# CVEs published 2018-12-20

136 CVEs were published on December 20, 2018: 1 critical, 8 high. 1 is now in CISA KEV. Days are UTC.

- [CVE-2017-9732](https://cve.now/CVE-2017-9732.md): The read\_packet function in knc (Kerberised NetCat) before 1.11-1 is vulnerable to denial of service (memory exhaustion) that can be exploit (no CVSS)
- [CVE-2018-12651](https://cve.now/CVE-2018-12651.md): A Reflected Cross Site Scripting (XSS) Vulnerability was discovered in Adrenalin 5.4 HRMS Software. (no CVSS)
- [CVE-2018-14846](https://cve.now/CVE-2018-14846.md): The Mondula Multi Step Form plugin before 1.2.8 for WordPress has multiple stored XSS via wp-admin/admin-ajax.php. (no CVSS)
- [CVE-2018-16627](https://cve.now/CVE-2018-16627.md): panel/login in Kirby v2.5.12 allows Host header injection via the "forget password" feature. (no CVSS)
- [CVE-2018-17244](https://cve.now/CVE-2018-17244.md): Elasticsearch Security versions 6.4.0 to 6.4.2 contain an error in the way request headers are applied to requests when using the Active Dir (no CVSS, Elasticsearch · org.elasticsearch:elasticsearch)
- [CVE-2018-17245](https://cve.now/CVE-2018-17245.md): Kibana versions 4.0 to 4.6, 5.0 to 5.6.12, and 6.0 to 6.4.2 contain an error in the way authorization credentials are used when generating P (no CVSS, Elastic Kibana)
- [CVE-2018-17246](https://cve.now/CVE-2018-17246.md): Kibana versions before 6.4.3 and 5.6.13 contain an arbitrary file inclusion flaw in the Console plugin. (no CVSS, Elastic Kibana)
- [CVE-2018-17247](https://cve.now/CVE-2018-17247.md): Elasticsearch Security versions 6.5.0 and 6.5.1 contain an XXE flaw in Machine Learning's find\_file\_structure API. (no CVSS, Elasticsearch · org.elasticsearch:elasticsearch)
- [CVE-2018-18388](https://cve.now/CVE-2018-18388.md): eScan Agent Application (MWAGENT.EXE) 4.0.2.98 in MicroWorld Technologies eScan 14.0 allows remote or local attackers to execute arbitrary c (no CVSS)
- [CVE-2018-18399](https://cve.now/CVE-2018-18399.md): SQL injection vulnerability in the "ContentPlaceHolder1\_uxTitle" component in ArchiveNews.aspx in jco.ir KARMA 6.0.0 allows a remote attacke (no CVSS)
- [CVE-2018-18441](https://cve.now/CVE-2018-18441.md): D-Link DCS series Wi-Fi cameras expose sensitive information regarding the device configuration. (no CVSS)
- [CVE-2018-18442](https://cve.now/CVE-2018-18442.md): D-Link DCS-825L devices with firmware 1.08 do not employ a suitable mechanism to prevent denial-of-service (DoS) attacks. (no CVSS)
- [CVE-2018-18629](https://cve.now/CVE-2018-18629.md): An issue was discovered in the Keybase command-line client before 2.8.0-20181023124437 for Linux. (no CVSS)
- [CVE-2018-18767](https://cve.now/CVE-2018-18767.md): An issue was discovered in D-Link 'myDlink Baby App' version 2.04.06. (no CVSS)
- [CVE-2018-19134](https://cve.now/CVE-2018-19134.md): In Artifex Ghostscript through 9.25, the setpattern operator did not properly validate certain types. (no CVSS)
- [CVE-2018-19239](https://cve.now/CVE-2018-19239.md): TRENDnet TEW-673GRU v1.00b40 devices have an OS command injection vulnerability in the start\_arpping function of the timer binary, which all (no CVSS)
- [CVE-2018-19240](https://cve.now/CVE-2018-19240.md): Buffer overflow in network.cgi on TRENDnet TV-IP110WN V1.2.2 build 68, V1.2.2.65, and V1.2.2 build 64 and TV-IP121WN V1.2.2 build 28 devices (no CVSS)
- [CVE-2018-19241](https://cve.now/CVE-2018-19241.md): Buffer overflow in video.cgi on TRENDnet TV-IP110WN V1.2.2 build 68, V1.2.2.65, and V1.2.2 build 64 and TV-IP121WN V1.2.2 build 28 devices a (no CVSS)
