# CVEs published 2018-12-13 56 CVEs were published on December 13, 2018: 0 critical, 3 high. Days are UTC. - [CVE-2018-12206](https://cve.now/CVE-2018-12206.md): Improper configuration of hardware access in Intel QuickAssist Technology for Linux (all versions) may allow an authenticated user to potent (no CVSS, Intel QuickAssist Technology for Linux) - [CVE-2018-18093](https://cve.now/CVE-2018-18093.md): Improper file permissions in the installer for Intel VTune Amplifier 2018 Update 3 and before may allow unprivileged user to potentially gai (no CVSS, Intel VTune Amplifier) - [CVE-2018-18096](https://cve.now/CVE-2018-18096.md): Improper memory handling in Intel QuickAssist Technology for Linux (all versions) may allow an authenticated user to potentially enable a de (no CVSS, Intel QuickAssist Technology for Linux) - [CVE-2018-18097](https://cve.now/CVE-2018-18097.md): Improper directory permissions in Intel Solid State Drive Toolbox before 3.5.7 may allow an authenticated user to potentially enable escalat (no CVSS, Intel Solid State Drive Toolbox) - [CVE-2018-3704](https://cve.now/CVE-2018-3704.md): Improper directory permissions in the installer for the Intel Parallel Studio before 2019 Gold may allow authenticated users to potentially (no CVSS, Intel Parallel Studio) - [CVE-2018-3705](https://cve.now/CVE-2018-3705.md): Improper directory permissions in the installer for the Intel(R) System Defense Utility (all versions) may allow authenticated users to pote (no CVSS, Intel System Defense Utility) - [CVE-2018-6707](https://cve.now/CVE-2018-6707.md): McAfee Agent Insecure usage of temporary files vulnerability (CVSS 3.7, McAfee Agent (MA) non-Windows non-Windows versions) - [CVE-2018-14623](https://cve.now/CVE-2018-14623.md): A SQL injection flaw was found in katello's errata-related API. (CVSS 4.3, The Foreman Project katello · katello) - [CVE-2018-15754](https://cve.now/CVE-2018-15754.md): UAA can issue tokens across identity providers if users with matching usernames exist (CVSS 4.2, Cloud Foundry UAA Release) - [CVE-2018-15774](https://cve.now/CVE-2018-15774.md): iDRAC7/iDRAC8/iDRAC9 - Privilege Escalation Vulnerability (CVSS 3.8, Dell EMC iDRAC) - [CVE-2018-15776](https://cve.now/CVE-2018-15776.md): iDRAC7, iDRAC8 - Improper Error Handling (CVSS 6.4, Dell EMC iDRAC) - [CVE-2018-5411](https://cve.now/CVE-2018-5411.md): Pixar's Tractor software, versions 2.2 and earlier, contains a stored cross-site scripting vulnerability (no CVSS, Pixar Tractor) - [CVE-2018-16872](https://cve.now/CVE-2018-16872.md): A flaw was found in qemu Media Transfer Protocol (MTP). (CVSS 5.0, \[UNKNOWN\] QEMU:) - [CVE-2018-20145](https://cve.now/CVE-2018-20145.md): Eclipse Mosquitto 1.5.x before 1.5.5 allows ACL bypass: if the option per\_listener\_settings was set to true, and the default listener was in (no CVSS) - [CVE-2018-12076](https://cve.now/CVE-2018-12076.md): A vulnerability in the UPC bar code of the Avanti Markets MarketCard could allow an unauthenticated, local attacker to access funds within t (no