CVEs published December 13, 2018
56 CVEs were published on December 13, 2018: 0 critical, 3 high.
- Published
- 56
- Critical
- 0
- High
- 3
- Medium
- 20
- Low
- 3
- Unrated
- 30
- Now in CISA KEV
- 0
- Fix available
- 3
Most affected products
- IBM Security Access Manager Appliance
- 10
- IBM Security Guardium
- 3
- Siemens AG SIMATIC HMI Comfort Panels 4" - 22", SIMATIC HMI…
- 3
- Dell EMC iDRAC
- 2
- Intel QuickAssist Technology for Linux
- 2
- Micro Focus Fortify Software Security Center
- 2
- Siemens SIMATIC S7-400 CPU 412-1 DP · Siemens SIMATIC S… +19
- 2
- [UNKNOWN] QEMU:
- 1
- Apache Software Foundation Apache OFBiz
- 1
- Cloud Foundry UAA Release
- 1
High 3
- CVE-2018-16556A vulnerability has been identified in SIMATIC S7-400 CPU 412-1 DP V7 (All versions), SIMATIC S7-400 CPU 412-2 DP V7 (All versions), SIMASiemens SIMATIC S7-400 CPU 412-1 DP · Siemens SIMATIC S… +19
- CVE-2018-16557A vulnerability has been identified in SIMATIC S7-400 CPU 412-1 DP V7 (All versions), SIMATIC S7-400 CPU 412-2 DP V7 (All versions), SIMASiemens SIMATIC S7-400 CPU 412-1 DP · Siemens SIMATIC S… +19
- CVE-2018-1821IBM Operational Decision Management 8.5, 8.6, 8.7, 8.8, and 8.9 is vulnerable to a XML External Entity Injection (XXE) attack when processinIBM Operational Decision Management
Medium, low and unrated 53
- CVE-2018-12206Improper configuration of hardware access in Intel QuickAssist Technology for Linux (all versions) may allow an authenticated user to potentIntel QuickAssist Technology for Linux
- CVE-2018-18093Improper file permissions in the installer for Intel VTune Amplifier 2018 Update 3 and before may allow unprivileged user to potentially gaiIntel VTune Amplifier
- CVE-2018-18096Improper memory handling in Intel QuickAssist Technology for Linux (all versions) may allow an authenticated user to potentially enable a deIntel QuickAssist Technology for Linux
- CVE-2018-18097Improper directory permissions in Intel Solid State Drive Toolbox before 3.5.7 may allow an authenticated user to potentially enable escalatIntel Solid State Drive Toolbox
- CVE-2018-3704Improper directory permissions in the installer for the Intel Parallel Studio before 2019 Gold may allow authenticated users to potentially Intel Parallel Studio
- CVE-2018-3705Improper directory permissions in the installer for the Intel(R) System Defense Utility (all versions) may allow authenticated users to poteIntel System Defense Utility
- CVE-2018-6707McAfee Agent Insecure usage of temporary files vulnerabilityMcAfee Agent (MA) non-Windows non-Windows versions
- CVE-2018-14623A SQL injection flaw was found in katello's errata-related API.The Foreman Project katello · katello
- CVE-2018-15754UAA can issue tokens across identity providers if users with matching usernames existCloud Foundry UAA Release
- CVE-2018-15774iDRAC7/iDRAC8/iDRAC9 - Privilege Escalation VulnerabilityDell EMC iDRAC
- CVE-2018-15776iDRAC7, iDRAC8 - Improper Error HandlingDell EMC iDRAC
- CVE-2018-5411Pixar's Tractor software, versions 2.2 and earlier, contains a stored cross-site scripting vulnerabilityPixar Tractor
- CVE-2018-16872A flaw was found in qemu Media Transfer Protocol (MTP).[UNKNOWN] QEMU:
- CVE-2018-20145Eclipse Mosquitto 1.5.x before 1.5.5 allows ACL bypass: if the option per_listener_settings was set to true, and the default listener was in
- CVE-2018-12076A vulnerability in the UPC bar code of the Avanti Markets MarketCard could allow an unauthenticated, local attacker to access funds within t
- CVE-2018-18922add_user in AbiSoft Ticketly 1.0 allows remote attackers to create administrator accounts via an action/add_user.php POST request.
