018-11461A vulnerability has been identified in SINUMERIK 808D V4.7 (All versions), SINUMERIK 808D V4.8 (All versions), SINUMERIK 828D V4.7 (All versSiemens AG SINUMERIK 808D V4.7, SINUMERIK 808D V4.8, SINUME…
- CVE-2018-11462A vulnerability has been identified in SINUMERIK 808D V4.7 (All versions), SINUMERIK 808D V4.8 (All versions), SINUMERIK 828D V4.7 (All versSiemens AG SINUMERIK 808D V4.7, SINUMERIK 808D V4.8, SINUME…
- CVE-2018-11463A vulnerability has been identified in SINUMERIK 808D V4.7 (All versions), SINUMERIK 808D V4.8 (All versions), SINUMERIK 828D V4.7 (All versSiemens AG SINUMERIK 808D V4.7, SINUMERIK 808D V4.8, SINUME…
- CVE-2018-11464A vulnerability has been identified in SINUMERIK 828D V4.7 (All versions < V4.7 SP6 HF1), SINUMERIK 840D sl V4.7 (All versions < V4.7 SP6 HFSiemens AG SINUMERIK 828D V4.7, SINUMERIK 840D sl V4.7, SIN…
- CVE-2018-11465A vulnerability has been identified in SINUMERIK 808D V4.7 (All versions), SINUMERIK 808D V4.8 (All versions), SINUMERIK 828D V4.7 (All versSiemens AG SINUMERIK 808D V4.7, SINUMERIK 808D V4.8, SINUME…
- CVE-2018-11466A vulnerability has been identified in SINUMERIK 808D V4.7 (All versions), SINUMERIK 808D V4.8 (All versions), SINUMERIK 828D V4.7 (All versSiemens AG SINUMERIK 808D V4.7, SINUMERIK 808D V4.8, SINUME…
- CVE-2018-13816A vulnerability has been identified in TIM 1531 IRC (All version < V2.0).Siemens AG TIM 1531 IRC
- CVE-2018-1474IBM BigFix Platform 9.2.0 through 9.2.14 and 9.5 through 9.5.9 is vulnerable to HTTP response splitting attacks, caused by improper validatiIBM BigFix Platform
- CVE-2018-1476IBM BigFix Platform 9.2.0 through 9.2.14 and 9.5 through 9.5.9 discloses sensitive information to unauthorized users.IBM BigFix Platform
- CVE-2018-1478IBM BigFix Platform 9.2.0 through 9.2.14 and 9.5 through 9.5.9 could allow a remote attacker to hijack the clicking action of the victim.IBM BigFix Platform
- CVE-2018-1480IBM BigFix Platform 9.2.0 through 9.2.14 and 9.5 through 9.5.9 does not set the 'HttpOnly' attribute on authorization tokens or session cookIBM BigFix Platform
- CVE-2018-1481IBM BigFix Platform 9.2.0 through 9.2.14 and 9.5 through 9.5.9 stores sensitive information in URL parameters.IBM BigFix Platform
- CVE-2018-1484IBM BigFix Platform 9.2.0 through 9.2.14 and 9.5 through 9.5.9 does not set the secure attribute on authorization tokens or session cookies.IBM BigFix Platform
- CVE-2018-1485IBM BigFix Platform 9.2.0 through 9.2.14 and 9.5 through 9.5.9 does not renew a session variable after a successful authentication which couIBM BigFix Platform
- CVE-2018-1901IBM WebSphere Application Server 8.5 and 9.0 could allow a remote attacker to temporarily gain elevated privileges on the system, caused by IBM WebSphere Application Server
- CVE-2018-1926IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 Admin Console is vulnerable to cross-site request forgery, caused by improper validaIBM WebSphere Application Server
- CVE-2018-20101The codection "Import users from CSV with meta" plugin before 1.12.1 for WordPress allows XSS via the value of a cell.
