CVEs published in December 2018
1,178 vulnerabilities, 184 critical, 11 exploited.
- libcaca project libcaca, canonical ubuntu linux, debian linux +2 more +4 moreThere is an illegal WRITE memory access at caca/file.c (function caca_file_read) in libcaca 0.99...8.8 High
- libcaca project libcaca, canonical ubuntu linux, fedoraproject fedora +1 more +3 moreThere is an illegal WRITE memory access at common-image.c (function load_image) in libcaca 0.99...8.8 High
- libcaca project libcaca, canonical ubuntu linux, debian linux +2 more +4 moreThere is an illegal READ memory access at caca/dither.c (function get_rgba_default) in libcaca 0...8.1 High
- libcaca project libcaca, canonical ubuntu linux, debian linux +2 more +4 moreThere is an illegal READ memory access at caca/dither.c (function get_rgba_default) in libcaca 0...8.1 High
- libcaca project libcaca, canonical ubuntu linux, fedoraproject fedora +1 more +3 moreThere is an illegal WRITE memory access at common-image.c (function load_image) in libcaca 0.99...8.8 High
- libcaca project libcaca, canonical ubuntu linux, debian linux +2 moreThere is floating point exception at caca/dither.c (function caca_dither_bitmap) in libcaca 0.99...6.5 Medium
- opensuse libsolv, canonical ubuntu linux +1 more** DISPUTED ** There is an illegal address access at ext/testcase.c in libsolv.a in libsolv...6.5 Medium
- opensuse libsolv, canonical ubuntu linux +1 moreThere is a NULL pointer dereference at ext/testcase.c (function testcase_str2dep_complex) in...6.5 Medium
- opensuse libsolv, canonical ubuntu linux +1 moreThere is a NULL pointer dereference at ext/testcase.c (function testcase_read) in libsolvext.a in...6.5 Medium
- website seller script project seller scriptPHP Scripts Mall Website Seller Script 2.0.5 has XSS via a Profile field such as Company Address,...5.4 Medium
- jeecmsJEECMS 9 has SSRF via the ueditor/getRemoteImage.jspx upfile parameter.6.5 Medium
- frontaccountingFrontAccounting 2.4.5 contains a Time Based Blind SQL Injection vulnerability in the parameter ...7.5 High
- logisim-evolution project logisim-evolutionLogisim Evolution version 2.14.3 and earlier contains an XML External Entity (XXE) vulnerability...8.8 High
- canonical ubuntu linux, debian linux, php pear archive tar +2 moreArchive_Tar contains Potential RCE if filename starts with phar://8.8 High
- peel shoppingPeel shopping peel-shopping_9_1_0 version contains a Cross Site Scripting (XSS) vulnerability...4.8 Medium
- urlchatbox chat anywhereThe Chat Anywhere extension 2.4.0 for Chrome allows XSS via crafted use of <<a> in a message,...6.1 Medium
- 1234n minicmsMiniCMS V1.10 has XSS via the mc-admin/post-edit.php query string, a related issue to CVE-2018...6.1 Medium
- 74cmsAn issue was discovered in 74cms v4.2.111. It allows remote authenticated users to read or modify...8.1 High
- crashfix project crashfixCrashFix 1.0.4 has SQL Injection via the User[status] parameter. This is related to actionIndex...9.8 Critical
libphp-phpmailerDebianlibphp-phpmailer - regression updateNo score- debian linux, linux kernel +1 moreAn issue was discovered in the Linux kernel before 4.18.11. The ipddp_ioctl function in drivers...5.5 Medium
monitMageiaUpdated monit packages fix security vulnerabilityNo scorethunderbirdMageia,thunderbird-l10nMageia +1 moreUpdated thunderbird packages fix security vulnerabilities & bugsNo score- axiosys bento4An issue was discovered in Bento4 1.5.1-627. There is an attempt at excessive memory allocation...6.5 Medium
