Skip to content
OpenAdvisories

Archive

20 December 2018

Vulnerabilities first published on this day (UTC), newest first.

← November 2018 2018 / December /20 January 2019 →
  1. 18
  2. 21
  3. 354
  4. 480
  5. 530
  6. 675
  7. 757
  8. 88
  9. 93
  10. 1032
  11. 1153
  12. 1281
  13. 1356
  14. 1421
  15. 152
  16. 16 
  17. 1778
  18. 1819
  19. 1931
  20. 20136
  21. 2130
  22. 2214
  23. 2340
  24. 2441
  25. 2526
  26. 2633
  27. 2711
  28. 2882
  29. 29 
  30. 3029
  31. 3134
All Critical High Medium Low Exploited only Public exploit

136 results · Feed

  • High 8.4
    CVE-2018-1771

    IBM Domino 9.0 and 9.0.1 could allow an attacker to execute commands on the system by triggering a buffer overflow in t…

    IBM Domino
  • High 7.2
    CVE-2018-1973

    IBM API Connect 5.0.0.0 through 5.0.8.4 allows a user with limited 'API Administrator level access to give themselves f…

    IBM API Connect
  • Medium 5.1
    CVE-2018-1677

    IBM DataPower Gateways 7.1, 7.2, 7.5, 7.5.1, 7.5.2, 7.6, and 7.7 and IBM MQ Appliance are vulnerable to a denial of ser…

    IBM DataPower Gateways
  • Medium 6.3
    CVE-2018-6669

    Bypass Application Control through an ASP.NET form

    A whitelist bypass vulnerability in McAfee Application Control / Change Control 7.0.1 and before allows a remote or local user to execute blacklisted files through an ASP.NET form.

    McAfee Application and Change Control
  • High 8.0
    CVE-2018-5198

    WIZVERA Veraport Race Condition Vulnerability

    In Veraport G3 ALL on MacOS, a race condition when calling the Veraport API allow remote attacker to cause arbitrary file download and execution. This results in remote code execution.

    WIZVERA Veraport
  • High 8.0
    CVE-2018-5199

    WIZVERA Remote Code Execution Vulnerability

    In Veraport G3 ALL on MacOS, due to insufficient domain validation, It is possible to overwrite installation file to malicious file. A remote unauthenticated attacker may use this vulnerability to execute arbitrary file.

    WIZVERA Veraport
  • High 8.0
    CVE-2018-5200

    KMPlayer Heap Overflow Vulnerability

    KMPlayer 4.2.2.15 and earlier have a Heap Based Buffer Overflow Vulnerability. It could be exploited with a crafted FLV format file. The problem is that more frame data is copied to heap memory than the size specified in the frame header. This results in a me…

    Pandora.tv KMPlayer
  • High 7.5
    CVE-2018-8653 Exploited EPSS 30%

    A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Internet…

    Microsoft Internet Explorer 11 Internet Explorer 9 Internet Explorer 10
    KEV Nov 3, 2021
  • Unscored —
    CVE-2018-20307

    Pulse Secure Virtual Traffic Manager 9.9 versions prior to 9.9r2 and 10.4r1 allow a remote authenticated user to obtain…

  • Medium 6.5
    CVE-2018-20301

    Permissive parameters and privilege escalation

    An issue was discovered in Steve Pallen Coherence before 0.5.2 that is similar to a Mass Assignment vulnerability. In particular, "registration" endpoints (e.g., creating, editing, updating) allow users to update any coherence_fields data. For example, users …

    coherence Hex
  • Unscored —
    CVE-2018-20306

    A stored cross-site scripting (XSS) vulnerability in the web administration user interface of Pulse Secure Virtual Traf…

  • Unscored —
    CVE-2018-20304

    wbook_addworksheet in workbook.c in libexcel.a in libexcel 0.01 allows attackers to cause a denial of service (SEGV) vi…

  • High 7.5
    CVE-2018-20303

    Gogs Directory Traversal

    In pkg/tool/path.go in Gogs before 0.11.82.1218, a directory traversal in the file-upload functionality can allow an attacker to create a file under data/sessions on the server, a similar issue to CVE-2018-18925.

    gogs.io/gogs Go
  • Unscored —
    CVE-2018-20305

    D-Link DIR-816 A2 1.10 B05 devices allow arbitrary remote code execution without authentication via the newpass paramet…

  • Unscored —
    CVE-2018-20300

    Empire CMS 7.5 allows remote attackers to execute arbitrary PHP code via the ftemp parameter in an enews=EditMemberForm…

  • Medium 6.1
    CVE-2018-20302

    Cross-site Scripting in xain

    An XSS issue was discovered in Steve Pallen Xain before 0.6.2 via the order parameter.

    xain Hex