CVEs published in December 2018
1,178 vulnerabilities, 184 critical, 11 exploited.
- statamicStatamic 2.10.3 allows XSS via First Name or Last Name to the /users URI in an 'Add new user'...4.8 Medium
- cmsmadesimple cms made simpleCMS Made Simple 2.2.8 allows XSS via an uploaded SVG document, a related issue to CVE-2017-16798.4.8 Medium
- zurmoZurmo 3.2.4 allows HTML Injection via an admin's use of HTML in the report section, a related...4.8 Medium
- cmsimpleCMSimple 4.7.5 has XSS via an admin's upload of an SVG file at a ?userfiles&subdir=userfiles...4.8 Medium
- cmsimpleCMSimple 4.7.5 has XSS via an admin's use of a ?file=config&action=array URI.4.8 Medium
- zurmoZurmo 3.2.4 has XSS via an admin's use of the name parameter in the reports section, aka the app...4.8 Medium
- advantech webaccess/scada, webaccess\/scada +1 moreWebAccess/SCADA, WebAccess/SCADA Version 8.3.2 installed on Windows 2008 R2 SP1. Lack of proper...7.3 High
drupal/jsonapiPackagistThis module provides a JSON:API specification-compliant HTTP API for accessing and manipulating Drupal content and configuration entities. The module doesn't sufficiently check access when responding…No score- s3browser s3 browserS3 Browser before 8.1.5 contains an XML external entity (XXE) vulnerability, allowing remote...6.5 Medium
- apache nifiCleartext Transmission of Sensitive Information in Apache nifi7.5 High
- apache nifiApache NiFi Improper Input Validation vulnerability7.5 High
- apache nifiCross site scripting in org.apache.nifi:nifi6.1 Medium
- apache nifiImproper Restriction of Rendered UI Layers or Frames in Apache nifif6.5 Medium
- [unknown] sssdsssd versions from 1.13.0 to before 2.0.0 did not properly restrict access to the infopipe...2.5 Low
- simbahosting two-factor-authenticationCross Site Request Forgery (CSRF) in the two-factor-authentication plugin before 1.3.13 for...8.8 High
- gnu psppAn issue was discovered in PSPP 1.2.0. There is a heap-based buffer overflow at the function...7.8 High
- subsonicSubsonic V6.1.5 allows internetRadioSettings.view streamUrl CSRF, with resultant SSRF.8.0 High
- eclipse rdf4jRDF4J vulnerable to zip slip7.5 High
crashSUSESecurity update for crashNo score- kaspersky libvnc, canonical ubuntu linux, debian linux +1 more +3 moreLibVNC before commit ca2a5ac02fbbadd0a21fabba779c1ea69173d10b contains heap use-after-free...8.1 High
- kaspersky libvnc, canonical ubuntu linux, debian linux +1 more +3 moreLibVNC before commit 4a21bbd097ef7c44bb000c3bd0907f96a10e4ce7 contains null pointer dereference...7.5 High
- kaspersky libvnc, canonical ubuntu linux, debian linux +1 more +3 moreLibVNC before 8b06f835e259652b0ff026898014fc7297ade858 contains CWE-665: Improper Initialization...7.5 High
- kaspersky libvnc, canonical ubuntu linux, debian linux +1 more +3 moreLibVNC before 2f5b2ad1c6c99b1ac6482c95844a84d66bb52838 contains multiple weaknesses CWE-665:...7.5 High
- kaspersky libvnc, canonical ubuntu linux, debian linux +1 more +3 moreLibVNC before commit c3115350eb8bb635d0fdb4dbbb0d0541f38ed19c contains a CWE-835: Infinite loop...7.5 High
- kaspersky libvnc, canonical ubuntu linux, debian linux +1 more +3 moreLibVNC before commit 7b1ef0ffc4815cab9a96c7278394152bdc89dc4d contains heap out-of-bound write...9.8 Critical
- kaspersky libvnc, canonical ubuntu linux, debian linux +7 more +9 moreLibVNC before commit a83439b9fbe0f03c48eb94ed05729cb016f8b72f contains multiple heap out-of-bound...9.8 Critical
