CVEs published December 19, 2018
30 CVEs were published on December 19, 2018: 0 critical, 1 high.
- Published
- 30
- Critical
- 0
- High
- 1
- Medium
- 0
- Low
- 2
- Unrated
- 27
- Now in CISA KEV
- 0
- Fix available
- 8
Most affected products
- LibVNC
- 9
- Apache Software Foundation Apache NiFi · org.apache.nifi:ni…
- 4
- [UNKNOWN] sssd
- 1
- Apache Software Foundation Apache Oozie · org.apache.oozie:…
- 1
- org.eclipse.rdf4j:rdf4j
- 1
- Pivotal Concourse · github.com/concourse/concourse
- 1
- Spring by Pivotal Spring Security · org.springframework.… +1
- 1
- WebAccess/SCADA
- 1
High 1
Medium, low and unrated 29
- CVE-2018-15801Authorization Bypass During JWT Issuer Validation with spring-securitySpring by Pivotal Spring Security · org.springframework.… +1
- CVE-2018-20299An issue was discovered in several Bosch Smart Home cameras (360 degree indoor camera and Eyes outdoor camera) with firmware before 6.52.4.
- CVE-2018-11799Vulnerability allows a user of Apache Oozie 3.1.3-incubating to 5.0.0 to impersonate other users.Apache Software Foundation Apache Oozie · org.apache.oozie:…
- CVE-2018-19506Zurmo 3.2.4 has XSS via an admin's use of the name parameter in the reports section, aka the app/index.php/reports/default/details?id=1 URI.
- CVE-2018-19507CMSimple 4.7.5 has XSS via an admin's use of a ?file=config&action=array URI.
- CVE-2018-19508CMSimple 4.7.5 has XSS via an admin's upload of an SVG file at a ?userfiles&subdir=userfiles/images/flags/ URI.
- CVE-2018-19596Zurmo 3.2.4 allows HTML Injection via an admin's use of HTML in the report section, a related issue to CVE-2018-19506.
- CVE-2018-19597CMS Made Simple 2.2.8 allows XSS via an uploaded SVG document, a related issue to CVE-2017-16798.
- CVE-2018-19598Statamic 2.10.3 allows XSS via First Name or Last Name to the /users URI in an 'Add new user' request.
- CVE-2018-18999WebAccess/SCADA, WebAccess/SCADA Version 8.3.2 installed on Windows 2008 R2 SP1.WebAccess/SCADA
- CVE-2018-20298S3 Browser before 8.1.5 contains an XML external entity (XXE) vulnerability, allowing remote attackers to read arbitrary files and obtain NT
- CVE-2018-15126LibVNC before commit 73cb96fec028a576a5a24417b57723b55854ad7b contains heap use-after-free vulnerability in server code of file transfer extLibVNC
- CVE-2018-15127LibVNC before commit 502821828ed00b4a2c4bef90683d0fd88ce495de contains heap out-of-bound write vulnerability in server code of file transferLibVNC
- CVE-2018-20019LibVNC before commit a83439b9fbe0f03c48eb94ed05729cb016f8b72f contains multiple heap out-of-bound write vulnerabilities in VNC client code tLibVNC
- CVE-2018-20020LibVNC before commit 7b1ef0ffc4815cab9a96c7278394152bdc89dc4d contains heap out-of-bound write vulnerability inside structure in VNC client LibVNC
- CVE-2018-20021LibVNC before commit c3115350eb8bb635d0fdb4dbbb0d0541f38ed19c contains a CWE-835: Infinite loop vulnerability in VNC client code.LibVNC
- CVE-2018-20022LibVNC before 2f5b2ad1c6c99b1ac6482c95844a84d66bb52838 contains multiple weaknesses CWE-665: Improper Initialization vulnerability in VNC clLibVNC
- CVE-2018-20023LibVNC before 8b06f835e259652b0ff026898014fc7297ade858 contains CWE-665: Improper Initialization vulnerability in VNC Repeater client code tLibVNC
- CVE-2018-20024LibVNC before commit 4a21bbd097ef7c44bb000c3bd0907f96a10e4ce7 contains null pointer dereference in VNC client code that can result DoS.LibVNC
- CVE-2018-6307LibVNC before commit ca2a5ac02fbbadd0a21fabba779c1ea69173d10b contains heap use-after-free vulnerability in server code of file transfer extLibVNC
- CVE-2018-16883sssd versions from 1.13.0 to before 2.0.0 did not properly restrict access to the infopipe according to the "allowed_uids" configuration par[UNKNOWN] sssd
- CVE-2018-17192The X-Frame-Options headers were applied inconsistently on some HTTP responses, resulting in duplicate or missing security headers.Apache Software Foundation Apache NiFi · org.apache.nifi:ni…
- CVE-2018-17193The message-page.jsp error page used the value of the HTTP request header X-ProxyContextPath without sanitization, resulting in a reflected Apache Software Foundation Apache NiFi · org.apache.nifi:ni…
- CVE-2018-17194When a client request to a cluster node was replicated to other nodes in the cluster for verification, the Content-Length was forwarded.Apache Software Foundation Apache NiFi · org.apache.nifi:ni…
- CVE-2018-17195The template upload API endpoint accepted requests from different domain when sent in conjunction with ARP spoofing + man in the middle (MiTApache Software Foundation Apache NiFi · org.apache.nifi:ni…
- CVE-2018-20227RDF4J 2.4.2 allows Directory Traversal via ../ in an entry in a ZIP archive.org.eclipse.rdf4j:rdf4j
- CVE-2018-20228Subsonic V6.1.5 allows internetRadioSettings.view streamUrl CSRF, with resultant SSRF.
- CVE-2018-20230An issue was discovered in PSPP 1.2.0.
- CVE-2018-20231Cross Site Request Forgery (CSRF) in the two-factor-authentication plugin before 1.3.13 for WordPress allows remote attackers to disable 2FA