# CVEs published 2018-12-12

81 CVEs were published on December 12, 2018: 0 critical, 3 high. 2 are now in CISA KEV. Days are UTC.

- [CVE-2018-6706](https://cve.now/CVE-2018-6706.md): McAfee Agent (MA) non-Windows versions incorrect use of temporary file vulnerability (CVSS 2.3, McAfee Agent (MA) for Linux)
- [CVE-2018-6704](https://cve.now/CVE-2018-6704.md): McAfee Agent for Linux Privilege Escalation vulnerability (CVSS 4.7, McAfee Agent (MA) for Linux)
- [CVE-2018-6705](https://cve.now/CVE-2018-6705.md): McAfee Agent (MA) for Linux Privilege Escalation vulnerability (CVSS 2.3, McAfee Agent (MA) for Linux)
- [CVE-2018-15717](https://cve.now/CVE-2018-15717.md): Open Dental before version 18.4 stores user passwords as base64 encoded MD5 hashes. (no CVSS, Open Dental)
- [CVE-2018-15718](https://cve.now/CVE-2018-15718.md): Open Dental before version 18.4 transmits the entire user database over the network when a remote unauthenticated user accesses the command (no CVSS, Open Dental)
- [CVE-2018-15719](https://cve.now/CVE-2018-15719.md): Open Dental before version 18.4 installs a mysql database and uses the default credentials of "root" with a blank password. (no CVSS, Open Dental)
- [CVE-2018-20102](https://cve.now/CVE-2018-20102.md): An out-of-bounds read in dns\_validate\_dns\_response in dns.c was discovered in HAProxy through 1.8.14. (no CVSS)
- [CVE-2018-20103](https://cve.now/CVE-2018-20103.md): An issue was discovered in dns.c in HAProxy through 1.8.14. (no CVSS)
- [CVE-2018-11457](https://cve.now/CVE-2018-11457.md): A vulnerability has been identified in SINUMERIK 828D V4.7 (All versions \< V4.7 SP6 HF1), SINUMERIK 840D sl V4.7 (All versions \< V4.7 SP6 HF (no CVSS, Siemens AG SINUMERIK 828D V4.7, SINUMERIK 840D sl V4.7, SIN…)
- [CVE-2018-11458](https://cve.now/CVE-2018-11458.md): A vulnerability has been identified in SINUMERIK 828D V4.7 (All versions \< V4.7 SP6 HF1), SINUMERIK 840D sl V4.7 (All versions \< V4.7 SP6 HF (no CVSS, Siemens AG SINUMERIK 828D V4.7, SINUMERIK 840D sl V4.7, SIN…)
- [CVE-2018-11459](https://cve.now/CVE-2018-11459.md): A vulnerability has been identified in SINUMERIK 808D V4.7 (All versions), SINUMERIK 808D V4.8 (All versions), SINUMERIK 828D V4.7 (All vers (no CVSS, Siemens AG SINUMERIK 808D V4.7, SINUMERIK 808D V4.8, SINUME…)
- [CVE-2018-11460](https://cve.now/CVE-2018-11460.md): A vulnerability has been identified in SINUMERIK 808D V4.7 (All versions), SINUMERIK 808D V4.8 (All versions), SINUMERIK 828D V4.7 (All vers (no CVSS, Siemens AG SINUMERIK 808D V4.7, SINUMERIK 808D V4.8, SINUME…)
- [CVE-2018-11461](https://cve.now/CVE-2018-11461.md): A vulnerability has been identified in SINUMERIK 808D V4.7 (All versions), SINUMERIK 808D V4.8 (All versions), SINUMERIK 828D V4.7 (All vers (no CVSS, Siemens AG SINUMERIK 808D V4.7, SINUMERIK 808D V4.8, SINUME…)
- [CVE-2018-11462](https://cve.now/CVE-2018-11462.md): A vulnerability has been identified in SINUMERIK 808D V4.7 (All versions), SINUMERIK 808D V4.8 (All versions), SINUMERIK 828D V4.7 (All vers (no CVSS, Siemens AG SINUMERIK 808D V4.7, SINUMERIK 808D V4.8, SINUME…)
- [CVE-2018-11463](https://cve.now/CVE-2018-11463.md): A vulnerability has been identified in SINUMERIK 808D V4.7 (All versions), SINUMERIK 808D V4.8 (All versions), SINUMERIK 828D V4.7 (All vers (no CVSS, Siemens AG SINUMERIK 808D V4.7, SINUMERIK 808D V4.8, SINUME…)
- [CVE-2018-11464](https://cve.now/CVE-2018-11464.md): A vulnerability has been identified in SINUMERIK 828D V4.7 (All versions \< V4.7 SP6 HF1), SINUMERIK 840D sl V4.7 (All versions \< V4.7 SP6 HF (no CVSS, Siemens AG SINUMERIK 828D V4.7, SINUMERIK 840D sl V4.7, SIN…)