- viatech epia-e900 firmwareETK_E900.sys, a SmartETK driver for VIA Technologies EPIA-E900 system board, is vulnerable to...7.5 High
- mit kerberos, debian linux +1 moreA Reachable Assertion issue was discovered in the KDC in MIT Kerberos 5 (aka krb5) before 1.17....5.3 Medium
- qt, opensuse leap +1 moreAn issue was discovered in Qt before 5.11.3. There is QTgaFile Uncontrolled Resource Consumption.6.5 Medium
- qt, opensuse leap +1 moreAn issue was discovered in Qt before 5.11.3. A malformed SVG image causes a segmentation fault in...6.5 Medium
- dolibarrDolibarr ERP and CRM contain XSS Vulnerability6.1 Medium
- rockwellautomation powermonitor 1000 firmwareAn issue was discovered in Rockwell Automation Allen-Bradley PowerMonitor 1000. An...8.1 High
- rockwellautomation powermonitor 1000 firmwareRockwell Automation Allen-Bradley PowerMonitor 1000 all versions. A remote attacker could inject...6.1 Medium
- engelsystemEngelsystem before commit hash 2e28336 allows CSRF.8.8 High
- asus aura sync firmwareThe GLCKIo low-level driver in ASUS Aura Sync v1.07.22 and earlier exposes a path to write an...5.5 Medium
- asus aura sync firmwareThe GLCKIo and Asusgio low-level drivers in ASUS Aura Sync v1.07.22 and earlier expose...7.8 High
- asus aura sync firmwareThe Asusgio low-level driver in ASUS Aura Sync v1.07.22 and earlier exposes functionality to read...7.8 High
- hashheroesThe determineWinner function of a smart contract implementation for HashHeroes Tiles, an Ethereum...7.5 High
- nec univerge sv9100 webpro firmwareNEC Univerge Sv9100 WebPro 6.00.00 devices have Cleartext Password Storage in the Web UI.9.8 Critical
- nec univerge sv9100 webpro firmwareNEC Univerge Sv9100 WebPro 6.00.00 devices have Predictable Session IDs that result in Account...9.8 Critical
- metinfoMetInfo 6.x through 6.1.3 has XSS via the /admin/login/login_check.php url_array[] parameter.6.1 Medium
- zohocorp manageengine adselfservice plusZoho ManageEngine ADSelfService Plus 5.7 before build 5702 has XSS in the employee search feature.6.1 Medium
- zohocorp manageengine adselfservice plusZoho ManageEngine ADSelfService Plus 5.7 before build 5702 has XSS in the self-update layout...6.1 Medium
- gnu tar, debian linux, opensuse leap +3 more +5 moreGNU Tar through 1.30, when --sparse is used, mishandles file shrinkage during read access, which...4.7 Medium
- qnap q'center virtual appliance, q\'center virtual appliance +1 moreCross-site scripting (XSS) vulnerability in Q'center Virtual Appliance 1.8.1014 and earlier...6.1 Medium
- qnap q'center virtual appliance, q\'center virtual appliance +1 moreCross-site scripting (XSS) vulnerability in Q'center Virtual Appliance 1.8.1014 and earlier...6.1 Medium
- s-cmsAn issue was discovered in S-CMS 1.0. It allows SQL Injection via the js/pic.php P_id parameter.9.8 Critical
- s-cmsAn issue was discovered in S-CMS 1.0. It allows SQL Injection via the wap_index.php?type=newsinfo...9.8 Critical
- s-cmsAn issue was discovered in S-CMS 1.0. It allows reading certain files, such as PHP source code,...7.5 High
- s-cmsAn issue was discovered in S-CMS 3.0. It allows SQL Injection via the bank/callback1.php P_no field.9.8 Critical
- s-cmsAn issue was discovered in S-CMS 3.0. It allows XSS via the admin/demo.php T_id parameter.6.1 Medium
- gnu wgetset_file_metadata in xattr.c in GNU Wget before 1.20.1 stores a file's origin URL in the user.xdg...7.8 High
- Show moreLoading…