# CVEs published 2018-12-17

78 CVEs were published on December 17, 2018: 0 critical, 0 high. Days are UTC.

- [CVE-2018-7797](https://cve.now/CVE-2018-7797.md): A URL redirection vulnerability exists in Power Monitoring Expert, Energy Expert (formerly Power Manager) - EcoStruxure Power Monitoring Exp (no CVSS, Schneider Electric SE Power Monitoring Expert, Energy Exper…)
- [CVE-2018-7804](https://cve.now/CVE-2018-7804.md): A URL Redirection to Untrusted Site vulnerability exists in the embedded web servers in all Modicon M340, Premium, Quantum PLCs and BMXNOR02 (no CVSS, Schneider Electric SE Embedded Web Servers in all Modicon M…)
- [CVE-2018-7812](https://cve.now/CVE-2018-7812.md): An Information Exposure through Discrepancy vulnerability exists in the embedded web servers in all Modicon M340, Premium, Quantum PLCs and (no CVSS, Schneider Electric SE Embedded Web Servers in all Modicon M…)
- [CVE-2018-7833](https://cve.now/CVE-2018-7833.md): An Improper Check for Unusual or Exceptional Conditions vulnerability exists in the embedded web servers in all Modicon M340, Premium, Quant (no CVSS, Schneider Electric SE Embedded Web Servers in all Modicon M…)
- [CVE-2018-20189](https://cve.now/CVE-2018-20189.md): In GraphicsMagick 1.3.31, the ReadDIBImage function of coders/dib.c has a vulnerability allowing a crash and denial of service via a dib fil (no CVSS)
- [CVE-2018-20190](https://cve.now/CVE-2018-20190.md): In LibSass 3.5.5, a NULL Pointer Dereference in the function Sass::Eval::operator()(Sass::Supports\_Operator\*) in eval.cpp may cause a Denial (no CVSS)
- [CVE-2018-20188](https://cve.now/CVE-2018-20188.md): FUEL CMS 1.4.3 has CSRF via users/create/ to add an administrator account. (no CVSS)
- [CVE-2018-14852](https://cve.now/CVE-2018-14852.md): Out-of-bounds array access in dhd\_rx\_frame in drivers/net/wireless/bcmdhd4358/dhd\_linux.c in the bcmdhd4358 Wi-Fi driver on the Samsung Gala (no CVSS)
- [CVE-2018-14853](https://cve.now/CVE-2018-14853.md): A NULL pointer dereference in dhd\_prot\_txdata\_write\_flush in drivers/net/wireless/bcmdhd4358/dhd\_msgbuf.c in the bcmdhd4358 Wi-Fi driver on (no CVSS)
- [CVE-2018-14854](https://cve.now/CVE-2018-14854.md): Buffer overflow in dhd\_bus\_flow\_ring\_delete\_response in drivers/net/wireless/bcmdhd4358/dhd\_pcie.c in the bcmdhd4358 Wi-Fi driver on the Sam (no CVSS)
- [CVE-2018-14855](https://cve.now/CVE-2018-14855.md): Buffer overflow in dhd\_bus\_flow\_ring\_flush\_response in drivers/net/wireless/bcmdhd4358/dhd\_pcie.c in the bcmdhd4358 Wi-Fi driver on the Sams (no CVSS)
- [CVE-2018-14856](https://cve.now/CVE-2018-14856.md): Buffer overflow in dhd\_bus\_flow\_ring\_create\_response in drivers/net/wireless/bcmdhd4358/dhd\_pcie.c in the bcmdhd4358 Wi-Fi driver on the Sam (no CVSS)
- [CVE-2018-16596](https://cve.now/CVE-2018-16596.md): A stack-based buffer overflow in the LAN UPnP service running on UDP port 1900 of Swisscom Internet-Box (2, Standard, and Plus) prior to v09 (no CVSS)
- [CVE-2018-18555](https://cve.now/CVE-2018-18555.md): A sandbox escape issue was discovered in VyOS 1.1.8. (no CVSS)
- [CVE-2018-18556](https://cve.now/CVE-2018-18556.md): A privilege escalation issue was discovered in VyOS 1.1.8. (no CVSS)
- [CVE-2018-19036](https://cve.now/CVE-2018-19036.md): An issue was discovered in several Bosch IP cameras for firmware versions 6.32 and higher. (no CVSS)