- [CVE-2018-11465](https://cve.now/CVE-2018-11465.md): A vulnerability has been identified in SINUMERIK 808D V4.7 (All versions), SINUMERIK 808D V4.8 (All versions), SINUMERIK 828D V4.7 (All vers (no CVSS, Siemens AG SINUMERIK 808D V4.7, SINUMERIK 808D V4.8, SINUME…)
- [CVE-2018-11466](https://cve.now/CVE-2018-11466.md): A vulnerability has been identified in SINUMERIK 808D V4.7 (All versions), SINUMERIK 808D V4.8 (All versions), SINUMERIK 828D V4.7 (All vers (no CVSS, Siemens AG SINUMERIK 808D V4.7, SINUMERIK 808D V4.8, SINUME…)
- [CVE-2018-13816](https://cve.now/CVE-2018-13816.md): A vulnerability has been identified in TIM 1531 IRC (All version \< V2.0). (no CVSS, Siemens AG TIM 1531 IRC)
- [CVE-2018-1474](https://cve.now/CVE-2018-1474.md): IBM BigFix Platform 9.2.0 through 9.2.14 and 9.5 through 9.5.9 is vulnerable to HTTP response splitting attacks, caused by improper validati (CVSS 6.1, IBM BigFix Platform)
- [CVE-2018-1476](https://cve.now/CVE-2018-1476.md): IBM BigFix Platform 9.2.0 through 9.2.14 and 9.5 through 9.5.9 discloses sensitive information to unauthorized users. (CVSS 5.3, IBM BigFix Platform)
- [CVE-2018-1478](https://cve.now/CVE-2018-1478.md): IBM BigFix Platform 9.2.0 through 9.2.14 and 9.5 through 9.5.9 could allow a remote attacker to hijack the clicking action of the victim. (CVSS 6.1, IBM BigFix Platform)
- [CVE-2018-1480](https://cve.now/CVE-2018-1480.md): IBM BigFix Platform 9.2.0 through 9.2.14 and 9.5 through 9.5.9 does not set the 'HttpOnly' attribute on authorization tokens or session cook (CVSS 4.0, IBM BigFix Platform)
- [CVE-2018-1481](https://cve.now/CVE-2018-1481.md): IBM BigFix Platform 9.2.0 through 9.2.14 and 9.5 through 9.5.9 stores sensitive information in URL parameters. (CVSS 3.7, IBM BigFix Platform)
- [CVE-2018-1484](https://cve.now/CVE-2018-1484.md): IBM BigFix Platform 9.2.0 through 9.2.14 and 9.5 through 9.5.9 does not set the secure attribute on authorization tokens or session cookies. (CVSS 3.7, IBM BigFix Platform)
- [CVE-2018-1485](https://cve.now/CVE-2018-1485.md): IBM BigFix Platform 9.2.0 through 9.2.14 and 9.5 through 9.5.9 does not renew a session variable after a successful authentication which cou (CVSS 3.1, IBM BigFix Platform)
- [CVE-2018-1901](https://cve.now/CVE-2018-1901.md): IBM WebSphere Application Server 8.5 and 9.0 could allow a remote attacker to temporarily gain elevated privileges on the system, caused by (CVSS 5.0, IBM WebSphere Application Server)
- [CVE-2018-1926](https://cve.now/CVE-2018-1926.md): IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 Admin Console is vulnerable to cross-site request forgery, caused by improper valida (CVSS 4.3, IBM WebSphere Application Server)
- [CVE-2018-20101](https://cve.now/CVE-2018-20101.md): The codection "Import users from CSV with meta" plugin before 1.12.1 for WordPress allows XSS via the value of a cell. (no CVSS)
- [CVE-2018-15328](https://cve.now/CVE-2018-15328.md): On BIG-IP 14.0.x, 13.x, 12.x, and 11.x, Enterprise Manager 3.1.1, BIG-IQ 6.x, 5.x, and 4.x, and iWorkflow 2.x, the passphrases for SNMPv3 us (no CVSS, F5 Networks BIG-IP (LTM, AAM, AFM, Analytics, APM, ASM, DNS…)
- [CVE-2018-17949](https://cve.now/CVE-2018-17949.md): Cross site scripting vulnerability in iManager prior to 3.1 SP2. (no CVSS, Micro Focus NetIQ iManager 3.1 SP2)
- [CVE-2018-17950](https://cve.now/CVE-2018-17950.md): Incorrect enforcement of authorization checks in eDirectory prior to 9.1 SP2 (no CVSS, Micro Focus NetIQ eDirectory 9.1 SP2)
