Skip to content
OpenAdvisories

Archive

26 December 2018

Vulnerabilities first published on this day (UTC), newest first.

← November 2018 2018 / December /26 January 2019 →
  1. 18
  2. 21
  3. 354
  4. 480
  5. 530
  6. 675
  7. 757
  8. 88
  9. 93
  10. 1032
  11. 1153
  12. 1281
  13. 1356
  14. 1421
  15. 152
  16. 16 
  17. 1778
  18. 1819
  19. 1931
  20. 20136
  21. 2130
  22. 2214
  23. 2340
  24. 2441
  25. 2526
  26. 2633
  27. 2711
  28. 2882
  29. 29 
  30. 3029
  31. 3134
All Critical High Medium Low Exploited only Public exploit

33 results · Feed

  • Unscored —
    CVE-2018-20502

    An issue was discovered in Bento4 1.5.1-627. There is an attempt at excessive memory allocation in the AP4_DataBuffer c…

    kodi-inputstream-adaptive Ubuntu
  • Unscored —
    CVE-2018-18535

    The Asusgio low-level driver in ASUS Aura Sync v1.07.22 and earlier exposes functionality to read and write Machine Spe…

  • Unscored —
    CVE-2018-18537

    The GLCKIo low-level driver in ASUS Aura Sync v1.07.22 and earlier exposes a path to write an arbitrary DWORD to an arb…

  • Unscored —
    CVE-2018-18536

    The GLCKIo and Asusgio low-level drivers in ASUS Aura Sync v1.07.22 and earlier expose functionality to read/write data…

  • Unscored —
    CVE-2018-11741 Public exploit EPSS 18%

    NEC Univerge Sv9100 WebPro 6.00.00 devices have Predictable Session IDs that result in Account Information Disclosure v…

  • Unscored —
    CVE-2018-11742 Public exploit EPSS 14%

    NEC Univerge Sv9100 WebPro 6.00.00 devices have Cleartext Password Storage in the Web UI.

  • Unscored —
    CVE-2018-17987

    The determineWinner function of a smart contract implementation for HashHeroes Tiles, an Ethereum game, uses a certain …

  • Unscored —
    CVE-2018-15518

    QXmlStream in Qt 5.x before 5.11.3 has a double-free or corruption during parsing of a specially crafted illegal XML do…

    qtbase-opensource-src qtbase-opensource-src Debian Ubuntu
  • Unscored —
    CVE-2018-19616 Public exploit EPSS 30%

    An issue was discovered in Rockwell Automation Allen-Bradley PowerMonitor 1000. An unauthenticated user can add/edit/re…

  • Unscored —
    CVE-2018-19870

    An issue was discovered in Qt before 5.11.3. A malformed GIF image causes a NULL pointer dereference in QGifHandler res…

    qtbase-opensource-src qtbase-opensource-src Debian Ubuntu
  • Unscored —
    CVE-2018-19871

    An issue was discovered in Qt before 5.11.3. There is QTgaFile Uncontrolled Resource Consumption.

    qt4-x11 qtimageformats-opensource-src qtimageformats-opensource-src Debian Ubuntu
  • Unscored —
    CVE-2018-19615

    Rockwell Automation Allen-Bradley PowerMonitor 1000 all versions. A remote attacker could inject arbitrary code into a …

  • Unscored —
    CVE-2018-19182

    Engelsystem before commit hash 2e28336 allows CSRF.

  • Medium 6.1
    CVE-2018-19799 Public exploit

    Dolibarr ERP and CRM contain XSS Vulnerability

    Dolibarr ERP/CRM through 8.0.3 has /exports/export.php?datatoexport= XSS.

    dolibarr dolibarr/dolibarr Ubuntu Packagist
  • Unscored —
    CVE-2018-19873

    An issue was discovered in Qt before 5.11.3. QBmpHandler has a buffer overflow via BMP data.

    qtbase-opensource-src qtbase-opensource-src Debian Ubuntu
  • Unscored —
    CVE-2018-19869

    An issue was discovered in Qt before 5.11.3. A malformed SVG image causes a segmentation fault in qsvghandler.cpp.

    qt4-x11 qtsvg-opensource-src qtsvg-opensource-src Debian Ubuntu
  • Unscored —
    CVE-2018-20404

    ETK_E900.sys, a SmartETK driver for VIA Technologies EPIA-E900 system board, is vulnerable to denial of service attack …

  • Unscored —
    CVE-2018-20217

    A Reachable Assertion issue was discovered in the KDC in MIT Kerberos 5 (aka krb5) before 1.17. If an attacker can obta…

    krb5 krb5 krb5 Debian Ubuntu Alpine
  • Unscored —
    CVE-2018-20486

    MetInfo 6.x through 6.1.3 has XSS via the /admin/login/login_check.php url_array[] parameter.

  • Unscored —
    CVE-2018-20485 Public exploit

    Zoho ManageEngine ADSelfService Plus 5.7 before build 5702 has XSS in the employee search feature.

  • Unscored —
    CVE-2018-20482

    GNU Tar through 1.30, when --sparse is used, mishandles file shrinkage during read access, which allows local users to …

    tar tar tar Debian Ubuntu Alpine
  • Unscored —
    CVE-2018-20483

    set_file_metadata in xattr.c in GNU Wget before 1.20.1 stores a file's origin URL in the user.xdg.origin.url metadata a…

    wget wget wget Debian Ubuntu Alpine
  • Unscored —
    CVE-2018-20484 Public exploit

    Zoho ManageEngine ADSelfService Plus 5.7 before build 5702 has XSS in the self-update layout implementation.

  • Unscored —
    CVE-2018-0723

    Cross-site scripting (XSS) vulnerability in Q'center Virtual Appliance 1.8.1014 and earlier versions could allow remote…

    QNAP Systems Q'center Virtual Appliance
  • Unscored —
    CVE-2018-0724

    Cross-site scripting (XSS) vulnerability in Q'center Virtual Appliance 1.8.1014 and earlier versions could allow remote…

    QNAP Systems Q'center Virtual Appliance
  • Low 3.4
    CVE-2018-17957

    yast2-rmt leaks database passwords in process list

    The YaST2 RMT module for configuring the SUSE Repository Mirroring Tool (RMT) before 1.1.2 exposed MySQL database passwords on process commandline, allowing local attackers to access or corrupt the RMT database.

    SUSE yast2-rmt
  • Unscored —
    CVE-2018-20481

    XRef::getEntry in XRef.cc in Poppler 0.72.0 mishandles unallocated XRef entries, which allows remote attackers to cause…

    poppler poppler Debian Ubuntu
  • Unscored —
    CVE-2018-20479

    An issue was discovered in S-CMS 1.0. It allows SQL Injection via the wap_index.php?type=newsinfo S_id parameter.

  • Unscored —
    CVE-2018-20477

    An issue was discovered in S-CMS 3.0. It allows SQL Injection via the bank/callback1.php P_no field.

  • Unscored —
    CVE-2018-20480

    An issue was discovered in S-CMS 1.0. It allows SQL Injection via the js/pic.php P_id parameter.

  • Unscored —
    CVE-2018-20467

    In coders/bmp.c in ImageMagick before 7.0.8-16, an input file can result in an infinite loop and hang, with high CPU an…

    imagemagick imagemagick imagemagick6 Debian Ubuntu Alpine
  • Unscored —
    CVE-2018-20478

    An issue was discovered in S-CMS 1.0. It allows reading certain files, such as PHP source code, via the admin/download.…

  • Unscored —
    CVE-2018-20476

    An issue was discovered in S-CMS 3.0. It allows XSS via the admin/demo.php T_id parameter.