CVEdetails.com the ultimate security vulnerability data source
(e.g.: CVE-2009-1234 or 2010-1234 or 20101234)
Log In   Register
Vulnerability Feeds & WidgetsNew   www.itsecdb.com  

Security Vulnerabilities Published In December 2018

Press ESC to close
# CVE ID CWE ID # of Exploits Vulnerability Type(s) Publish Date Update Date Score Gained Access Level Access Complexity Authentication Conf. Integ. Avail.
251 CVE-2018-20396 522 2018-12-23 2019-10-02
5.0
None Remote Low Not required Partial None None
NET&SYS MNG2120J 5.76.1006c and MNG6300 5.83.6305jrc2 devices allow remote attackers to discover credentials via iso.3.6.1.4.1.4491.2.4.1.1.6.1.1.0 and iso.3.6.1.4.1.4491.2.4.1.1.6.1.2.0 SNMP requests.
252 CVE-2018-20395 522 2018-12-23 2019-10-02
5.0
None Remote Low Not required Partial None None
NETWAVE MNG6200 C4835805jrc12FU121413.cpr devices allow remote attackers to discover credentials via iso.3.6.1.4.1.4491.2.4.1.1.6.1.1.0 and iso.3.6.1.4.1.4491.2.4.1.1.6.1.2.0 SNMP requests.
253 CVE-2018-20394 522 2018-12-23 2019-10-02
5.0
None Remote Low Not required Partial None None
Thomson DWG849 STC0.01.16, DWG850-4 ST9C.05.25, DWG855 ST80.20.26, and TWG870 STB2.01.36 devices allow remote attackers to discover credentials via iso.3.6.1.4.1.4491.2.4.1.1.6.1.1.0 and iso.3.6.1.4.1.4491.2.4.1.1.6.1.2.0 SNMP requests.
254 CVE-2018-20393 2018-12-23 2018-12-23
0.0
None ??? ??? ??? ??? ??? ???
Technicolor CGA0111 CGA0111E-ES-13-E23E-c8000r5712-170217-0829-TRU, CWA0101 CWA0101E-A23E-c7000r5712-170315-SKC, DPC3928SL D3928SL-PSIP-13-A010-c3420r55105-170214a, TC7110.AR STD3.38.03, TC7110.B STC8.62.02, TC7110.D STDB.79.02, TC7200.d1I TC7200.d1IE-N23E-c7000r5712-170406-HAT, and TC7200.TH2v2 SC05.00.22 devices allow remote attackers to discover credentials via iso.3.6.1.4.1.4491.2.4.1.1.6.1.1.0 and iso.3.6.1.4.1.4491.2.4.1.1.6.1.2.0 SNMP requests.
255 CVE-2018-20392 522 2018-12-23 2019-10-02
5.0
None Remote Low Not required Partial None None
S-A WebSTAR DPC2100 v2.0.2r1256-060303 devices allow remote attackers to discover credentials via iso.3.6.1.4.1.4491.2.4.1.1.6.1.1.0 and iso.3.6.1.4.1.4491.2.4.1.1.6.1.2.0 SNMP requests.
256 CVE-2018-20391 522 2018-12-23 2019-10-02
5.0
None Remote Low Not required Partial None None
TEKNOTEL CBW700N 81.447.392110.729.024 devices allow remote attackers to discover credentials via iso.3.6.1.4.1.4491.2.4.1.1.6.1.1.0 and iso.3.6.1.4.1.4491.2.4.1.1.6.1.2.0 SNMP requests.
257 CVE-2018-20390 522 2018-12-23 2019-10-02
5.0
None Remote Low Not required Partial None None
Kaonmedia CG2001-AN22A 1.2.1, CG2001-UDBNA 3.0.8, and CG2001-UN2NA 3.0.8 devices allow remote attackers to discover credentials via iso.3.6.1.4.1.4491.2.4.1.1.6.1.1.0 and iso.3.6.1.4.1.4491.2.4.1.1.6.1.2.0 SNMP requests.