- CVE-2018-15328On BIG-IP 14.0.x, 13.x, 12.x, and 11.x, Enterprise Manager 3.1.1, BIG-IQ 6.x, 5.x, and 4.x, and iWorkflow 2.x, the passphrases for SNMPv3 usF5 Networks BIG-IP (LTM, AAM, AFM, Analytics, APM, ASM, DNS…
- CVE-2018-17949Cross site scripting vulnerability in iManager prior to 3.1 SP2.Micro Focus NetIQ iManager 3.1 SP2
- CVE-2018-17950Incorrect enforcement of authorization checks in eDirectory prior to 9.1 SP2Micro Focus NetIQ eDirectory 9.1 SP2
- CVE-2018-17952Cross site scripting vulnerability in eDirectory prior to 9.1 SP2Micro Focus NetIQ eDirectory 9.1 SP2
- CVE-2018-8650A cross-site-scripting (XSS) vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web requesMicrosoft SharePoint
- CVE-2018-20094An issue was discovered in XXL-CONF 1.6.0.com.xuxueli:xxl-conf-admin
- CVE-2018-20095An issue was discovered in EnsureCapacity in Core/Ap4Array.h in Bento4 1.5.1-627.
- CVE-2018-20096There is a heap-based buffer over-read in the Exiv2::tEXtToDataBuf function of pngimage.cpp in Exiv2 0.27-RC3.exiv2
- CVE-2018-20098There is a heap-based buffer over-read in Exiv2::Jp2Image::encodeJp2Header of jp2image.cpp in Exiv2 0.27-RC3.exiv2
- CVE-2018-20099There is an infinite loop in Exiv2::Jp2Image::encodeJp2Header of jp2image.cpp in Exiv2 0.27-RC3.exiv2
- CVE-2018-18397The userfaultfd implementation in the Linux kernel before 4.19.7 mishandles access control for certain UFFDIO_ ioctl calls, as demonstrated
- CVE-2018-10143The Palo Alto Networks Expedition Migration tool 1.0.107 and earlier may allow an unauthenticated attacker with remote access to run system Palo Alto Networks Expedition
- CVE-2018-20097There is a SEGV in Exiv2::Internal::TiffParserWorker::findPrimaryGroups of tiffimage_int.cpp in Exiv2 0.27-RC3.exiv2
- CVE-2018-8477An information disclosure vulnerability exists when the Windows kernel improperly handles objects in memory, aka "Windows Kernel InformationMicrosoft Windows
- CVE-2018-8514An information disclosure vulnerability exists when Remote Procedure Call runtime improperly initializes objects in memory, aka "Remote ProcMicrosoft Windows
- CVE-2018-8517A denial of service vulnerability exists when .NET Framework improperly handles special web requests, aka ".NET Framework Denial Of Service Microsoft .NET Framework
- CVE-2018-8540A remote code execution vulnerability exists when the Microsoft .NET Framework fails to validate input properly, aka ".NET Framework Remote Microsoft .NET Framework
- CVE-2018-8580An information disclosure vulnerability exists where certain modes of the search function in Microsoft SharePoint Server are vulnerable to cMicrosoft SharePoint
- CVE-2018-8583A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka "CMicrosoft Edge · Microsoft ChakraCore +1
- CVE-2018-8587A remote code execution vulnerability exists in Microsoft Outlook software when it fails to properly handle objects in memory, aka "MicrosofMicrosoft Office · Microsoft Outlook
- CVE-2018-8595An information disclosure vulnerability exists when the Windows GDI component improperly discloses the contents of its memory, aka "Windows Microsoft Windows
- CVE-2018-8596An information disclosure vulnerability exists when the Windows GDI component improperly discloses the contents of its memory, aka "Windows Microsoft Windows
- CVE-2018-8597A remote code execution vulnerability exists in Microsoft Excel software when the software fails to properly handle objects in memory, aka "Microsoft Office · Microsoft Excel
- CVE-2018-8598An information disclosure vulnerability exists when Microsoft Excel improperly discloses the contents of its memory, aka "Microsoft Excel InMicrosoft Office · Microsoft Excel
- CVE-2018-8599An elevation of privilege vulnerability exists when the Diagnostics Hub Standard Collector Service improperly impersonates certain file operMicrosoft Visual Studio · Microsoft Windows Server +1
- CVE-2018-8604A tampering vulnerability exists when Microsoft Exchange Server fails to properly handle profile data, aka "Microsoft Exchange Server TamperMicrosoft Exchange Server
