# CVEs published 2018-12-23 40 CVEs were published on December 23, 2018: 0 critical, 0 high. Days are UTC. - [CVE-2018-20405](https://cve.now/CVE-2018-20405.md): BigTree 4.3 allows full path disclosure via authenticated admin/news/ input that triggers a syntax error. (CVSS 2.7) - [CVE-2018-20406](https://cve.now/CVE-2018-20406.md): Modules/\_pickle.c in Python before 3.7.1 has an integer overflow via a large LONG\_BINPUT value that is mishandled during a "resize to twice (no CVSS) - [CVE-2018-20407](https://cve.now/CVE-2018-20407.md): An issue was discovered in Bento4 1.5.1-627. (no CVSS) - [CVE-2018-20408](https://cve.now/CVE-2018-20408.md): An issue was discovered in Bento4 1.5.1-627. (no CVSS) - [CVE-2018-20409](https://cve.now/CVE-2018-20409.md): An issue was discovered in Bento4 1.5.1-627. (no CVSS) - [CVE-2018-20379](https://cve.now/CVE-2018-20379.md): Technicolor DPC3928SL D3928SL-PSIP-13-A010-c3420r55105-160428a devices allow XSS via a Cross Protocol Injection attack with setSSID of 1.3.6 (no CVSS) - [CVE-2018-20380](https://cve.now/CVE-2018-20380.md): Ambit DDW2600 5.100.1009, DDW2602 5.105.1003, T60C926 4.64.1012, and U10C019 5.66.1026 devices allow remote attackers to discover credential (no CVSS) - [CVE-2018-20381](https://cve.now/CVE-2018-20381.md): Technicolor DPC2320 dpc2300r2-v202r1244101-150420a-v6 devices allow remote attackers to discover credentials via iso.3.6.1.4.1.4491.2.4.1.1. (no CVSS) - [CVE-2018-20382](https://cve.now/CVE-2018-20382.md): Jiuzhou BCM93383WRG 139.4410mp1.3921132mp1.899.004404.004 devices allow remote attackers to discover credentials via iso.3.6.1.4.1.4491.2.4. (no CVSS) - [CVE-2018-20383](https://cve.now/CVE-2018-20383.md): ARRIS DG950A 7.10.145 and DG950S 7.10.145.EURO devices allow remote attackers to discover credentials via iso.3.6.1.4.1.4491.2.4.1.1.6.1.1.0 (no CVSS) - [CVE-2018-20384](https://cve.now/CVE-2018-20384.md): iNovo Broadband IB-8120-W21 139.4410mp1.004200.002 and IB-8120-W21E1 139.4410mp1.3921132mp1.899.004404.004 devices allow remote attackers to (no CVSS) - [CVE-2018-20385](https://cve.now/CVE-2018-20385.md): CastleNet CBV38Z4EC 125.553mp1.39219mp1.899.007, CBV38Z4ECNIT 125.553mp1.39219mp1.899.005ITT, CBW383G4J 37.556mp5.008, and CBW38G4J 37.553mp (no CVSS) - [CVE-2018-20386](https://cve.now/CVE-2018-20386.md): ARRIS SBG6580-2 D30GW-SEAEAGLE-1.5.2.5-GA-00-NOSH devices allow remote attackers to discover credentials via iso.3.6.1.4.1.4491.2.4.1.1.6.1. (no CVSS) - [CVE-2018-20387](https://cve.now/CVE-2018-20387.md): Bnmux BCW700J 5.20.7, BCW710J 5.30.6a, and BCW710J2 5.30.16 devices allow remote attackers to discover credentials via iso.3.6.1.4.1.4491.2. (no CVSS) - [CVE-2018-20388](https://cve.now/CVE-2018-20388.md): Comtrend CM-6200un 123.447.007 and CM-6300n 123.553mp1.005 devices allow remote attackers to discover credentials via iso.3.6.1.4.1.4491.2.4 (no CVSS) - [CVE-2018-20389](https://cve.now/CVE-2018-20389.md): D-Link DCM-604 DCM604\_C1\_ViaCabo\_1.04\_20130606 and DCM-704 EU\_DCM-704\_1.10 devices allow remote attackers to discover credentials via iso.3. (no CVSS) - [CVE-2018-20390](https://cve.now/CVE-2018-20390.md): Kaonmedia CG2001-AN22A 1.2.1, CG2001-UDBNA 3.0.8, and CG2001-UN2NA 3.0.8 devices allow remote attackers to discover credentials via iso.3.6. (no CVSS) - [CVE-2018-20391](https://cve.now/CVE-2018-20391.md): TEKNOTEL CBW700N 81.447.392110.729.024 devices allow remote attackers to discover credentials via iso.3.6.1.4.1.4491.2.4.1.1.6.1.1.0 and iso (no CVSS) - [CVE-2018-20392](https://cve.now/CVE-2018-20392.md): S-A WebSTAR DPC2100 v2.0.2r1256-060303 devices allow remote attackers to discover credentials via iso.3.6.1.4.1.4491.2.4.1.1.6.1.1.0 and iso (no CVSS) - [CVE-2018-20393](https://cve.now/CVE-2018-20393.md): Technicolor CGA0111 CGA0111E-ES-13-E23E-c8000r5712-170217-0829-TRU, CWA0101 CWA0101E-A23E-c7000r5712-170315-SKC, DPC3928SL