258 CVE-2018-20389 522 2018-12-23 2019-10-02
5.0
None Remote Low Not required Partial None None
D-Link DCM-604 DCM604_C1_ViaCabo_1.04_20130606 and DCM-704 EU_DCM-704_1.10 devices allow remote attackers to discover credentials via iso.3.6.1.4.1.4491.2.4.1.1.6.1.1.0 and iso.3.6.1.4.1.4491.2.4.1.1.6.1.2.0 SNMP requests.
259 CVE-2018-20388 522 2018-12-23 2019-10-02
5.0
None Remote Low Not required Partial None None
Comtrend CM-6200un 123.447.007 and CM-6300n 123.553mp1.005 devices allow remote attackers to discover credentials via iso.3.6.1.4.1.4491.2.4.1.1.6.1.1.0 and iso.3.6.1.4.1.4491.2.4.1.1.6.1.2.0 SNMP requests.
260 CVE-2018-20387 522 2018-12-23 2019-10-02
5.0
None Remote Low Not required Partial None None
Bnmux BCW700J 5.20.7, BCW710J 5.30.6a, and BCW710J2 5.30.16 devices allow remote attackers to discover credentials via iso.3.6.1.4.1.4491.2.4.1.1.6.1.1.0 and iso.3.6.1.4.1.4491.2.4.1.1.6.1.2.0 SNMP requests.
261 CVE-2018-20386 522 2018-12-23 2019-10-02
5.0
None Remote Low Not required Partial None None
ARRIS SBG6580-2 D30GW-SEAEAGLE-1.5.2.5-GA-00-NOSH devices allow remote attackers to discover credentials via iso.3.6.1.4.1.4491.2.4.1.1.6.1.1.0 and iso.3.6.1.4.1.4491.2.4.1.1.6.1.2.0 SNMP requests.
262 CVE-2018-20385 522 2018-12-23 2019-10-02
5.0
None Remote Low Not required Partial None None
CastleNet CBV38Z4EC 125.553mp1.39219mp1.899.007, CBV38Z4ECNIT 125.553mp1.39219mp1.899.005ITT, CBW383G4J 37.556mp5.008, and CBW38G4J 37.553mp1.008 devices allow remote attackers to discover credentials via iso.3.6.1.4.1.4491.2.4.1.1.6.1.1.0 and iso.3.6.1.4.1.4491.2.4.1.1.6.1.2.0 SNMP requests.
263 CVE-2018-20384 522 2018-12-23 2019-10-02
5.0
None Remote Low Not required Partial None None
iNovo Broadband IB-8120-W21 139.4410mp1.004200.002 and IB-8120-W21E1 139.4410mp1.3921132mp1.899.004404.004 devices allow remote attackers to discover credentials via iso.3.6.1.4.1.4491.2.4.1.1.6.1.1.0 and iso.3.6.1.4.1.4491.2.4.1.1.6.1.2.0 SNMP requests.
264 CVE-2018-20383 522 2018-12-23 2019-10-02
5.0
None Remote Low Not required Partial None None
ARRIS DG950A 7.10.145 and DG950S 7.10.145.EURO devices allow remote attackers to discover credentials via iso.3.6.1.4.1.4491.2.4.1.1.6.1.1.0 and iso.3.6.1.4.1.4491.2.4.1.1.6.1.2.0 SNMP requests.
265 CVE-2018-20382 522 2018-12-23 2019-10-02
5.0
None Remote Low Not required Partial None None
Jiuzhou BCM93383WRG 139.4410mp1.3921132mp1.899.004404.004 devices allow remote attackers to discover credentials via iso.3.6.1.4.1.4491.2.4.1.1.6.1.1.0 and iso.3.6.1.4.1.4491.2.4.1.1.6.1.2.0 SNMP requests.
266 CVE-2018-20381 2018-12-23 2018-12-23
0.0
None ??? ??? ??? ??? ??? ???
Technicolor DPC2320 dpc2300r2-v202r1244101-150420a-v6 devices allow remote attackers to discover credentials via iso.3.6.1.4.1.4491.2.4.1.1.6.1.1.0 and iso.3.6.1.4.1.4491.2.4.1.1.6.1.2.0 SNMP requests.
