CVEs published in December 2018
1,178 vulnerabilities, 184 critical, 11 exploited.
- facebook nuclide Nuclide Improper Input Validation 9.8 Critical
- facebook buck Buck parser-cache command loads/saves state using Java serialized object. If the state... 9.8 Critical
- facebook proxygen An issue in the Proxygen handling of HTTP2 parsing of headers/trailers can lead to a denial-of... 7.5 High
- facebook proxygen A potential denial-of-service issue in the Proxygen handling of invalid HTTP2 priority settings ... 7.5 High
- facebook whatsapp for android, whatsapp for ios, whatsapp for windows phone +1 more +3 more A heap corruption in WhatsApp can be caused by a malformed RTP packet being sent after a call is... 7.5 High
- facebook proxygen Proxygen fails to validate that a secondary auth manager is set before dereferencing it. That can... 7.5 High
- facebook react-dev-utils react-dev-utils on Windows vulnerable to Remote Code Execution 9.8 Critical
- facebook react, react-dom +1 more Cross-Site Scripting in react-dom 6.1 Medium
- facebook hhvm The Memcache::getextendedstats function can be used to trigger an out-of-bounds read. Exploiting... 8.1 High
- facebook folly, hhvm +1 more folly::secureRandom will re-use a buffer between parent and child processes when fork() is called... 7.5 High
- facebook osquery An issue was discovered in osquery. A maliciously crafted Universal/fat binary can evade third... 7.8 High
- facebook hhvm A Malformed h2 frame can cause 'std::out_of_range' exception when parsing priority meta data.... 7.5 High
- facebook hhvm Multipart-file uploads call variables to be improperly registered in the global scope. In cases... 9.8 Critical
- gnu binutils In GNU Binutils 2.31.1, there is a use-after-free in the error function in elfcomm.c when called... 5.5 Medium
- jasper project jasper, debian linux +1 more JasPer 2.0.14 has a memory leak in base/jas_malloc.c in libjasper.a when "--output-format jp2" is... 6.5 Medium
- mcafee application and change control, application change control +1 more Bypass Application Control with simple DLL 6.1 Medium
- videolan vlc for mobile A local, authenticated attacker can bypass the passcode in the VideoLAN VLC media player app... 6.6 Medium
- guardzilla 180 indoor firmware, 180 outdoor firmware, 360 indoor firmware +3 more +5 more The Cloud API on Guardzilla smart cameras allows user enumeration, with resultant arbitrary... 9.8 Critical
- guardzilla gz621w firmware The TK_set_deviceModel_req_handle function in the cloud communication component in Guardzilla... 8.1 High
- guardzilla 180 indoor firmware, 180 outdoor firmware +1 more The remote upgrade feature in Guardzilla GZ180 devices allow command injection via a crafted new... 8.1 High
- ok-file-formats project ok-file-formats ok-file-formats through 2018-10-16 has a heap-based buffer over-read in the ok_mo_decode2... 8.8 High
- cuppacms CuppaCMS has XSS via an SVG document uploaded to the administrator/#/component/table_manager/view... 5.4 Medium
- razorcms Stored XSS exists in razorCMS 3.4.8 via the /#/page description parameter. 5.4 Medium
- razorcms HTML injection exists in razorCMS 3.4.8 via the /#/page keywords parameter. 5.4 Medium
- xsltcms.org project xsltcms.org Persistent XSS exists in XSLT CMS via the create/?action=items.edit&type=Page "body" field. 6.1 Medium
- xsltcms.org project xsltcms.org Persistent XSS exists in XSLT CMS via the create/?action=items.edit&type=Page title field. 6.1 Medium
- no-cms project no-cms No-CMS 1.1.3 is prone to Persistent XSS via the blog/manage_article "keyword" parameter. 4.8 Medium
- no-cms project no-cms No-CMS 1.1.3 is prone to Persistent XSS via the blog/manage_article/index/ "article_title"... 4.8 Medium
- get-simple getsimple cms There is Stored XSS in GetSimple CMS 3.3.12 via the admin/edit.php "post-menu" parameter, a... 5.4 Medium
- frogcms project frogcms FROG CMS 0.9.5 has XSS via the admin/?/snippet/add name parameter, which is mishandled during an... 4.8 Medium
- micro focus ucmdb configuration management service, hp ucmdb configuration manager +1 more MFSBGN03838 rev.1 - UCMDB Configuration Management Service, Multiple Vulnerabilities 6.5 Medium
- ok-file-formats project ok-file-formats ok-file-formats through 2018-10-16 has a heap-based buffer overflow in the ok_csv_decode2... 8.8 High
- apache netbeans Apache NetBeans (incubating) 9.0 NetBeans Proxy Auto-Configuration (PAC) interpretation is... 9.8 Critical
- ok-file-formats project ok-file-formats ok-file-formats through 2018-10-16 has a heap-based buffer overflow in the... 8.8 High
- google libwebp, redhat enterprise linux +1 more A flaw was found in libwebp in versions before 1.0.1. An unitialized variable is used in function... 9.8 Critical
- google libwebp, redhat enterprise linux +1 more A flaw was found in libwebp in versions before 1.0.1. An out-of-bounds read was found in function... 9.1 Critical
- google libwebp, redhat enterprise linux +1 more A flaw was found in libwebp in versions before 1.0.1. An out-of-bounds read was found in function... 9.1 Critical
- google libwebp, redhat enterprise linux +1 more A flaw was found in libwebp in versions before 1.0.1. A heap-based buffer overflow was found in... 9.8 Critical
- google libwebp, redhat enterprise linux +1 more A flaw was found in libwebp in versions before 1.0.1. An out-of-bounds read was found in function... 9.1 Critical
- google libwebp, redhat enterprise linux +1 more A flaw was found in libwebp in versions before 1.0.1. An out-of-bounds read was found in function... 9.1 Critical
- qemu In QEMU 3.1.0, load_device_tree in device_tree.c calls the deprecated load_image function, which... 9.8 Critical
- haproxy, canonical ubuntu linux, opensuse leap +2 more +4 more An out-of-bounds read issue was discovered in the HTTP/2 protocol decoder in HAProxy 1.8.x and 1... 7.5 High
- mozilla firefox Cross-origin images can be read from a canvas element in violation of the same-origin policy... 4.3 Medium
- mozilla thunderbird A flaw during verification of certain S/MIME signatures causes emails to be shown in Thunderbird... 5.3 Medium
- mozilla network security services, nss, siemens ruggedcom rox mx5000 firmware +7 more +9 more In Network Security Services (NSS) before 3.36.7 and before 3.41.1, a malformed signature can... 6.5 Medium
- apache openoffice, canonical ubuntu linux +1 more When loading a document with Apache Open Office 4.1.5 and earlier with smaller end line... 7.8 High
-
kojiMageia Updated koji packages fix security vulnerability No score - cim project cim public\install\install.php in CIM 0.9.3 allows remote attackers to reload the product via the... 7.5 High
- temmoku project temmoku TEMMOKU T1.09 Beta allows admin/user/add CSRF. 8.8 High
- asthis universal website asthis UWA 2.3.11 allows index.php?g=admin&c=admin&a=add_admin_do CSRF. 8.8 High
- Show olderLoading…