- [CVE-2018-19242](https://cve.now/CVE-2018-19242.md): Buffer overflow in apply.cgi on TRENDnet TEW-632BRP 1.010B32 and TEW-673GRU devices allows attackers to hijack the control flow to any attac (no CVSS)
- [CVE-2018-20124](https://cve.now/CVE-2018-20124.md): hw/rdma/rdma\_backend.c in QEMU allows guest OS users to trigger out-of-bounds access via a PvrdmaSqWqe ring element with a large num\_sge val (no CVSS)
- [CVE-2018-20191](https://cve.now/CVE-2018-20191.md): hw/rdma/vmw/pvrdma\_main.c in QEMU does not implement a read operation (such as uar\_read by analogy to uar\_write), which allows attackers to (no CVSS)
- [CVE-2018-1160](https://cve.now/CVE-2018-1160.md): Netatalk before 3.1.12 is vulnerable to an out of bounds write in dsi\_opensess.c. (CVSS 9.8, Netatalk)
- [CVE-2018-15720](https://cve.now/CVE-2018-15720.md): Logitech Harmony Hub before version 4.15.206 contained two hard-coded accounts in the XMPP server that gave remote users access to the local (no CVSS, Logitech Harmony Hub)
- [CVE-2018-15721](https://cve.now/CVE-2018-15721.md): The XMPP server in Logitech Harmony Hub before version 4.15.206 is vulnerable to authentication bypass via a crafted XMPP request. (no CVSS, Logitech Harmony Hub)
- [CVE-2018-15722](https://cve.now/CVE-2018-15722.md): The Logitech Harmony Hub before version 4.15.206 is vulnerable to OS command injection via the time update request. (no CVSS, Logitech Harmony Hub)
- [CVE-2018-15723](https://cve.now/CVE-2018-15723.md): The Logitech Harmony Hub before version 4.15.206 is vulnerable to application level command injection via crafted HTTP request. (no CVSS, Logitech Harmony Hub)
- [CVE-2018-18871](https://cve.now/CVE-2018-18871.md): Missing password verification in the web interface on Gigaset Maxwell Basic VoIP phones with firmware 2.22.7 would allow a remote attacker ( (no CVSS)
- [CVE-2018-19005](https://cve.now/CVE-2018-19005.md): Cscape, Version 9.80.75.3 SP3 and prior. (no CVSS, Cscape)
- [CVE-2018-20125](https://cve.now/CVE-2018-20125.md): hw/rdma/vmw/pvrdma\_cmd.c in QEMU allows attackers to cause a denial of service (NULL pointer dereference or excessive memory allocation) in (no CVSS)
- [CVE-2018-20126](https://cve.now/CVE-2018-20126.md): hw/rdma/vmw/pvrdma\_cmd.c in QEMU allows create\_cq and create\_qp memory leaks because errors are mishandled. (no CVSS)
- [CVE-2018-20216](https://cve.now/CVE-2018-20216.md): QEMU can have an infinite loop in hw/rdma/vmw/pvrdma\_dev\_ring.c because return values are not checked (and -1 is mishandled). (no CVSS)
- [CVE-2018-1000883](https://cve.now/CVE-2018-1000883.md): Elixir Plug Plug version All contains a Header Injection vulnerability in Connection that can result in Given a cookie value, Headers can be (no CVSS)
- [CVE-2018-1000884](https://cve.now/CVE-2018-1000884.md): Vesta CP version Prior to commit f6f6f9cfbbf2979e301956d1c6ab5c44386822c0 -- any release prior to 0.9.8-18 contains a CWE-208 / Information (no CVSS)
- [CVE-2018-1000885](https://cve.now/CVE-2018-1000885.md): PHKP version including commit 88fd9cfdf14ea4b6ac3e3967feea7bcaabb6f03b contains a Improper Neutralization of Special Elements used in a Comm (no CVSS)
- [CVE-2018-1000886](https://cve.now/CVE-2018-1000886.md): nasm version 2.14.01rc5, 2.15 contains a Buffer Overflow vulnerability in asm/stdscan.c:130 that can result in Stack-overflow caused by trig (no CVSS)
- [CVE-2018-15329](https://cve.now/CVE-2018-15329.md): On BIG-IP 14.0.0-14.0.0.2, 13.0.0-13.1.1.1, or 12.1.0-12.1.3.7, or Enterprise Manager 3.1.1, when authenticated administrative users run com (no CVSS, F5 Networks BIG-IP (LTM, AAM, AFM, Analytics, APM, ASM, DNS…)
