CVEs published December 26, 2018
33 CVEs were published on December 26, 2018: 0 critical, 0 high.
- Published
- 33
- Critical
- 0
- High
- 0
- Medium
- 0
- Low
- 1
- Unrated
- 32
- Now in CISA KEV
- 0
- Fix available
- 1
Most affected products
- QNAP Q'center Virtual Appliance
- 2
- dolibarr/dolibarr
- 1
- SUSE yast2-rmt
- 1
Medium, low and unrated 33
- CVE-2018-20502An issue was discovered in Bento4 1.5.1-627.
- CVE-2018-11741NEC Univerge Sv9100 WebPro 6.00.00 devices have Predictable Session IDs that result in Account Information Disclosure via Home.htm?sessionId
- CVE-2018-11742NEC Univerge Sv9100 WebPro 6.00.00 devices have Cleartext Password Storage in the Web UI.
- CVE-2018-15518QXmlStream in Qt 5.x before 5.11.3 has a double-free or corruption during parsing of a specially crafted illegal XML document.
- CVE-2018-17987The determineWinner function of a smart contract implementation for HashHeroes Tiles, an Ethereum game, uses a certain blockhash value in an
- CVE-2018-18535The Asusgio low-level driver in ASUS Aura Sync v1.07.22 and earlier exposes functionality to read and write Machine Specific Registers (MSRs
- CVE-2018-18536The GLCKIo and Asusgio low-level drivers in ASUS Aura Sync v1.07.22 and earlier expose functionality to read/write data from/to IO ports.
- CVE-2018-18537The GLCKIo low-level driver in ASUS Aura Sync v1.07.22 and earlier exposes a path to write an arbitrary DWORD to an arbitrary address.
- CVE-2018-19182Engelsystem before commit hash 2e28336 allows CSRF.
- CVE-2018-19615Rockwell Automation Allen-Bradley PowerMonitor 1000 all versions.
- CVE-2018-19616An issue was discovered in Rockwell Automation Allen-Bradley PowerMonitor 1000.
- CVE-2018-19799Dolibarr ERP/CRM through 8.0.3 has /exports/export.php?datatoexport= XSS.dolibarr/dolibarr
- CVE-2018-19869An issue was discovered in Qt before 5.11.3.
- CVE-2018-19870An issue was discovered in Qt before 5.11.3.
- CVE-2018-19871An issue was discovered in Qt before 5.11.3.
- CVE-2018-19873An issue was discovered in Qt before 5.11.3.
- CVE-2018-20217A Reachable Assertion issue was discovered in the KDC in MIT Kerberos 5 (aka krb5) before 1.17.
- CVE-2018-20404ETK_E900.sys, a SmartETK driver for VIA Technologies EPIA-E900 system board, is vulnerable to denial of service attack via IOCTL 0x9C402048,
- CVE-2018-20486MetInfo 6.x through 6.1.3 has XSS via the /admin/login/login_check.php url_array[] parameter.
- CVE-2018-20482GNU Tar through 1.30, when --sparse is used, mishandles file shrinkage during read access, which allows local users to cause a denial of ser
- CVE-2018-20483set_file_metadata in xattr.c in GNU Wget before 1.20.1 stores a file's origin URL in the user.xdg.origin.url metadata attribute of the exten
- CVE-2018-20484Zoho ManageEngine ADSelfService Plus 5.7 before build 5702 has XSS in the self-update layout implementation.
- CVE-2018-20485Zoho ManageEngine ADSelfService Plus 5.7 before build 5702 has XSS in the employee search feature.
- CVE-2018-0723Cross-site scripting (XSS) vulnerability in Q'center Virtual Appliance 1.8.1014 and earlier versions could allow remote attackers to inject QNAP Q'center Virtual Appliance
- CVE-2018-0724Cross-site scripting (XSS) vulnerability in Q'center Virtual Appliance 1.8.1014 and earlier versions could allow remote attackers to inject QNAP Q'center Virtual Appliance
- CVE-2018-17957yast2-rmt leaks database passwords in process listSUSE yast2-rmt
- CVE-2018-20481XRef::getEntry in XRef.cc in Poppler 0.72.0 mishandles unallocated XRef entries, which allows remote attackers to cause a denial of service
- CVE-2018-20467In coders/bmp.c in ImageMagick before 7.0.8-16, an input file can result in an infinite loop and hang, with high CPU and memory consumption.
- CVE-2018-20476An issue was discovered in S-CMS 3.0.
- CVE-2018-20477An issue was discovered in S-CMS 3.0.
- CVE-2018-20478An issue was discovered in S-CMS 1.0.
- CVE-2018-20479An issue was discovered in S-CMS 1.0.
- CVE-2018-20480An issue was discovered in S-CMS 1.0.