CVEs published December 21, 2018
30 CVEs were published on December 21, 2018: 1 critical, 4 high. 4 are now in CISA KEV.
- Published
- 30
- Critical
- 1
- High
- 4
- Medium
- 0
- Low
- 0
- Unrated
- 25
- Now in CISA KEV
- 4
- Fix available
- 0
Most affected products
- Trend Micro OfficeScan
- 2
- definitions
- 1
- Estsoft Alzip
- 1
- Hancom Office
- 1
- SIGNKOREA SKCertService
- 1
- Trend Micro Dr. Safety for Android
- 1
Critical 1
High 4
- CVE-2018-19320The GDrv low-level driver in GIGABYTE APP Center v1.05.21 and earlier, AORUS GRAPHICS ENGINE before 1.57, XTREME GAMING ENGINE before 1.26,
- CVE-2018-19321The GPCIDrv and GDrv low-level drivers in GIGABYTE APP Center v1.05.21 and earlier, AORUS GRAPHICS ENGINE before 1.57, XTREME GAMING ENGINE
- CVE-2018-19322The GPCIDrv and GDrv low-level drivers in GIGABYTE APP Center v1.05.21 and earlier, AORUS GRAPHICS ENGINE before 1.57, XTREME GAMING ENGINE
- CVE-2018-5196Alzip Stack Overflow VulnerabilityEstsoft Alzip
Medium, low and unrated 25
- CVE-2018-18007atbox.htm on D-Link DSL-2770L devices allows remote unauthenticated attackers to discover admin credentials.
- CVE-2018-18008spaces.htm on multiple D-Link devices (DSL, DIR, DWR) allows remote unauthenticated attackers to discover admin credentials.
- CVE-2018-18009dirary0.js on D-Link DIR-140L, DIR-640L devices allows remote unauthenticated attackers to discover admin credentials.
- CVE-2018-20193Certain Secure Access SA Series SSL VPN products (originally developed by Juniper Networks but now sold and supported by Pulse Secure, LLC)
- CVE-2018-16778Cross-site scripting (XSS) vulnerability in Jenzabar v8.2.1 through 9.2.0 allows remote attackers to inject arbitrary web script or HTML via
- CVE-2018-20226An organization administrator can add a super administrator in THEHIVE PROJECT Cortex before 2.1.3 due to the lack of overriding the Role.to
- CVE-2018-20322LimeSurvey version 3.15.5 contains a Cross-site scripting (XSS) vulnerability in Survey Resource zip upload, resulting in Javascript code ex
- CVE-2018-20325There is a vulnerability in load() method in definitions/parser.py in the Danijar Hafner definitions package for Python.definitions
- CVE-2018-20346SQLite before 3.25.3, when the FTS3 extension is enabled, encounters an integer overflow (and resultant buffer overflow) for FTS3 queries th
- CVE-2018-20345Incorrect access control in StackStorm API (st2api) in StackStorm before 2.9.2 and 2.10.x before 2.10.1 allows an attacker (who has a StackS
- CVE-2018-20342The Floureon IP Camera SP012 provides a root terminal on a UART serial interface without proper access control.
- CVE-2018-5201Hancom Office 2018 10.0.0.8214 and earlier, Hancom Office NEO 9.6.1.10472 and earlier, Hancom Office 2014 9.1.1.4540 and earlier, Hancom OffHancom Office
- CVE-2018-5202SKCertService 2.5.5 and earlier contains a vulnerability that could allow remote attacker to execute arbitrary code.SIGNKOREA SKCertService
- CVE-2018-18330An Address Bar Spoofing vulnerability in Trend Micro Dr.Trend Micro Dr. Safety for Android
- CVE-2018-18331A Trend Micro OfficeScan XG weak file permissions vulnerability on a particular folder for a particular group may allow an attacker to alterTrend Micro OfficeScan
- CVE-2018-18332A Trend Micro OfficeScan XG weak file permissions vulnerability may allow an attacker to potentially manipulate permissions on some key fileTrend Micro OfficeScan
- CVE-2018-20330The tjLoadImage function in libjpeg-turbo 2.0.1 has an integer overflow with a resultant heap-based buffer overflow via a BMP image because
- CVE-2018-20332An issue has been discovered in the OpenWebif plugin through 1.2.4 for Enigma2 based devices.
- CVE-2018-20337There is a stack-based buffer overflow in the parse_makernote function of dcraw_common.cpp in LibRaw 0.19.1.
- CVE-2018-20338Zoho ManageEngine OpManager 12.3 before build 123239 allows SQL injection in the Alarms section.
- CVE-2018-20339Zoho ManageEngine OpManager 12.3 before build 123239 allows XSS in the Notes column of the Alarms section.
- CVE-2018-20327Chamilo LMS version 1.11.8 contains XSS in main/template/default/admin/gradebook_list.tpl in the gradebook dependencies tool, allowing authe
- CVE-2018-20328Chamilo LMS version 1.11.8 contains XSS in main/social/group_view.php in the social groups tool, allowing authenticated users to affect othe
- CVE-2018-20329Chamilo LMS version 1.11.8 contains a main/inc/lib/CoursesAndSessionsCatalog.class.php SQL injection, allowing users with access to the sess
- CVE-2018-20318An issue was discovered in weixin-java-tools v3.2.0.