CVSS) - [CVE-2018-18922](https://cve.now/CVE-2018-18922.md): add\_user in AbiSoft Ticketly 1.0 allows remote attackers to create administrator accounts via an action/add\_user.php POST request. (no CVSS) - [CVE-2018-18923](https://cve.now/CVE-2018-18923.md): AbiSoft Ticketly 1.0 is affected by multiple SQL Injection vulnerabilities through the parameters name, category\_id and description in actio (no CVSS) - [CVE-2018-19039](https://cve.now/CVE-2018-19039.md): Grafana before 4.6.5 and 5.x before 5.3.3 allows remote authenticated users to read arbitrary files by leveraging Editor or Admin permission (no CVSS) - [CVE-2018-19118](https://cve.now/CVE-2018-19118.md): Zoho ManageEngine ADAudit before 5.1 build 5120 allows remote attackers to cause a denial of service (stack-based buffer overflow) via the ' (no CVSS) - [CVE-2018-19364](https://cve.now/CVE-2018-19364.md): hw/9pfs/cofile.c and hw/9pfs/9p.c in QEMU can modify an fid path while it is being accessed by a second thread, leading to (for example) a u (no CVSS) - [CVE-2018-19439](https://cve.now/CVE-2018-19439.md): XSS exists in the Administration Console in Oracle Secure Global Desktop 4.4 20080807152602 (but was fixed in later versions including 5.4). (no CVSS) - [CVE-2018-19489](https://cve.now/CVE-2018-19489.md): v9fs\_wstat in hw/9pfs/9p.c in QEMU allows guest OS users to cause a denial of service (crash) because of a race condition during file renami (no CVSS) - [CVE-2018-20136](https://cve.now/CVE-2018-20136.md): XSS exists in FUEL CMS 1.4.3 via the Header or Body in the Layout Variables during new-page creation, as demonstrated by the pages/edit/1?la (no CVSS) - [CVE-2018-20137](https://cve.now/CVE-2018-20137.md): XSS exists in FUEL CMS 1.4.3 via the Page title, Meta description, or Meta keywords during page data management, as demonstrated by the page (no CVSS) - [CVE-2018-20138](https://cve.now/CVE-2018-20138.md): PHP Scripts Mall Entrepreneur B2B Script 3.0.6 allows Stored XSS via Account Settings fields such as FirstName and LastName, a similar issue (no CVSS) - [CVE-2017-1268](https://cve.now/CVE-2017-1268.md): IBM Security Guardium 10 and 10.5 uses a one-way cryptographic hash against an input that should not be reversible, such as a password, but (CVSS 5.9, IBM Security Guardium) - [CVE-2018-13804](https://cve.now/CVE-2018-13804.md): A vulnerability has been identified in SIMATIC IT LMS (All versions), SIMATIC IT Production Suite (Versions V7.1 \< V7.1 Upd3), SIMATIC IT UA (no CVSS, Siemens AG SIMATIC IT LMS, SIMATIC IT Production Suite, SIM…) - [CVE-2018-13811](https://cve.now/CVE-2018-13811.md): A vulnerability has been identified in SIMATIC STEP 7 (TIA Portal) (All Versions \< V15.1). (no CVSS, Siemens AG SIMATIC STEP) - [CVE-2018-13812](https://cve.now/CVE-2018-13812.md): A vulnerability has been identified in SIMATIC HMI Comfort Panels 4" - 22" (All versions \< V15 Update 4), SIMATIC HMI Comfort Outdoor Panels (no CVSS, Siemens AG SIMATIC HMI Comfort Panels 4" - 22", SIMATIC HMI…) - [CVE-2018-13813](https://cve.now/CVE-2018-13813.md): A vulnerability has