CVEs published in December 2018
1,178 vulnerabilities, 184 critical, 11 exploited.
- qt, debian linux, opensuse leap +2 moreAn issue was discovered in Qt before 5.11.3. A malformed GIF image causes a NULL pointer...8.8 High
- craftcms craft cmsCraft CMS Vulnerable to Server-Side Template Injection7.2 High
- cmsmadesimple cms made simpleThere is a reflected XSS vulnerability in the CMS Made Simple 2.2.8 admin/myaccount.php. This...6.1 Medium
- jsmol2wp project jsmol2wpAn issue was discovered in the JSmol2WP plugin 1.07 for WordPress. There is an arbitrary file...7.5 High
- jsmol2wp project jsmol2wpAn issue was discovered in the JSmol2WP plugin 1.07 for WordPress. A cross-site scripting (XSS)...6.1 Medium
- radare radare2In radare2 prior to 3.1.1, core_anal_bytes in libr/core/cmd_anal.c allows attackers to cause a...5.5 Medium
- radare radare2In radare2 prior to 3.1.2, the parseOperands function in libr/asm/arch/arm/armass64.c allows...5.5 Medium
- radare radare2In radare2 through 3.1.3, the armass_assemble function in libr/asm/arch/arm/armass.c allows...5.5 Medium
- radare radare2In radare2 prior to 3.1.1, r_bin_dyldcache_extract in libr/bin/format/mach0/dyldcache.c may allow...5.5 Medium
- radare radare2In radare2 through 3.1.3, the assemble function inside libr/asm/p/asm_arm_cs.c allows attackers...5.5 Medium
- radare radare2In radare2 prior to 3.1.1, the parseOperand function inside libr/asm/p/asm_x86_nz.c may allow...5.5 Medium
- radare radare2In radare2 prior to 3.1.1, the parseOperand function inside libr/asm/p/asm_x86_nz.c may allow...5.5 Medium
- 74cmsAn issue was discovered in 74cms v4.2.111. upload/index.php?c=resume&a=resume_list has XSS via...6.1 Medium
- libdoc project libdocThe getlong function in numutils.c in libdoc through 2017-10-23 has a heap-based buffer over-read...6.5 Medium
- libxls project libxlsThe read_MSAT_body function in ole.c in libxls 1.4.0 has an invalid free that allows attackers to...8.8 High
- libdoc project libdocThe process_file function in reader.c in libdoc through 2017-10-23 has a heap-based buffer over...6.5 Medium
- libxls project libxlsThe read_MSAT function in ole.c in libxls 1.4.0 has a double free that allows attackers to cause...6.5 Medium
- frog cms project cmsFrog CMS 0.9.5 has XSS via the Database name field to the /install/index.php URI.5.4 Medium
- dlink dcm-604 firmware, dcm-704 firmware +1 moreD-Link DCM-604 DCM604_C1_ViaCabo_1.04_20130606 and DCM-704 EU_DCM-704_1.10 devices allow remote...9.8 Critical
- technicolor cga0111 firmwareTechnicolor CGA0111 CGA0111E-ES-13-E23E-c8000r5712-170217-0829-TRU devices allow remote attackers...9.8 Critical
- technicolor tc7200.d1i firmwareTechnicolor TC7200.d1I TC7200.d1IE-N23E-c7000r5712-170406-HAT devices allow remote attackers to...9.8 Critical
- technicolor tc7110.b firmwareTechnicolor TC7110.B STC8.62.02 devices allow remote attackers to discover Wi-Fi credentials via...9.8 Critical
- technicolor tc7200.th2v2 firmwareTechnicolor TC7200.TH2v2 SC05.00.22 devices allow remote attackers to discover Wi-Fi credentials...9.8 Critical
- technicolor cwa0101 firmwareTechnicolor CWA0101 CWA0101E-A23E-c7000r5712-170315-SKC devices allow remote attackers to...9.8 Critical
- technicolor dpc3928sl firmwareTechnicolor DPC3928SL D3928SL-PSIP-13-A010-c3420r55105-170214a devices allow remote attackers to...9.8 Critical
- technicolor tc7110.ar firmwareTechnicolor TC7110.AR STD3.38.03 devices allow remote attackers to discover Wi-Fi credentials via...9.8 Critical
- mrbird febs-shiro** DISPUTED ** An issue was discovered in the fileDownload function in the CommonController class...7.5 High
- libvnc project libvncserver, canonical ubuntu linux, debian linux +7 more +9 moreAn issue was discovered in LibVNCServer before 0.9.13. There is a memory leak in the libvncclient...7.5 High
