CVEs published December 28, 2018
82 CVEs were published on December 28, 2018: 0 critical, 0 high.
- Published
- 82
- Critical
- 0
- High
- 0
- Medium
- 1
- Low
- 0
- Unrated
- 81
- Now in CISA KEV
- 0
- Fix available
- 2
Most affected products
- F5 Networks BIG-IP
- 3
- evolutioncms/evolution
- 2
- Devpia DEXTUploadX5
- 1
- getkirby/kirby
- 1
- Infraware ML Report
- 1
- ZTE ZXV10 B860AV2.1_ChinaMobile
- 1
Medium, low and unrated 82
- CVE-2018-14979The ASUS ZenFone 3 Max Android device with a build fingerprint of asus/US_Phone/ASUS_X008_1:7.0/NRD90M/US_Phone-14.14.1711.92-20171208:user/
- CVE-2018-14984The Leagoo Z5C Android device with a build fingerprint of sp7731c_1h10_32v4_bird:6.0/MRA58K/android.20170629.214736:user/release-keys contai
- CVE-2018-14985The Leagoo Z5C Android device with a build fingerprint of sp7731c_1h10_32v4_bird:6.0/MRA58K/android.20170629.214736:user/release-keys contai
- CVE-2018-14986The Leagoo Z5C Android device with a build fingerprint of sp7731c_1h10_32v4_bird:6.0/MRA58K/android.20170629.214736:user/release-keys contai
- CVE-2018-14987The MXQ TV Box 4.4.2 Android device with a build fingerprint of MBX/m201_N/m201_N:4.4.2/KOT49H/20160106:user/test-keys contains the Android
- CVE-2018-14988The MXQ TV Box 4.4.2 Android device with a build fingerprint of MBX/m201_N/m201_N:4.4.2/KOT49H/20160106:user/test-keys contains the Android
- CVE-2018-14992The ASUS ZenFone 3 Max Android device with a build fingerprint of asus/US_Phone/ASUS_X008_1:7.0/NRD90M/US_Phone-14.14.1711.92-20171208:user/
- CVE-2018-14995The ZTE Blade Vantage Android device with a build fingerprint of ZTE/Z839/sweet:7.1.1/NMF26V/20180120.095344:user/release-keys, the ZTE Blad
- CVE-2018-14998The Leagoo P1 Android device with a build fingerprint of sp7731c_1h10_32v4_bird:6.0/MRA58K/android.20170629.214736:user/release-keys contain
- CVE-2018-15001The Vivo V7 Android device with a build fingerprint of vivo/1718/1718:7.1.2/N2G47H/compil11021857:user/release-keys contains a platform app
- CVE-2018-15002The Vivo V7 device with a build fingerprint of vivo/1718/1718:7.1.2/N2G47H/compil11021857:user/release-keys allows any app co-located on the
- CVE-2018-15004The Coolpad Canvas device with a build fingerprint of Coolpad/cp3636a/cp3636a:7.0/NRD90M/093031423:user/release-keys contains a platform app
- CVE-2018-15005The ZTE ZMAX Champ Android device with a build fingerprint of ZTE/Z917VL/fortune:6.0.1/MMB29M/20170327.120922:user/release-keys contains a p
- CVE-2018-15006The ZTE ZMAX Champ Android device with a build fingerprint of ZTE/Z917VL/fortune:6.0.1/MMB29M/20170327.120922:user/release-keys contains a p
- CVE-2018-15007The Sky Elite 6.0L+ Android device with a build fingerprint of SKY/x6069_trx_l601_sky/x6069_trx_l601_sky:6.0/MRA58K/1482897127:user/release-
- CVE-2018-20578An issue was discovered in NuttX before 7.27.
- CVE-2018-20579Contiki-NG before 4.2 has a stack-based buffer overflow in the push function in os/lib/json/jsonparse.c that allows an out-of-bounds write o
- CVE-2018-16630Kirby v2.5.12 allows XSS by using the "site files" Add option to upload an SVG file.getkirby/kirby
- CVE-2018-16632Mezzanine CMS v4.3.1 allows XSS via the /admin/blog/blogcategory/add/?_to_field=id&_popup=1 title parameter at admin/blog/blogpost/add/.
