CVEs published December 17, 2018
78 CVEs were published on December 17, 2018: 0 critical, 0 high.
- Published
- 78
- Critical
- 0
- High
- 0
- Medium
- 3
- Low
- 2
- Unrated
- 73
- Now in CISA KEV
- 0
- Fix available
- 7
Most affected products
- IBM Security Guardium
- 5
- rendertron
- 4
- Schneider Electric SE Embedded Web Servers in all Modicon M…
- 3
- bolt/bolt
- 1
- github.com/sylabs/singularity
- 1
- keystone
- 1
- Schneider Electric SE Power Monitoring Expert, Energy Exper…
- 1
- ymlref
- 1
Medium, low and unrated 78
- CVE-2018-7797A URL redirection vulnerability exists in Power Monitoring Expert, Energy Expert (formerly Power Manager) - EcoStruxure Power Monitoring ExpSchneider Electric SE Power Monitoring Expert, Energy Exper…
- CVE-2018-7804A URL Redirection to Untrusted Site vulnerability exists in the embedded web servers in all Modicon M340, Premium, Quantum PLCs and BMXNOR02Schneider Electric SE Embedded Web Servers in all Modicon M…
- CVE-2018-7812An Information Exposure through Discrepancy vulnerability exists in the embedded web servers in all Modicon M340, Premium, Quantum PLCs and Schneider Electric SE Embedded Web Servers in all Modicon M…
- CVE-2018-7833An Improper Check for Unusual or Exceptional Conditions vulnerability exists in the embedded web servers in all Modicon M340, Premium, QuantSchneider Electric SE Embedded Web Servers in all Modicon M…
- CVE-2018-20189In GraphicsMagick 1.3.31, the ReadDIBImage function of coders/dib.c has a vulnerability allowing a crash and denial of service via a dib fil
- CVE-2018-20190In LibSass 3.5.5, a NULL Pointer Dereference in the function Sass::Eval::operator()(Sass::Supports_Operator*) in eval.cpp may cause a Denial
- CVE-2018-20188FUEL CMS 1.4.3 has CSRF via users/create/ to add an administrator account.
- CVE-2018-14852Out-of-bounds array access in dhd_rx_frame in drivers/net/wireless/bcmdhd4358/dhd_linux.c in the bcmdhd4358 Wi-Fi driver on the Samsung Gala
- CVE-2018-14853A NULL pointer dereference in dhd_prot_txdata_write_flush in drivers/net/wireless/bcmdhd4358/dhd_msgbuf.c in the bcmdhd4358 Wi-Fi driver on
- CVE-2018-14854Buffer overflow in dhd_bus_flow_ring_delete_response in drivers/net/wireless/bcmdhd4358/dhd_pcie.c in the bcmdhd4358 Wi-Fi driver on the Sam
- CVE-2018-14855Buffer overflow in dhd_bus_flow_ring_flush_response in drivers/net/wireless/bcmdhd4358/dhd_pcie.c in the bcmdhd4358 Wi-Fi driver on the Sams
- CVE-2018-14856Buffer overflow in dhd_bus_flow_ring_create_response in drivers/net/wireless/bcmdhd4358/dhd_pcie.c in the bcmdhd4358 Wi-Fi driver on the Sam
- CVE-2018-16596A stack-based buffer overflow in the LAN UPnP service running on UDP port 1900 of Swisscom Internet-Box (2, Standard, and Plus) prior to v09
- CVE-2018-18555A sandbox escape issue was discovered in VyOS 1.1.8.
- CVE-2018-18556A privilege escalation issue was discovered in VyOS 1.1.8.
- CVE-2018-19036An issue was discovered in several Bosch IP cameras for firmware versions 6.32 and higher.
- CVE-2018-19828Artica Integria IMS 5.0.83 has XSS via the search_string parameter.
- CVE-2018-19933Bolt CMS <3.6.2 allows XSS via text input click preview button as demonstrated by the Title field of a Configured and New Entry.bolt/bolt
- CVE-2018-19936PrinterOn Enterprise 4.1.4 allows Arbitrary File Deletion.