- [CVE-2018-15330](https://cve.now/CVE-2018-15330.md): On BIG-IP 14.0.0-14.0.0.2, 13.0.0-13.1.1.1, or 12.1.0-12.1.3.7, when a virtual server using the inflate functionality to process a gzip bomb (no CVSS, F5 Networks BIG-IP)
- [CVE-2018-15331](https://cve.now/CVE-2018-15331.md): On BIG-IP AAM 13.0.0 or 12.1.0-12.1.3.7, the dcdb\_convert utility used by BIG-IP AAM fails to drop group permissions when executing helper s (no CVSS, F5 Networks BIG-IP)
- [CVE-2018-8888](https://cve.now/CVE-2018-8888.md): A stored cross-site scripting (XSS) vulnerability in the Management Console of BlackBerry UEM versions earlier than 12.10.0 could allow an a (no CVSS, BlackBerry UEM)
- [CVE-2018-8891](https://cve.now/CVE-2018-8891.md): Multiple stored cross-site scripting (XSS) vulnerabilities in the Management Console of BlackBerry UEM versions earlier than 12.9.1 could al (no CVSS, BlackBerry UEM)
- [CVE-2018-8892](https://cve.now/CVE-2018-8892.md): A cross-site request forgery (CSRF) vulnerability in the Management Console of BlackBerry UEM versions earlier than 12.9.1 could allow an at (no CVSS, BlackBerry UEM)
- [CVE-2018-1000867](https://cve.now/CVE-2018-1000867.md): WeBid version up to current version 1.2.2 contains a SQL Injection vulnerability in All five yourauctions\*.php scripts that can result in Da (no CVSS)
- [CVE-2018-1000868](https://cve.now/CVE-2018-1000868.md): WeBid version up to current version 1.2.2 contains a Cross Site Scripting (XSS) vulnerability in user\_login.php, register.php that can resul (no CVSS)
- [CVE-2018-1000869](https://cve.now/CVE-2018-1000869.md): phpIPAM version 1.3.2 contains a CWE-89 vulnerability in /app/admin/nat/item-add-submit.php that can result in SQL Injection.. (no CVSS)
- [CVE-2018-1000870](https://cve.now/CVE-2018-1000870.md): PHPipam version 1.3.2 and earlier contains a CWE-79 vulnerability in /app/admin/users/print-user.php that can result in Execute code in the (no CVSS)
- [CVE-2018-1000871](https://cve.now/CVE-2018-1000871.md): HotelDruid HotelDruid 2.3.0 version 2.3.0 and earlier contains a SQL Injection vulnerability in "id\_utente\_mod" parameter in gestione\_utenti (no CVSS)
- [CVE-2018-1000872](https://cve.now/CVE-2018-1000872.md): OpenKMIP PyKMIP version All versions before 0.8.0 contains a CWE 399: Resource Management Errors (similar issue to CVE-2015-5262) vulnerabil (no CVSS, pykmip)
- [CVE-2018-1000873](https://cve.now/CVE-2018-1000873.md): Fasterxml Jackson version Before 2.9.8 contains a CWE-20: Improper Input Validation vulnerability in Jackson-Modules-Java8 that can result i (no CVSS, com.fasterxml.jackson.datatype:jackson-datatype-jsr310)
- [CVE-2018-1000874](https://cve.now/CVE-2018-1000874.md): PHP cebe markdown parser version 1.2.0 and earlier contains a Cross Site Scripting (XSS) vulnerability in all distributed parsers allowing a (CVSS 6.1)
- [CVE-2018-1000875](https://cve.now/CVE-2018-1000875.md): Berkeley Open Infrastructure for Network Computing BOINC Server and Website Code version 0.9-1.0.2 contains a CWE-302: Authentication Bypass (no CVSS)
- [CVE-2018-1000876](https://cve.now/CVE-2018-1000876.md): binutils version 2.32 and earlier contains a Integer Overflow vulnerability in objdump, bfd\_get\_dynamic\_reloc\_upper\_bound,bfd\_canonicalize\_d (no CVSS)
- [CVE-2018-1000877](https://cve.now/CVE-2018-1000877.md): libarchive version commit 416694915449219d505531b1096384f3237dd6cc onwards (release v3.1.0 onwards) contains a CWE-415: Double Free vulnerab (no CVSS)
