CVEs published in December 2018
1,178 vulnerabilities, 184 critical, 11 exploited.
- zohocorp manageengine opmanagerZoho ManageEngine OpManager 12.3 before build 123239 allows XSS in the Notes column of the Alarms...6.1 Medium
- zohocorp manageengine opmanagerZoho ManageEngine OpManager 12.3 before build 123239 allows SQL injection in the Alarms section.9.8 Critical
- openwebif project openwebifAn issue has been discovered in the OpenWebif plugin through 1.2.4 for Enigma2 based devices....7.5 High
- libjpeg-turboThe tjLoadImage function in libjpeg-turbo 2.0.1 has an integer overflow with a resultant heap...8.8 High
- chamilo lmsChamilo LMS version 1.11.8 contains a main/inc/lib/CoursesAndSessionsCatalog.class.php SQL...8.1 High
- chamilo lmsChamilo LMS version 1.11.8 contains XSS in main/social/group_view.php in the social groups tool,...5.4 Medium
- chamilo lmsChamilo LMS version 1.11.8 contains XSS in main/template/default/admin/gradebook_list.tpl in the...5.4 Medium
- librawThere is a stack-based buffer overflow in the parse_makernote function of dcraw_common.cpp in...8.8 High
- wxjava project wxjavaAn issue was discovered in weixin-java-tools v3.2.0. There is an XXE vulnerability in the...9.8 Critical
- qemu, canonical ubuntu linux, fedoraproject fedora +2 morehw/rdma/vmw/pvrdma_main.c in QEMU does not implement a read operation (such as uar_read by...7.5 High
- qemu, canonical ubuntu linux +1 morehw/rdma/rdma_backend.c in QEMU allows guest OS users to trigger out-of-bounds access via a...5.5 Medium
- trendnet tew-632brp firmware, tew-673gru firmware +1 moreBuffer overflow in apply.cgi on TRENDnet TEW-632BRP 1.010B32 and TEW-673GRU devices allows...8.8 High
- trendnet tv-ip110wn firmware, tv-ip121wn firmware +1 moreBuffer overflow in video.cgi on TRENDnet TV-IP110WN V1.2.2 build 68, V1.2.2.65, and V1.2.2 build...7.5 High
- trendnet tv-ip110wn firmware, tv-ip121wn firmware +1 moreBuffer overflow in network.cgi on TRENDnet TV-IP110WN V1.2.2 build 68, V1.2.2.65, and V1.2.2...9.8 Critical
- trendnet tew-673gru firmwareTRENDnet TEW-673GRU v1.00b40 devices have an OS command injection vulnerability in the...7.2 High
- d-link dcs-825l firmware, dlink mydlink baby camera monitor +1 moreAn issue was discovered in D-Link 'myDlink Baby App' version 2.04.06. Whenever actions are...7.0 High
- keybaseAn issue was discovered in the Keybase command-line client before 2.8.0-20181023124437 for Linux....7.8 High
- d-link dcs-825l firmwareD-Link DCS-825L devices with firmware 1.08 do not employ a suitable mechanism to prevent denial...7.5 High
- d-link dcs-2102 firmware, dcs-2121 firmware, dcs-2630l firmware +15 more +17 moreD-Link DCS series Wi-Fi cameras expose sensitive information regarding the device configuration....7.5 High
- jco karmaSQL injection vulnerability in the "ContentPlaceHolder1_uxTitle" component in ArchiveNews.aspx in...9.8 Critical
- escanav escan anti-viruseScan Agent Application (MWAGENT.EXE) 4.0.2.98 in MicroWorld Technologies eScan 14.0 allows...9.8 Critical
- elastic elasticsearchImproper Restriction of XML External Entity Reference in Elasticsearch5.9 Medium
- elastic kibana, redhat openshift container platform +1 moreKibana versions before 6.4.3 and 5.6.13 contain an arbitrary file inclusion flaw in the Console...9.8 Critical
- elastic kibanaKibana versions 4.0 to 4.6, 5.0 to 5.6.12, and 6.0 to 6.4.2 contain an error in the way...9.8 Critical
- elastic elasticsearchExposure of Sensitive Information to an Unauthorized Actor in Elasticsearch6.5 Medium
- getkirby kirbypanel/login in Kirby v2.5.12 allows Host header injection via the "forget password" feature.6.1 Medium
