CVEs published December 14, 2018
21 CVEs were published on December 14, 2018: 0 critical, 1 high.
- Published
- 21
- Critical
- 0
- High
- 1
- Medium
- 5
- Low
- 0
- Unrated
- 15
- Now in CISA KEV
- 0
- Fix available
- 4
Most affected products
- [UNKNOWN] golang · toolchain
- 2
- [UNKNOWN] golang · stdlib
- 1
- GE Mark VIe, EX2100e, EX2100e_Reg, and LS2100e
- 1
- Geutebrück GmbH E2 Camera Series versions prior…
- 1
- IBM Business Automation Workflow
- 1
- IBM DB2 for Linux, UNIX and Windows
- 1
- Medtronic CareLink 9790 Programmer · Medtronic CareLink… +1
- 1
- org.sonarsource.sonarqube:sonar-plugin-api
- 1
High 1
Medium, low and unrated 20
- CVE-2018-20157The data import functionality in OpenRefine through 3.1 allows an XML External Entity (XXE) attack through a crafted (zip) file, allowing at
- CVE-2018-20154The WP Maintenance Mode plugin before 2.0.7 for WordPress allows remote authenticated users to discover all subscriber e-mail addresses.
- CVE-2018-20155The WP Maintenance Mode plugin before 2.0.7 for WordPress allows remote authenticated subscriber users to bypass intended access restriction
- CVE-2018-20156The WP Maintenance Mode plugin before 2.0.7 for WordPress allows remote authenticated "site administrator" users to execute arbitrary PHP co
- CVE-2018-19007In Geutebrueck GmbH E2 Camera Series versions prior to 1.12.0.25 the DDNS configuration (in the Network Configuration panel) is vulnerable tGeutebrück GmbH E2 Camera Series versions prior…
- CVE-2018-20147In WordPress before 4.9.9 and 5.x before 5.0.1, authors could modify metadata to bypass intended restrictions on deleting files.
- CVE-2018-20148In WordPress before 4.9.9 and 5.x before 5.0.1, contributors could conduct PHP object injection attacks via crafted metadata in a wp.getMedi
- CVE-2018-20149In WordPress before 4.9.9 and 5.x before 5.0.1, when the Apache HTTP Server is used, authors could upload crafted files that bypass intended
- CVE-2018-20150In WordPress before 4.9.9 and 5.x before 5.0.1, crafted URLs could trigger XSS for certain use cases involving plugins.
- CVE-2018-20151In WordPress before 4.9.9 and 5.x before 5.0.1, the user-activation page could be read by a search engine's web crawler if an unusual config
- CVE-2018-20152In WordPress before 4.9.9 and 5.x before 5.0.1, authors could bypass intended restrictions on post types via crafted input.
- CVE-2018-20153In WordPress before 4.9.9 and 5.x before 5.0.1, contributors could modify new comments made by users with greater privileges, possibly causi
- CVE-2018-1848IBM Business Automation Workflow 18.0.0.0 and 18.0.0.1 is vulnerable to cross-site scripting.IBM Business Automation Workflow
- CVE-2018-1977IBM DB2 for Linux, UNIX and Windows 11.1 (includes DB2 Connect Server) contains a denial of service vulnerability.IBM DB2 for Linux, UNIX and Windows
- CVE-2018-18006Hardcoded credentials in the Ricoh myPrint application 2.9.2.4 for Windows and 2.2.7 for Android give access to any externally disclosed myP
- CVE-2018-18984Medtronic 9790, 2090 CareLink, and 29901 Encore Programmers Missing Encryption of Sensitive DataMedtronic CareLink 9790 Programmer · Medtronic CareLink… +1
- CVE-2018-19003GE Mark VIe, EX2100e, EX2100e_Reg, and LS2100e Versions 03.03.28C to 05.02.04C, EX2100e All versions prior to v04.09.00C, EX2100e_Reg All veGE Mark VIe, EX2100e, EX2100e_Reg, and LS2100e
- CVE-2018-19413A vulnerability in the API of SonarSource SonarQube before 7.4 could allow an authenticated user to discover sensitive information such as vorg.sonarsource.sonarqube:sonar-plugin-api
- CVE-2018-16874In Go before 1.10.6 and 1.11.x before 1.11.3, the "go get" command is vulnerable to directory traversal when executed with the import path o[UNKNOWN] golang · toolchain
- CVE-2018-16875The crypto/x509 package of Go before 1.10.6 and 1.11.x before 1.11.3 does not limit the amount of work performed for each chain verification[UNKNOWN] golang · stdlib