# CVEs published 2018-12-18 19 CVEs were published on December 18, 2018: 0 critical, 1 high. Days are UTC. - [CVE-2018-16884](https://cve.now/CVE-2018-16884.md): A flaw was found in the Linux kernel's NFS41+ subsystem. (CVSS 6.5, \[UNKNOWN\] kernel:) - [CVE-2018-17777](https://cve.now/CVE-2018-17777.md): An issue was discovered on D-Link DVA-5592 A1\_WI\_20180823 devices. (no CVSS) - [CVE-2018-18921](https://cve.now/CVE-2018-18921.md): PHP Server Monitor before 3.3.2 has CSRF, as demonstrated by a Delete action. (no CVSS, phpservermon/phpservermon) - [CVE-2018-19789](https://cve.now/CVE-2018-19789.md): An issue was discovered in Symfony 2.7.x before 2.7.50, 2.8.x before 2.8.49, 3.x before 3.4.20, 4.0.x before 4.0.15, 4.1.x before 4.1.9, and (no CVSS, symfony/symfony · symfony/form) - [CVE-2018-19790](https://cve.now/CVE-2018-19790.md): An open redirect was discovered in Symfony 2.7.x before 2.7.50, 2.8.x before 2.8.49, 3.x before 3.4.20, 4.0.x before 4.0.15, 4.1.x before 4. (no CVSS, symfony/security-http · symfony/security +1) - [CVE-2018-19829](https://cve.now/CVE-2018-19829.md): Artica Integria IMS 5.0.83 has CSRF in godmode/usuarios/lista\_usuarios, resulting in the ability to delete an arbitrary user when the ID num (no CVSS) - [CVE-2018-6978](https://cve.now/CVE-2018-6978.md): vRealize Operations (7.x before 7.0.0.11287810, 6.7.x before 6.7.0.11286837 and 6.6.x before 6.6.1.11286876) contains a local privilege esca (no CVSS) - [CVE-2018-20213](https://cve.now/CVE-2018-20213.md): wbook\_addworksheet in workbook.c in libexcel.a in libexcel 0.01 allows attackers to cause a denial of service (SEGV) via a long name. (no CVSS) - [CVE-2017-15031](https://cve.now/CVE-2017-15031.md): In all versions of ARM Trusted Firmware up to and including v1.4, not initializing or saving/restoring the PMCR\_EL0 register can leak secure (no CVSS) - [CVE-2018-1833](https://cve.now/CVE-2018-1833.md): IBM Event Streams 2018.3.0 could allow a remote attacker to submit an API request with a fake Host request header. (CVSS 5.3, IBM Event Streams) - [CVE-2018-19522](https://cve.now/CVE-2018-19522.md): DriverAgent 2.2015.7.14, which includes DrvAgent64.sys 1.0.0.1, allows a user to send an IOCTL (0x800020F4) with a buffer containing user de (no CVSS) - [CVE-2018-4015](https://cve.now/CVE-2018-4015.md): An exploitable vulnerability exists in the HTTP client functionality of the Webroot BrightCloud SDK. (CVSS 8.1, Webroot) - [CVE-2018-20201](https://cve.now/CVE-2018-20201.md): There is a stack-based buffer over-read in the jsfNameFromString function of jsflash.c in Espruino 2V00, leading to a denial of service or p (no CVSS) - [CVE-2018-20194](https://cve.now/CVE-2018-20194.md): There is a stack-based buffer underflow in the third instance of the calculate\_gain function in libfaad/sbr\_hfadj.c in Freeware Advanced Aud (no CVSS) - [CVE-2018-20195](https://cve.now/CVE-2018-20195.md): A NULL pointer dereference was discovered in ic\_predict of libfaad/ic\_predict.c in Freeware Advanced Audio Decoder 2 (FAAD2) 2.8.8. (no CVSS) - [CVE-2018-20196](https://cve.now/CVE-2018-20196.md): There is a stack-based buffer overflow in the third instance of the calculate\_gain function in libfaad/sbr\_hfadj.c in Freeware Advanced Audi (no CVSS) - [CVE-2018-20197](https://cve.now/CVE-2018-20197.md): There is a stack-based buffer underflow in the third instance of the calculate\_gain function in libfaad/sbr\_hfadj.c in Freeware Advanced Aud (no CVSS) - [CVE-2018-20198](https://cve.now/CVE-2018-20198.md): A NULL pointer dereference was discovered in ifilter\_bank of libfaad/filtbank.c in Freeware Advanced Audio Decoder 2 (FAAD2) 2.8.8. (no CVSS) - [CVE-2018-20199](https://cve.now/CVE-2018-20199.md): A NULL pointer dereference was discovered in ifilter\_bank of libfaad/filtbank.c in Freeware Advanced Audio Decoder 2 (FAAD2) 2.8.8. (no CVSS) --- Source: cve.now, built and run by Sazabi (AI-native observability and security) Page: https://cve.now/daily/2018-12-18 Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.