# CVEs published 2018-12-27 11 CVEs were published on December 27, 2018: 0 critical, 0 high. Days are UTC. - [CVE-2018-1000887](https://cve.now/CVE-2018-1000887.md): Peel shopping peel-shopping\_9\_1\_0 version contains a Cross Site Scripting (XSS) vulnerability that can result in an authenticated user injec (no CVSS) - [CVE-2018-1000888](https://cve.now/CVE-2018-1000888.md): PEAR Archive\_Tar version 1.4.3 and earlier contains a CWE-502, CWE-915 vulnerability in the Archive\_Tar class. (no CVSS, pear/archive\_tar) - [CVE-2018-1000889](https://cve.now/CVE-2018-1000889.md): Logisim Evolution version 2.14.3 and earlier contains an XML External Entity (XXE) vulnerability in Circuit file loading functionality (load (no CVSS) - [CVE-2018-1000890](https://cve.now/CVE-2018-1000890.md): FrontAccounting 2.4.5 contains a Time Based Blind SQL Injection vulnerability in the parameter "filterType" in /attachments.php that can all (no CVSS) - [CVE-2018-20528](https://cve.now/CVE-2018-20528.md): JEECMS 9 has SSRF via the ueditor/getRemoteImage.jspx upfile parameter. (no CVSS) - [CVE-2018-20530](https://cve.now/CVE-2018-20530.md): PHP Scripts Mall Website Seller Script 2.0.5 has XSS via a Profile field such as Company Address, a related issue to CVE-2018-15896. (no CVSS) - [CVE-2018-20524](https://cve.now/CVE-2018-20524.md): The Chat Anywhere extension 2.4.0 for Chrome allows XSS via crafted use of \<\ in a message, because a danmuWrapper DIV element in chatbox- (no CVSS) - [CVE-2018-20519](https://cve.now/CVE-2018-20519.md): An issue was discovered in 74cms v4.2.111. (no CVSS) - [CVE-2018-20520](https://cve.now/CVE-2018-20520.md): MiniCMS V1.10 has XSS via the mc-admin/post-edit.php query string, a related issue to CVE-2018-10296 and CVE-2018-16233. (no CVSS) - [CVE-2018-20511](https://cve.now/CVE-2018-20511.md): An issue was discovered in the Linux kernel before 4.18.11. (no CVSS) - [CVE-2018-20508](https://cve.now/CVE-2018-20508.md): CrashFix 1.0.4 has SQL Injection via the User\[status\] parameter. (no CVSS) --- Source: cve.now, built and run by Sazabi (AI-native observability and security) Page: https://cve.now/daily/2018-12-27 Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.