- [CVE-2018-17952](https://cve.now/CVE-2018-17952.md): Cross site scripting vulnerability in eDirectory prior to 9.1 SP2 (no CVSS, Micro Focus NetIQ eDirectory 9.1 SP2)
- [CVE-2018-8650](https://cve.now/CVE-2018-8650.md): A cross-site-scripting (XSS) vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web reques (CVSS 5.4, Microsoft SharePoint)
- [CVE-2018-16867](https://cve.now/CVE-2018-16867.md): A flaw was found in qemu Media Transfer Protocol (MTP) before version 3.1.0. (CVSS 7.0, \[UNKNOWN\] QEMU:)
- [CVE-2018-20094](https://cve.now/CVE-2018-20094.md): An issue was discovered in XXL-CONF 1.6.0. (no CVSS, com.xuxueli:xxl-conf-admin)
- [CVE-2018-20095](https://cve.now/CVE-2018-20095.md): An issue was discovered in EnsureCapacity in Core/Ap4Array.h in Bento4 1.5.1-627. (no CVSS)
- [CVE-2018-20096](https://cve.now/CVE-2018-20096.md): There is a heap-based buffer over-read in the Exiv2::tEXtToDataBuf function of pngimage.cpp in Exiv2 0.27-RC3. (no CVSS, exiv2)
- [CVE-2018-20098](https://cve.now/CVE-2018-20098.md): There is a heap-based buffer over-read in Exiv2::Jp2Image::encodeJp2Header of jp2image.cpp in Exiv2 0.27-RC3. (no CVSS, exiv2)
- [CVE-2018-20099](https://cve.now/CVE-2018-20099.md): There is an infinite loop in Exiv2::Jp2Image::encodeJp2Header of jp2image.cpp in Exiv2 0.27-RC3. (no CVSS, exiv2)
- [CVE-2018-18397](https://cve.now/CVE-2018-18397.md): The userfaultfd implementation in the Linux kernel before 4.19.7 mishandles access control for certain UFFDIO\_ ioctl calls, as demonstrated (no CVSS)
- [CVE-2018-10143](https://cve.now/CVE-2018-10143.md): The Palo Alto Networks Expedition Migration tool 1.0.107 and earlier may allow an unauthenticated attacker with remote access to run system (no CVSS, Palo Alto Networks Expedition)
- [CVE-2018-20097](https://cve.now/CVE-2018-20097.md): There is a SEGV in Exiv2::Internal::TiffParserWorker::findPrimaryGroups of tiffimage\_int.cpp in Exiv2 0.27-RC3. (no CVSS, exiv2)
- [CVE-2018-8477](https://cve.now/CVE-2018-8477.md): An information disclosure vulnerability exists when the Windows kernel improperly handles objects in memory, aka "Windows Kernel Information (no CVSS, Microsoft Windows)
- [CVE-2018-8514](https://cve.now/CVE-2018-8514.md): An information disclosure vulnerability exists when Remote Procedure Call runtime improperly initializes objects in memory, aka "Remote Proc (no CVSS, Microsoft Windows)
- [CVE-2018-8517](https://cve.now/CVE-2018-8517.md): A denial of service vulnerability exists when .NET Framework improperly handles special web requests, aka ".NET Framework Denial Of Service (no CVSS, Microsoft .NET Framework)
- [CVE-2018-8540](https://cve.now/CVE-2018-8540.md): A remote code execution vulnerability exists when the Microsoft .NET Framework fails to validate input properly, aka ".NET Framework Remote (no CVSS, Microsoft .NET Framework)
- [CVE-2018-8580](https://cve.now/CVE-2018-8580.md): An information disclosure vulnerability exists where certain modes of the search function in Microsoft SharePoint Server are vulnerable to c (no CVSS, Microsoft SharePoint)
- [CVE-2018-8583](https://cve.now/CVE-2018-8583.md): A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka "C (no CVSS, Microsoft Edge · Microsoft ChakraCore +1)
- [CVE-2018-8587](https://cve.now/CVE-2018-8587.md): A remote code execution vulnerability exists in Microsoft Outlook software when it fails to properly handle objects in memory, aka "Microsof (no CVSS, Microsoft Office · Microsoft Outlook)