- kaspersky libvnc, canonical ubuntu linux, debian linux +7 more +9 moreLibVNC before commit 502821828ed00b4a2c4bef90683d0fd88ce495de contains heap out-of-bound write...9.8 Critical
- kaspersky libvnc, canonical ubuntu linux, debian linux +1 more +3 moreLibVNC before commit 73cb96fec028a576a5a24417b57723b55854ad7b contains heap use-after-free...9.8 Critical
- artica integria imsArtica Integria IMS 5.0.83 has CSRF in godmode/usuarios/lista_usuarios, resulting in the ability...6.5 Medium
- sensiolabs symfony, debian linux, fedoraproject fedora +2 moreSymfony Open Redirect6.1 Medium
- sensiolabs symfony, debian linux +1 moreSymfony Path Disclosure5.3 Medium
- phpservermonitor php server monitorCSRF in PHP Server Monitor before 3.3.26.5 Medium
- dlink dva-5592 firmwareAn issue was discovered on D-Link DVA-5592 A1_WI_20180823 devices. If the PIN of the page "/ui...9.8 Critical
- vmware vrealize operationsvRealize Operations (7.x before 7.0.0.11287810, 6.7.x before 6.7.0.11286837 and 6.6.x before 6.6...6.7 Medium
- libexcel project libexcelwbook_addworksheet in workbook.c in libexcel.a in libexcel 0.01 allows attackers to cause a...7.5 High
- driveragentDriverAgent 2.2015.7.14, which includes DrvAgent64.sys 1.0.0.1, allows a user to send an IOCTL ...5.5 Medium
- trustedfirmware trusted firmware-aIn all versions of ARM Trusted Firmware up to and including v1.4, not initializing or saving...7.5 High
- ibm event streamsIBM Event Streams 2018.3.0 could allow a remote attacker to submit an API request with a fake...5.3 Medium
- qt, canonical ubuntu linux, debian linux +2 more +4 moreAn issue was discovered in Qt before 5.11.3. QBmpHandler has a buffer overflow via BMP data.9.8 Critical
- qt, debian linux, opensuse leap +2 moreQXmlStream in Qt 5.x before 5.11.3 has a double-free or corruption during parsing of a specially...8.8 High
- webroot brightcloudAn exploitable vulnerability exists in the HTTP client functionality of the Webroot BrightCloud...8.1 High
- arrayfirePotential memory corruption in arrayfire9.8 Critical
- pur3 espruinoThere is a stack-based buffer over-read in the jsfNameFromString function of jsflash.c in...7.8 High
- audiocoding freeware advanced audio decoder 2, debian linux +1 moreA NULL pointer dereference was discovered in ifilter_bank of libfaad/filtbank.c in Freeware...5.5 Medium
- audiocoding freeware advanced audio decoder 2A NULL pointer dereference was discovered in ifilter_bank of libfaad/filtbank.c in Freeware...5.5 Medium
- audiocoding freeware advanced audio decoder 2There is a stack-based buffer underflow in the third instance of the calculate_gain function in...7.8 High
- audiocoding freeware advanced audio decoder 2, debian linux +1 moreThere is a stack-based buffer overflow in the third instance of the calculate_gain function in...7.8 High
- audiocoding freeware advanced audio decoder 2A NULL pointer dereference was discovered in ic_predict of libfaad/ic_predict.c in Freeware...5.5 Medium
- audiocoding freeware advanced audio decoder 2There is a stack-based buffer underflow in the third instance of the calculate_gain function in...7.8 High
- debian linux, linux kernel, [unknown] kernel: +3 more +5 moreA flaw was found in the Linux kernel's NFS41+ subsystem. NFS41+ shares mounted in different...6.5 Medium
- Show moreLoading…