Archive

December 2018

Vulnerabilities first published in this month (UTC), newest first.

← November 2018 2018 / December January 2019 →

All Critical High Medium Low Exploited only Public exploit

1,165 results · Feed

Medium 6.1

CVE-2018-1000855

Cross Site Scripting (XSS) vulnerability in easymon

easymon version 1.4 and earlier contains a Cross Site Scripting (XSS) vulnerability in Endpoint where monitoring is mounted that can result in Reflected XSS that affects Firefox. Can be used to steal cookies, depending on the cookie settings.. This attack app…

easymon RubyGems

Dec 20, 2018
Unscored —

CVE-2018-1000860

phpipam version 1.3.2 and earlier contains a Cross Site Scripting (XSS) vulnerability in The value of the phpipamredire…

Dec 20, 2018
Unscored —

CVE-2018-1000857

log-user-session version 0.7 and earlier contains a Directory Traversal vulnerability in Main SUID-binary /usr/local/bi…

Dec 20, 2018
Unscored —

CVE-2018-1000856 Scanner template

DomainMOD version 4.09.03 and above. Also verified in the latest version 4.11.01 contains a Cross Site Scripting (XSS) …

Dec 20, 2018
Critical 9.8

CVE-2018-1000854

Remote Code Execution in esigate-core

esigate.org esigate version 5.2 and earlier contains a CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') vulnerability in ESI directive with user specified XSLT that can result in Remote Code Execution.…

org.esigate:esigate-core Maven

Dec 20, 2018
Unscored —

CVE-2018-1000846

FreshDNS version 1.0.3 and earlier contains a Cross ite Request Forgery (CSRF) vulnerability in All (authenticated) API…

Dec 20, 2018
Unscored —

CVE-2018-1000847

FreshDNS version 1.0.3 and prior contains a Cross Site Scripting (XSS) vulnerability in Account data form; Zone editor …

Dec 20, 2018
Unscored —

CVE-2018-1000811 Public exploit EPSS 48%

bludit version 3.0.0 contains a Unrestricted Upload of File with Dangerous Type vulnerability in Content Upload in Page…

Dec 20, 2018
Critical 10.0

CVE-2018-1000822

XML External Entity (XXE) vulnerability in codelibs fess

codelibs fess version before commit faa265b contains a XML External Entity (XXE) vulnerability in GSA XML file parser that can result in Disclosure of confidential data, denial of service, SSRF, port scanning. This attack appear to be exploitable via speciall…

org.codelibs.fess:fess Maven

Dec 20, 2018
Critical 9.0

CVE-2018-1000836

XML External Entity (XXE) vulnerability in bw-calendar-engine

bw-calendar-engine version <= bw-calendar-engine-3.12.0 contains a XML External Entity (XXE) vulnerability in IscheduleClient XML Parser that can result in Disclosure of confidential data, denial of service, SSRF, port scanning. This attack appear to be explo…

org.bedework.caleng:bw-calendar-engine Maven

Dec 20, 2018
Medium 6.1

CVE-2018-1000826

Microweber XSS Vulnerability

Microweber version <= 1.0.7 contains a Cross Site Scripting (XSS) vulnerability in Admin login form template that can result in Execution of JavaScript code.

microweber/microweber Packagist

Dec 20, 2018
Unscored —

CVE-2018-1000812

Artica Integria IMS version 5.0 MR56 Package 58, likely earlier versions contains a CWE-640: Weak Password Recovery Mec…

Dec 20, 2018
Unscored —

CVE-2018-1000813

Backdrop CMS version 1.11.0 and earlier contains a Cross Site Scripting (XSS) vulnerability in Sanitization of custom c…

Dec 20, 2018
High 7.5

CVE-2018-1000850 Public exploit

Directory Traversal vulnerability in Square Retrofit

Square Retrofit version versions from (including) 2.0 and 2.5.0 (excluding) contains a Directory Traversal vulnerability in RequestBuilder class, method addPathParameter that can result in By manipulating the URL an attacker could add or delete resources othe…

com.squareup.retrofit2:retrofit Maven

Dec 20, 2018
Unscored —

CVE-2018-1000840

Processing Foundation Processing version 3.4 and earlier contains a XML External Entity (XXE) vulnerability in loadXML(…

processing-core Ubuntu

Dec 20, 2018
Unscored —

CVE-2018-1000848

Wampserver version prior to version 3.1.5 contains a Cross Site Scripting (XSS) vulnerability in index.php localhost pa…

Dec 20, 2018
Unscored —

CVE-2018-1000830

XR3Player version <= V3.124 contains a XML External Entity (XXE) vulnerability in Playlist parser that can result in Di…

Dec 20, 2018
Unscored —

CVE-2018-1000849

Alpine Linux version Versions prior to 2.6.10, 2.7.6, and 2.10.1 contains a Other/Unknown vulnerability in apk-tools (A…

Dec 20, 2018
Medium 6.5

CVE-2018-1000814

aiohttp-session creates non-expiring sessions

aio-libs aiohttp-session version 2.6.0 and earlier contains a Other/Unknown vulnerability in EncryptedCookieStorage and NaClCookieStorage that can result in Non-expiring sessions / Infinite lifespan. This attack appear to be exploitable via Recreation of a co…

aiohttp-session PyPI

Dec 20, 2018
High 8.8

CVE-2018-1000843

Cross-Site Request Forgery (CSRF) in Luigi

Luigi version prior to version 2.8.0; after commit 53b52e12745075a8acc016d33945d9d6a7a6aaeb; after GitHub PR spotify/luigi/pull/1870 contains a Cross ite Request Forgery (CSRF) vulnerability in API endpoint: /api/<method> that can result in Task metadata such…

luigi PyPI

Dec 20, 2018
Unscored —

CVE-2018-1000834

runelite version <= runelite-parent-1.4.23 contains a XML External Entity (XXE) vulnerability in Man in the middle runs…