- [CVE-2018-19828](https://cve.now/CVE-2018-19828.md): Artica Integria IMS 5.0.83 has XSS via the search\_string parameter. (no CVSS)
- [CVE-2018-19933](https://cve.now/CVE-2018-19933.md): Bolt CMS \<3.6.2 allows XSS via text input click preview button as demonstrated by the Title field of a Configured and New Entry. (no CVSS, bolt/bolt)
- [CVE-2018-19936](https://cve.now/CVE-2018-19936.md): PrinterOn Enterprise 4.1.4 allows Arbitrary File Deletion. (no CVSS)
- [CVE-2018-19974](https://cve.now/CVE-2018-19974.md): In YARA 3.8.1, bytecode in a specially crafted compiled rule can read uninitialized data from VM scratch memory in libyara/exec.c. (no CVSS)
- [CVE-2018-19975](https://cve.now/CVE-2018-19975.md): In YARA 3.8.1, bytecode in a specially crafted compiled rule can read data from any arbitrary address in memory, in libyara/exec.c. (no CVSS)
- [CVE-2018-19976](https://cve.now/CVE-2018-19976.md): In YARA 3.8.1, bytecode in a specially crafted compiled rule is exposed to information about its environment, in libyara/exec.c. (no CVSS)
- [CVE-2018-20092](https://cve.now/CVE-2018-20092.md): PTC ThingWorx Platform through 8.3.0 is vulnerable to a directory traversal attack on ZIP files via a POST request. (no CVSS)
- [CVE-2018-20123](https://cve.now/CVE-2018-20123.md): pvrdma\_realize in hw/rdma/vmw/pvrdma\_main.c in QEMU has a Memory leak after an initialisation error. (no CVSS)
- [CVE-2018-20133](https://cve.now/CVE-2018-20133.md): ymlref allows code injection. (no CVSS, ymlref)
- [CVE-2018-20184](https://cve.now/CVE-2018-20184.md): In GraphicsMagick 1.4 snapshot-20181209 Q8, there is a heap-based buffer overflow in the WriteTGAImage function of tga.c, which allows attac (no CVSS)
- [CVE-2018-20185](https://cve.now/CVE-2018-20185.md): In GraphicsMagick 1.4 snapshot-20181209 Q8 on 32-bit platforms, there is a heap-based buffer over-read in the ReadBMPImage function of bmp.c (no CVSS)
- [CVE-2018-20186](https://cve.now/CVE-2018-20186.md): An issue was discovered in Bento4 1.5.1-627. (no CVSS)
- [CVE-2017-1265](https://cve.now/CVE-2017-1265.md): IBM Security Guardium 10.0, 10.0.1, 10.1, 10.1.2, 10.1.3, 10.1.4, and 10.5 does not validate, or incorrectly validates, a certificate. (CVSS 3.7, IBM Security Guardium)
- [CVE-2017-1272](https://cve.now/CVE-2017-1272.md): IBM Security Guardium 10.0 and 10.5 stores sensitive information in URL parameters. (CVSS 3.7, IBM Security Guardium)
- [CVE-2017-1597](https://cve.now/CVE-2017-1597.md): IBM Security Guardium 10.0, 10.0.1, 10.1, 10.1.2, 10.1.3, 10.1.4, and 10.5 Database Activity Monitor does not require that users should have (CVSS 5.9, IBM Security Guardium)
- [CVE-2018-1889](https://cve.now/CVE-2018-1889.md): IBM Security Guardium 10.0 and 10.5 is vulnerable to cross-site scripting. (CVSS 5.4, IBM Security Guardium)
- [CVE-2018-1891](https://cve.now/CVE-2018-1891.md): IBM Security Guardium 10 and 10.5 is vulnerable to cross-site scripting. (CVSS 5.4, IBM Security Guardium)
- [CVE-2018-18245](https://cve.now/CVE-2018-18245.md): Nagios Core 4.4.2 has XSS via the alert summary reports of plugin results, as demonstrated by a SCRIPT element delivered by a modified check (no CVSS)
- [CVE-2018-18246](https://cve.now/CVE-2018-18246.md): Icinga Web 2 before 2.6.2 has CSRF via /icingaweb2/config/moduledisable?name=monitoring to disable the monitoring module, or via /icingaweb2 (no CVSS)
- [CVE-2018-18247](https://cve.now/CVE-2018-18247.md): Icinga Web 2 before 2.6.2 has XSS via the /icingaweb2/navigation/add icon parameter. (no CVSS)
