CVEs published December 24, 2018
41 CVEs were published on December 24, 2018: 0 critical, 2 high.
- Published
- 41
- Critical
- 0
- High
- 2
- Medium
- 3
- Low
- 0
- Unrated
- 36
- Now in CISA KEV
- 0
- Fix available
- 6
Most affected products
- Foxit Quick PDF Library
- 3
- Schneider Electric SE EVLink Parking v3.2.0-12_v1 and earli…
- 3
- Schneider Electric SE IIoT Monitor
- 3
- Synology DiskStation Manager
- 3
- Apache Software Foundation Apache Tika · org.apache.tika:ti…
- 1
- Cisco Adaptive Security Appliance (ASA) Software
- 1
- com.mchange:c3p0
- 1
- craftcms/cms
- 1
- Schneider Electric SE FoxView HMI SCADA (All Foxboro DCS, F…
- 1
- Schneider Electric SE PowerSuite 2, All released versions
- 1
High 2
- CVE-2018-8919Information exposure vulnerability in SYNO.Core.Desktop.SessionData in Synology DiskStation Manager (DSM) before 6.1.6-15266 allows remote aSynology DiskStation Manager
- CVE-2018-15465Cisco Adaptive Security Appliance Software Privilege Escalation VulnerabilityCisco Adaptive Security Appliance (ASA) Software
Medium, low and unrated 39
- CVE-2018-20436The "secret chat" feature in Telegram 4.9.1 for Android has a "side channel" in which Telegram servers send GET requests for URLs typed whil
- CVE-2018-20247In Foxit Quick PDF Library (all versions prior to 16.12), issue where loading a malformed or malicious PDF containing a recursive page tree Foxit Quick PDF Library
- CVE-2018-20248In Foxit Quick PDF Library (all versions prior to 16.12), issue where loading a malformed or malicious PDF containing invalid xref table poiFoxit Quick PDF Library
- CVE-2018-20249In Foxit Quick PDF Library (all versions prior to 16.12), issue where loading a malformed or malicious PDF containing invalid xref entries uFoxit Quick PDF Library
- CVE-2018-18698An issue was discovered on Xiaomi Mi A1 tissot_sprout:8.1.0/OPM1.171019.026/V9.6.4.0.ODHMIFE devices.
- CVE-2018-18959An issue was discovered on Epson WorkForce WF-2861 10.48 LQ22I3, 10.51.LQ20I6 and 10.52.LQ17IA devices.
- CVE-2018-18960An issue was discovered on Epson WorkForce WF-2861 10.48 LQ22I3, 10.51.LQ20I6 and 10.52.LQ17IA devices.
- CVE-2018-19232The web service on Epson WorkForce WF-2861 10.48 LQ22I3(Recovery-mode), WF-2861 10.51.LQ20I6, and WF-2861 10.52.LQ17IA devices allows remote
- CVE-2018-19248The web service on Epson WorkForce WF-2861 10.48 LQ22I3(Recovery-mode), WF-2861 10.51.LQ20I6, and WF-2861 10.52.LQ17IA devices allows remote
- CVE-2018-7793A Credential Management vulnerability exists in FoxView HMI SCADA (All Foxboro DCS, Foxboro Evo, and IA Series versions prior to Foxboro DCSSchneider Electric SE FoxView HMI SCADA (All Foxboro DCS, F…
- CVE-2018-7796A Buffer Error vulnerability exists in PowerSuite 2, all released versions (VW3A8104 & Patches), which could cause an overflow in the memcpySchneider Electric SE PowerSuite 2, All released versions
- CVE-2018-7800A Hard-coded Credentials vulnerability exists in EVLink Parking, v3.2.0-12_v1 and earlier, which could enable an attacker to gain access to Schneider Electric SE EVLink Parking v3.2.0-12_v1 and earli…
- CVE-2018-7801A Code Injection vulnerability exists in EVLink Parking, v3.2.0-12_v1 and earlier, which could enable access with maximum privileges when a Schneider Electric SE EVLink Parking v3.2.0-12_v1 and earli…
- CVE-2018-7802A SQL Injection vulnerability exists in EVLink Parking, v3.2.0-12_v1 and earlier, which could give access to the web interface with full priSchneider Electric SE EVLink Parking v3.2.0-12_v1 and earli…
- CVE-2018-7832An Improper Input Validation vulnerability exists in Pro-Face GP-Pro EX v4.08 and previous versions which could cause the execution arbitrarSchneider Electric SE Pro-Face GP-Pro EX v4.08 and previous…
