# CVEs published 2018-12-14

21 CVEs were published on December 14, 2018: 0 critical, 1 high. Days are UTC.

- [CVE-2018-20157](https://cve.now/CVE-2018-20157.md): The data import functionality in OpenRefine through 3.1 allows an XML External Entity (XXE) attack through a crafted (zip) file, allowing at (no CVSS)
- [CVE-2018-20154](https://cve.now/CVE-2018-20154.md): The WP Maintenance Mode plugin before 2.0.7 for WordPress allows remote authenticated users to discover all subscriber e-mail addresses. (no CVSS)
- [CVE-2018-20155](https://cve.now/CVE-2018-20155.md): The WP Maintenance Mode plugin before 2.0.7 for WordPress allows remote authenticated subscriber users to bypass intended access restriction (no CVSS)
- [CVE-2018-20156](https://cve.now/CVE-2018-20156.md): The WP Maintenance Mode plugin before 2.0.7 for WordPress allows remote authenticated "site administrator" users to execute arbitrary PHP co (no CVSS)
- [CVE-2018-19007](https://cve.now/CVE-2018-19007.md): In Geutebrueck GmbH E2 Camera Series versions prior to 1.12.0.25 the DDNS configuration (in the Network Configuration panel) is vulnerable t (no CVSS, Geutebrück GmbH E2 Camera Series versions prior…)
- [CVE-2018-20147](https://cve.now/CVE-2018-20147.md): In WordPress before 4.9.9 and 5.x before 5.0.1, authors could modify metadata to bypass intended restrictions on deleting files. (no CVSS)
- [CVE-2018-20148](https://cve.now/CVE-2018-20148.md): In WordPress before 4.9.9 and 5.x before 5.0.1, contributors could conduct PHP object injection attacks via crafted metadata in a wp.getMedi (no CVSS)
- [CVE-2018-20149](https://cve.now/CVE-2018-20149.md): In WordPress before 4.9.9 and 5.x before 5.0.1, when the Apache HTTP Server is used, authors could upload crafted files that bypass intended (no CVSS)
- [CVE-2018-20150](https://cve.now/CVE-2018-20150.md): In WordPress before 4.9.9 and 5.x before 5.0.1, crafted URLs could trigger XSS for certain use cases involving plugins. (no CVSS)
- [CVE-2018-20151](https://cve.now/CVE-2018-20151.md): In WordPress before 4.9.9 and 5.x before 5.0.1, the user-activation page could be read by a search engine's web crawler if an unusual config (no CVSS)
- [CVE-2018-20152](https://cve.now/CVE-2018-20152.md): In WordPress before 4.9.9 and 5.x before 5.0.1, authors could bypass intended restrictions on post types via crafted input. (no CVSS)
- [CVE-2018-20153](https://cve.now/CVE-2018-20153.md): In WordPress before 4.9.9 and 5.x before 5.0.1, contributors could modify new comments made by users with greater privileges, possibly causi (no CVSS)
- [CVE-2018-1848](https://cve.now/CVE-2018-1848.md): IBM Business Automation Workflow 18.0.0.0 and 18.0.0.1 is vulnerable to cross-site scripting. (CVSS 6.1, IBM Business Automation Workflow)
- [CVE-2018-1977](https://cve.now/CVE-2018-1977.md): IBM DB2 for Linux, UNIX and Windows 11.1 (includes DB2 Connect Server) contains a denial of service vulnerability. (CVSS 5.3, IBM DB2 for Linux, UNIX and Windows)
- [CVE-2018-18006](https://cve.now/CVE-2018-18006.md): Hardcoded credentials in the Ricoh myPrint application 2.9.2.4 for Windows and 2.2.7 for Android give access to any externally disclosed myP (no CVSS)
- [CVE-2018-18984](https://cve.now/CVE-2018-18984.md): Medtronic 9790, 2090 CareLink, and 29901 Encore Programmers Missing Encryption of Sensitive Data (CVSS 4.6, Medtronic CareLink 9790 Programmer · Medtronic CareLink… +1)
- [CVE-2018-19003](https://cve.now/CVE-2018-19003.md): GE Mark VIe, EX2100e, EX2100e\_Reg, and LS2100e Versions 03.03.28C to 05.02.04C, EX2100e All versions prior to v04.09.00C, EX2100e\_Reg All ve (no CVSS, GE Mark VIe, EX2100e, EX2100e\_Reg, and LS2100e)
- [CVE-2018-19413](https://cve.now/CVE-2018-19413.md): A vulnerability in the API of SonarSource SonarQube before 7.4 could allow an authenticated user to discover sensitive information such as v (no CVSS, org.sonarsource.sonarqube:sonar-plugin-api)
- [CVE-2018-16873](https://cve.now/CVE-2018-16873.md): In Go before 1.10.6 and 1.11.x before 1.11.3, the "go get" command is vulnerable to remote code execution when executed with the -u flag and (CVSS 7.5, \[UNKNOWN\] golang · toolchain)
- [CVE-2018-16874](https://cve.now/CVE-2018-16874.md): In Go before 1.10.6 and 1.11.x before 1.11.3, the "go get" command is vulnerable to directory traversal when executed with the import path o (CVSS 6.8, \[UNKNOWN\] golang · toolchain)
- [CVE-2018-16875](https://cve.now/CVE-2018-16875.md): The crypto/x509 package of Go before 1.10.6 and 1.11.x before 1.11.3 does not limit the amount of work performed for each chain verification (CVSS 5.9, \[UNKNOWN\] golang · stdlib)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2018-12-14
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.