- [CVE-2018-1000878](https://cve.now/CVE-2018-1000878.md): libarchive version commit 416694915449219d505531b1096384f3237dd6cc onwards (release v3.1.0 onwards) contains a CWE-416: Use After Free vulne (no CVSS)
- [CVE-2018-1000879](https://cve.now/CVE-2018-1000879.md): libarchive version commit 379867ecb330b3a952fb7bfa7bffb7bbd5547205 onwards (release v3.3.0 onwards) contains a CWE-476: NULL Pointer Derefer (no CVSS)
- [CVE-2018-1000880](https://cve.now/CVE-2018-1000880.md): libarchive version commit 9693801580c0cf7c70e862d305270a16b52826a7 onwards (release v3.2.0 onwards) contains a CWE-20: Improper Input Valida (no CVSS)
- [CVE-2018-1000881](https://cve.now/CVE-2018-1000881.md): Traccar Traccar Server version 4.0 and earlier contains a CWE-94: Improper Control of Generation of Code ('Code Injection') vulnerability in (no CVSS)
- [CVE-2018-1000882](https://cve.now/CVE-2018-1000882.md): WeBid version up to current version 1.2.2 contains a Directory Traversal vulnerability in getthumb.php that can result in Arbitrary Image Fi (no CVSS)
- [CVE-2018-19233](https://cve.now/CVE-2018-19233.md): COMPAREX Miss Marple Enterprise Edition before 2.0 allows local users to execute arbitrary code by reading the user name and encrypted passw (no CVSS)
- [CVE-2018-19234](https://cve.now/CVE-2018-19234.md): The Miss Marple Updater Service in COMPAREX Miss Marple Enterprise Edition before 2.0 allows remote attackers to execute arbitrary code with (no CVSS)
- [CVE-2018-1000854](https://cve.now/CVE-2018-1000854.md): esigate.org esigate version 5.2 and earlier contains a CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Co (no CVSS, org.esigate:esigate-core)
- [CVE-2018-1000855](https://cve.now/CVE-2018-1000855.md): easymon version 1.4 and earlier contains a Cross Site Scripting (XSS) vulnerability in Endpoint where monitoring is mounted that can result (no CVSS, easymon)
- [CVE-2018-1000856](https://cve.now/CVE-2018-1000856.md): DomainMOD version 4.09.03 and above. (no CVSS)
- [CVE-2018-1000857](https://cve.now/CVE-2018-1000857.md): log-user-session version 0.7 and earlier contains a Directory Traversal vulnerability in Main SUID-binary /usr/local/bin/log-user-session th (no CVSS)
- [CVE-2018-1000858](https://cve.now/CVE-2018-1000858.md): GnuPG version 2.1.12 - 2.2.11 contains a Cross ite Request Forgery (CSRF) vulnerability in dirmngr that can result in Attacker controlled CS (no CVSS)
- [CVE-2018-1000860](https://cve.now/CVE-2018-1000860.md): phpipam version 1.3.2 and earlier contains a Cross Site Scripting (XSS) vulnerability in The value of the phpipamredirect cookie is copied i (no CVSS)
- [CVE-2017-9704](https://cve.now/CVE-2017-9704.md): In all android releases(Android for MSM, Firefox OS for MSM, QRD Android) from CAF using the linux kernel, There is no synchronization betwe (no CVSS, Qualcomm Android for MSM, Firefox OS for MSM, QRD Android)
- [CVE-2018-1000811](https://cve.now/CVE-2018-1000811.md): bludit version 3.0.0 contains a Unrestricted Upload of File with Dangerous Type vulnerability in Content Upload in Pages Editor that can res (no CVSS)
- [CVE-2018-1000812](https://cve.now/CVE-2018-1000812.md): Artica Integria IMS version 5.0 MR56 Package 58, likely earlier versions contains a CWE-640: Weak Password Recovery Mechanism for Forgotten (no CVSS)
- [CVE-2018-1000813](https://cve.now/CVE-2018-1000813.md): Backdrop CMS version 1.11.0 and earlier contains a Cross Site Scripting (XSS) vulnerability in Sanitization of custom class names used on bl (no CVSS)
- [CVE-2018-1000814](https://cve.now/CVE-2018-1000814.md): aio-libs aiohttp-session version 2.6.0 and earlier contains a Other/Unknown vulnerability in EncryptedCookieStorage and NaClCookieStorage th (no CVSS, aiohttp-session)