267 CVE-2018-20380 2018-12-23 2018-12-23
0.0
None ??? ??? ??? ??? ??? ???
Ambit DDW2600 5.100.1009, DDW2602 5.105.1003, T60C926 4.64.1012, and U10C019 5.66.1026 devices allow remote attackers to discover credentials via iso.3.6.1.4.1.4491.2.4.1.1.6.1.1.0 and iso.3.6.1.4.1.4491.2.4.1.1.6.1.2.0 SNMP requests.
268 CVE-2018-20379 79 XSS 2018-12-23 2019-01-14
2.6
None Remote High Not required None Partial None
Technicolor DPC3928SL D3928SL-PSIP-13-A010-c3420r55105-160428a devices allow XSS via a Cross Protocol Injection attack with setSSID of 1.3.6.1.4.1.4413.2.2.2.1.18.1.2.1.1.3.10001.
269 CVE-2018-20377 2018-12-23 2019-10-02
10.0
None Remote Low Not required Complete Complete Complete
Orange Livebox 00.96.320S devices allow remote attackers to discover Wi-Fi credentials via /get_getnetworkconf.cgi on port 8080, leading to full control if the admin password equals the Wi-Fi password or has the default admin value. This is related to Firmware 01.11.2017-11:43:44, Boot v0.70.03, Modem 5.4.1.10.1.1A, Hardware 02, and Arcadyan ARV7519RW22-A-L T VR9 1.2.
270 CVE-2018-20376 787 2018-12-23 2019-01-06
4.3
None Remote Medium Not required None None Partial
An issue was discovered in Tiny C Compiler (aka TinyCC or TCC) 0.9.27. Compiling a crafted source file leads to an 8 byte out of bounds write in the asm_parse_directive function in tccasm.c.
271 CVE-2018-20375 787 2018-12-23 2019-01-06
4.3
None Remote Medium Not required None None Partial
An issue was discovered in Tiny C Compiler (aka TinyCC or TCC) 0.9.27. Compiling a crafted source file leads to an 8 byte out of bounds write in the sym_pop function in tccgen.c.
272 CVE-2018-20374 787 2018-12-23 2019-01-06
4.3
None Remote Medium Not required None None Partial
An issue was discovered in Tiny C Compiler (aka TinyCC or TCC) 0.9.27. Compiling a crafted source file leads to an 8 byte out of bounds write in the use_section1 function in tccasm.c.
273 CVE-2018-20373 79 XSS 2018-12-22 2019-01-14
3.5
None Remote Medium Single system None Partial None
Tenda ADSL modem routers 1.0.1 allow XSS via the hostname of a DHCP client.
274 CVE-2018-20372 79 XSS 2018-12-22 2019-01-11
3.5
None Remote Medium Single system None Partial None
TP-Link TD-W8961ND devices allow XSS via the hostname of a DHCP client.
275 CVE-2018-20371 Bypass 2018-12-22 2018-12-22
0.0
None ??? ??? ??? ??? ??? ???
PhotoRange Photo Vault 1.2 appends the password to the URI for authorization, which makes it easier for remote attackers to bypass intended GET restrictions via a brute-force approach, as demonstrated by "GET /login.html__passwd1" and "GET /login.html__passwd2" and so on.
276 CVE-2018-20370 79 XSS 2018-12-22 2019-01-09
3.5
None Remote Medium Single system None Partial None
SZ NetChat before 7.9 has XSS in the MyName input field of the Options module. Attackers are able to inject commands to compromise the enabled HTTP server web frontend.
277 CVE-2018-20369 79 XSS 2018-12-22 2019-01-15
4.3
None Remote Medium Not required None Partial None
Barracuda Message Archiver 2018 has XSS in the error_msg exception-handling value for the ldap_user parameter to the cgi-mod/ldap_load_entry.cgi module. The injection point of the issue is the Add_Update module.
278 CVE-2018-20368 79 XSS 2018-12-22 2019-01-15
3.5
None Remote Medium Single system None Partial None
The Master Slider plugin 3.2.7 and 3.5.1 for WordPress has XSS via the wp-admin/admin-ajax.php Name input field of the MSPanel.Settings value on Callback.
