# CVEs published 2018-12-28

82 CVEs were published on December 28, 2018: 0 critical, 0 high. Days are UTC.

- [CVE-2018-14979](https://cve.now/CVE-2018-14979.md): The ASUS ZenFone 3 Max Android device with a build fingerprint of asus/US\_Phone/ASUS\_X008\_1:7.0/NRD90M/US\_Phone-14.14.1711.92-20171208:user/ (no CVSS)
- [CVE-2018-14984](https://cve.now/CVE-2018-14984.md): The Leagoo Z5C Android device with a build fingerprint of sp7731c\_1h10\_32v4\_bird:6.0/MRA58K/android.20170629.214736:user/release-keys contai (no CVSS)
- [CVE-2018-14985](https://cve.now/CVE-2018-14985.md): The Leagoo Z5C Android device with a build fingerprint of sp7731c\_1h10\_32v4\_bird:6.0/MRA58K/android.20170629.214736:user/release-keys contai (no CVSS)
- [CVE-2018-14986](https://cve.now/CVE-2018-14986.md): The Leagoo Z5C Android device with a build fingerprint of sp7731c\_1h10\_32v4\_bird:6.0/MRA58K/android.20170629.214736:user/release-keys contai (no CVSS)
- [CVE-2018-14987](https://cve.now/CVE-2018-14987.md): The MXQ TV Box 4.4.2 Android device with a build fingerprint of MBX/m201\_N/m201\_N:4.4.2/KOT49H/20160106:user/test-keys contains the Android (no CVSS)
- [CVE-2018-14988](https://cve.now/CVE-2018-14988.md): The MXQ TV Box 4.4.2 Android device with a build fingerprint of MBX/m201\_N/m201\_N:4.4.2/KOT49H/20160106:user/test-keys contains the Android (no CVSS)
- [CVE-2018-14992](https://cve.now/CVE-2018-14992.md): The ASUS ZenFone 3 Max Android device with a build fingerprint of asus/US\_Phone/ASUS\_X008\_1:7.0/NRD90M/US\_Phone-14.14.1711.92-20171208:user/ (no CVSS)
- [CVE-2018-14995](https://cve.now/CVE-2018-14995.md): The ZTE Blade Vantage Android device with a build fingerprint of ZTE/Z839/sweet:7.1.1/NMF26V/20180120.095344:user/release-keys, the ZTE Blad (no CVSS)
- [CVE-2018-14998](https://cve.now/CVE-2018-14998.md): The Leagoo P1 Android device with a build fingerprint of sp7731c\_1h10\_32v4\_bird:6.0/MRA58K/android.20170629.214736:user/release-keys contain (no CVSS)
- [CVE-2018-15001](https://cve.now/CVE-2018-15001.md): The Vivo V7 Android device with a build fingerprint of vivo/1718/1718:7.1.2/N2G47H/compil11021857:user/release-keys contains a platform app (no CVSS)
- [CVE-2018-15002](https://cve.now/CVE-2018-15002.md): The Vivo V7 device with a build fingerprint of vivo/1718/1718:7.1.2/N2G47H/compil11021857:user/release-keys allows any app co-located on the (no CVSS)
- [CVE-2018-15004](https://cve.now/CVE-2018-15004.md): The Coolpad Canvas device with a build fingerprint of Coolpad/cp3636a/cp3636a:7.0/NRD90M/093031423:user/release-keys contains a platform app (no CVSS)
- [CVE-2018-15005](https://cve.now/CVE-2018-15005.md): The ZTE ZMAX Champ Android device with a build fingerprint of ZTE/Z917VL/fortune:6.0.1/MMB29M/20170327.120922:user/release-keys contains a p (no CVSS)
- [CVE-2018-15006](https://cve.now/CVE-2018-15006.md): The ZTE ZMAX Champ Android device with a build fingerprint of ZTE/Z917VL/fortune:6.0.1/MMB29M/20170327.120922:user/release-keys contains a p (no CVSS)
- [CVE-2018-15007](https://cve.now/CVE-2018-15007.md): The Sky Elite 6.0L+ Android device with a build fingerprint of SKY/x6069\_trx\_l601\_sky/x6069\_trx\_l601\_sky:6.0/MRA58K/1482897127:user/release- (no CVSS)
- [CVE-2018-20578](https://cve.now/CVE-2018-20578.md): An issue was discovered in NuttX before 7.27. (no CVSS)
- [CVE-2018-20579](https://cve.now/CVE-2018-20579.md): Contiki-NG before 4.2 has a stack-based buffer overflow in the push function in os/lib/json/jsonparse.c that allows an out-of-bounds write o (no CVSS)
- [CVE-2018-16630](https://cve.now/CVE-2018-16630.md): Kirby v2.5.12 allows XSS by using the "site files" Add option to upload an SVG file. (no CVSS, getkirby/kirby)
- [CVE-2018-16632](https://cve.now/CVE-2018-16632.md): Mezzanine CMS v4.3.1 allows XSS via the /admin/blog/blogcategory/add/?\_to\_field=id&\_popup=1 title parameter at admin/blog/blogpost/add/. (no CVSS)
