CVEs published April 4, 2018
163 CVEs were published on April 4, 2018: 1 critical, 4 high.
- Published
- 163
- Critical
- 1
- High
- 4
- Medium
- 6
- Low
- 1
- Unrated
- 151
- Now in CISA KEV
- 0
- Fix available
- 12
Most affected products
- Google Android
- 91
- McAfee Network Security Management
- 6
- FreeBSD
- 3
- IBM Security QRadar SIEM
- 2
- Red Hat Moodle · moodle/moodle
- 2
- Atlassian Application Links
- 1
- auth0-js
- 1
- Foreman Project foreman
- 1
- IBM API Connect
- 1
- IBM DataPower Gateways
- 1
Critical 1
High 4
- CVE-2018-1421IBM WebSphere DataPower Appliances 7.1, 7.2, 7.5, 7.5.1, 7.5.2, and 7.6 is vulnerable to a XML External Entity Injection (XXE) attack when pIBM DataPower Gateways
- CVE-2017-3965SB10192 - Network Security Management (NSM) - Cross-Site Request Forgery (CSRF) (aka Session Riding) vulnerabilityMcAfee Network Security Management
- CVE-2017-3969SB10192 - Network Security Management (NSM) - Abuse of communication channels vulnerabilityMcAfee Network Security Management
- CVE-2017-3971SB10192 - Network Security Management (NSM) - Cryptanalysis vulnerabilityMcAfee Network Security Management
Medium, low and unrated 158
- CVE-2018-1081A flaw was found in Moodle 3.4 to 3.4.1, 3.3 to 3.3.4, 3.2 to 3.2.7, 3.1 to 3.1.10 and earlier unsupported versions.Red Hat Moodle · moodle/moodle
- CVE-2018-1082A flaw was found in Moodle 3.4 to 3.4.1, and 3.3 to 3.3.4.Red Hat Moodle · moodle/moodle
- CVE-2018-1097A flaw was found in foreman before 1.16.1.Foreman Project foreman
- CVE-2018-9303In Exiv2 0.26, an assertion failure in BigTiffImage::readData in bigtiffimage.cpp results in an abort.
- CVE-2018-9304In Exiv2 0.26, a divide by zero in BigTiffImage::printIFD in bigtiffimage.cpp could result in denial of service.
- CVE-2018-9305In Exiv2 0.26, an out-of-bounds read in IptcData::printStructure in iptc.c could result in a crash or information leak, related to the "== 0
- CVE-2018-9307dsmall v20180320 allows XSS via the pdr_sn parameter to public/index.php/home/predeposit/index.html.
- CVE-2018-1002150Koji version 1.12, 1.13, 1.14 and 1.15 contain an incorrect access control vulnerability resulting in arbitrary filesystem read/write accesskoji
- CVE-2018-8719An issue was discovered in the WP Security Audit Log plugin 3.1.1 for WordPress.
- CVE-2018-9034Cross-site scripting (XSS) vulnerability in lib/interface.php of the Relevanssi plugin 4.0.4 for WordPress allows remote attackers to inject
- CVE-2018-9035CSV Injection vulnerability in ExportToCsvUtf8.php of the Contact Form 7 to Database Extension plugin 2.10.32 for WordPress allows remote at
- CVE-2018-9115Systematic SitaWare 6.4 SP2 does not validate input from other sources sufficiently.