- [CVE-2018-18248](https://cve.now/CVE-2018-18248.md): Icinga Web 2 has XSS via the /icingaweb2/monitoring/list/services dir parameter, the /icingaweb2/user/list query string, the /icingaweb2/mon (no CVSS)
- [CVE-2018-18249](https://cve.now/CVE-2018-18249.md): Icinga Web 2 before 2.6.2 allows injection of PHP ini-file directives via vectors involving environment variables as the channel to send inf (no CVSS)
- [CVE-2018-18250](https://cve.now/CVE-2018-18250.md): Icinga Web 2 before 2.6.2 allows parameters that break navigation dashlets, as demonstrated by a single '$' character as the Name of a Navig (no CVSS)
- [CVE-2018-19295](https://cve.now/CVE-2018-19295.md): Sylabs Singularity 2.4 to 2.6 allows local users to conduct Improper Input Validation attacks. (no CVSS, github.com/sylabs/singularity)
- [CVE-2018-19649](https://cve.now/CVE-2018-19649.md): XSS exists in InfoVista VistaPortal SE Version 5.1 (build 51029). (no CVSS)
- [CVE-2018-19765](https://cve.now/CVE-2018-19765.md): Cross Site Scripting exists in InfoVista VistaPortal SE Version 5.1 (build 51029). (no CVSS)
- [CVE-2018-19766](https://cve.now/CVE-2018-19766.md): Cross Site Scripting exists in InfoVista VistaPortal SE Version 5.1 (build 51029). (no CVSS)
- [CVE-2018-19767](https://cve.now/CVE-2018-19767.md): Cross Site Scripting exists in InfoVista VistaPortal SE Version 5.1 (build 51029). (no CVSS)
- [CVE-2018-19768](https://cve.now/CVE-2018-19768.md): Cross Site Scripting exists in InfoVista VistaPortal SE Version 5.1 (build 51029). (no CVSS)
- [CVE-2018-19769](https://cve.now/CVE-2018-19769.md): Cross Site Scripting exists in InfoVista VistaPortal SE Version 5.1 (build 51029). (no CVSS)
- [CVE-2018-19770](https://cve.now/CVE-2018-19770.md): Cross Site Scripting exists in InfoVista VistaPortal SE Version 5.1 (build 51029). (no CVSS)
- [CVE-2018-19771](https://cve.now/CVE-2018-19771.md): Cross Site Scripting exists in InfoVista VistaPortal SE Version 5.1 (build 51029). (no CVSS)
- [CVE-2018-19772](https://cve.now/CVE-2018-19772.md): Cross Site Scripting exists in InfoVista VistaPortal SE Version 5.1 (build 51029). (no CVSS)
- [CVE-2018-19773](https://cve.now/CVE-2018-19773.md): Cross Site Scripting exists in InfoVista VistaPortal SE Version 5.1 (build 51029). (no CVSS)
- [CVE-2018-19774](https://cve.now/CVE-2018-19774.md): Cross Site Scripting exists in InfoVista VistaPortal SE Version 5.1 (build 51029). (no CVSS)
- [CVE-2018-19775](https://cve.now/CVE-2018-19775.md): Cross Site Scripting exists in InfoVista VistaPortal SE Version 5.1 (build 51029). (no CVSS)
- [CVE-2018-19809](https://cve.now/CVE-2018-19809.md): Cross Site Scripting exists in InfoVista VistaPortal SE Version 5.1 (build 51029). (no CVSS)
- [CVE-2018-19810](https://cve.now/CVE-2018-19810.md): Cross Site Scripting exists in InfoVista VistaPortal SE Version 5.1 (build 51029). (no CVSS)
- [CVE-2018-19811](https://cve.now/CVE-2018-19811.md): Cross Site Scripting exists in InfoVista VistaPortal SE Version 5.1 (build 51029). (no CVSS)
- [CVE-2018-19812](https://cve.now/CVE-2018-19812.md): Cross Site Scripting exists in InfoVista VistaPortal SE Version 5.1 (build 51029). (no CVSS)
- [CVE-2018-19813](https://cve.now/CVE-2018-19813.md): Cross Site Scripting exists in InfoVista VistaPortal SE Version 5.1 (build 51029). (no CVSS)
- [CVE-2018-19814](https://cve.now/CVE-2018-19814.md): Cross Site Scripting exists in InfoVista VistaPortal SE Version 5.1 (build 51029). (no CVSS)
