CVEdetails.com the ultimate security vulnerability data source
(e.g.: CVE-2009-1234 or 2010-1234 or 20101234)
Log In   Register
Vulnerability Feeds & WidgetsNew   www.itsecdb.com  

Security Vulnerabilities Published In December 2018

Press ESC to close
# CVE ID CWE ID # of Exploits Vulnerability Type(s) Publish Date Update Date Score Gained Access Level Access Complexity Authentication Conf. Integ. Avail.
301 CVE-2018-20329 89 Sql 2018-12-21 2019-01-07
5.5
None Remote Low Single system Partial Partial None
Chamilo LMS version 1.11.8 contains a main/inc/lib/CoursesAndSessionsCatalog.class.php SQL injection, allowing users with access to the sessions catalogue (which may optionally be made public) to extract and/or modify database information.
302 CVE-2018-20328 79 XSS 2018-12-21 2019-01-07
3.5
None Remote Medium Single system None Partial None
Chamilo LMS version 1.11.8 contains XSS in main/social/group_view.php in the social groups tool, allowing authenticated users to affect other users, under specific conditions of permissions granted by administrators. This is considered "low risk" due to the nature of the feature it exploits.
303 CVE-2018-20327 79 XSS 2018-12-21 2019-01-07
3.5
None Remote Medium Single system None Partial None
Chamilo LMS version 1.11.8 contains XSS in main/template/default/admin/gradebook_list.tpl in the gradebook dependencies tool, allowing authenticated users to affect other users, under specific conditions of permissions granted by administrators. This is considered "low risk" due to the nature of the feature it exploits.
304 CVE-2018-20325 77 Exec Code 2018-12-21 2019-10-02
7.5
None Remote Low Not required Partial Partial Partial
There is a vulnerability in load() method in definitions/parser.py in the Danijar Hafner definitions package for Python. It can execute arbitrary python commands resulting in command execution.
305 CVE-2018-20322 79 Exec Code XSS 2018-12-21 2019-01-09
4.3
None Remote Medium Not required None Partial None
LimeSurvey contains an XSS vulnerability while uploading a ZIP file, resulting in JavaScript code execution against LimeSurvey admins.
306 CVE-2018-20318 611 2018-12-20 2019-01-16
7.5
None Remote Low Not required Partial Partial Partial
An issue was discovered in weixin-java-tools v3.2.0. There is an XXE vulnerability in the getXmlDoc method of the BaseWxPayResult.java file.
307 CVE-2018-20307 +Info 2018-12-20 2018-12-20
0.0
None ??? ??? ??? ??? ??? ???
Pulse Secure Virtual Traffic Manager 9.9 versions prior to 9.9r2 and 10.4r1 allow a remote authenticated user to obtain sensitive historical activity information by leveraging incorrect permission validation.
308 CVE-2018-20306 79 XSS 2018-12-20 2019-01-08
3.5
None Remote Medium Single system None Partial None
A stored cross-site scripting (XSS) vulnerability in the web administration user interface of Pulse Secure Virtual Traffic Manager may allow a remote authenticated attacker to inject web script or HTML via a crafted website and steal sensitive data and credentials. Affected releases are Pulse Secure Virtual Traffic Manager 9.9 versions prior to 9.9r2 and 10.4r1.
309 CVE-2018-20305 119 Exec Code Overflow 2018-12-19 2019-01-07
7.5
None Remote Low Not required Partial Partial Partial
D-Link DIR-816 A2 1.10 B05 devices allow arbitrary remote code execution without authentication via the newpass parameter. In the /goform/form2userconfig.cgi handler function, a long password may lead to a stack-based buffer overflow and overwrite a return address.
310 CVE-2018-20304 DoS 2018-12-19 2018-12-19
0.0
None ??? ??? ??? ??? ??? ???
wbook_addworksheet in workbook.c in libexcel.a in libexcel 0.01 allows attackers to cause a denial of service (SEGV) via a long second argument. NOTE: this is not a Microsoft product.