- CVE-2018-9126The DNNArticle module 11 for DNN (formerly DotNetNuke) allows remote attackers to read the web.config file, and consequently discover databa
- CVE-2018-9284authentication.cgi on D-Link DIR-868L devices with Singapore StarHub firmware before v1.21SHCb03 allows remote attackers to execute arbitrar
- CVE-2018-9285Main_Analysis_Content.asp in /apply.cgi on ASUS RT-AC66U, RT-AC68U, RT-AC86U, RT-AC88U, RT-AC1900, RT-AC2900, and RT-AC3100 devices before 3
- CVE-2014-9953An elevation of privilege vulnerability in Qualcomm closed source components.Google Android
- CVE-2014-9954An elevation of privilege vulnerability in Qualcomm closed source components.Google Android
- CVE-2014-9955An elevation of privilege vulnerability in Qualcomm closed source components.Google Android
- CVE-2014-9956An elevation of privilege vulnerability in Qualcomm closed source components.Google Android
- CVE-2014-9957An elevation of privilege vulnerability in Qualcomm closed source components.Google Android
- CVE-2014-9958An elevation of privilege vulnerability in Qualcomm closed source components.Google Android
- CVE-2014-9959An elevation of privilege vulnerability in Qualcomm closed source components.Google Android
- CVE-2015-9008An elevation of privilege vulnerability in Qualcomm closed source components.Google Android
- CVE-2015-9009An elevation of privilege vulnerability in Qualcomm closed source components.Google Android
- CVE-2015-9010An elevation of privilege vulnerability in Qualcomm closed source components.Google Android
- CVE-2015-9011An elevation of privilege vulnerability in Qualcomm closed source components.Google Android
- CVE-2015-9012An elevation of privilege vulnerability in Qualcomm closed source components.Google Android
- CVE-2015-9013An elevation of privilege vulnerability in Qualcomm closed source components.Google Android
- CVE-2015-9014An elevation of privilege vulnerability in Qualcomm closed source components.Google Android
- CVE-2015-9015An elevation of privilege vulnerability in Qualcomm closed source components.Google Android
- CVE-2016-10230A remote code execution vulnerability in the Qualcomm crypto driver.Google Android
- CVE-2016-10231An elevation of privilege vulnerability in the Qualcomm sound codec driver.Google Android
- CVE-2016-10232An elevation of privilege vulnerability in the Qualcomm video driver.Google Android
- CVE-2016-10233An elevation of privilege vulnerability in the Qualcomm video driver.Google Android
- CVE-2016-10234An information disclosure vulnerability in the Qualcomm IPA driver.Google Android
- CVE-2016-10235A denial of service vulnerability in the Qualcomm WiFi driver.Google Android
- CVE-2016-10236An information disclosure vulnerability in the Qualcomm USB driver.Google Android
- CVE-2016-10298An elevation of privilege vulnerability in Qualcomm closed source components.Google Android
- CVE-2016-10299An elevation of privilege vulnerability in Qualcomm closed source components.Google Android
- CVE-2016-8484An elevation of privilege vulnerability in Qualcomm closed source components.Google Android
- CVE-2016-8485An information disclosure vulnerability in Qualcomm closed source components.Google Android
- CVE-2016-8486An information disclosure vulnerability in Qualcomm closed source components.Google Android
- CVE-2016-8487An elevation of privilege vulnerability in Qualcomm closed source components.
- CVE-2016-8488An elevation of privilege vulnerability in Qualcomm closed source components.Google Android
- CVE-2017-1624IBM QRadar 7.3 and 7.3.1 specifies permissions for a security-critical resource in a way that allows that resource to be read or modified byIBM Security QRadar SIEM
- CVE-2017-1733IBM QRadar 7.3 stores potentially sensitive information in log files that could be read by a local user.IBM Security QRadar SIEM
- CVE-2017-1772IBM Worklight (IBM MobileFirst Platform Foundation 6.3, 7.0, 7.1, and 8.0) is vulnerable to cross-site scripting.IBM MobileFirst Platform Foundation
- CVE-2017-6423An elevation of privilege vulnerability in the Qualcomm kyro L2 driver.Google Android
- CVE-2017-6424An elevation of privilege vulnerability in the Qualcomm WiFi driver.Google Android
- CVE-2017-6425An information disclosure vulnerability in the Qualcomm video driver.Google Android
- CVE-2017-6426An information disclosure vulnerability in the Qualcomm SPMI driver.Google Android
- CVE-2018-1447The GSKit (IBM Spectrum Protect 7.1 and 7.2) and (IBM Spectrum Protect Snapshot 4.1.3, 4.1.4, and 4.1.6) CMS KDB logic fails to salt the hasIBM Spectrum Protect
- CVE-2018-9275In check_user_token in util.c in the Yubico PAM module (aka pam_yubico) 2.18 through 2.25, successful logins can leak file descriptors to th
- CVE-2017-13248In impeg2_idct_recon_sse42() of impeg2_idct_recon_sse42_intr.c, there is an out of bound write due to a missing bounds check.Google Android
- CVE-2017-13249In impeg2d_api_set_display_frame of impeg2d_api_main.c, there is an out of bound write due to a missing bounds check.Google Android
- CVE-2017-13250In ih264d_fmt_conv_420sp_to_420p of ih264d_utils.c, there is an out of bound write due to a missing out of bounds check because of a multiplGoogle Android