- CVE-2018-16637Evolution CMS 1.4.x allows XSS via the page weblink title parameter to the manager/ URI.evolutioncms/evolution
- CVE-2018-16638Evolution CMS 1.4.x allows XSS via the manager/ search parameter.evolutioncms/evolution
- CVE-2018-18665The mintToken function of Nexxus (NXX) aka NexxusToken, an Ethereum token, has an integer overflow that allows the owner of the contract to
- CVE-2018-18666The mintToken function of SwftCoin (SWFTC) aka SwftCoin, an Ethereum token, has an integer overflow that allows the owner of the contract to
- CVE-2018-18667The mintToken function of Pylon (PYLNT) aka PylonToken, an Ethereum token, has an integer overflow that allows the owner of the contract to
- CVE-2018-18696main.aspx in Microstrategy Analytics 10.4.0026.0049 and earlier has CSRF.
- CVE-2018-20575Orange Livebox 00.96.320S devices have an undocumented /system_firmwarel.stm URI for manual firmware update.
- CVE-2018-20576Orange Livebox 00.96.320S devices allow cgi-bin/autodialing.exe and cgi-bin/phone_test.exe CSRF, leading to arbitrary outbound telephone cal
- CVE-2018-20577Orange Livebox 00.96.320S devices allow cgi-bin/restore.exe, cgi-bin/firewall_SPI.exe, cgi-bin/setup_remote_mgmt.exe, cgi-bin/setup_pass.exe
- CVE-2018-20571DamiCMS 6.0.1 allows remote attackers to read arbitrary files via a crafted admin.php?s=Tpl/Add/id request, as demonstrated by admin.php?s=T
- CVE-2018-20572WUZHI CMS 4.1.0 allows coreframe/app/coupon/admin/copyfrom.php SQL injection via the index.php?m=promote&f=index&v=search keywords parameter
- CVE-2018-20573The Scanner::EnsureTokensInQueue function in yaml-cpp (aka LibYaml-C++) 0.6.2 allows remote attackers to cause a denial of service (stack co
- CVE-2018-20574The SingleDocParser::HandleFlowMap function in yaml-cpp (aka LibYaml-C++) 0.6.2 allows remote attackers to cause a denial of service (stack
- CVE-2018-5203DEXTUploadX5 version Between 1.0.0.0 and 2.2.0.0 contains a vulnerability that could allow remote attacker to download and execute remote arDevpia DEXTUploadX5
- CVE-2018-5204ML Report version Between 2.00.000.0000 and 2.18.628.5980 contains a vulnerability that could allow remote attacker to download and execute Infraware ML Report
- CVE-2018-7366ZTE ZXV10 B860AV2.1 product ChinaMobile branch with the ICNT versions up to V1.3.3, the BESTV versions up to V1.2.2, the WASU versions up toZTE ZXV10 B860AV2.1_ChinaMobile
- CVE-2018-15333On versions 11.2.1.F5 Networks BIG-IP
- CVE-2018-15334A cross-site request forgery (CSRF) vulnerability in the APM webtop 11.2.1 or greater may allow attacker to force an APM webtop session to lF5 Networks BIG-IP
- CVE-2018-15335When APM 13.0.0-13.1.x is deployed as an OAuth Resource Server, APM becomes a client application to an external OAuth authorization server.F5 Networks BIG-IP
- CVE-2018-17539The BGP daemon (bgpd) in all IP Infusion ZebOS versions to 7.10.6 and all OcNOS versions to 1.3.3.145 allow remote attackers to cause a deni
- CVE-2018-20557An issue was discovered in DouCo DouPHP 1.5 20181221.
- CVE-2018-20558An issue was discovered in DouCo DouPHP 1.5 20181221.
- CVE-2018-20559An issue was discovered in DouCo DouPHP 1.5 20181221.
- CVE-2018-20560An issue was discovered in DouCo DouPHP 1.5 20181221.
- CVE-2018-20561An issue was discovered in DouCo DouPHP 1.5 20181221.
- CVE-2018-20562An issue was discovered in DouCo DouPHP 1.5 20181221.
- CVE-2018-20563An issue was discovered in DouCo DouPHP 1.5 20181221.
- CVE-2018-20564An issue was discovered in DouCo DouPHP 1.5 20181221.
- CVE-2018-20565An issue was discovered in DouCo DouPHP 1.5 20181221.
- CVE-2018-20566An issue was discovered in DouCo DouPHP 1.5 20181221.
- CVE-2018-20567An issue was discovered in DouCo DouPHP 1.5 20181221.
- CVE-2018-20568Administrator/index.php in Ivan Cordoba Generic Content Management System (CMS) through 2018-04-28 allows SQL injection for authentication b
- CVE-2018-20569user/index.php in Ivan Cordoba Generic Content Management System (CMS) through 2018-04-28 allows SQL injection for authentication bypass.