311 CVE-2018-20303 Dir. Trav. 2018-12-19 2018-12-19
0.0
None ??? ??? ??? ??? ??? ???
In pkg/tool/path.go in Gogs before 0.11.82.1218, a directory traversal in the file-upload functionality can allow an attacker to create a file under data/sessions on the server, a similar issue to CVE-2018-18925.
312 CVE-2018-20302 79 XSS 2018-12-19 2019-01-09
4.3
None Remote Medium Not required None Partial None
An XSS issue was discovered in Steve Pallen Xain before 0.6.2 via the order parameter.
313 CVE-2018-20301 20 2018-12-20 2019-01-08
4.0
None Remote Low Single system None Partial None
An issue was discovered in Steve Pallen Coherence before 0.5.2 that is similar to a Mass Assignment vulnerability. In particular, "registration" endpoints (e.g., creating, editing, updating) allow users to update any coherence_fields data. For example, users can automatically confirm their accounts by sending the confirmed_at parameter with their registration request.
314 CVE-2018-20300 Exec Code 2018-12-19 2018-12-19
0.0
None ??? ??? ??? ??? ??? ???
Empire CMS 7.5 allows remote attackers to execute arbitrary PHP code via the ftemp parameter in an enews=EditMemberForm action because this code is injected into a memberform.$fid.php file.
315 CVE-2018-20299 Exec Code Overflow 2018-12-19 2018-12-19
0.0
None ??? ??? ??? ??? ??? ???
An issue was discovered in several Bosch Smart Home cameras (360 degree indoor camera and Eyes outdoor camera) with firmware before 6.52.4. A malicious client could potentially succeed in the unauthorized execution of code on the device via the network interface, because there is a buffer overflow in the RCP+ parser of the web server.
316 CVE-2018-20298 2018-12-19 2018-12-19
0.0
None ??? ??? ??? ??? ??? ???
S3 Browser before 8.1.5 contains an XML external entity (XXE) vulnerability, allowing remote attackers to read arbitrary files and obtain NTLMv2 hash values by tricking a user into connecting to a malicious server via the S3 protocol.
317 CVE-2018-20249 119 Overflow 2018-12-24 2019-10-09
6.8
None Remote Medium Not required Partial Partial Partial
In Foxit Quick PDF Library (all versions prior to 16.12), issue where loading a malformed or malicious PDF containing invalid xref entries using the DAOpenFile or DAOpenFileReadOnly functions may result in an access violation caused by out of bounds memory access.
318 CVE-2018-20248 119 Overflow 2018-12-24 2019-10-09
7.5
None Remote Low Not required Partial Partial Partial
In Foxit Quick PDF Library (all versions prior to 16.12), issue where loading a malformed or malicious PDF containing invalid xref table pointers or invalid xref table data using the LoadFromFile, LoadFromString, LoadFromStream, DAOpenFile or DAOpenFileReadOnly functions may result in an access violation caused by out of bounds memory access.
319 CVE-2018-20247 119 Overflow 2018-12-24 2019-10-09
6.8
None Remote Medium Not required Partial Partial Partial
In Foxit Quick PDF Library (all versions prior to 16.12), issue where loading a malformed or malicious PDF containing a recursive page tree structure using the LoadFromFile, LoadFromString or LoadFromStream functions results in a stack overflow.
320 CVE-2018-20231 CSRF 2018-12-19 2019-01-08
0.0
None ??? ??? ??? ??? ??? ???
Cross Site Request Forgery (CSRF) in the two-factor-authentication plugin before 1.3.13 for WordPress allows remote attackers to disable 2FA via the tfa_enable_tfa parameter due to missing nonce validation.
321 CVE-2018-20230 119 DoS Overflow 2018-12-19 2019-01-03
6.8
None Remote Medium Not required Partial Partial Partial
An issue was discovered in PSPP 1.2.0. There is a heap-based buffer overflow at the function read_bytes_internal in utilities/pspp-dump-sav.c, which allows attackers to cause a denial of service (application crash) or possibly have unspecified other impact.