Dec 20, 2018
Unscored —

CVE-2018-1000851

Copay Bitcoin Wallet version 5.01 to 5.1.0 included. contains a Other/Unknown vulnerability in wallet private key stora…

Dec 20, 2018
Unscored —

CVE-2018-1000824

MegaMek version < v0.45.1 contains a Other/Unknown vulnerability in Object Stream Connection that can result in Disclos…

Dec 20, 2018
High 7.5

CVE-2018-1000817

Asset Pipeline Grails Plugin vulnerable to Path Traversal

Asset Pipeline Grails Plugin Asset-pipeline plugin version Prior to 2.14.1.1, 2.15.1 and 3.0.6 contains a Incorrect Access Control vulnerability in Applications deployed in Jetty that can result in Download .class files and any arbitrary file. This attack app…

org.grails.plugins:asset-pipeline Maven

Dec 20, 2018
Unscored —

CVE-2018-1000841

Zend.To version Prior to 5.15-1 contains a Cross Site Scripting (XSS) vulnerability in The verify.php page that can res…

Dec 20, 2018
Critical 10.0

CVE-2018-1000823

exist-db:exist-core XML External Entity (XXE) vulnerability

exist version <= 5.0.0-RC4 contains a XML External Entity (XXE) vulnerability in XML Parser for REST Server that can result in Disclosure of confidential data, denial of service, SSRF, port scanning.

org.exist-db:exist-core Maven

Dec 20, 2018
Medium 5.4

CVE-2018-1000816

Grafana XSS Vulnerability

Grafana version confirmed for 5.2.4 and 5.3.0 contains a Cross Site Scripting (XSS) vulnerability in Influxdb and Graphite query editor that can result in Running arbitrary js code in victims browser.. This attack appear to be exploitable via Authenticated us…

grafana github.com/grafana/grafana Ubuntu Go

Dec 20, 2018
Unscored —

CVE-2018-1000829

Anyplace version before commit 80359b4 contains a XML External Entity (XXE) vulnerability in Man in the middle on map A…

Dec 20, 2018
Unscored —

CVE-2018-1000837

UML Designer version <= 8.0.0 contains a XML External Entity (XXE) vulnerability in XML parser for plugins that can res…

Dec 20, 2018
Unscored —

CVE-2018-1000827

Ubilling version <= 0.9.2 contains a Other/Unknown vulnerability in user-controlled parameter that can result in Disclo…

Dec 20, 2018
Unscored —

CVE-2018-1000852

FreeRDP FreeRDP 2.0.0-rc3 released version before commit 205c612820dac644d665b5bb1cdf437dc5ca01e3 contains a Other/Unkn…

freerdp2 freerdp2 Debian Ubuntu

Dec 20, 2018
Unscored —

CVE-2018-1000828

FrostWire version <= frostwire-desktop-6.7.4-build-272 contains a XML External Entity (XXE) vulnerability in Man in the…

Dec 20, 2018
Critical 10.0

CVE-2018-1000820

XML External Entity (XXE) vulnerability in neo4j.procedure:apoc

neo4j-contrib neo4j-apoc-procedures version before commit 45bc09c contains a XML External Entity (XXE) vulnerability in XML Parser that can result in Disclosure of confidential data, denial of service, SSRF, port scanning. This vulnerability appears to have b…

org.neo4j.procedure:apoc Maven

Dec 20, 2018
Unscored —

CVE-2018-1000835

KeePassDX version <= 2.5.0.0beta17 contains a XML External Entity (XXE) vulnerability in kdbx file parser that can resu…

Dec 20, 2018
Unscored —

CVE-2018-1000833

ZoneMinder version <= 1.32.2 contains a Other/Unknown vulnerability in User-controlled parameter that can result in Dis…

zoneminder zoneminder Debian Ubuntu

Dec 20, 2018
Unscored —

CVE-2018-1000821

MicroMathematics version before commit 5c05ac8 contains a XML External Entity (XXE) vulnerability in SMathStudio files …

Dec 20, 2018
Unscored —

CVE-2018-1000839

LH-EHR version REL-2_0_0 contains a Arbitrary File Upload vulnerability in Profile picture upload that can result in Re…

Dec 20, 2018
Unscored —

CVE-2018-1000831

K9Mail version <= v5.600 contains a XML External Entity (XXE) vulnerability in WebDAV response parser that can result i…

Dec 20, 2018
Critical 9.1

CVE-2018-1000844 Public exploit

XML External Entity (XXE) vulnerability in Square Retrofit

Square Open Source Retrofit version Prior to commit 4a693c5aeeef2be6c7ecf80e7b5ec79f6ab59437 contains a XML External Entity (XXE) vulnerability in JAXB that can result in An attacker could use this to remotely read files from the file system or to perform SSR…

com.squareup.retrofit2:retrofit Maven

Dec 20, 2018
Unscored —

CVE-2018-1000815

Brave Software Inc. Brave version version 0.22.810 to 0.24.0 contains a Other/Unknown vulnerability in function Content…

Dec 20, 2018