been identified in SIMATIC HMI Comfort Panels 4" - 22" (All versions \< V15 Update 4), SIMATIC HMI Comfort Outdoor Panels (no CVSS, Siemens AG SIMATIC HMI Comfort Panels 4" - 22", SIMATIC HMI…) - [CVE-2018-13814](https://cve.now/CVE-2018-13814.md): A vulnerability has been identified in SIMATIC HMI Comfort Panels 4" - 22" (All versions \< V14), SIMATIC HMI Comfort Outdoor Panels 7" & 15" (no CVSS, Siemens AG SIMATIC HMI Comfort Panels 4" - 22", SIMATIC HMI…) - [CVE-2018-13815](https://cve.now/CVE-2018-13815.md): A vulnerability has been identified in SIMATIC S7-1200 (All versions), SIMATIC S7-1500 (All Versions \< V2.6). (no CVSS, Siemens AG SIMATIC S7-1200, SIMATIC S7-1500) - [CVE-2018-1653](https://cve.now/CVE-2018-1653.md): IBM Security Access Manager Appliance 9.0.1.0, 9.0.2.0, 9.0.3.0, 9.0.4.0, and 9.0.5.0 is vulnerable to cross-site scripting. (CVSS 5.4, IBM Security Access Manager Appliance) - [CVE-2018-16555](https://cve.now/CVE-2018-16555.md): A vulnerability has been identified in SCALANCE S602 (All versions \< V4.0.1.1), SCALANCE S612 (All versions \< V4.0.1.1), SCALANCE S623 (All (no CVSS, Siemens AG SCALANCE S602, SCALANCE S612, SCALANCE S623, SCA…) - [CVE-2018-16556](https://cve.now/CVE-2018-16556.md): A vulnerability has been identified in SIMATIC S7-400 CPU 412-1 DP V7 (All versions), SIMATIC S7-400 CPU 412-2 DP V7 (All versions), SIMA (CVSS 7.5, Siemens SIMATIC S7-400 CPU 412-1 DP · Siemens SIMATIC S… +19) - [CVE-2018-16557](https://cve.now/CVE-2018-16557.md): A vulnerability has been identified in SIMATIC S7-400 CPU 412-1 DP V7 (All versions), SIMATIC S7-400 CPU 412-2 DP V7 (All versions), SIMA (CVSS 8.2, Siemens SIMATIC S7-400 CPU 412-1 DP · Siemens SIMATIC S… +19) - [CVE-2018-1665](https://cve.now/CVE-2018-1665.md): IBM DataPower Gateway 7.6.0.0 through 7.6.0.10, 7.5.2.0 through 7.5.2.17, 7.5.1.0 through 7.5.1.17, 7.5.0.0 through 7.5.0.18, and 7.7.0.0 th (CVSS 5.9, IBM DataPower Gateway) - [CVE-2018-1667](https://cve.now/CVE-2018-1667.md): IBM DataPower Gateway 7.6.0.0 through 7.6.0.10, 7.5.2.0 through 7.5.2.17, 7.5.1.0 through 7.5.1.17, 7.5.0.0 through 7.5.0.18, and 7.7.0.0 th (CVSS 5.4, IBM DataPower Gateways) - [CVE-2018-1740](https://cve.now/CVE-2018-1740.md): IBM Security Access Manager Appliance 9.0.1.0, 9.0.2.0, 9.0.3.0, 9.0.4.0, and 9.0.5.0 is vulnerable to cross-site scripting. (CVSS 5.4, IBM Security Access Manager Appliance) - [CVE-2018-1803](https://cve.now/CVE-2018-1803.md): IBM Security Access Manager Appliance 9.0.1.0, 9.0.2.0, 9.0.3.0, 9.0.4.0, and 9.0.5.0 could allow a remote attacker to hijack the clicking a (CVSS 6.1, IBM Security Access Manager Appliance) - [CVE-2018-1804](https://cve.now/CVE-2018-1804.md): IBM Security Access Manager Appliance 9.0.1.0, 9.0.2.0, 9.0.3.0, 9.0.4.0, and 9.0.5.0 does not set the secure attribute on authorization tok (CVSS 3.7, IBM Security Access Manager Appliance) - [CVE-2018-1805](https://cve.now/CVE-2018-1805.md): IBM Security Access Manager Appliance 9.0.1.0, 9.0.2.0, 9.0.3.0, 9.0.4.0, and 9.0.5.0 generates an error message that includes