322 CVE-2018-20228 352 CSRF 2018-12-19 2019-01-24
6.0
None Remote Medium Single system Partial Partial Partial
Subsonic V6.1.5 allows internetRadioSettings.view streamUrl CSRF, with resultant SSRF.
323 CVE-2018-20227 22 Dir. Trav. 2018-12-19 2019-01-07
6.4
None Remote Low Not required None Partial Partial
RDF4J 2.4.2 allows Directory Traversal via ../ in an entry in a ZIP archive.
324 CVE-2018-20226 2018-12-21 2019-10-02
6.5
None Remote Low Single system Partial Partial Partial
An organization administrator can add a super administrator in THEHIVE PROJECT Cortex before 2.1.3 due to the lack of overriding the Role.toString method.
325 CVE-2018-20217 617 2018-12-26 2019-10-02
3.5
None Remote Medium Single system None None Partial
A Reachable Assertion issue was discovered in the KDC in MIT Kerberos 5 (aka krb5) before 1.17. If an attacker can obtain a krbtgt ticket using an older encryption type (single-DES, triple-DES, or RC4), the attacker can crash the KDC by making an S4U2Self request.
326 CVE-2018-20216 252 2018-12-20 2019-10-02
5.0
None Remote Low Not required None None Partial
QEMU can have an infinite loop in hw/rdma/vmw/pvrdma_dev_ring.c because return values are not checked (and -1 is mishandled).
327 CVE-2018-20213 119 DoS Overflow 2018-12-18 2019-01-10
5.0
None Remote Low Not required None None Partial
wbook_addworksheet in workbook.c in libexcel.a in libexcel 0.01 allows attackers to cause a denial of service (SEGV) via a long name. NOTE: this is not a Microsoft product.
328 CVE-2018-20201 125 DoS 2018-12-18 2019-10-02
6.8
None Remote Medium Not required Partial Partial Partial
There is a stack-based buffer over-read in the jsfNameFromString function of jsflash.c in Espruino 2V00, leading to a denial of service or possibly unspecified other impact via a crafted js file.
329 CVE-2018-20199 476 DoS 2018-12-17 2019-08-28
4.3
None Remote Medium Not required None None Partial
A NULL pointer dereference was discovered in ifilter_bank of libfaad/filtbank.c in Freeware Advanced Audio Decoder 2 (FAAD2) 2.8.8. The vulnerability causes a segmentation fault and application crash, which leads to denial of service because adding to windowed output is mishandled in the ONLY_LONG_SEQUENCE case.
330 CVE-2018-20198 476 DoS 2018-12-17 2019-05-19
4.3
None Remote Medium Not required None None Partial
A NULL pointer dereference was discovered in ifilter_bank of libfaad/filtbank.c in Freeware Advanced Audio Decoder 2 (FAAD2) 2.8.8. The vulnerability causes a segmentation fault and application crash, which leads to denial of service because adding to windowed output is mishandled in the LONG_START_SEQUENCE case.
331 CVE-2018-20197 787 DoS 2018-12-17 2019-10-02
6.8
None Remote Medium Not required Partial Partial Partial
There is a stack-based buffer underflow in the third instance of the calculate_gain function in libfaad/sbr_hfadj.c in Freeware Advanced Audio Decoder 2 (FAAD2) 2.8.8. A crafted input will lead to a denial of service or possibly unspecified other impact because limiting the additional noise energy level is mishandled for the G_max > G case.
332 CVE-2018-20196 119 DoS Overflow 2018-12-17 2019-08-28
6.8
None Remote Medium Not required Partial Partial Partial
There is a stack-based buffer overflow in the third instance of the calculate_gain function in libfaad/sbr_hfadj.c in Freeware Advanced Audio Decoder 2 (FAAD2) 2.8.8. A crafted input will lead to a denial of service or possibly unspecified other impact because the S_M array is mishandled.