- [CVE-2018-1000815](https://cve.now/CVE-2018-1000815.md): Brave Software Inc. (no CVSS)
- [CVE-2018-1000816](https://cve.now/CVE-2018-1000816.md): Grafana version confirmed for 5.2.4 and 5.3.0 contains a Cross Site Scripting (XSS) vulnerability in Influxdb and Graphite query editor that (no CVSS, github.com/grafana/grafana)
- [CVE-2018-1000817](https://cve.now/CVE-2018-1000817.md): Asset Pipeline Grails Plugin Asset-pipeline plugin version Prior to 2.14.1.1, 2.15.1 and 3.0.6 contains a Incorrect Access Control vulnerabi (no CVSS, org.grails.plugins:asset-pipeline)
- [CVE-2018-1000820](https://cve.now/CVE-2018-1000820.md): neo4j-contrib neo4j-apoc-procedures version before commit 45bc09c contains a XML External Entity (XXE) vulnerability in XML Parser that can (no CVSS, org.neo4j.procedure:apoc)
- [CVE-2018-1000821](https://cve.now/CVE-2018-1000821.md): MicroMathematics version before commit 5c05ac8 contains a XML External Entity (XXE) vulnerability in SMathStudio files that can result in Di (no CVSS)
- [CVE-2018-1000822](https://cve.now/CVE-2018-1000822.md): codelibs fess version before commit faa265b contains a XML External Entity (XXE) vulnerability in GSA XML file parser that can result in Dis (no CVSS, org.codelibs.fess:fess)
- [CVE-2018-1000823](https://cve.now/CVE-2018-1000823.md): exist version \<= 5.0.0-RC4 contains a XML External Entity (XXE) vulnerability in XML Parser for REST Server that can result in Disclosure of (no CVSS, org.exist-db:exist-core)
- [CVE-2018-1000824](https://cve.now/CVE-2018-1000824.md): MegaMek version \< v0.45.1 contains a Other/Unknown vulnerability in Object Stream Connection that can result in Disclosure of confidential d (no CVSS)
- [CVE-2018-1000825](https://cve.now/CVE-2018-1000825.md): FreeCol version \<= nightly-2018-08-22 contains a XML External Entity (XXE) vulnerability in FreeColXMLReader parser that can result in Discl (no CVSS)
- [CVE-2018-1000826](https://cve.now/CVE-2018-1000826.md): Microweber version \<= 1.0.7 contains a Cross Site Scripting (XSS) vulnerability in Admin login form template that can result in Execution of (no CVSS, microweber/microweber)
- [CVE-2018-1000827](https://cve.now/CVE-2018-1000827.md): Ubilling version \<= 0.9.2 contains a Other/Unknown vulnerability in user-controlled parameter that can result in Disclosure of confidential (no CVSS)
- [CVE-2018-1000828](https://cve.now/CVE-2018-1000828.md): FrostWire version \<= frostwire-desktop-6.7.4-build-272 contains a XML External Entity (XXE) vulnerability in Man in the middle on update tha (no CVSS)
- [CVE-2018-1000829](https://cve.now/CVE-2018-1000829.md): Anyplace version before commit 80359b4 contains a XML External Entity (XXE) vulnerability in Man in the middle on map API call that can resu (no CVSS)
- [CVE-2018-1000830](https://cve.now/CVE-2018-1000830.md): XR3Player version \<= V3.124 contains a XML External Entity (XXE) vulnerability in Playlist parser that can result in Disclosure of confident (no CVSS)
- [CVE-2018-1000831](https://cve.now/CVE-2018-1000831.md): K9Mail version \<= v5.600 contains a XML External Entity (XXE) vulnerability in WebDAV response parser that can result in Disclosure of confi (no CVSS)
- [CVE-2018-1000832](https://cve.now/CVE-2018-1000832.md): ZoneMinder version \<= 1.32.2 contains a Other/Unknown vulnerability in User-controlled parameter that can result in Disclosure of confidenti (no CVSS)
