# CVEs published 2018-04-02

25 CVEs were published on April 2, 2018: 1 critical, 1 high. Days are UTC.

- [CVE-2018-9230](https://cve.now/CVE-2018-9230.md): In OpenResty through 1.13.6.1, URI parameters are obtained using the ngx.req.get\_uri\_args and ngx.req.get\_post\_args functions that ignore pa (no CVSS)
- [CVE-2016-8717](https://cve.now/CVE-2016-8717.md): An exploitable Use of Hard-coded Credentials vulnerability exists in the Moxa AWK-3131A Wireless Access Point running firmware 1.1. (CVSS 10.0, Talos Moxa)
- [CVE-2018-1295](https://cve.now/CVE-2018-1295.md): In Apache Ignite 2.3 or earlier, the serialization mechanism does not have a list of classes allowed for serialization/deserialization, whic (no CVSS, Apache Software Foundation Apache Ignite · org.apache.ignit…)
- [CVE-2018-6659](https://cve.now/CVE-2018-6659.md): SB10228 ePO Reflected Cross-Site Scripting vulnerability (CVSS 3.7, McAfee ePolicy Orchestrator)
- [CVE-2018-9127](https://cve.now/CVE-2018-9127.md): Botan 2.2.0 - 2.4.0 (fixed in 2.5.0) improperly handled wildcard certificates and could accept certain certificates as valid for hostnames w (no CVSS)
- [CVE-2018-6247](https://cve.now/CVE-2018-6247.md): NVIDIA Windows GPU Display Driver contains a vulnerability in the kernel mode layer (nvlddmkm.sys) handler for DxgkDdiEscape where a NULL po (no CVSS, Nvidia GPU Display Driver)
- [CVE-2018-6248](https://cve.now/CVE-2018-6248.md): NVIDIA Windows GPU Display Driver contains a vulnerability in the kernel mode layer handler for DxgkDdiEscape where the software uses a sequ (no CVSS, Nvidia GPU Display Driver)
- [CVE-2018-6249](https://cve.now/CVE-2018-6249.md): NVIDIA GPU Display Driver contains a vulnerability in kernel mode layer handler where a NULL pointer dereference may lead to denial of servi (no CVSS, Nvidia GPU Display Driver)
- [CVE-2018-6250](https://cve.now/CVE-2018-6250.md): NVIDIA Windows GPU Display Driver contains a vulnerability in the kernel mode layer (nvlddmkm.sys) handler for DxgkDdiEscape where a NULL po (no CVSS, Nvidia GPU Display Driver)
- [CVE-2018-6251](https://cve.now/CVE-2018-6251.md): NVIDIA Windows GPU Display Driver contains a vulnerability in the DirectX 10 Usermode driver, where a specially crafted pixel shader can cau (no CVSS, Nvidia GPU Display Driver)
- [CVE-2018-6252](https://cve.now/CVE-2018-6252.md): NVIDIA Windows GPU Display Driver contains a vulnerability in the kernel mode layer handler for DxgkDdiEscape where the software allows an a (no CVSS, Nvidia GPU Display Driver)
- [CVE-2018-6253](https://cve.now/CVE-2018-6253.md): NVIDIA GPU Display Driver contains a vulnerability in the DirectX and OpenGL Usermode drivers where a specially crafted pixel shader can cau (no CVSS, Nvidia GPU Display Driver)
- [CVE-2018-9183](https://cve.now/CVE-2018-9183.md): The Joom Sky JS Jobs extension before 1.2.1 for Joomla! has XSS. (no CVSS)
- [CVE-2018-0194](https://cve.now/CVE-2018-0194.md): Multiple vulnerabilities in the CLI parser of Cisco IOS XE Software could allow an authenticated, local attacker to inject arbitrary command (no CVSS, Cisco IOS XE)
- [CVE-2018-1038](https://cve.now/CVE-2018-1038.md): The Windows kernel in Windows 7 SP1 and Windows Server 2008 R2 SP1 allows an elevation of privilege vulnerability due to the way it handles (no CVSS, Microsoft Windows)
- [CVE-2018-6660](https://cve.now/CVE-2018-6660.md): SB10228 ePO Directory Traversal vulnerability (CVSS 6.2, McAfee ePolicy Orchestrator)
- [CVE-2018-6661](https://cve.now/CVE-2018-6661.md): TS102801 True Key DLL Side-Loading vulnerability (CVSS 7.5, McAfee True Key)
- [CVE-2018-9163](https://cve.now/CVE-2018-9163.md): A stored Cross-site scripting (XSS) vulnerability in Zoho ManageEngine Recovery Manager Plus before 5.3 (Build 5350) allows remote authentic (no CVSS)
- [CVE-2018-1092](https://cve.now/CVE-2018-1092.md): The ext4\_iget function in fs/ext4/inode.c in the Linux kernel through 4.15.15 mishandles the case of a root directory with a zero i\_links\_co (no CVSS, Linux kernel through)
- [CVE-2018-1093](https://cve.now/CVE-2018-1093.md): The ext4\_valid\_block\_bitmap function in fs/ext4/balloc.c in the Linux kernel through 4.15.15 allows attackers to cause a denial of service ( (no CVSS, Linux kernel through)
- [CVE-2018-1094](https://cve.now/CVE-2018-1094.md): The ext4\_fill\_super function in fs/ext4/super.c in the Linux kernel through 4.15.15 does not always initialize the crc32c checksum driver, w (no CVSS, Linux kernel through)
- [CVE-2018-1095](https://cve.now/CVE-2018-1095.md): The ext4\_xattr\_check\_entries function in fs/ext4/xattr.c in the Linux kernel through 4.15.15 does not properly validate xattr sizes, which c (no CVSS, Linux kernel through)
- [CVE-2018-9173](https://cve.now/CVE-2018-9173.md): Cross-site scripting (XSS) vulnerability in admin/template/js/uploadify/uploadify.swf in GetSimple CMS 3.3.13 allows remote attackers to inj (no CVSS)
- [CVE-2018-9174](https://cve.now/CVE-2018-9174.md): sys\_verifies.php in DedeCMS 5.7 allows remote attackers to execute arbitrary PHP code via the refiles array parameter, because the contents (no CVSS)
- [CVE-2018-9175](https://cve.now/CVE-2018-9175.md): DedeCMS 5.7 allows remote attackers to execute arbitrary PHP code via the egroup parameter to uploads/dede/stepselect\_main.php because code (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2018-04-02
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.