333 CVE-2018-20195 476 DoS 2018-12-17 2019-09-16
4.3
None Remote Medium Not required None None Partial
A NULL pointer dereference was discovered in ic_predict of libfaad/ic_predict.c in Freeware Advanced Audio Decoder 2 (FAAD2) 2.8.8. The vulnerability causes a segmentation fault and application crash, which leads to denial of service.
334 CVE-2018-20194 787 DoS 2018-12-17 2019-10-02
6.8
None Remote Medium Not required Partial Partial Partial
There is a stack-based buffer underflow in the third instance of the calculate_gain function in libfaad/sbr_hfadj.c in Freeware Advanced Audio Decoder 2 (FAAD2) 2.8.8. A crafted input will lead to a denial of service or possibly unspecified other impact because limiting the additional noise energy level is mishandled for the G_max <= G case.
335 CVE-2018-20193 269 2018-12-21 2019-10-02
4.0
None Remote Low Single system Partial None None
Certain Secure Access SA Series SSL VPN products (originally developed by Juniper Networks but now sold and supported by Pulse Secure, LLC) allow privilege escalation, as demonstrated by Secure Access SSL VPN SA-4000 5.1R5 (build 9627) 4.2 Release (build 7631). This occurs because appropriate controls are not performed. Specifically, it is possible for a readonly user to change the administrator user password by making a local copy of the /dana-admin/user/update.cgi page, changing the "user" value, and saving the changes.
336 CVE-2018-20191 476 DoS 2018-12-20 2019-04-03
5.0
None Remote Low Not required None None Partial
hw/rdma/vmw/pvrdma_main.c in QEMU does not implement a read operation (such as uar_read by analogy to uar_write), which allows attackers to cause a denial of service (NULL pointer dereference).
337 CVE-2018-20190 476 DoS 2018-12-17 2019-07-23
4.3
None Remote Medium Not required None None Partial
In LibSass 3.5.5, a NULL Pointer Dereference in the function Sass::Eval::operator()(Sass::Supports_Operator*) in eval.cpp may cause a Denial of Service (application crash) via a crafted sass input file.
338 CVE-2018-20189 20 DoS 2018-12-17 2019-01-08
4.3
None Remote Medium Not required None None Partial
In GraphicsMagick 1.3.31, the ReadDIBImage function of coders/dib.c has a vulnerability allowing a crash and denial of service via a dib file that is crafted to appear with direct pixel values and also colormapping (which is not available beyond 8-bits/sample), and therefore lacks indexes initialization.
339 CVE-2018-20188 352 CSRF 2018-12-17 2019-01-07
6.8
None Remote Medium Not required Partial Partial Partial
FUEL CMS 1.4.3 has CSRF via users/create/ to add an administrator account.
340 CVE-2018-20186 2018-12-17 2018-12-17
0.0
None ??? ??? ??? ??? ??? ???
An issue was discovered in Bento4 1.5.1-627. AP4_Sample::ReadData in Core/Ap4Sample.cpp allows attackers to trigger an attempted excessive memory allocation, related to AP4_DataBuffer::SetDataSize and AP4_DataBuffer::ReallocateBuffer in Core/Ap4DataBuffer.cpp.
341 CVE-2018-20185 125 DoS 2018-12-17 2019-01-08
2.6
None Remote High Not required None None Partial
In GraphicsMagick 1.4 snapshot-20181209 Q8 on 32-bit platforms, there is a heap-based buffer over-read in the ReadBMPImage function of bmp.c, which allows attackers to cause a denial of service via a crafted bmp image file. This only affects GraphicsMagick installations with customized BMP limits.