- mondula multi step formThe Mondula Multi Step Form plugin before 1.2.8 for WordPress has multiple stored XSS via wp...5.4 Medium
- myadrenalin human resource management softwareA Reflected Cross Site Scripting (XSS) Vulnerability was discovered in Adrenalin 5.4 HRMS...6.1 Medium
- secure-endpoints kerberised netcatThe read_packet function in knc (Kerberised NetCat) before 1.11-1 is vulnerable to denial of...7.5 High
- suse repository mirroring tool, yast2-rmt +1 moreyast2-rmt leaks database passwords in process list3.4 Low
- qemu, canonical ubuntu linux +1 moreQEMU can have an infinite loop in hw/rdma/vmw/pvrdma_dev_ring.c because return values are not...7.5 High
- qemu, canonical ubuntu linux, opensuse leap +2 morehw/rdma/vmw/pvrdma_cmd.c in QEMU allows create_cq and create_qp memory leaks because errors are...5.5 Medium
- qemu, canonical ubuntu linux +1 morehw/rdma/vmw/pvrdma_cmd.c in QEMU allows attackers to cause a denial of service (NULL pointer...7.5 High
- horner automation cscapeCscape, Version 9.80.75.3 SP3 and prior. An improper input validation vulnerability has been...7.8 High
- gigasetpro maxwell basic firmwareMissing password verification in the web interface on Gigaset Maxwell Basic VoIP phones with...9.8 Critical
- logitech harmony hub, harmony hub firmware +1 moreThe Logitech Harmony Hub before version 4.15.206 is vulnerable to application level command...9.8 Critical
- logitech harmony hub, harmony hub firmware +1 moreThe Logitech Harmony Hub before version 4.15.206 is vulnerable to OS command injection via the...8.1 High
- logitech harmony hub, harmony hub firmware +1 moreThe XMPP server in Logitech Harmony Hub before version 4.15.206 is vulnerable to authentication...9.8 Critical
- logitech harmony hub, harmony hub firmware +1 moreLogitech Harmony Hub before version 4.15.206 contained two hard-coded accounts in the XMPP server...9.8 Critical
- blackberry uem, unified endpoint manager +1 moreA cross-site request forgery (CSRF) vulnerability in the Management Console of BlackBerry UEM...6.5 Medium
- blackberry uem, unified endpoint manager +1 moreMultiple stored cross-site scripting (XSS) vulnerabilities in the Management Console of...4.8 Medium
- blackberry uem, unified endpoint manager +1 moreA stored cross-site scripting (XSS) vulnerability in the Management Console of BlackBerry UEM...4.8 Medium
- f5 big-ip application acceleration manager, f5 networks, inc. big-ip (aam) +1 moreOn BIG-IP AAM 13.0.0 or 12.1.0-12.1.3.7, the dcdb_convert utility used by BIG-IP AAM fails to...7.8 High
- f5 big-ip (ltm, aam, afm, analytics, apm, asm, dns, edge gateway, fps, gtm, link controller, pem, webaccelerator), big-ip access policy manager, big-ip advanced firewall manager +11 more +13 moreOn BIG-IP 14.0.0-14.0.0.2, 13.0.0-13.1.1.1, or 12.1.0-12.1.3.7, when a virtual server using the...7.5 High
- f5 enterprise manager, big-ip access policy manager, big-ip advanced firewall manager +12 more +14 moreOn BIG-IP 14.0.0-14.0.0.2, 13.0.0-13.1.1.1, or 12.1.0-12.1.3.7, or Enterprise Manager 3.1.1, when...7.2 High
- nasm netwide assemblernasm version 2.14.01rc5, 2.15 contains a Buffer Overflow vulnerability in asm/stdscan.c:130 that...5.5 Medium
- phkp project phkpPHKP version including commit 88fd9cfdf14ea4b6ac3e3967feea7bcaabb6f03b contains a Improper...9.8 Critical
- vestacp vesta control panelVesta CP version Prior to commit f6f6f9cfbbf2979e301956d1c6ab5c44386822c0 -- any release prior to...9.8 Critical
- plug project plugHeader Injection6.5 Medium
- comparex miss marpleThe Miss Marple Updater Service in COMPAREX Miss Marple Enterprise Edition before 2.0 allows...8.8 High
- Show moreLoading…