- CVE-2018-7835An Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability exists in IIoT Monitor 3.1.38 which could alSchneider Electric SE IIoT Monitor
- CVE-2018-7836An unrestricted Upload of File with Dangerous Type vulnerability exists on numerous methods of the IIoT Monitor 3.1.38 software that could aSchneider Electric SE IIoT Monitor
- CVE-2018-7837An Improper Restriction of XML External Entity Reference ('XXE') vulnerability exists on numerous methods of the IIoT Monitor 3.1.38 softwarSchneider Electric SE IIoT Monitor
- CVE-2018-8917Cross-site scripting (XSS) vulnerability in info.cgi in Synology DiskStation Manager (DSM) before 6.1.6-15266 allows remote attackers to injSynology DiskStation Manager
- CVE-2018-8918Cross-site scripting (XSS) vulnerability in info.cgi in Synology Router Manager (SRM) before 1.1.7-6941 allows remote attackers to inject arSynology Router Manager
- CVE-2018-8920Improper neutralization of escape vulnerability in Log Exporter in Synology DiskStation Manager (DSM) before 6.1.6-15266 allows remote attacSynology DiskStation Manager
- CVE-2018-17197A carefully crafted or corrupt sqlite file can cause an infinite loop in Apache Tika's SQLite3Parser in versions 1.8-1.19.1 of Apache Tika.Apache Software Foundation Apache Tika · org.apache.tika:ti…
- CVE-2018-20433c3p0 0.9.5.2 allows XXE in extractXmlConfigFromInputStream in com/mchange/v2/c3p0/cfg/C3P0ConfigXmlUtils.java during initialization.com.mchange:c3p0
- CVE-2018-19357XMPlay 3.8.3 allows remote attackers to execute arbitrary code or cause a denial of service (stack-based buffer overflow) via a crafted http
- CVE-2018-20425libming 0.4.8 has a NULL pointer dereference in the pushdup function of the decompile.c file.
- CVE-2018-20426libming 0.4.8 has a NULL pointer dereference in the newVar3 function of the decompile.c file, a different vulnerability than CVE-2018-7866.
- CVE-2018-20427libming 0.4.8 has a NULL pointer dereference in the getInt function of the decompile.c file, a different vulnerability than CVE-2018-9132.
- CVE-2018-20428libming 0.4.8 has a NULL pointer dereference in the strlenext function of the decompile.c file, a different vulnerability than CVE-2018-7874
- CVE-2018-20429libming 0.4.8 has a NULL pointer dereference in the getName function of the decompile.c file, a different vulnerability than CVE-2018-7872 a
- CVE-2018-20430GNU Libextractor through 1.8 has an out-of-bounds read vulnerability in the function history_extract() in plugins/ole2_extractor.c, related
- CVE-2018-20431GNU Libextractor through 1.8 has a NULL Pointer Dereference vulnerability in the function process_metadata() in plugins/ole2_extractor.c.
- CVE-2018-20418index.php?p=admin/actions/entries/save-entry in Craft CMS 3.0.25 allows XSS by saving a new title from the console tab.craftcms/cms
- CVE-2018-20422Discuz! DiscuzX 3.4, when WeChat login is enabled, allows remote attackers to bypass authentication by leveraging a non-empty #wechat#common
- CVE-2018-20423Discuz! DiscuzX 3.4, when WeChat login is enabled, allows remote attackers to bypass a "disabled registration" setting by adding a non-exist
- CVE-2018-20424Discuz! DiscuzX 3.4, when WeChat login is enabled, allows remote attackers to delete the common_member_wechatmp data structure via an ac=unb
- CVE-2018-20419DouCo DouPHP 1.5 has upload/admin/manager.php?rec=insert CSRF to add an administrator account.
- CVE-2018-20420In webERP 4.15, Z_CreateCompanyTemplateFile.php has Incorrect Access Control, leading to the overwrite of an existing .sql file on the targe
- CVE-2018-20421Go Ethereum (aka geth) 1.8.19 allows attackers to cause a denial of service (memory consumption) by rewriting the length of a dynamic array
- CVE-2018-20410WellinTech KingSCADA before 3.7.0.0.1 contains a stack-based buffer overflow.