279 CVE-2018-20367 XSS 2018-12-22 2018-12-22
0.0
None ??? ??? ??? ??? ??? ???
The "mall some commodity details: commodity consultation" component in WSTMart 2.0.8_181212 has stored XSS via the consultContent parameter, as demonstrated by the index.php/home/goodsconsult/add.html URI.
280 CVE-2018-20365 119 Overflow 2018-12-22 2019-05-21
4.3
None Remote Medium Not required None None Partial
LibRaw::raw2image() in libraw_cxx.cpp has a heap-based buffer overflow.
281 CVE-2018-20364 476 2018-12-22 2019-05-21
4.3
None Remote Medium Not required None None Partial
LibRaw::copy_bayer in libraw_cxx.cpp in LibRaw 0.19.1 has a NULL pointer dereference.
282 CVE-2018-20363 476 2018-12-22 2019-05-21
4.3
None Remote Medium Not required None None Partial
LibRaw::raw2image in libraw_cxx.cpp in LibRaw 0.19.1 has a NULL pointer dereference.
283 CVE-2018-20362 476 2018-12-22 2019-05-19
4.3
None Remote Medium Not required None None Partial
A NULL pointer dereference was discovered in ifilter_bank of libfaad/filtbank.c in Freeware Advanced Audio Decoder 2 (FAAD2) 2.8.8. The vulnerability causes a segmentation fault and application crash because adding to windowed output is mishandled in the EIGHT_SHORT_SEQUENCE case.
284 CVE-2018-20361 119 DoS Overflow 2018-12-22 2019-09-16
4.3
None Remote Medium Not required None None Partial
An invalid memory address dereference was discovered in the hf_assembly function of libfaad/sbr_hfadj.c in Freeware Advanced Audio Decoder 2 (FAAD2) 2.8.8. The vulnerability causes a segmentation fault and application crash, which leads to denial of service.
285 CVE-2018-20360 119 DoS Overflow 2018-12-22 2019-08-28
4.3
None Remote Medium Not required None None Partial
An invalid memory address dereference was discovered in the sbr_process_channel function of libfaad/sbr_dec.c in Freeware Advanced Audio Decoder 2 (FAAD2) 2.8.8. The vulnerability causes a segmentation fault and application crash, which leads to denial of service.
286 CVE-2018-20359 119 DoS Overflow 2018-12-22 2019-09-16
4.3
None Remote Medium Not required None None Partial
An invalid memory address dereference was discovered in the sbrDecodeSingleFramePS function of libfaad/sbr_dec.c in Freeware Advanced Audio Decoder 2 (FAAD2) 2.8.8. The vulnerability causes a segmentation fault and application crash, which leads to denial of service.
287 CVE-2018-20358 119 DoS Overflow 2018-12-22 2019-09-16
4.3
None Remote Medium Not required None None Partial
An invalid memory address dereference was discovered in the lt_prediction function of libfaad/lt_predict.c in Freeware Advanced Audio Decoder 2 (FAAD2) 2.8.8. The vulnerability causes a segmentation fault and application crash, which leads to denial of service.
288 CVE-2018-20357 476 2018-12-22 2019-09-16
4.3
None Remote Medium Not required None None Partial
A NULL pointer dereference was discovered in sbr_process_channel of libfaad/sbr_dec.c in Freeware Advanced Audio Decoder 2 (FAAD2) 2.8.8. The vulnerability causes a segmentation fault and application crash.
289 CVE-2018-20351 79 XSS 2018-12-21 2019-01-09
4.3
None Remote Medium Not required None Partial None
The Markdown component in Evernote (Chinese) before 8.3.2 on macOS allows stored XSS, aka MAC-832.
290 CVE-2018-20349 476 DoS 2018-12-21 2019-08-13
4.3
None Remote Medium Not required None None Partial
The igraph_i_strdiff function in igraph_trie.c in igraph through 0.7.1 has an NULL pointer dereference that allows attackers to cause a denial of service (application crash) via a crafted object.
