# CVEs published 2018-12-25 26 CVEs were published on December 25, 2018: 0 critical, 1 high. Days are UTC. - [CVE-2018-20464](https://cve.now/CVE-2018-20464.md): There is a reflected XSS vulnerability in the CMS Made Simple 2.2.8 admin/myaccount.php. (no CVSS) - [CVE-2018-20465](https://cve.now/CVE-2018-20465.md): Craft CMS through 3.0.34 allows remote authenticated administrators to read sensitive information via server-side template injection, as dem (no CVSS, craftcms/cms) - [CVE-2018-20462](https://cve.now/CVE-2018-20462.md): An issue was discovered in the JSmol2WP plugin 1.07 for WordPress. (no CVSS) - [CVE-2018-20463](https://cve.now/CVE-2018-20463.md): An issue was discovered in the JSmol2WP plugin 1.07 for WordPress. (no CVSS) - [CVE-2018-20455](https://cve.now/CVE-2018-20455.md): In radare2 prior to 3.1.1, the parseOperand function inside libr/asm/p/asm\_x86\_nz.c may allow attackers to cause a denial of service (applic (no CVSS) - [CVE-2018-20456](https://cve.now/CVE-2018-20456.md): In radare2 prior to 3.1.1, the parseOperand function inside libr/asm/p/asm\_x86\_nz.c may allow attackers to cause a denial of service (applic (no CVSS) - [CVE-2018-20457](https://cve.now/CVE-2018-20457.md): In radare2 through 3.1.3, the assemble function inside libr/asm/p/asm\_arm\_cs.c allows attackers to cause a denial-of-service (application cr (no CVSS) - [CVE-2018-20458](https://cve.now/CVE-2018-20458.md): In radare2 prior to 3.1.1, r\_bin\_dyldcache\_extract in libr/bin/format/mach0/dyldcache.c may allow attackers to cause a denial-of-service (ap (no CVSS) - [CVE-2018-20459](https://cve.now/CVE-2018-20459.md): In radare2 through 3.1.3, the armass\_assemble function in libr/asm/arch/arm/armass.c allows attackers to cause a denial-of-service (applicat (no CVSS) - [CVE-2018-20460](https://cve.now/CVE-2018-20460.md): In radare2 prior to 3.1.2, the parseOperands function in libr/asm/arch/arm/armass64.c allows attackers to cause a denial-of-service (applica (no CVSS) - [CVE-2018-20461](https://cve.now/CVE-2018-20461.md): In radare2 prior to 3.1.1, core\_anal\_bytes in libr/core/cmd\_anal.c allows attackers to cause a denial-of-service (application crash caused b (no CVSS) - [CVE-2018-20450](https://cve.now/CVE-2018-20450.md): The read\_MSAT function in ole.c in libxls 1.4.0 has a double free that allows attackers to cause a denial of service (application crash) via (no CVSS) - [CVE-2018-20451](https://cve.now/CVE-2018-20451.md): The process\_file function in reader.c in libdoc through 2017-10-23 has a heap-based buffer over-read that allows attackers to cause a denial (no CVSS) - [CVE-2018-20452](https://cve.now/CVE-2018-20452.md): The read\_MSAT\_body function in ole.c in libxls 1.4.0 has an invalid free that allows attackers to cause a denial of service (application cra (no CVSS) - [CVE-2018-20453](https://cve.now/CVE-2018-20453.md): The getlong function in numutils.c in libdoc through 2017-10-23 has a heap-based buffer over-read that allows attackers to cause a denial of (no CVSS) - [CVE-2018-20454](https://cve.now/CVE-2018-20454.md): An issue was discovered in 74cms v4.2.111. (no CVSS) - [CVE-2018-20448](https://cve.now/CVE-2018-20448.md): Frog CMS 0.9.5 has XSS via the Database name field to the /install/index.php URI. (no CVSS) - [CVE-2018-20437](https://cve.now/CVE-2018-20437.md): An issue was discovered in the fileDownload function in the CommonController class in FEBS-Shiro before 2018-11-05. (CVSS 7.5) - [CVE-2018-20438](https://cve.now/CVE-2018-20438.md): Technicolor TC7110.AR STD3.38.03 devices allow remote attackers to discover Wi-Fi credentials via iso.3.6.1.4.1.2863.205.10.1.30.4.1.14.1.3. (no CVSS) - [CVE-2018-20439](https://cve.now/CVE-2018-20439.md): Technicolor DPC3928SL D3928SL-PSIP-13-A010-c3420r55105-170214a devices allow remote attackers to discover Wi-Fi credentials via iso.3.6.1.4. (no CVSS) - [CVE-2018-20440](https://cve.now/CVE-2018-20440.md): Technicolor CWA0101 CWA0101E-A23E-c7000r5712-170315-SKC devices allow remote attackers to discover Wi-Fi credentials via iso.3.6.1.4.1.4413. (no CVSS) - [CVE-2018-20441](https://cve.now/CVE-2018-20441.md): Technicolor TC7200.TH2v2 SC05.00.22 devices allow remote attackers to discover Wi-Fi credentials via iso.3.6.1.4.1.2863.205.10.1.30.4.1.14.1 (no CVSS) - [CVE-2018-20442](https://cve.now/CVE-2018-20442.md): Technicolor TC7110.B STC8.62.02 devices allow remote attackers to discover Wi-Fi credentials via iso.3.6.1.4.1.2863.205.10.1.30.4.1.14.1.3.3 (no CVSS) - [CVE-2018-20443](https://cve.now/CVE-2018-20443.md): Technicolor TC7200.d1I TC7200.d1IE-N23E-c7000r5712-170406-HAT devices allow remote attackers to discover Wi-Fi credentials via iso.3.6.1.4.1 (no CVSS) - [CVE-2018-20444](https://cve.now/CVE-2018-20444.md): Technicolor CGA0111 CGA0111E-ES-13-E23E-c8000r5712-170217-0829-TRU devices allow remote attackers to discover Wi-Fi credentials via iso.3.6. (no CVSS) - [CVE-2018-20445](https://cve.now/CVE-2018-20445.md): D-Link DCM-604 DCM604\_C1\_ViaCabo\_1.04\_20130606 and DCM-704 EU\_DCM-704\_1.10 devices allow remote attackers to discover Wi-Fi credentials via (no CVSS) --- Source: cve.now, built and run by Sazabi (AI-native observability and security) Page: https://cve.now/daily/2018-12-25 Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.