- [CVE-2018-8595](https://cve.now/CVE-2018-8595.md): An information disclosure vulnerability exists when the Windows GDI component improperly discloses the contents of its memory, aka "Windows (no CVSS, Microsoft Windows)
- [CVE-2018-8596](https://cve.now/CVE-2018-8596.md): An information disclosure vulnerability exists when the Windows GDI component improperly discloses the contents of its memory, aka "Windows (no CVSS, Microsoft Windows)
- [CVE-2018-8597](https://cve.now/CVE-2018-8597.md): A remote code execution vulnerability exists in Microsoft Excel software when the software fails to properly handle objects in memory, aka " (no CVSS, Microsoft Office · Microsoft Excel)
- [CVE-2018-8598](https://cve.now/CVE-2018-8598.md): An information disclosure vulnerability exists when Microsoft Excel improperly discloses the contents of its memory, aka "Microsoft Excel In (no CVSS, Microsoft Office · Microsoft Excel)
- [CVE-2018-8599](https://cve.now/CVE-2018-8599.md): An elevation of privilege vulnerability exists when the Diagnostics Hub Standard Collector Service improperly impersonates certain file oper (no CVSS, Microsoft Visual Studio · Microsoft Windows Server +1)
- [CVE-2018-8604](https://cve.now/CVE-2018-8604.md): A tampering vulnerability exists when Microsoft Exchange Server fails to properly handle profile data, aka "Microsoft Exchange Server Tamper (no CVSS, Microsoft Exchange Server)
- [CVE-2018-8611](https://cve.now/CVE-2018-8611.md): An elevation of privilege vulnerability exists when the Windows kernel fails to properly handle objects in memory, aka "Windows Kernel Eleva (CVSS 7.8, KEV, Microsoft Windows)
- [CVE-2018-8612](https://cve.now/CVE-2018-8612.md): A Denial Of Service vulnerability exists when Connected User Experiences and Telemetry Service fails to validate certain function values, ak (no CVSS, Microsoft Windows Server · Microsoft Windows)
- [CVE-2018-8617](https://cve.now/CVE-2018-8617.md): A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka "C (no CVSS, Microsoft Edge · Microsoft ChakraCore +1)
- [CVE-2018-8618](https://cve.now/CVE-2018-8618.md): A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka "C (no CVSS, Microsoft Edge · Microsoft ChakraCore +1)
- [CVE-2018-8619](https://cve.now/CVE-2018-8619.md): A remote code execution vulnerability exists when the Internet Explorer VBScript execution policy does not properly restrict VBScript under (no CVSS, Microsoft Internet Explorer)
- [CVE-2018-8621](https://cve.now/CVE-2018-8621.md): An information disclosure vulnerability exists when the Windows kernel improperly handles objects in memory, aka "Windows Kernel Information (no CVSS, Microsoft Windows Server · Microsoft Windows)
- [CVE-2018-8622](https://cve.now/CVE-2018-8622.md): An information disclosure vulnerability exists when the Windows kernel improperly handles objects in memory, aka "Windows Kernel Information (no CVSS, Microsoft Windows)
- [CVE-2018-8624](https://cve.now/CVE-2018-8624.md): A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka "C (no CVSS, Microsoft Edge · Microsoft ChakraCore +1)
- [CVE-2018-8625](https://cve.now/CVE-2018-8625.md): A remote code execution vulnerability exists in the way that the VBScript engine handles objects in memory, aka "Windows VBScript Engine Rem (no CVSS, Microsoft Internet Explorer)
- [CVE-2018-8626](https://cve.now/CVE-2018-8626.md): A remote code execution vulnerability exists in Windows Domain Name System (DNS) servers when they fail to properly handle requests, aka "Wi (no CVSS, Microsoft Windows Server 2012 R2 · Microsoft Windows Ser… +1)