342 CVE-2018-20184 119 DoS Overflow 2018-12-17 2019-01-08
4.3
None Remote Medium Not required None None Partial
In GraphicsMagick 1.4 snapshot-20181209 Q8, there is a heap-based buffer overflow in the WriteTGAImage function of tga.c, which allows attackers to cause a denial of service via a crafted image file, because the number of rows or columns can exceed the pixel-dimension restrictions of the TGA specification.
343 CVE-2018-20173 89 Sql 2018-12-17 2019-01-04
7.5
None Remote Low Not required Partial Partial Partial
Zoho ManageEngine OpManager 12.3 before 123238 allows SQL injection via the getGraphData API.
344 CVE-2018-20172 79 XSS 2018-12-17 2019-01-07
4.3
None Remote Medium Not required None Partial None
An issue was discovered in Nagios XI before 5.5.8. The rss_url parameter of rss_dashlet/magpierss/scripts/magpie_slashbox.php is not filtered, resulting in an XSS vulnerability.
345 CVE-2018-20171 79 XSS 2018-12-17 2019-01-07
4.3
None Remote Medium Not required None Partial None
An issue was discovered in Nagios XI before 5.5.8. The url parameter of rss_dashlet/magpierss/scripts/magpie_simple.php is not filtered, resulting in an XSS vulnerability.
346 CVE-2018-20170 2018-12-17 2018-12-17
0.0
None ??? ??? ??? ??? ??? ???
** DISPUTED ** OpenStack Keystone through 14.0.1 has a user enumeration vulnerability because invalid usernames have much faster responses than valid ones for a POST /v3/auth/tokens request. NOTE: the vendor's position is that this is a hardening opportunity, and not necessarily an issue that should have an OpenStack Security Advisory.
347 CVE-2018-20169 400 2018-12-17 2019-08-13
7.2
None Local Low Not required Complete Complete Complete
An issue was discovered in the Linux kernel before 4.19.9. The USB subsystem mishandles size checks during the reading of an extra descriptor, related to __usb_get_extra_descriptor in drivers/usb/core/usb.c.
348 CVE-2018-20168 20 DoS 2018-12-17 2019-01-07
4.3
None Remote Medium Not required None None Partial
Google gVisor before 2018-08-22 reuses a pagetable in a different level with the paging-structure cache intact, which allows attackers to cause a denial of service ("physical address not valid" panic) via a crafted application.
349 CVE-2018-20167 74 Exec Code 2018-12-17 2019-10-02
6.8
None Remote Medium Not required Partial Partial Partial
Terminology before 1.3.1 allows Remote Code Execution because popmedia is mishandled, as demonstrated by an unsafe "cat README.md" command when \e}pn is used. A popmedia control sequence can allow the malicious execution of executable file formats registered in the X desktop share MIME types (/usr/share/applications). The control sequence defers unknown file types to the handle_unknown_media() function, which executes xdg-open against the filename specified in the sequence. The use of xdg-open for all unknown file types allows executable file formats with a registered shared MIME type to be executed. An attacker can achieve remote code execution by introducing an executable file and a plain text file containing the control sequence through a fake software project (e.g., in Git or a tarball). When the control sequence is rendered (such as with cat), the executable file will be run.
350 CVE-2018-20161 2018-12-15 2018-12-15
0.0
None ??? ??? ??? ??? ??? ???
A design flaw in the BlinkForHome (aka Blink For Home) Sync Module 2.10.4 and earlier allows attackers to disable cameras via Wi-Fi, because incident clips (triggered by the motion sensor) are not saved if the attacker's traffic (such as Dot11Deauth) successfully disconnects the Sync Module from the Wi-Fi network. (Access to live video from the app also becomes unavailable.)
Total number of vulnerabilities : 1160   Page : 1 2 3 4 5 6 7 (This Page)8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24
CVE is a registred trademark of the MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. CWE is a registred trademark of the MITRE Corporation and the authoritative source of CWE content is MITRE's CWE web site. OVAL is a registered trademark of The MITRE Corporation and the authoritative source of OVAL content is MITRE's OVAL web site.
Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.