- [CVE-2018-16637](https://cve.now/CVE-2018-16637.md): Evolution CMS 1.4.x allows XSS via the page weblink title parameter to the manager/ URI. (no CVSS, evolutioncms/evolution)
- [CVE-2018-16638](https://cve.now/CVE-2018-16638.md): Evolution CMS 1.4.x allows XSS via the manager/ search parameter. (no CVSS, evolutioncms/evolution)
- [CVE-2018-18665](https://cve.now/CVE-2018-18665.md): The mintToken function of Nexxus (NXX) aka NexxusToken, an Ethereum token, has an integer overflow that allows the owner of the contract to (no CVSS)
- [CVE-2018-18666](https://cve.now/CVE-2018-18666.md): The mintToken function of SwftCoin (SWFTC) aka SwftCoin, an Ethereum token, has an integer overflow that allows the owner of the contract to (no CVSS)
- [CVE-2018-18667](https://cve.now/CVE-2018-18667.md): The mintToken function of Pylon (PYLNT) aka PylonToken, an Ethereum token, has an integer overflow that allows the owner of the contract to (no CVSS)
- [CVE-2018-18696](https://cve.now/CVE-2018-18696.md): main.aspx in Microstrategy Analytics 10.4.0026.0049 and earlier has CSRF. (no CVSS)
- [CVE-2018-20575](https://cve.now/CVE-2018-20575.md): Orange Livebox 00.96.320S devices have an undocumented /system\_firmwarel.stm URI for manual firmware update. (no CVSS)
- [CVE-2018-20576](https://cve.now/CVE-2018-20576.md): Orange Livebox 00.96.320S devices allow cgi-bin/autodialing.exe and cgi-bin/phone\_test.exe CSRF, leading to arbitrary outbound telephone cal (no CVSS)
- [CVE-2018-20577](https://cve.now/CVE-2018-20577.md): Orange Livebox 00.96.320S devices allow cgi-bin/restore.exe, cgi-bin/firewall\_SPI.exe, cgi-bin/setup\_remote\_mgmt.exe, cgi-bin/setup\_pass.exe (no CVSS)
- [CVE-2018-20571](https://cve.now/CVE-2018-20571.md): DamiCMS 6.0.1 allows remote attackers to read arbitrary files via a crafted admin.php?s=Tpl/Add/id request, as demonstrated by admin.php?s=T (no CVSS)
- [CVE-2018-20572](https://cve.now/CVE-2018-20572.md): WUZHI CMS 4.1.0 allows coreframe/app/coupon/admin/copyfrom.php SQL injection via the index.php?m=promote&f=index&v=search keywords parameter (no CVSS)
- [CVE-2018-20573](https://cve.now/CVE-2018-20573.md): The Scanner::EnsureTokensInQueue function in yaml-cpp (aka LibYaml-C++) 0.6.2 allows remote attackers to cause a denial of service (stack co (no CVSS)
- [CVE-2018-20574](https://cve.now/CVE-2018-20574.md): The SingleDocParser::HandleFlowMap function in yaml-cpp (aka LibYaml-C++) 0.6.2 allows remote attackers to cause a denial of service (stack (no CVSS)
- [CVE-2018-5203](https://cve.now/CVE-2018-5203.md): DEXTUploadX5 version Between 1.0.0.0 and 2.2.0.0 contains a vulnerability that could allow remote attacker to download and execute remote ar (no CVSS, Devpia DEXTUploadX5)
- [CVE-2018-5204](https://cve.now/CVE-2018-5204.md): ML Report version Between 2.00.000.0000 and 2.18.628.5980 contains a vulnerability that could allow remote attacker to download and execute (no CVSS, Infraware ML Report)
- [CVE-2018-7366](https://cve.now/CVE-2018-7366.md): ZTE ZXV10 B860AV2.1 product ChinaMobile branch with the ICNT versions up to V1.3.3, the BESTV versions up to V1.2.2, the WASU versions up to (CVSS 4.3, ZTE ZXV10 B860AV2.1\_ChinaMobile)
- [CVE-2018-15333](https://cve.now/CVE-2018-15333.md): On versions 11.2.1. (no CVSS, F5 Networks BIG-IP)
- [CVE-2018-15334](https://cve.now/CVE-2018-15334.md): A cross-site request forgery (CSRF) vulnerability in the APM webtop 11.2.1 or greater may allow attacker to force an APM webtop session to l (no CVSS, F5 Networks BIG-IP)
- [CVE-2018-15335](https://cve.now/CVE-2018-15335.md): When APM 13.0.0-13.1.x is deployed as an OAuth Resource Server, APM becomes a client application to an external OAuth authorization server. (no CVSS, F5 Networks BIG-IP)