- CVE-2018-19974In YARA 3.8.1, bytecode in a specially crafted compiled rule can read uninitialized data from VM scratch memory in libyara/exec.c.
- CVE-2018-19975In YARA 3.8.1, bytecode in a specially crafted compiled rule can read data from any arbitrary address in memory, in libyara/exec.c.
- CVE-2018-19976In YARA 3.8.1, bytecode in a specially crafted compiled rule is exposed to information about its environment, in libyara/exec.c.
- CVE-2018-20092PTC ThingWorx Platform through 8.3.0 is vulnerable to a directory traversal attack on ZIP files via a POST request.
- CVE-2018-20123pvrdma_realize in hw/rdma/vmw/pvrdma_main.c in QEMU has a Memory leak after an initialisation error.
- CVE-2018-20133ymlref allows code injection.ymlref
- CVE-2018-20184In GraphicsMagick 1.4 snapshot-20181209 Q8, there is a heap-based buffer overflow in the WriteTGAImage function of tga.c, which allows attac
- CVE-2018-20185In GraphicsMagick 1.4 snapshot-20181209 Q8 on 32-bit platforms, there is a heap-based buffer over-read in the ReadBMPImage function of bmp.c
- CVE-2018-20186An issue was discovered in Bento4 1.5.1-627.
- CVE-2017-1265IBM Security Guardium 10.0, 10.0.1, 10.1, 10.1.2, 10.1.3, 10.1.4, and 10.5 does not validate, or incorrectly validates, a certificate.IBM Security Guardium
- CVE-2017-1272IBM Security Guardium 10.0 and 10.5 stores sensitive information in URL parameters.IBM Security Guardium
- CVE-2017-1597IBM Security Guardium 10.0, 10.0.1, 10.1, 10.1.2, 10.1.3, 10.1.4, and 10.5 Database Activity Monitor does not require that users should haveIBM Security Guardium
- CVE-2018-1889IBM Security Guardium 10.0 and 10.5 is vulnerable to cross-site scripting.IBM Security Guardium
- CVE-2018-1891IBM Security Guardium 10 and 10.5 is vulnerable to cross-site scripting.IBM Security Guardium
- CVE-2018-18245Nagios Core 4.4.2 has XSS via the alert summary reports of plugin results, as demonstrated by a SCRIPT element delivered by a modified check
- CVE-2018-18246Icinga Web 2 before 2.6.2 has CSRF via /icingaweb2/config/moduledisable?name=monitoring to disable the monitoring module, or via /icingaweb2
- CVE-2018-18247Icinga Web 2 before 2.6.2 has XSS via the /icingaweb2/navigation/add icon parameter.
- CVE-2018-18248Icinga Web 2 has XSS via the /icingaweb2/monitoring/list/services dir parameter, the /icingaweb2/user/list query string, the /icingaweb2/mon
- CVE-2018-18249Icinga Web 2 before 2.6.2 allows injection of PHP ini-file directives via vectors involving environment variables as the channel to send inf
- CVE-2018-18250Icinga Web 2 before 2.6.2 allows parameters that break navigation dashlets, as demonstrated by a single '$' character as the Name of a Navig
- CVE-2018-19295Sylabs Singularity 2.4 to 2.6 allows local users to conduct Improper Input Validation attacks.github.com/sylabs/singularity
- CVE-2018-19649XSS exists in InfoVista VistaPortal SE Version 5.1 (build 51029).
- CVE-2018-19765Cross Site Scripting exists in InfoVista VistaPortal SE Version 5.1 (build 51029).
- CVE-2018-19766Cross Site Scripting exists in InfoVista VistaPortal SE Version 5.1 (build 51029).
- CVE-2018-19767Cross Site Scripting exists in InfoVista VistaPortal SE Version 5.1 (build 51029).
- CVE-2018-19768Cross Site Scripting exists in InfoVista VistaPortal SE Version 5.1 (build 51029).
- CVE-2018-19769Cross Site Scripting exists in InfoVista VistaPortal SE Version 5.1 (build 51029).