- [CVE-2018-1000833](https://cve.now/CVE-2018-1000833.md): ZoneMinder version \<= 1.32.2 contains a Other/Unknown vulnerability in User-controlled parameter that can result in Disclosure of confidenti (no CVSS)
- [CVE-2018-1000834](https://cve.now/CVE-2018-1000834.md): runelite version \<= runelite-parent-1.4.23 contains a XML External Entity (XXE) vulnerability in Man in the middle runscape services call th (no CVSS)
- [CVE-2018-1000835](https://cve.now/CVE-2018-1000835.md): KeePassDX version \<= 2.5.0.0beta17 contains a XML External Entity (XXE) vulnerability in kdbx file parser that can result in Disclosure of c (no CVSS)
- [CVE-2018-1000836](https://cve.now/CVE-2018-1000836.md): bw-calendar-engine version \<= bw-calendar-engine-3.12.0 contains a XML External Entity (XXE) vulnerability in IscheduleClient XML Parser tha (no CVSS, org.bedework.caleng:bw-calendar-engine)
- [CVE-2018-1000837](https://cve.now/CVE-2018-1000837.md): UML Designer version \<= 8.0.0 contains a XML External Entity (XXE) vulnerability in XML parser for plugins that can result in Disclosure of (no CVSS)
- [CVE-2018-1000838](https://cve.now/CVE-2018-1000838.md): autopsy version \<= 4.9.0 contains a XML External Entity (XXE) vulnerability in CaseMetadata XML Parser that can result in Disclosure of conf (no CVSS)
- [CVE-2018-1000839](https://cve.now/CVE-2018-1000839.md): LH-EHR version REL-2\_0\_0 contains a Arbitrary File Upload vulnerability in Profile picture upload that can result in Remote Code Execution. (no CVSS)
- [CVE-2018-1000840](https://cve.now/CVE-2018-1000840.md): Processing Foundation Processing version 3.4 and earlier contains a XML External Entity (XXE) vulnerability in loadXML() function that can r (no CVSS)
- [CVE-2018-1000841](https://cve.now/CVE-2018-1000841.md): Zend.To version Prior to 5.15-1 contains a Cross Site Scripting (XSS) vulnerability in The verify.php page that can result in An attacker co (no CVSS)
- [CVE-2018-1000842](https://cve.now/CVE-2018-1000842.md): FatFreeCRM version \<=0.14.1, \>=0.15.0 \<=0.15.1, \>=0.16.0 \<=0.16.3, \>=0.17.0 \<=0.17.2, ==0.18.0 contains a Cross Site Scripting (XSS) vulnera (no CVSS, fat\_free\_crm)
- [CVE-2018-1000843](https://cve.now/CVE-2018-1000843.md): Luigi version prior to version 2.8.0; after commit 53b52e12745075a8acc016d33945d9d6a7a6aaeb; after GitHub PR spotify/luigi/pull/1870 contain (no CVSS, luigi)
- [CVE-2018-1000844](https://cve.now/CVE-2018-1000844.md): Square Open Source Retrofit version Prior to commit 4a693c5aeeef2be6c7ecf80e7b5ec79f6ab59437 contains a XML External Entity (XXE) vulnerabil (no CVSS, com.squareup.retrofit2:retrofit)
- [CVE-2018-1000846](https://cve.now/CVE-2018-1000846.md): FreshDNS version 1.0.3 and earlier contains a Cross ite Request Forgery (CSRF) vulnerability in All (authenticated) API calls in index.php / (no CVSS)
- [CVE-2018-1000847](https://cve.now/CVE-2018-1000847.md): FreshDNS version 1.0.3 and prior contains a Cross Site Scripting (XSS) vulnerability in Account data form; Zone editor that can result in Ex (no CVSS)
- [CVE-2018-1000848](https://cve.now/CVE-2018-1000848.md): Wampserver version prior to version 3.1.5 contains a Cross Site Scripting (XSS) vulnerability in index.php localhost page that can result in (no CVSS)
- [CVE-2018-1000849](https://cve.now/CVE-2018-1000849.md): Alpine Linux version Versions prior to 2.6.10, 2.7.6, and 2.10.1 contains a Other/Unknown vulnerability in apk-tools (Alpine Linux' package (no CVSS)
- [CVE-2018-1000850](https://cve.now/CVE-2018-1000850.md): Square Retrofit version versions from (including) 2.0 and 2.5.0 (excluding) contains a Directory Traversal vulnerability in RequestBuilder c (no CVSS, com.squareup.retrofit2:retrofit)