- CVE-2018-18923AbiSoft Ticketly 1.0 is affected by multiple SQL Injection vulnerabilities through the parameters name, category_id and description in actio
- CVE-2018-19039Grafana before 4.6.5 and 5.x before 5.3.3 allows remote authenticated users to read arbitrary files by leveraging Editor or Admin permission
- CVE-2018-19118Zoho ManageEngine ADAudit before 5.1 build 5120 allows remote attackers to cause a denial of service (stack-based buffer overflow) via the '
- CVE-2018-19364hw/9pfs/cofile.c and hw/9pfs/9p.c in QEMU can modify an fid path while it is being accessed by a second thread, leading to (for example) a u
- CVE-2018-19439XSS exists in the Administration Console in Oracle Secure Global Desktop 4.4 20080807152602 (but was fixed in later versions including 5.4).
- CVE-2018-19489v9fs_wstat in hw/9pfs/9p.c in QEMU allows guest OS users to cause a denial of service (crash) because of a race condition during file renami
- CVE-2018-20136XSS exists in FUEL CMS 1.4.3 via the Header or Body in the Layout Variables during new-page creation, as demonstrated by the pages/edit/1?la
- CVE-2018-20137XSS exists in FUEL CMS 1.4.3 via the Page title, Meta description, or Meta keywords during page data management, as demonstrated by the page
- CVE-2018-20138PHP Scripts Mall Entrepreneur B2B Script 3.0.6 allows Stored XSS via Account Settings fields such as FirstName and LastName, a similar issue
- CVE-2017-1268IBM Security Guardium 10 and 10.5 uses a one-way cryptographic hash against an input that should not be reversible, such as a password, but IBM Security Guardium
- CVE-2018-13804A vulnerability has been identified in SIMATIC IT LMS (All versions), SIMATIC IT Production Suite (Versions V7.1 < V7.1 Upd3), SIMATIC IT UASiemens AG SIMATIC IT LMS, SIMATIC IT Production Suite, SIM…
- CVE-2018-13811A vulnerability has been identified in SIMATIC STEP 7 (TIA Portal) (All Versions < V15.1).Siemens AG SIMATIC STEP
- CVE-2018-13812A vulnerability has been identified in SIMATIC HMI Comfort Panels 4" - 22" (All versions < V15 Update 4), SIMATIC HMI Comfort Outdoor PanelsSiemens AG SIMATIC HMI Comfort Panels 4" - 22", SIMATIC HMI…
- CVE-2018-13813A vulnerability has been identified in SIMATIC HMI Comfort Panels 4" - 22" (All versions < V15 Update 4), SIMATIC HMI Comfort Outdoor PanelsSiemens AG SIMATIC HMI Comfort Panels 4" - 22", SIMATIC HMI…
- CVE-2018-13814A vulnerability has been identified in SIMATIC HMI Comfort Panels 4" - 22" (All versions < V14), SIMATIC HMI Comfort Outdoor Panels 7" & 15"Siemens AG SIMATIC HMI Comfort Panels 4" - 22", SIMATIC HMI…
- CVE-2018-13815A vulnerability has been identified in SIMATIC S7-1200 (All versions), SIMATIC S7-1500 (All Versions < V2.6).Siemens AG SIMATIC S7-1200, SIMATIC S7-1500
- CVE-2018-1653IBM Security Access Manager Appliance 9.0.1.0, 9.0.2.0, 9.0.3.0, 9.0.4.0, and 9.0.5.0 is vulnerable to cross-site scripting.IBM Security Access Manager Appliance
- CVE-2018-16555A vulnerability has been identified in SCALANCE S602 (All versions < V4.0.1.1), SCALANCE S612 (All versions < V4.0.1.1), SCALANCE S623 (All Siemens AG SCALANCE S602, SCALANCE S612, SCALANCE S623, SCA…
