# CVEs published 2018-12-21 30 CVEs were published on December 21, 2018: 1 critical, 4 high. 4 are now in CISA KEV. Days are UTC. - [CVE-2018-18007](https://cve.now/CVE-2018-18007.md): atbox.htm on D-Link DSL-2770L devices allows remote unauthenticated attackers to discover admin credentials. (no CVSS) - [CVE-2018-18008](https://cve.now/CVE-2018-18008.md): spaces.htm on multiple D-Link devices (DSL, DIR, DWR) allows remote unauthenticated attackers to discover admin credentials. (no CVSS) - [CVE-2018-18009](https://cve.now/CVE-2018-18009.md): dirary0.js on D-Link DIR-140L, DIR-640L devices allows remote unauthenticated attackers to discover admin credentials. (no CVSS) - [CVE-2018-19320](https://cve.now/CVE-2018-19320.md): The GDrv low-level driver in GIGABYTE APP Center v1.05.21 and earlier, AORUS GRAPHICS ENGINE before 1.57, XTREME GAMING ENGINE before 1.26, (CVSS 7.8, KEV) - [CVE-2018-19321](https://cve.now/CVE-2018-19321.md): The GPCIDrv and GDrv low-level drivers in GIGABYTE APP Center v1.05.21 and earlier, AORUS GRAPHICS ENGINE before 1.57, XTREME GAMING ENGINE (CVSS 7.8, KEV) - [CVE-2018-19322](https://cve.now/CVE-2018-19322.md): The GPCIDrv and GDrv low-level drivers in GIGABYTE APP Center v1.05.21 and earlier, AORUS GRAPHICS ENGINE before 1.57, XTREME GAMING ENGINE (CVSS 7.8, KEV) - [CVE-2018-19323](https://cve.now/CVE-2018-19323.md): The GDrv low-level driver in GIGABYTE APP Center v1.05.21 and earlier, AORUS GRAPHICS ENGINE before 1.57, XTREME GAMING ENGINE before 1.26, (CVSS 9.8, KEV) - [CVE-2018-20193](https://cve.now/CVE-2018-20193.md): Certain Secure Access SA Series SSL VPN products (originally developed by Juniper Networks but now sold and supported by Pulse Secure, LLC) (no CVSS) - [CVE-2018-16778](https://cve.now/CVE-2018-16778.md): Cross-site scripting (XSS) vulnerability in Jenzabar v8.2.1 through 9.2.0 allows remote attackers to inject arbitrary web script or HTML via (no CVSS) - [CVE-2018-20226](https://cve.now/CVE-2018-20226.md): An organization administrator can add a super administrator in THEHIVE PROJECT Cortex before 2.1.3 due to the lack of overriding the Role.to (no CVSS) - [CVE-2018-20322](https://cve.now/CVE-2018-20322.md): LimeSurvey version 3.15.5 contains a Cross-site scripting (XSS) vulnerability in Survey Resource zip upload, resulting in Javascript code ex (no CVSS) - [CVE-2018-20325](https://cve.now/CVE-2018-20325.md): There is a vulnerability in load() method in definitions/parser.py in the Danijar Hafner definitions package for Python. (no CVSS, definitions) - [CVE-2018-20346](https://cve.now/CVE-2018-20346.md): SQLite before 3.25.3, when the FTS3 extension is enabled, encounters an integer overflow (and resultant buffer overflow) for FTS3 queries th (no CVSS) - [CVE-2018-20345](https://cve.now/CVE-2018-20345.md): Incorrect access control in StackStorm API (st2api) in StackStorm before 2.9.2 and 2.10.x before 2.10.1 allows an attacker (who has a StackS (no CVSS) - [CVE-2018-20342](https://cve.now/CVE-2018-20342.md): The Floureon IP Camera SP012 provides a root terminal on a UART serial interface without proper access control. (no CVSS) - [CVE-2018-5201](https://cve.now/CVE-2018-5201.md): Hancom Office 2018 10.0.0.8214 and earlier, Hancom Office NEO 9.6.1.10472 and earlier, Hancom Office 2014 9.1.1.4540 and earlier, Hancom Off (no CVSS, Hancom Office) - [CVE-2018-5202](https://cve.now/CVE-2018-5202.md): SKCertService 2.5.5 and earlier contains a vulnerability that could allow remote attacker to execute arbitrary code. (no CVSS, SIGNKOREA SKCertService) - [CVE-2018-18330](https://cve.now/CVE-2018-18330.md): An Address Bar Spoofing vulnerability in Trend Micro Dr. (no CVSS, Trend Micro Dr. Safety for Android) - [CVE-2018-18331](https://cve.now/CVE-2018-18331.md): A Trend Micro OfficeScan XG weak file permissions vulnerability on a particular folder for a particular group may allow an attacker to alter (no CVSS, Trend Micro OfficeScan) - [CVE-2018-18332](https://cve.now/CVE-2018-18332.md): A Trend Micro OfficeScan XG weak file permissions vulnerability may allow an attacker to potentially manipulate permissions on some key file (no CVSS, Trend Micro OfficeScan) - [CVE-2018-5196](https://cve.now/CVE-2018-5196.md): Alzip Stack Overflow Vulnerability (CVSS 8.8, Estsoft Alzip) - [CVE-2018-20330](https://cve.now/CVE-2018-20330.md): The tjLoadImage function in libjpeg-turbo 2.0.1 has an integer overflow with a resultant heap-based buffer overflow via a BMP image because (no CVSS) - [CVE-2018-20332](https://cve.now/CVE-2018-20332.md): An issue has been discovered in the OpenWebif plugin through 1.2.4 for Enigma2 based devices. (no CVSS) - [CVE-2018-20337](https://cve.now/CVE-2018-20337.md): There is a stack-based buffer overflow in the parse\_makernote function of dcraw\_common.cpp in LibRaw 0.19.1. (no CVSS) - [CVE-2018-20338](https://cve.now/CVE-2018-20338.md): Zoho ManageEngine OpManager 12.3 before build 123239 allows SQL injection in the Alarms section. (no CVSS) - [CVE-2018-20339](https://cve.now/CVE-2018-20339.md): Zoho ManageEngine OpManager 12.3 before build 123239 allows XSS in the Notes column of the Alarms section. (no CVSS) - [CVE-2018-20327](https://cve.now/CVE-2018-20327.md): Chamilo LMS version 1.11.8 contains XSS in main/template/default/admin/gradebook\_list.tpl in the gradebook dependencies tool, allowing authe (no CVSS) - [CVE-2018-20328](https://cve.now/CVE-2018-20328.md): Chamilo LMS version 1.11.8 contains XSS in main/social/group\_view.php in the social groups tool, allowing authenticated users to affect othe (no CVSS) - [CVE-2018-20329](https://cve.now/CVE-2018-20329.md): Chamilo LMS version 1.11.8 contains a main/inc/lib/CoursesAndSessionsCatalog.class.php SQL injection, allowing users with access to the sess (no CVSS) - [CVE-2018-20318](https://cve.now/CVE-2018-20318.md): An issue was discovered in weixin-java-tools v3.2.0. (no CVSS) --- Source: cve.now, built and run by Sazabi (AI-native observability and security) Page: https://cve.now/daily/2018-12-21 Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.