- [CVE-2018-1000851](https://cve.now/CVE-2018-1000851.md): Copay Bitcoin Wallet version 5.01 to 5.1.0 included. (no CVSS)
- [CVE-2018-1000852](https://cve.now/CVE-2018-1000852.md): FreeRDP FreeRDP 2.0.0-rc3 released version before commit 205c612820dac644d665b5bb1cdf437dc5ca01e3 contains a Other/Unknown vulnerability in (no CVSS)
- [CVE-2018-11960](https://cve.now/CVE-2018-11960.md): In all android releases(Android for MSM, Firefox OS for MSM, QRD Android) from CAF using the linux kernel, A use after free condition can oc (no CVSS, Qualcomm Android for MSM, Firefox OS for MSM, QRD Android)
- [CVE-2018-11961](https://cve.now/CVE-2018-11961.md): In all android releases(Android for MSM, Firefox OS for MSM, QRD Android) from CAF using the linux kernel, Possibility of accessing out of b (no CVSS, Qualcomm Android for MSM, Firefox OS for MSM, QRD Android)
- [CVE-2018-11963](https://cve.now/CVE-2018-11963.md): In all android releases(Android for MSM, Firefox OS for MSM, QRD Android) from CAF using the linux kernel, Buffer overread may occur due to (no CVSS, Qualcomm Android for MSM, Firefox OS for MSM, QRD Android)
- [CVE-2018-11964](https://cve.now/CVE-2018-11964.md): In all android releases(Android for MSM, Firefox OS for MSM, QRD Android) from CAF using the linux kernel, Exposing the hashed content in /e (no CVSS, Qualcomm Android for MSM, Firefox OS for MSM, QRD Android)
- [CVE-2018-11965](https://cve.now/CVE-2018-11965.md): In all android releases(Android for MSM, Firefox OS for MSM, QRD Android) from CAF using the linux kernel, Anyone can execute proptrigger.sh (no CVSS, Qualcomm Android for MSM, Firefox OS for MSM, QRD Android)
- [CVE-2018-11983](https://cve.now/CVE-2018-11983.md): In all android releases(Android for MSM, Firefox OS for MSM, QRD Android) from CAF using the linux kernel, Error in kernel observed while ac (no CVSS, Qualcomm Android for MSM, Firefox OS for MSM, QRD Android)
- [CVE-2018-11984](https://cve.now/CVE-2018-11984.md): In all android releases(Android for MSM, Firefox OS for MSM, QRD Android) from CAF using the linux kernel, A use after free condition and an (no CVSS, Qualcomm Android for MSM, Firefox OS for MSM, QRD Android)
- [CVE-2018-11985](https://cve.now/CVE-2018-11985.md): In all android releases(Android for MSM, Firefox OS for MSM, QRD Android) from CAF using the linux kernel, When allocating heap using user s (no CVSS, Qualcomm Android for MSM, Firefox OS for MSM, QRD Android)
- [CVE-2018-11986](https://cve.now/CVE-2018-11986.md): In all android releases(Android for MSM, Firefox OS for MSM, QRD Android) from CAF using the linux kernel, Possible buffer overflow in TX an (no CVSS, Qualcomm Android for MSM, Firefox OS for MSM, QRD Android)
- [CVE-2018-11987](https://cve.now/CVE-2018-11987.md): In all android releases(Android for MSM, Firefox OS for MSM, QRD Android) from CAF using the linux kernel, if there is an unlikely memory al (no CVSS, Qualcomm Android for MSM, Firefox OS for MSM, QRD Android)
- [CVE-2018-11988](https://cve.now/CVE-2018-11988.md): In all android releases(Android for MSM, Firefox OS for MSM, QRD Android) from CAF using the linux kernel, Un-trusted pointer de-reference i (no CVSS, Qualcomm Android for MSM, Firefox OS for MSM, QRD Android)
- [CVE-2018-1661](https://cve.now/CVE-2018-1661.md): IBM DataPower Gateways 7.5, 7.5.1, 7.5.2, and 7.6 is vulnerable to cross-site request forgery which could allow an attacker to execute malic (CVSS 6.5, IBM DataPower Gateways)