- [CVE-2018-8627](https://cve.now/CVE-2018-8627.md): An information disclosure vulnerability exists when Microsoft Excel software reads out of bound memory due to an uninitialized variable, whi (no CVSS, Microsoft Office · Microsoft Excel)
- [CVE-2018-8628](https://cve.now/CVE-2018-8628.md): A remote code execution vulnerability exists in Microsoft PowerPoint software when the software fails to properly handle objects in memory, (no CVSS, Microsoft Office · Microsoft PowerPoint +1)
- [CVE-2018-8629](https://cve.now/CVE-2018-8629.md): A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka "C (no CVSS, Microsoft Edge · Microsoft ChakraCore +1)
- [CVE-2018-8631](https://cve.now/CVE-2018-8631.md): A remote code execution vulnerability exists when Internet Explorer improperly accesses objects in memory, aka "Internet Explorer Memory Cor (no CVSS, Microsoft Internet Explorer)
- [CVE-2018-8634](https://cve.now/CVE-2018-8634.md): A remote code execution vulnerability exists in Windows where Microsoft text-to-speech fails to properly handle objects in the memory, aka " (no CVSS, Microsoft Windows Server · Microsoft Windows)
- [CVE-2018-8635](https://cve.now/CVE-2018-8635.md): An elevation of privilege vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted authenticatio (no CVSS, Microsoft SharePoint Server · Microsoft SharePoint)
- [CVE-2018-8636](https://cve.now/CVE-2018-8636.md): A remote code execution vulnerability exists in Microsoft Excel software when the software fails to properly handle objects in memory, aka " (no CVSS, Microsoft Office · Microsoft Excel)
- [CVE-2018-8637](https://cve.now/CVE-2018-8637.md): An information disclosure vulnerability exists in Windows kernel that could allow an attacker to retrieve information that could lead to a K (no CVSS, Microsoft Windows 10 Servers · Microsoft Windows)
- [CVE-2018-8638](https://cve.now/CVE-2018-8638.md): An information disclosure vulnerability exists when DirectX improperly handles objects in memory, aka "DirectX Information Disclosure Vulner (no CVSS, Microsoft Windows)
- [CVE-2018-8639](https://cve.now/CVE-2018-8639.md): An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in memory, aka "Win32k (CVSS 8.4, KEV, Microsoft Windows)
- [CVE-2018-8641](https://cve.now/CVE-2018-8641.md): An elevation of privilege vulnerability exists in Windows when the Windows kernel-mode driver fails to properly handle objects in memory, ak (no CVSS, Microsoft Windows)
- [CVE-2018-8643](https://cve.now/CVE-2018-8643.md): A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Internet Explorer, aka "Scrip (no CVSS, Microsoft Internet Explorer)
- [CVE-2018-8649](https://cve.now/CVE-2018-8649.md): A denial of service vulnerability exists when Windows improperly handles objects in memory, aka "Windows Denial of Service Vulnerability." T (no CVSS, Microsoft Windows)
- [CVE-2018-8651](https://cve.now/CVE-2018-8651.md): A cross site scripting vulnerability exists when Microsoft Dynamics NAV does not properly sanitize a specially crafted web request to an aff (no CVSS, Microsoft Dynamics NAV)
- [CVE-2018-8652](https://cve.now/CVE-2018-8652.md): A Cross-site Scripting (XSS) vulnerability exists when Windows Azure Pack does not properly sanitize user-provided input, aka "Windows Azure (no CVSS, Microsoft Windows Azure Pack Rollup)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2018-12-12
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.