- [CVE-2018-19815](https://cve.now/CVE-2018-19815.md): Cross Site Scripting exists in InfoVista VistaPortal SE Version 5.1 (build 51029). (no CVSS)
- [CVE-2018-19816](https://cve.now/CVE-2018-19816.md): Cross Site Scripting exists in InfoVista VistaPortal SE Version 5.1 (build 51029). (no CVSS)
- [CVE-2018-19817](https://cve.now/CVE-2018-19817.md): Cross Site Scripting exists in InfoVista VistaPortal SE Version 5.1 (build 51029). (no CVSS)
- [CVE-2018-19818](https://cve.now/CVE-2018-19818.md): Cross Site Scripting exists in InfoVista VistaPortal SE Version 5.1 (build 51029). (no CVSS)
- [CVE-2018-19819](https://cve.now/CVE-2018-19819.md): Cross Site Scripting exists in InfoVista VistaPortal SE Version 5.1 (build 51029). (no CVSS)
- [CVE-2018-19820](https://cve.now/CVE-2018-19820.md): Cross Site Scripting exists in InfoVista VistaPortal SE Version 5.1 (build 51029). (no CVSS)
- [CVE-2018-19821](https://cve.now/CVE-2018-19821.md): Cross Site Scripting exists in InfoVista VistaPortal SE Version 5.1 (build 51029). (no CVSS)
- [CVE-2018-19822](https://cve.now/CVE-2018-19822.md): Cross Site Scripting exists in InfoVista VistaPortal SE Version 5.1 (build 51029). (no CVSS)
- [CVE-2018-20027](https://cve.now/CVE-2018-20027.md): The yaml\_parse.load method in Pylearn2 allows code injection. (no CVSS)
- [CVE-2018-20171](https://cve.now/CVE-2018-20171.md): An issue was discovered in Nagios XI before 5.5.8. (no CVSS)
- [CVE-2018-20172](https://cve.now/CVE-2018-20172.md): An issue was discovered in Nagios XI before 5.5.8. (no CVSS)
- [CVE-2018-20173](https://cve.now/CVE-2018-20173.md): Zoho ManageEngine OpManager 12.3 before 123238 allows SQL injection via the getGraphData API. (no CVSS)
- [CVE-2017-18352](https://cve.now/CVE-2017-18352.md): Error reporting within Rendertron 1.0.0 allows reflected Cross Site Scripting (XSS) from invalid URLs. (no CVSS, rendertron)
- [CVE-2017-18353](https://cve.now/CVE-2017-18353.md): Rendertron 1.0.0 includes an \_ah/stop route to shutdown the Chrome instance responsible for serving render requests to all users. (no CVSS, rendertron)
- [CVE-2017-18354](https://cve.now/CVE-2017-18354.md): Rendertron 1.0.0 allows for alternative protocols such as 'file://' introducing a Local File Inclusion (LFI) bug where arbitrary files can b (no CVSS, rendertron)
- [CVE-2017-18355](https://cve.now/CVE-2017-18355.md): Installed packages are exposed by node\_modules in Rendertron 1.0.0, allowing remote attackers to read absolute paths on the server by examin (no CVSS, rendertron)
- [CVE-2018-20169](https://cve.now/CVE-2018-20169.md): An issue was discovered in the Linux kernel before 4.19.9. (no CVSS)
- [CVE-2018-20170](https://cve.now/CVE-2018-20170.md): OpenStack Keystone through 14.0.1 has a user enumeration vulnerability because invalid usernames have much faster responses than valid ones (no CVSS, keystone)
- [CVE-2018-20167](https://cve.now/CVE-2018-20167.md): Terminology before 1.3.1 allows Remote Code Execution because popmedia is mishandled, as demonstrated by an unsafe "cat README.md" command w (no CVSS)
- [CVE-2018-20168](https://cve.now/CVE-2018-20168.md): Google gVisor before 2018-08-22 reuses a pagetable in a different level with the paging-structure cache intact, which allows attackers to ca (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2018-12-17
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.