sensitive inf (CVSS 4.3, IBM Security Access Manager Appliance) - [CVE-2018-1813](https://cve.now/CVE-2018-1813.md): IBM Security Access Manager Appliance 9.0.1.0, 9.0.2.0, 9.0.3.0, 9.0.4.0, and 9.0.5.0 uses incomplete blacklisting for input validation whic (CVSS 4.3, IBM Security Access Manager Appliance) - [CVE-2018-1814](https://cve.now/CVE-2018-1814.md): IBM Security Access Manager Appliance 9.0.1.0, 9.0.2.0, 9.0.3.0, 9.0.4.0, and 9.0.5.0 uses weaker than expected cryptographic algorithms tha (CVSS 5.9, IBM Security Access Manager Appliance) - [CVE-2018-1815](https://cve.now/CVE-2018-1815.md): IBM Security Access Manager Appliance 9.0.1.0, 9.0.2.0, 9.0.3.0, 9.0.4.0, and 9.0.5.0 for Enterprise Single-Sign On is vulnerable to cross-s (CVSS 6.1, IBM Security Access Manager Appliance) - [CVE-2018-1817](https://cve.now/CVE-2018-1817.md): IBM Security Guardium 10 and 10.5 is vulnerable to cross-site scripting. (CVSS 6.1, IBM Security Guardium) - [CVE-2018-1818](https://cve.now/CVE-2018-1818.md): IBM Security Guardium 10 and 10.5 contains hard-coded credentials, such as a password or cryptographic key, which it uses for its own inboun (CVSS 5.9, IBM Security Guardium) - [CVE-2018-1821](https://cve.now/CVE-2018-1821.md): IBM Operational Decision Management 8.5, 8.6, 8.7, 8.8, and 8.9 is vulnerable to a XML External Entity Injection (XXE) attack when processin (CVSS 7.1, IBM Operational Decision Management) - [CVE-2018-1886](https://cve.now/CVE-2018-1886.md): IBM Security Access Manager Appliance 9.0.1.0, 9.0.2.0, 9.0.3.0, 9.0.4.0, and 9.0.5.0 discloses sensitive information to unauthorized users. (CVSS 5.3, IBM Security Access Manager Appliance) - [CVE-2018-1887](https://cve.now/CVE-2018-1887.md): IBM Security Access Manager Appliance 9.0.1.0, 9.0.2.0, 9.0.3.0, 9.0.4.0, and 9.0.5.0 contains hard-coded credentials, such as a password or (CVSS 5.9, IBM Security Access Manager Appliance) - [CVE-2018-7690](https://cve.now/CVE-2018-7690.md): MFSBGN03835 rev.1 - Fortify Software Security Center (SSC), Remote Unauthorized Access (CVSS 6.5, Micro Focus Fortify Software Security Center) - [CVE-2018-7691](https://cve.now/CVE-2018-7691.md): MFSBGN03835 rev.1 - Fortify Software Security Center (SSC), Remote Unauthorized Access (CVSS 6.5, Micro Focus Fortify Software Security Center) - [CVE-2018-8033](https://cve.now/CVE-2018-8033.md): In Apache OFBiz 16.11.01 to 16.11.04, the OFBiz HTTP engine (org.apache.ofbiz.service.engine.HttpEngine.java) handles requests for HTTP serv (no CVSS, Apache Software Foundation Apache OFBiz) - [CVE-2018-20127](https://cve.now/CVE-2018-20127.md): An issue was discovered in zzzphp cms 1.5.8. (no CVSS) - [CVE-2018-20128](https://cve.now/CVE-2018-20128.md): An issue was discovered in UsualToolCMS v8.0. (no CVSS) - [CVE-2018-20129](https://cve.now/CVE-2018-20129.md): An issue was discovered in DedeCMS V5.7 SP2. (no CVSS) --- Source: cve.now, built and run by Sazabi (AI-native observability and security) Page: https://cve.now/daily/2018-12-13 Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.