D3928SL-PSIP-13-A (no CVSS) - [CVE-2018-20394](https://cve.now/CVE-2018-20394.md): Thomson DWG849 STC0.01.16, DWG850-4 ST9C.05.25, DWG855 ST80.20.26, and TWG870 STB2.01.36 devices allow remote attackers to discover credenti (no CVSS) - [CVE-2018-20395](https://cve.now/CVE-2018-20395.md): NETWAVE MNG6200 C4835805jrc12FU121413.cpr devices allow remote attackers to discover credentials via iso.3.6.1.4.1.4491.2.4.1.1.6.1.1.0 and (no CVSS) - [CVE-2018-20396](https://cve.now/CVE-2018-20396.md): NET&SYS MNG2120J 5.76.1006c and MNG6300 5.83.6305jrc2 devices allow remote attackers to discover credentials via iso.3.6.1.4.1.4491.2.4.1.1. (no CVSS) - [CVE-2018-20397](https://cve.now/CVE-2018-20397.md): mplus CBC383Z CBC383Z\_mplus\_MDr026 devices allow remote attackers to discover credentials via iso.3.6.1.4.1.4491.2.4.1.1.6.1.1.0 and iso.3.6 (no CVSS) - [CVE-2018-20398](https://cve.now/CVE-2018-20398.md): Skyworth CM5100 V1.1.0, CM5100-440 V1.2.1, CM5100-511 4.1.0.14, CM5100-GHD00 V1.2.2, and CM5100.g2 4.1.0.17 devices allow remote attackers t (no CVSS) - [CVE-2018-20399](https://cve.now/CVE-2018-20399.md): Motorola SBG901 SBG901-2.10.1.1-GA-00-581-NOSH, SBG941 SBG941-2.11.0.0-GA-07-624-NOSH, and SVG1202 SVG1202-2.1.0.0-GA-14-LTSH devices allow (no CVSS) - [CVE-2018-20400](https://cve.now/CVE-2018-20400.md): Ubee DVW2108 6.28.1017 and DVW2110 6.28.2012 devices allow remote attackers to discover credentials via iso.3.6.1.4.1.4491.2.4.1.1.6.1.1.0 a (no CVSS) - [CVE-2018-20401](https://cve.now/CVE-2018-20401.md): Zoom 5352 v5.5.8.6Y devices allow remote attackers to discover credentials via iso.3.6.1.4.1.4491.2.4.1.1.6.1.1.0 and iso.3.6.1.4.1.4491.2.4 (no CVSS) - [CVE-2018-20402](https://cve.now/CVE-2018-20402.md): Safe Software FME Server through 2018.1 creates and enables three additional accounts in addition to the initial administrator account. (no CVSS) - [CVE-2018-20374](https://cve.now/CVE-2018-20374.md): An issue was discovered in Tiny C Compiler (aka TinyCC or TCC) 0.9.27. (no CVSS) - [CVE-2018-20375](https://cve.now/CVE-2018-20375.md): An issue was discovered in Tiny C Compiler (aka TinyCC or TCC) 0.9.27. (no CVSS) - [CVE-2018-20376](https://cve.now/CVE-2018-20376.md): An issue was discovered in Tiny C Compiler (aka TinyCC or TCC) 0.9.27. (no CVSS) - [CVE-2018-20377](https://cve.now/CVE-2018-20377.md): Orange Livebox 00.96.320S devices allow remote attackers to discover Wi-Fi credentials via /get\_getnetworkconf.cgi on port 8080, leading to (no CVSS) - [CVE-2018-20331](https://cve.now/CVE-2018-20331.md): Local attackers can trigger a Kernel Pool Buffer Overflow in Antiy AVL ATool v1.0.0.22. (no CVSS) - [CVE-2018-20368](https://cve.now/CVE-2018-20368.md): The Master Slider plugin 3.2.7 and 3.5.1 for WordPress has XSS via the wp-admin/admin-ajax.php Name input field of the MSPanel.Settings valu (no CVSS) - [CVE-2018-20369](https://cve.now/CVE-2018-20369.md): Barracuda Message Archiver 2018 has XSS in the error\_msg exception-handling value for the ldap\_user parameter to the cgi-mod/ldap\_load\_entry (no CVSS) - [CVE-2018-20370](https://cve.now/CVE-2018-20370.md): SZ NetChat before 7.9 has XSS in the MyName input field of the Options module. (no CVSS) - [CVE-2018-20371](https://cve.now/CVE-2018-20371.md): PhotoRange Photo Vault 1.2 appends the password to the URI for authorization, which makes it easier for remote attackers to bypass intended (no CVSS) - [CVE-2018-20372](https://cve.now/CVE-2018-20372.md): TP-Link TD-W8961ND devices allow XSS via the hostname of a DHCP client. (no CVSS) - [CVE-2018-20373](https://cve.now/CVE-2018-20373.md): Tenda ADSL modem routers 1.0.1 allow XSS via the hostname of a DHCP client. (no CVSS) --- Source: cve.now, built and run by Sazabi (AI-native observability and security) Page: https://cve.now/daily/2018-12-23 Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.