# CVEs published 2018-04-09

14 CVEs were published on April 9, 2018: 0 critical, 0 high. Days are UTC.

- [CVE-2018-5463](https://cve.now/CVE-2018-5463.md): A structured exception handler overflow vulnerability in Leao Consultoria e Desenvolvimento de Sistemas (LCDS) LTDA ME LAquis SCADA… (no CVSS, ICS-CERT LCDS - Leão Consultoria e Desenvolvimen…)
- [CVE-2017-2826](https://cve.now/CVE-2017-2826.md): An information disclosure vulnerability exists in the iConfig proxy request of Zabbix server 2.4.X. (no CVSS, Talos Zabbix)
- [CVE-2018-1217](https://cve.now/CVE-2018-1217.md): Avamar Installation Manager in Dell EMC Avamar Server 7.3.1, 7.4.1, and 7.5.0, and Dell EMC Integrated Data Protection Appliance 2.0 and… (no CVSS, Dell EMC Avamar, Integrated Data Protection Appliance)
- [CVE-2018-6182](https://cve.now/CVE-2018-6182.md): Mahara 16.10 before 16.10.9 and 17.04 before 17.04.7 and 17.10 before 17.10.4 are vulnerable to bad input when TinyMCE is bypassed by POST… (no CVSS)
- [CVE-2018-9864](https://cve.now/CVE-2018-9864.md): The WP Live Chat Support plugin before 8.0.06 for WordPress has stored XSS via the Name field. (no CVSS)
- [CVE-2018-9862](https://cve.now/CVE-2018-9862.md): util.c in runV 1.0.0 for Docker mishandles a numeric username, which allows attackers to obtain root access by leveraging the presence of… (no CVSS)
- [CVE-2018-0545](https://cve.now/CVE-2018-0545.md): LXR version 1.0.0 to 2.3.0 allows remote attackers to execute arbitrary OS commands via unspecified vectors. (no CVSS, LXR Project LXR)
- [CVE-2018-0553](https://cve.now/CVE-2018-0553.md): The iRemoconWiFi App for Android version 4.1.7 and earlier does not verify X.509 certificates from SSL servers, which allows… (no CVSS, Glamo iRemoconWiFi App for Android)
- [CVE-2018-0554](https://cve.now/CVE-2018-0554.md): Buffalo WZR-1750DHP2 Ver.2.30 and earlier allows an attacker to bypass authentication and execute arbitrary commands on the device via… (no CVSS, BUFFALO WZR-1750DHP2)
- [CVE-2018-0555](https://cve.now/CVE-2018-0555.md): Buffer overflow in Buffalo WZR-1750DHP2 Ver.2.30 and earlier allows an attacker to execute arbitrary code via a specially crafted file. (no CVSS, BUFFALO WZR-1750DHP2)
- [CVE-2018-0556](https://cve.now/CVE-2018-0556.md): Buffalo WZR-1750DHP2 Ver.2.30 and earlier allows an attacker to execute arbitrary OS commands via unspecified vectors. (no CVSS, BUFFALO WZR-1750DHP2)
- [CVE-2018-1308](https://cve.now/CVE-2018-1308.md): This vulnerability in Apache Solr 1.2 to 6.6.2 and 7.0.0 to 7.2.1 relates to an XML external entity expansion (XXE) in the… (no CVSS, Apache Software Foundation Apache Solr · org.apache.solr:so…)
- [CVE-2018-9856](https://cve.now/CVE-2018-9856.md): Kotti before 1.3.2 and 2.x before 2.0.0b2 has CSRF in the local roles implementation, as demonstrated by triggering a permission change… (no CVSS, kotti)
- [CVE-2018-9857](https://cve.now/CVE-2018-9857.md): PHP Scripts Mall Match Clone Script 1.0.4 has XSS via the search field to searchbyid.php (aka the "View Search By Id" screen). (no CVSS)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/archive/2018-04-09
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.