291 CVE-2018-20348 835 DoS 2018-12-21 2019-10-02
1.9
None Local Medium Not required None None Partial
libpff_item_tree_create_node in libpff_item_tree.c in libpff before experimental-20180714 allows attackers to cause a denial of service (infinite recursion) via a crafted file, related to libfdata_tree_get_node_value in libfdata_tree.c.
292 CVE-2018-20346 190 Exec Code Overflow 2018-12-21 2019-06-19
6.8
None Remote Medium Not required Partial Partial Partial
SQLite before 3.25.3, when the FTS3 extension is enabled, encounters an integer overflow (and resultant buffer overflow) for FTS3 queries that occur after crafted changes to FTS3 shadow tables, allowing remote attackers to execute arbitrary code by leveraging the ability to run arbitrary SQL statements (such as in certain WebSQL use cases), aka Magellan.
293 CVE-2018-20345 425 2018-12-21 2019-10-02
3.5
None Remote Medium Single system Partial None None
Incorrect access control in StackStorm API (st2api) in StackStorm before 2.9.2 and 2.10.x before 2.10.1 allows an attacker (who has a StackStorm account and is authenticated against the StackStorm API) to retrieve datastore items for other users by utilizing the /v1/keys "?scope=all" and "?user=<username>" query filter parameters. Enterprise editions with RBAC enabled are not affected.
294 CVE-2018-20342 287 Exec Code 2018-12-21 2019-10-02
7.2
None Local Low Not required Complete Complete Complete
The Floureon IP Camera SP012 provides a root terminal on a UART serial interface without proper access control. This allows attackers with physical access to execute arbitrary commands with root privileges.
295 CVE-2018-20339 79 XSS 2018-12-21 2019-01-04
4.3
None Remote Medium Not required None Partial None
Zoho ManageEngine OpManager 12.3 before build 123239 allows XSS in the Notes column of the Alarms section.
296 CVE-2018-20338 89 Sql 2018-12-21 2019-01-04
7.5
None Remote Low Not required Partial Partial Partial
Zoho ManageEngine OpManager 12.3 before build 123239 allows SQL injection in the Alarms section.
297 CVE-2018-20337 119 DoS Overflow 2018-12-21 2019-05-21
6.8
None Remote Medium Not required Partial Partial Partial
There is a stack-based buffer overflow in the parse_makernote function of dcraw_common.cpp in LibRaw 0.19.1. Crafted input will lead to a denial of service or possibly unspecified other impact.
298 CVE-2018-20332 2018-12-21 2018-12-21
0.0
None ??? ??? ??? ??? ??? ???
An issue has been discovered in the OpenWebif plugin through 1.2.4 for Enigma2 based devices. Reading of arbitrary files is possible with /file?action=download&file= followed by a full pathname, and listing of arbitrary directories is possible with /file?action=download&dir= followed by a full pathname. This is related to plugin/controllers/file.py in the e2openplugin-OpenWebif project.
299 CVE-2018-20331 119 DoS Exec Code Overflow 2018-12-22 2018-12-31
7.2
None Local Low Not required Complete Complete Complete
Local attackers can trigger a Kernel Pool Buffer Overflow in Antiy AVL ATool v1.0.0.22. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the processing of IOCTL 0x80002004 by the ssdt.sys kernel driver. The bug is caused by failure to properly validate the length of the user-supplied data. An attacker can leverage this vulnerability to execute arbitrary code in the context of the kernel, which could lead to privilege escalation. A failed exploit could lead to denial of service.
300 CVE-2018-20330 190 Overflow 2018-12-21 2019-01-08
6.8
None Remote Medium Not required Partial Partial Partial
The tjLoadImage function in libjpeg-turbo 2.0.1 has an integer overflow with a resultant heap-based buffer overflow via a BMP image because multiplication of pitch and height is mishandled, as demonstrated by tjbench.
Total number of vulnerabilities : 1160   Page : 1 2 3 4 5 6 (This Page)7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24
CVE is a registred trademark of the MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. CWE is a registred trademark of the MITRE Corporation and the authoritative source of CWE content is MITRE's CWE web site. OVAL is a registered trademark of The MITRE Corporation and the authoritative source of OVAL content is MITRE's OVAL web site.
Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.