- [CVE-2018-1677](https://cve.now/CVE-2018-1677.md): IBM DataPower Gateways 7.1, 7.2, 7.5, 7.5.1, 7.5.2, 7.6, and 7.7 and IBM MQ Appliance are vulnerable to a denial of service, caused by the i (CVSS 5.1, IBM DataPower Gateways)
- [CVE-2018-1771](https://cve.now/CVE-2018-1771.md): IBM Domino 9.0 and 9.0.1 could allow an attacker to execute commands on the system by triggering a buffer overflow in the parsing of command (CVSS 8.4, IBM Domino)
- [CVE-2018-1778](https://cve.now/CVE-2018-1778.md): IBM LoopBack (IBM API Connect 2018.1, 2018.4.1, 5.0.8.0, and 5.0.8.4) could allow an attacker to bypass authentication if the AccessToken Mo (CVSS 7.7, IBM API Connect)
- [CVE-2018-1784](https://cve.now/CVE-2018-1784.md): IBM API Connect 5.0.0.0 and 5.0.8.4 is affected by a NoSQL Injection in MongoDB connector for the LoopBack framework. (CVSS 7.1, IBM API Connect)
- [CVE-2018-1973](https://cve.now/CVE-2018-1973.md): IBM API Connect 5.0.0.0 through 5.0.8.4 allows a user with limited 'API Administrator level access to give themselves full 'Administrator' l (CVSS 7.2, IBM API Connect)
- [CVE-2018-5198](https://cve.now/CVE-2018-5198.md): WIZVERA Veraport Race Condition Vulnerability (CVSS 8.0, WIZVERA Veraport)
- [CVE-2018-5199](https://cve.now/CVE-2018-5199.md): WIZVERA Remote Code Execution Vulnerability (CVSS 8.0, WIZVERA Veraport)
- [CVE-2018-5200](https://cve.now/CVE-2018-5200.md): KMPlayer Heap Overflow Vulnerability (CVSS 8.0, Pandora.tv KMPlayer)
- [CVE-2018-6669](https://cve.now/CVE-2018-6669.md): Bypass Application Control through an ASP.NET form (CVSS 6.3, McAfee Application and Change Control)
- [CVE-2018-7365](https://cve.now/CVE-2018-7365.md): All versions up to ZXCLOUD iRAI V5.01.05 of the ZTE uSmartView product are impacted by untrusted search path vulnerability, which may allow (CVSS 5.1, ZTE uSmartView)
- [CVE-2018-8653](https://cve.now/CVE-2018-8653.md): A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Internet Explorer, aka "Scrip (CVSS 7.5, KEV, Microsoft Internet Explorer)
- [CVE-2018-20301](https://cve.now/CVE-2018-20301.md): An issue was discovered in Steve Pallen Coherence before 0.5.2 that is similar to a Mass Assignment vulnerability. (no CVSS)
- [CVE-2018-20306](https://cve.now/CVE-2018-20306.md): A stored cross-site scripting (XSS) vulnerability in the web administration user interface of Pulse Secure Virtual Traffic Manager may allow (no CVSS)
- [CVE-2018-20307](https://cve.now/CVE-2018-20307.md): Pulse Secure Virtual Traffic Manager 9.9 versions prior to 9.9r2 and 10.4r1 allow a remote authenticated user to obtain sensitive historical (no CVSS)
- [CVE-2018-20300](https://cve.now/CVE-2018-20300.md): Empire CMS 7.5 allows remote attackers to execute arbitrary PHP code via the ftemp parameter in an enews=EditMemberForm action because this (no CVSS)
- [CVE-2018-20302](https://cve.now/CVE-2018-20302.md): An XSS issue was discovered in Steve Pallen Xain before 0.6.2 via the order parameter. (no CVSS)
- [CVE-2018-20303](https://cve.now/CVE-2018-20303.md): In pkg/tool/path.go in Gogs before 0.11.82.1218, a directory traversal in the file-upload functionality can allow an attacker to create a fi (no CVSS, gogs.io/gogs)
- [CVE-2018-20304](https://cve.now/CVE-2018-20304.md): wbook\_addworksheet in workbook.c in libexcel.a in libexcel 0.01 allows attackers to cause a denial of service (SEGV) via a long second argum (no CVSS)
- [CVE-2018-20305](https://cve.now/CVE-2018-20305.md): D-Link DIR-816 A2 1.10 B05 devices allow arbitrary remote code execution without authentication via the newpass parameter. (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2018-12-20
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.