- CVE-2018-19770Cross Site Scripting exists in InfoVista VistaPortal SE Version 5.1 (build 51029).
- CVE-2018-19771Cross Site Scripting exists in InfoVista VistaPortal SE Version 5.1 (build 51029).
- CVE-2018-19772Cross Site Scripting exists in InfoVista VistaPortal SE Version 5.1 (build 51029).
- CVE-2018-19773Cross Site Scripting exists in InfoVista VistaPortal SE Version 5.1 (build 51029).
- CVE-2018-19774Cross Site Scripting exists in InfoVista VistaPortal SE Version 5.1 (build 51029).
- CVE-2018-19775Cross Site Scripting exists in InfoVista VistaPortal SE Version 5.1 (build 51029).
- CVE-2018-19809Cross Site Scripting exists in InfoVista VistaPortal SE Version 5.1 (build 51029).
- CVE-2018-19810Cross Site Scripting exists in InfoVista VistaPortal SE Version 5.1 (build 51029).
- CVE-2018-19811Cross Site Scripting exists in InfoVista VistaPortal SE Version 5.1 (build 51029).
- CVE-2018-19812Cross Site Scripting exists in InfoVista VistaPortal SE Version 5.1 (build 51029).
- CVE-2018-19813Cross Site Scripting exists in InfoVista VistaPortal SE Version 5.1 (build 51029).
- CVE-2018-19814Cross Site Scripting exists in InfoVista VistaPortal SE Version 5.1 (build 51029).
- CVE-2018-19815Cross Site Scripting exists in InfoVista VistaPortal SE Version 5.1 (build 51029).
- CVE-2018-19816Cross Site Scripting exists in InfoVista VistaPortal SE Version 5.1 (build 51029).
- CVE-2018-19817Cross Site Scripting exists in InfoVista VistaPortal SE Version 5.1 (build 51029).
- CVE-2018-19818Cross Site Scripting exists in InfoVista VistaPortal SE Version 5.1 (build 51029).
- CVE-2018-19819Cross Site Scripting exists in InfoVista VistaPortal SE Version 5.1 (build 51029).
- CVE-2018-19820Cross Site Scripting exists in InfoVista VistaPortal SE Version 5.1 (build 51029).
- CVE-2018-19821Cross Site Scripting exists in InfoVista VistaPortal SE Version 5.1 (build 51029).
- CVE-2018-19822Cross Site Scripting exists in InfoVista VistaPortal SE Version 5.1 (build 51029).
- CVE-2018-20027The yaml_parse.load method in Pylearn2 allows code injection.
- CVE-2018-20171An issue was discovered in Nagios XI before 5.5.8.
- CVE-2018-20172An issue was discovered in Nagios XI before 5.5.8.
- CVE-2018-20173Zoho ManageEngine OpManager 12.3 before 123238 allows SQL injection via the getGraphData API.
- CVE-2017-18352Error reporting within Rendertron 1.0.0 allows reflected Cross Site Scripting (XSS) from invalid URLs.rendertron
- CVE-2017-18353Rendertron 1.0.0 includes an _ah/stop route to shutdown the Chrome instance responsible for serving render requests to all users.rendertron
- CVE-2017-18354Rendertron 1.0.0 allows for alternative protocols such as 'file://' introducing a Local File Inclusion (LFI) bug where arbitrary files can brendertron
- CVE-2017-18355Installed packages are exposed by node_modules in Rendertron 1.0.0, allowing remote attackers to read absolute paths on the server by examinrendertron
- CVE-2018-20169An issue was discovered in the Linux kernel before 4.19.9.
- CVE-2018-20170OpenStack Keystone through 14.0.1 has a user enumeration vulnerability because invalid usernames have much faster responses than valid ones keystone
- CVE-2018-20167Terminology before 1.3.1 allows Remote Code Execution because popmedia is mishandled, as demonstrated by an unsafe "cat README.md" command w
- CVE-2018-20168Google gVisor before 2018-08-22 reuses a pagetable in a different level with the paging-structure cache intact, which allows attackers to ca