- [CVE-2018-17539](https://cve.now/CVE-2018-17539.md): The BGP daemon (bgpd) in all IP Infusion ZebOS versions to 7.10.6 and all OcNOS versions to 1.3.3.145 allow remote attackers to cause a deni (no CVSS)
- [CVE-2018-20557](https://cve.now/CVE-2018-20557.md): An issue was discovered in DouCo DouPHP 1.5 20181221. (no CVSS)
- [CVE-2018-20558](https://cve.now/CVE-2018-20558.md): An issue was discovered in DouCo DouPHP 1.5 20181221. (no CVSS)
- [CVE-2018-20559](https://cve.now/CVE-2018-20559.md): An issue was discovered in DouCo DouPHP 1.5 20181221. (no CVSS)
- [CVE-2018-20560](https://cve.now/CVE-2018-20560.md): An issue was discovered in DouCo DouPHP 1.5 20181221. (no CVSS)
- [CVE-2018-20561](https://cve.now/CVE-2018-20561.md): An issue was discovered in DouCo DouPHP 1.5 20181221. (no CVSS)
- [CVE-2018-20562](https://cve.now/CVE-2018-20562.md): An issue was discovered in DouCo DouPHP 1.5 20181221. (no CVSS)
- [CVE-2018-20563](https://cve.now/CVE-2018-20563.md): An issue was discovered in DouCo DouPHP 1.5 20181221. (no CVSS)
- [CVE-2018-20564](https://cve.now/CVE-2018-20564.md): An issue was discovered in DouCo DouPHP 1.5 20181221. (no CVSS)
- [CVE-2018-20565](https://cve.now/CVE-2018-20565.md): An issue was discovered in DouCo DouPHP 1.5 20181221. (no CVSS)
- [CVE-2018-20566](https://cve.now/CVE-2018-20566.md): An issue was discovered in DouCo DouPHP 1.5 20181221. (no CVSS)
- [CVE-2018-20567](https://cve.now/CVE-2018-20567.md): An issue was discovered in DouCo DouPHP 1.5 20181221. (no CVSS)
- [CVE-2018-20568](https://cve.now/CVE-2018-20568.md): Administrator/index.php in Ivan Cordoba Generic Content Management System (CMS) through 2018-04-28 allows SQL injection for authentication b (no CVSS)
- [CVE-2018-20569](https://cve.now/CVE-2018-20569.md): user/index.php in Ivan Cordoba Generic Content Management System (CMS) through 2018-04-28 allows SQL injection for authentication bypass. (no CVSS)
- [CVE-2018-20570](https://cve.now/CVE-2018-20570.md): jp2\_encode in jp2/jp2\_enc.c in JasPer 2.0.14 has a heap-based buffer over-read. (no CVSS)
- [CVE-2018-1000624](https://cve.now/CVE-2018-1000624.md): Battelle V2I Hub 2.5.1 is vulnerable to a denial of service, caused by the failure to restrict access to a sensitive functionality. (no CVSS)
- [CVE-2018-1000625](https://cve.now/CVE-2018-1000625.md): Battelle V2I Hub 2.5.1 contains hard-coded credentials for the administrative account. (no CVSS)
- [CVE-2018-1000626](https://cve.now/CVE-2018-1000626.md): Battelle V2I Hub 2.5.1 could allow a remote attacker to bypass security restrictions, caused by the lack of requirement to change the defaul (no CVSS)
- [CVE-2018-1000627](https://cve.now/CVE-2018-1000627.md): Battelle V2I Hub 2.5.1 could allow a remote attacker to obtain sensitive information, caused by the failure to restrict access to the API ke (no CVSS)
- [CVE-2018-1000628](https://cve.now/CVE-2018-1000628.md): Battelle V2I Hub 2.5.1 could allow a remote attacker to bypass security restrictions, caused by the direct checking of the API key against a (no CVSS)
- [CVE-2018-1000629](https://cve.now/CVE-2018-1000629.md): Battelle V2I Hub 2.5.1 is vulnerable to cross-site scripting, caused by improper validation of user-supplied input by api/SystemConfigAction (no CVSS)
- [CVE-2018-1000630](https://cve.now/CVE-2018-1000630.md): Battelle V2I Hub 2.5.1 is vulnerable to SQL injection. (no CVSS)
- [CVE-2018-1000631](https://cve.now/CVE-2018-1000631.md): Battelle V2I Hub 3.0 is vulnerable to SQL injection. (no CVSS)
- [CVE-2018-20552](https://cve.now/CVE-2018-20552.md): Tcpreplay before 4.3.1 has a heap-based buffer over-read in packet2tree in tree.c. (no CVSS)
- [CVE-2018-20553](https://cve.now/CVE-2018-20553.md): Tcpreplay before 4.3.1 has a heap-based buffer over-read in get\_l2len in common/get.c. (no CVSS)
