# CVEs published 2018-12-26 33 CVEs were published on December 26, 2018: 0 critical, 0 high. Days are UTC. - [CVE-2018-20502](https://cve.now/CVE-2018-20502.md): An issue was discovered in Bento4 1.5.1-627. (no CVSS) - [CVE-2018-11741](https://cve.now/CVE-2018-11741.md): NEC Univerge Sv9100 WebPro 6.00.00 devices have Predictable Session IDs that result in Account Information Disclosure via Home.htm?sessionId (no CVSS) - [CVE-2018-11742](https://cve.now/CVE-2018-11742.md): NEC Univerge Sv9100 WebPro 6.00.00 devices have Cleartext Password Storage in the Web UI. (no CVSS) - [CVE-2018-15518](https://cve.now/CVE-2018-15518.md): QXmlStream in Qt 5.x before 5.11.3 has a double-free or corruption during parsing of a specially crafted illegal XML document. (no CVSS) - [CVE-2018-17987](https://cve.now/CVE-2018-17987.md): The determineWinner function of a smart contract implementation for HashHeroes Tiles, an Ethereum game, uses a certain blockhash value in an (no CVSS) - [CVE-2018-18535](https://cve.now/CVE-2018-18535.md): The Asusgio low-level driver in ASUS Aura Sync v1.07.22 and earlier exposes functionality to read and write Machine Specific Registers (MSRs (no CVSS) - [CVE-2018-18536](https://cve.now/CVE-2018-18536.md): The GLCKIo and Asusgio low-level drivers in ASUS Aura Sync v1.07.22 and earlier expose functionality to read/write data from/to IO ports. (no CVSS) - [CVE-2018-18537](https://cve.now/CVE-2018-18537.md): The GLCKIo low-level driver in ASUS Aura Sync v1.07.22 and earlier exposes a path to write an arbitrary DWORD to an arbitrary address. (no CVSS) - [CVE-2018-19182](https://cve.now/CVE-2018-19182.md): Engelsystem before commit hash 2e28336 allows CSRF. (no CVSS) - [CVE-2018-19615](https://cve.now/CVE-2018-19615.md): Rockwell Automation Allen-Bradley PowerMonitor 1000 all versions. (no CVSS) - [CVE-2018-19616](https://cve.now/CVE-2018-19616.md): An issue was discovered in Rockwell Automation Allen-Bradley PowerMonitor 1000. (no CVSS) - [CVE-2018-19799](https://cve.now/CVE-2018-19799.md): Dolibarr ERP/CRM through 8.0.3 has /exports/export.php?datatoexport= XSS. (no CVSS, dolibarr/dolibarr) - [CVE-2018-19869](https://cve.now/CVE-2018-19869.md): An issue was discovered in Qt before 5.11.3. (no CVSS) - [CVE-2018-19870](https://cve.now/CVE-2018-19870.md): An issue was discovered in Qt before 5.11.3. (no CVSS) - [CVE-2018-19871](https://cve.now/CVE-2018-19871.md): An issue was discovered in Qt before 5.11.3. (no CVSS) - [CVE-2018-19873](https://cve.now/CVE-2018-19873.md): An issue was discovered in Qt before 5.11.3. (no CVSS) - [CVE-2018-20217](https://cve.now/CVE-2018-20217.md): A Reachable Assertion issue was discovered in the KDC in MIT Kerberos 5 (aka krb5) before 1.17. (no CVSS) - [CVE-2018-20404](https://cve.now/CVE-2018-20404.md): ETK\_E900.sys, a SmartETK driver for VIA Technologies EPIA-E900 system board, is vulnerable to denial of service attack via IOCTL 0x9C402048, (no CVSS) - [CVE-2018-20486](https://cve.now/CVE-2018-20486.md): MetInfo 6.x through 6.1.3 has XSS via the /admin/login/login\_check.php url\_array\[\] parameter. (no CVSS) - [CVE-2018-20482](https://cve.now/CVE-2018-20482.md): GNU Tar through 1.30, when --sparse is used, mishandles file shrinkage during read access, which allows local users to cause a denial of ser (no CVSS) - [CVE-2018-20483](https://cve.now/CVE-2018-20483.md): set\_file\_metadata in xattr.c in GNU Wget before 1.20.1 stores a file's origin URL in the user.xdg.origin.url metadata attribute of the exten (no CVSS) - [CVE-2018-20484](https://cve.now/CVE-2018-20484.md): Zoho ManageEngine ADSelfService Plus 5.7 before build 5702 has XSS in the self-update layout implementation. (no CVSS) - [CVE-2018-20485](https://cve.now/CVE-2018-20485.md): Zoho ManageEngine ADSelfService Plus 5.7 before build 5702 has XSS in the employee search feature. (no CVSS) - [CVE-2018-0723](https://cve.now/CVE-2018-0723.md): Cross-site scripting (XSS) vulnerability in Q'center Virtual Appliance 1.8.1014 and earlier versions could allow remote attackers to inject (no CVSS, QNAP Q'center Virtual Appliance) - [CVE-2018-0724](https://cve.now/CVE-2018-0724.md): Cross-site scripting (XSS) vulnerability in Q'center Virtual Appliance 1.8.1014 and earlier versions could allow remote attackers to inject (no CVSS, QNAP Q'center Virtual Appliance) - [CVE-2018-17957](https://cve.now/CVE-2018-17957.md): yast2-rmt leaks database passwords in process list (CVSS 3.4, SUSE yast2-rmt) - [CVE-2018-20481](https://cve.now/CVE-2018-20481.md): XRef::getEntry in XRef.cc in Poppler 0.72.0 mishandles unallocated XRef entries, which allows remote attackers to cause a denial of service (no CVSS) - [CVE-2018-20467](https://cve.now/CVE-2018-20467.md): In coders/bmp.c in ImageMagick before 7.0.8-16, an input file can result in an infinite loop and hang, with high CPU and memory consumption. (no CVSS) - [CVE-2018-20476](https://cve.now/CVE-2018-20476.md): An issue was discovered in S-CMS 3.0. (no CVSS) - [CVE-2018-20477](https://cve.now/CVE-2018-20477.md): An issue was discovered in S-CMS 3.0. (no CVSS) - [CVE-2018-20478](https://cve.now/CVE-2018-20478.md): An issue was discovered in S-CMS 1.0. (no CVSS) - [CVE-2018-20479](https://cve.now/CVE-2018-20479.md): An issue was discovered in S-CMS 1.0. (no CVSS) - [CVE-2018-20480](https://cve.now/CVE-2018-20480.md): An issue was discovered in S-CMS 1.0. (no CVSS) --- Source: cve.now, built and run by Sazabi (AI-native observability and security) Page: https://cve.now/daily/2018-12-26 Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.