- freedesktop poppler, canonical ubuntu linux, debian linux +2 moreXRef::getEntry in XRef.cc in Poppler 0.72.0 mishandles unallocated XRef entries, which allows...6.5 Medium
- imagemagick, canonical ubuntu linux, debian linux +1 more +3 moreIn coders/bmp.c in ImageMagick before 7.0.8-16, an input file can result in an infinite loop and...6.5 Medium
- telegram, telegram web +1 more** DISPUTED ** The "secret chat" feature in Telegram 4.9.1 for Android has a "side channel" in...8.1 High
- foxitsoftware quick pdf libraryIn Foxit Quick PDF Library (all versions prior to 16.12), issue where loading a malformed or...8.8 High
- foxitsoftware quick pdf libraryIn Foxit Quick PDF Library (all versions prior to 16.12), issue where loading a malformed or...9.8 Critical
- foxitsoftware quick pdf libraryIn Foxit Quick PDF Library (all versions prior to 16.12), issue where loading a malformed or...7.8 High
- epson workforce wf-2861 firmwareThe web service on Epson WorkForce WF-2861 10.48 LQ22I3(Recovery-mode), WF-2861 10.51.LQ20I6, and...9.1 Critical
- epson workforce wf-2861 firmwareThe web service on Epson WorkForce WF-2861 10.48 LQ22I3(Recovery-mode), WF-2861 10.51.LQ20I6, and...7.5 High
- epson workforce wf-2861 firmwareAn issue was discovered on Epson WorkForce WF-2861 10.48 LQ22I3, 10.51.LQ20I6 and 10.52.LQ17IA...5.9 Medium
- epson workforce wf-2861 firmwareAn issue was discovered on Epson WorkForce WF-2861 10.48 LQ22I3, 10.51.LQ20I6 and 10.52.LQ17IA...7.5 High
- mi xiaomi mi-a1 firmwareAn issue was discovered on Xiaomi Mi A1 tissot_sprout:8.1.0/OPM1.171019.026/V9.6.4.0.ODHMIFE...9.8 Critical
- schneider electric se iiot monitor 3.1.38, schneider-electric iiot monior +1 moreAn Improper Restriction of XML External Entity Reference ('XXE') vulnerability exists on numerous...7.5 High
- schneider electric se iiot monitor 3.1.38, schneider-electric iiot monitor +1 moreAn unrestricted Upload of File with Dangerous Type vulnerability exists on numerous methods of...9.8 Critical
- schneider electric se iiot monitor 3.1.38, schneider-electric iiot monior +1 moreAn Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability...7.5 High
- schneider electric se pro-face gp-pro ex v4.08 and previous versions, schneider-electric pro-face gp-pro ex +1 moreAn Improper Input Validation vulnerability exists in Pro-Face GP-Pro EX v4.08 and previous...8.8 High
- schneider electric se evlink parking v3.2.0-12 v1 and earlier, schneider-electric evlink parking firmware +1 moreA SQL Injection vulnerability exists in EVLink Parking, v3.2.0-12_v1 and earlier, which could...8.8 High
- schneider electric se evlink parking v3.2.0-12 v1 and earlier, schneider-electric evlink parking firmware +1 moreA Code Injection vulnerability exists in EVLink Parking, v3.2.0-12_v1 and earlier, which could...8.8 High
- schneider electric se evlink parking v3.2.0-12 v1 and earlier, schneider-electric evlink parking firmware +1 moreA Hard-coded Credentials vulnerability exists in EVLink Parking, v3.2.0-12_v1 and earlier, which...9.8 Critical
- schneider electric se powersuite 2, all released versions (vw3a8104 & patches), schneider-electric powersuite 2 +1 moreA Buffer Error vulnerability exists in PowerSuite 2, all released versions (VW3A8104 & Patches),...6.3 Medium
- schneider electric se foxview hmi scada (all foxboro dcs, foxboro evo, and ia series versions prior to foxboro dcs control core services 9.4 (ccs 9.4) and foxview 10.5.), schneider-electric foxboro dcs, foxboro evo +2 more +4 moreA Credential Management vulnerability exists in FoxView HMI SCADA (All Foxboro DCS, Foxboro Evo,...8.7 High
- synology diskstation manager (dsm), diskstation manager +1 moreImproper neutralization of escape vulnerability in Log Exporter in Synology DiskStation Manager ...5.9 Medium
- synology diskstation manager (dsm), diskstation manager +1 moreInformation exposure vulnerability in SYNO.Core.Desktop.SessionData in Synology DiskStation...8.3 High
- Show moreLoading…