- [CVE-2018-20551](https://cve.now/CVE-2018-20551.md): A reachable Object::getString assertion in Poppler 0.72.0 allows attackers to cause a denial of service due to construction of invalid rich (no CVSS)
- [CVE-2018-20532](https://cve.now/CVE-2018-20532.md): There is a NULL pointer dereference at ext/testcase.c (function testcase\_read) in libsolvext.a in libsolv through 0.7.2 that will cause a de (no CVSS)
- [CVE-2018-20533](https://cve.now/CVE-2018-20533.md): There is a NULL pointer dereference at ext/testcase.c (function testcase\_str2dep\_complex) in libsolvext.a in libsolv through 0.7.2 that will (no CVSS)
- [CVE-2018-20534](https://cve.now/CVE-2018-20534.md): There is an illegal address access at ext/testcase.c in libsolv.a in libsolv through 0.7.2 that will cause a denial of service. (no CVSS)
- [CVE-2018-20535](https://cve.now/CVE-2018-20535.md): There is a use-after-free at asm/preproc.c (function pp\_getline) in Netwide Assembler (NASM) 2.14rc16 that will cause a denial of service du (no CVSS)
- [CVE-2018-20536](https://cve.now/CVE-2018-20536.md): There is a heap-based buffer over-read at liblas::SpatialReference::GetGTIF() (spatialreference.cpp) in libLAS 1.8.1 that will cause a denia (no CVSS)
- [CVE-2018-20537](https://cve.now/CVE-2018-20537.md): There is a NULL pointer dereference at liblas::SpatialReference::GetGTIF() (spatialreference.cpp) in libLAS 1.8.1 that will cause a denial o (no CVSS)
- [CVE-2018-20538](https://cve.now/CVE-2018-20538.md): There is a use-after-free at asm/preproc.c (function pp\_getline) in Netwide Assembler (NASM) 2.14rc16 that will cause a denial of service du (no CVSS)
- [CVE-2018-20539](https://cve.now/CVE-2018-20539.md): There is a Segmentation fault triggered by illegal address access at liblas::SpatialReference::GetGTIF() (spatialreference.cpp) in libLAS 1. (no CVSS)
- [CVE-2018-20540](https://cve.now/CVE-2018-20540.md): There is memory leak at liblas::Open (liblas/liblas.hpp) in libLAS 1.8.1. (no CVSS)
- [CVE-2018-20541](https://cve.now/CVE-2018-20541.md): There is a heap-based buffer overflow in libxsmm\_sparse\_csc\_reader at generator\_spgemm\_csc\_reader.c in LIBXSMM 1.10, a different vulnerabili (no CVSS)
- [CVE-2018-20542](https://cve.now/CVE-2018-20542.md): There is a heap-based buffer-overflow at generator\_spgemm\_csc\_reader.c (function libxsmm\_sparse\_csc\_reader) in LIBXSMM 1.10, a different vul (no CVSS)
- [CVE-2018-20543](https://cve.now/CVE-2018-20543.md): There is an attempted excessive memory allocation at libxsmm\_sparse\_csc\_reader in generator\_spgemm\_csc\_reader.c in LIBXSMM 1.10 that will ca (no CVSS)
- [CVE-2018-20544](https://cve.now/CVE-2018-20544.md): There is floating point exception at caca/dither.c (function caca\_dither\_bitmap) in libcaca 0.99.beta19. (no CVSS)
- [CVE-2018-20545](https://cve.now/CVE-2018-20545.md): There is an illegal WRITE memory access at common-image.c (function load\_image) in libcaca 0.99.beta19 for 4bpp data. (no CVSS)
- [CVE-2018-20546](https://cve.now/CVE-2018-20546.md): There is an illegal READ memory access at caca/dither.c (function get\_rgba\_default) in libcaca 0.99.beta19 for the default bpp case. (no CVSS)
- [CVE-2018-20547](https://cve.now/CVE-2018-20547.md): There is an illegal READ memory access at caca/dither.c (function get\_rgba\_default) in libcaca 0.99.beta19 for 24bpp data. (no CVSS)
- [CVE-2018-20548](https://cve.now/CVE-2018-20548.md): There is an illegal WRITE memory access at common-image.c (function load\_image) in libcaca 0.99.beta19 for 1bpp data. (no CVSS)
- [CVE-2018-20549](https://cve.now/CVE-2018-20549.md): There is an illegal WRITE memory access at caca/file.c (function caca\_file\_read) in libcaca 0.99.beta19. (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2018-12-28
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.