- CVE-2018-20570jp2_encode in jp2/jp2_enc.c in JasPer 2.0.14 has a heap-based buffer over-read.
- CVE-2018-1000624Battelle V2I Hub 2.5.1 is vulnerable to a denial of service, caused by the failure to restrict access to a sensitive functionality.
- CVE-2018-1000625Battelle V2I Hub 2.5.1 contains hard-coded credentials for the administrative account.
- CVE-2018-1000626Battelle V2I Hub 2.5.1 could allow a remote attacker to bypass security restrictions, caused by the lack of requirement to change the defaul
- CVE-2018-1000627Battelle V2I Hub 2.5.1 could allow a remote attacker to obtain sensitive information, caused by the failure to restrict access to the API ke
- CVE-2018-1000628Battelle V2I Hub 2.5.1 could allow a remote attacker to bypass security restrictions, caused by the direct checking of the API key against a
- CVE-2018-1000629Battelle V2I Hub 2.5.1 is vulnerable to cross-site scripting, caused by improper validation of user-supplied input by api/SystemConfigAction
- CVE-2018-1000630Battelle V2I Hub 2.5.1 is vulnerable to SQL injection.
- CVE-2018-1000631Battelle V2I Hub 3.0 is vulnerable to SQL injection.
- CVE-2018-20552Tcpreplay before 4.3.1 has a heap-based buffer over-read in packet2tree in tree.c.
- CVE-2018-20553Tcpreplay before 4.3.1 has a heap-based buffer over-read in get_l2len in common/get.c.
- CVE-2018-20551A reachable Object::getString assertion in Poppler 0.72.0 allows attackers to cause a denial of service due to construction of invalid rich
- CVE-2018-20532There is a NULL pointer dereference at ext/testcase.c (function testcase_read) in libsolvext.a in libsolv through 0.7.2 that will cause a de
- CVE-2018-20533There is a NULL pointer dereference at ext/testcase.c (function testcase_str2dep_complex) in libsolvext.a in libsolv through 0.7.2 that will
- CVE-2018-20534There is an illegal address access at ext/testcase.c in libsolv.a in libsolv through 0.7.2 that will cause a denial of service.
- CVE-2018-20535There is a use-after-free at asm/preproc.c (function pp_getline) in Netwide Assembler (NASM) 2.14rc16 that will cause a denial of service du
- CVE-2018-20536There is a heap-based buffer over-read at liblas::SpatialReference::GetGTIF() (spatialreference.cpp) in libLAS 1.8.1 that will cause a denia
- CVE-2018-20537There is a NULL pointer dereference at liblas::SpatialReference::GetGTIF() (spatialreference.cpp) in libLAS 1.8.1 that will cause a denial o
- CVE-2018-20538There is a use-after-free at asm/preproc.c (function pp_getline) in Netwide Assembler (NASM) 2.14rc16 that will cause a denial of service du
- CVE-2018-20539There is a Segmentation fault triggered by illegal address access at liblas::SpatialReference::GetGTIF() (spatialreference.cpp) in libLAS 1.
- CVE-2018-20540There is memory leak at liblas::Open (liblas/liblas.hpp) in libLAS 1.8.1.
- CVE-2018-20541There is a heap-based buffer overflow in libxsmm_sparse_csc_reader at generator_spgemm_csc_reader.c in LIBXSMM 1.10, a different vulnerabili
- CVE-2018-20542There is a heap-based buffer-overflow at generator_spgemm_csc_reader.c (function libxsmm_sparse_csc_reader) in LIBXSMM 1.10, a different vul
- CVE-2018-20543There is an attempted excessive memory allocation at libxsmm_sparse_csc_reader in generator_spgemm_csc_reader.c in LIBXSMM 1.10 that will ca
- CVE-2018-20544There is floating point exception at caca/dither.c (function caca_dither_bitmap) in libcaca 0.99.beta19.
- CVE-2018-20545There is an illegal WRITE memory access at common-image.c (function load_image) in libcaca 0.99.beta19 for 4bpp data.
- CVE-2018-20546There is an illegal READ memory access at caca/dither.c (function get_rgba_default) in libcaca 0.99.beta19 for the default bpp case.
- CVE-2018-20547There is an illegal READ memory access at caca/dither.c (function get_rgba_default) in libcaca 0.99.beta19 for 24bpp data.
- CVE-2018-20548There is an illegal WRITE memory access at common-image.c (function load_image) in libcaca 0.99.beta19 for 1bpp data.
- CVE-2018-20549There is an illegal WRITE memory access at caca/file.c (function caca_file_read) in libcaca 0.99.beta19.