- CVE-2018-1665IBM DataPower Gateway 7.6.0.0 through 7.6.0.10, 7.5.2.0 through 7.5.2.17, 7.5.1.0 through 7.5.1.17, 7.5.0.0 through 7.5.0.18, and 7.7.0.0 thIBM DataPower Gateway
- CVE-2018-1667IBM DataPower Gateway 7.6.0.0 through 7.6.0.10, 7.5.2.0 through 7.5.2.17, 7.5.1.0 through 7.5.1.17, 7.5.0.0 through 7.5.0.18, and 7.7.0.0 thIBM DataPower Gateways
- CVE-2018-1740IBM Security Access Manager Appliance 9.0.1.0, 9.0.2.0, 9.0.3.0, 9.0.4.0, and 9.0.5.0 is vulnerable to cross-site scripting.IBM Security Access Manager Appliance
- CVE-2018-1803IBM Security Access Manager Appliance 9.0.1.0, 9.0.2.0, 9.0.3.0, 9.0.4.0, and 9.0.5.0 could allow a remote attacker to hijack the clicking aIBM Security Access Manager Appliance
- CVE-2018-1804IBM Security Access Manager Appliance 9.0.1.0, 9.0.2.0, 9.0.3.0, 9.0.4.0, and 9.0.5.0 does not set the secure attribute on authorization tokIBM Security Access Manager Appliance
- CVE-2018-1805IBM Security Access Manager Appliance 9.0.1.0, 9.0.2.0, 9.0.3.0, 9.0.4.0, and 9.0.5.0 generates an error message that includes sensitive infIBM Security Access Manager Appliance
- CVE-2018-1813IBM Security Access Manager Appliance 9.0.1.0, 9.0.2.0, 9.0.3.0, 9.0.4.0, and 9.0.5.0 uses incomplete blacklisting for input validation whicIBM Security Access Manager Appliance
- CVE-2018-1814IBM Security Access Manager Appliance 9.0.1.0, 9.0.2.0, 9.0.3.0, 9.0.4.0, and 9.0.5.0 uses weaker than expected cryptographic algorithms thaIBM Security Access Manager Appliance
- CVE-2018-1815IBM Security Access Manager Appliance 9.0.1.0, 9.0.2.0, 9.0.3.0, 9.0.4.0, and 9.0.5.0 for Enterprise Single-Sign On is vulnerable to cross-sIBM Security Access Manager Appliance
- CVE-2018-1817IBM Security Guardium 10 and 10.5 is vulnerable to cross-site scripting.IBM Security Guardium
- CVE-2018-1818IBM Security Guardium 10 and 10.5 contains hard-coded credentials, such as a password or cryptographic key, which it uses for its own inbounIBM Security Guardium
- CVE-2018-1886IBM Security Access Manager Appliance 9.0.1.0, 9.0.2.0, 9.0.3.0, 9.0.4.0, and 9.0.5.0 discloses sensitive information to unauthorized users.IBM Security Access Manager Appliance
- CVE-2018-1887IBM Security Access Manager Appliance 9.0.1.0, 9.0.2.0, 9.0.3.0, 9.0.4.0, and 9.0.5.0 contains hard-coded credentials, such as a password orIBM Security Access Manager Appliance
- CVE-2018-7690MFSBGN03835 rev.1 - Fortify Software Security Center (SSC), Remote Unauthorized AccessMicro Focus Fortify Software Security Center
- CVE-2018-7691MFSBGN03835 rev.1 - Fortify Software Security Center (SSC), Remote Unauthorized AccessMicro Focus Fortify Software Security Center
- CVE-2018-8033In Apache OFBiz 16.11.01 to 16.11.04, the OFBiz HTTP engine (org.apache.ofbiz.service.engine.HttpEngine.java) handles requests for HTTP servApache Software Foundation Apache OFBiz
- CVE-2018-20127An issue was discovered in zzzphp cms 1.5.8.
- CVE-2018-20128An issue was discovered in UsualToolCMS v8.0.
- CVE-2018-20129An issue was discovered in DedeCMS V5.7 SP2.