- CVE-2018-8612A Denial Of Service vulnerability exists when Connected User Experiences and Telemetry Service fails to validate certain function values, akMicrosoft Windows Server · Microsoft Windows
- CVE-2018-8617A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka "CMicrosoft Edge · Microsoft ChakraCore +1
- CVE-2018-8618A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka "CMicrosoft Edge · Microsoft ChakraCore +1
- CVE-2018-8619A remote code execution vulnerability exists when the Internet Explorer VBScript execution policy does not properly restrict VBScript under Microsoft Internet Explorer
- CVE-2018-8621An information disclosure vulnerability exists when the Windows kernel improperly handles objects in memory, aka "Windows Kernel InformationMicrosoft Windows Server · Microsoft Windows
- CVE-2018-8622An information disclosure vulnerability exists when the Windows kernel improperly handles objects in memory, aka "Windows Kernel InformationMicrosoft Windows
- CVE-2018-8624A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka "CMicrosoft Edge · Microsoft ChakraCore +1
- CVE-2018-8625A remote code execution vulnerability exists in the way that the VBScript engine handles objects in memory, aka "Windows VBScript Engine RemMicrosoft Internet Explorer
- CVE-2018-8626A remote code execution vulnerability exists in Windows Domain Name System (DNS) servers when they fail to properly handle requests, aka "WiMicrosoft Windows Server 2012 R2 · Microsoft Windows Ser… +1
- CVE-2018-8627An information disclosure vulnerability exists when Microsoft Excel software reads out of bound memory due to an uninitialized variable, whiMicrosoft Office · Microsoft Excel
- CVE-2018-8628A remote code execution vulnerability exists in Microsoft PowerPoint software when the software fails to properly handle objects in memory, Microsoft Office · Microsoft PowerPoint +1
- CVE-2018-8629A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka "CMicrosoft Edge · Microsoft ChakraCore +1
- CVE-2018-8631A remote code execution vulnerability exists when Internet Explorer improperly accesses objects in memory, aka "Internet Explorer Memory CorMicrosoft Internet Explorer
- CVE-2018-8634A remote code execution vulnerability exists in Windows where Microsoft text-to-speech fails to properly handle objects in the memory, aka "Microsoft Windows Server · Microsoft Windows
- CVE-2018-8635An elevation of privilege vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted authenticatioMicrosoft SharePoint Server · Microsoft SharePoint
- CVE-2018-8636A remote code execution vulnerability exists in Microsoft Excel software when the software fails to properly handle objects in memory, aka "Microsoft Office · Microsoft Excel
- CVE-2018-8637An information disclosure vulnerability exists in Windows kernel that could allow an attacker to retrieve information that could lead to a KMicrosoft Windows 10 Servers · Microsoft Windows
- CVE-2018-8638An information disclosure vulnerability exists when DirectX improperly handles objects in memory, aka "DirectX Information Disclosure VulnerMicrosoft Windows
- CVE-2018-8641An elevation of privilege vulnerability exists in Windows when the Windows kernel-mode driver fails to properly handle objects in memory, akMicrosoft Windows
- CVE-2018-8643A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Internet Explorer, aka "ScripMicrosoft Internet Explorer
- CVE-2018-8649A denial of service vulnerability exists when Windows improperly handles objects in memory, aka "Windows Denial of Service Vulnerability." TMicrosoft Windows
- CVE-2018-8651A cross site scripting vulnerability exists when Microsoft Dynamics NAV does not properly sanitize a specially crafted web request to an affMicrosoft Dynamics NAV
- CVE-2018-8652A Cross-site Scripting (XSS) vulnerability exists when Windows Azure Pack does not properly sanitize user-provided input, aka "Windows AzureMicrosoft Windows Azure Pack Rollup