- CVE-2017-13251In impeg2d_dec_pic_data_thread of impeg2d_dec_hdr.c, there is a possible out of bounds write due to a missing bounds check.Google Android
- CVE-2017-13252In CryptoHal::decrypt of CryptoHal.cpp, there is an out of bounds write due to improper input validation that results in a read from uninitiGoogle Android
- CVE-2017-13253In CryptoPlugin::decrypt of CryptoPlugin.cpp, there is a possible out of bounds write due to a missing bounds check.Google Android
- CVE-2017-13254A other vulnerability in the Android media framework (AACExtractor).Google Android
- CVE-2017-13255In process_service_attr_req of sdp_server.c, there is an out of bounds write due to a missing bounds check.Google Android
- CVE-2017-13256In process_service_search_attr_req of sdp_server.cc, there is an out of bounds write due to a missing bounds check.Google Android
- CVE-2017-13257In bta_pan_data_buf_ind_cback of bta_pan_act.cc there is a use after free that can result in an out of bounds read of memory allocated via mGoogle Android
- CVE-2017-13258In bnep_data_ind of bnep_main.cc, there is a possible out of bounds read due to a missing bounds check.Google Android
- CVE-2017-13259In functionality implemented in sdp_discovery.cc, there are possible out of bounds reads due to missing bounds checks.Google Android
- CVE-2017-13260In bnep_data_ind of bnep_main.cc, there is a possible out of bounds read due to a missing bounds check.Google Android
- CVE-2017-13261In bnep_process_control_packet of bnep_utils.cc, there is a possible out of bounds read due to a missing bounds check.Google Android
- CVE-2017-13262In bnep_data_ind of bnep_main.cc, there is a possible out of bounds read due to a missing length decrement operation.Google Android
- CVE-2017-13263A elevation of privilege vulnerability in the Android framework.Google Android
- CVE-2017-13264A other vulnerability in the Android media framework (Avcdec).Google Android
- CVE-2017-13265A elevation of privilege vulnerability in the Android system (OTA updates).Google Android
- CVE-2017-13266In avrc_pars_vendor_cmd of avrc_pars_tg.cc, there is a possible stack corruption due to a missing bounds check.Google Android
- CVE-2017-13268A information disclosure vulnerability in the Android system (bluetooth).Google Android
- CVE-2017-13269A information disclosure vulnerability in the Android system (bluetooth).Google Android
- CVE-2017-13270A elevation of privilege vulnerability in the upstream kernel mnh_sm driver.Google Android
- CVE-2017-13271A elevation of privilege vulnerability in the upstream kernel mnh_sm driver.Google Android
- CVE-2017-13272In alarm_ready_generic of alarm.cc, there is a possible out of bounds write due to a use after free.Google Android
- CVE-2017-18257The __get_data_block function in fs/f2fs/data.c in the Linux kernel before 4.11 allows local users to cause a denial of service (integer ove
- CVE-2018-0986A remote code execution vulnerability exists when the Microsoft Malware Protection Engine does not properly scan a specially crafted file, lMicrosoft Windows Defender · Microsoft Windows Intune En… +5
- CVE-2018-6873The Auth0 authentication service before 2017-10-15 allows privilege escalation because the JWT audience is not validated.
- CVE-2018-6874CSRF exists in the Auth0 authentication service through 14591 if the Legacy Lock API flag is enabled.auth0-js
- CVE-2017-13267In avrc_pars_vendor_cmd of avrc_pars_tg.cc, there is a possible stack corruption due to a missing bounds check.Google Android
- CVE-2017-13274In the getHost() function of UriTest.java, there is the possibility of incorrect web origin determination.Google Android
- CVE-2017-13275In getVSCoverage of CmapCoverage.cpp, there is a possible out of bounds read due to an incorrect bounds check.Google Android
- CVE-2017-13276In CProgramConfig_ReadHeightExt of tpdec_asc.cpp, there is a possible stack buffer overflow due to a missing bounds check.Google Android
- CVE-2017-13277In ihevcd_fmt_conv of ihevcd_fmt_conv.c, there is a possible out of bounds write due to a missing bounds check.Google Android
- CVE-2017-13278In MediaPlayerService::Client::notify of MediaPlayerService.cpp, there is a possible use after free.Google Android
- CVE-2017-13279In M3UParser::parse of M3UParser.cpp, there is a memory resource exhaustion due to a large loop of pushing items into a vector.Google Android
- CVE-2017-13280In the FrameSequence_gif::FrameSequence_gif function of libframesequence, there is a out of bounds read due to a missing bounds check.Google Android
- CVE-2017-13281In avrc_pars_browsing_cmd of avrc_pars_tg.cc, there is a possible stack buffer overflow due to an incorrect bounds check.Google Android
- CVE-2017-13282In avrc_ctrl_pars_vendor_rsp of avrc_pars_ct.cc, there is a possible stack buffer overflow due to a missing bounds check.Google Android
- CVE-2017-13283In avrc_ctrl_pars_vendor_rsp of bluetooth avrcp_ctrl, there is a possible out of bounds write on the stack due to a missing bounds check.Google Android
- CVE-2017-13284In config_set_string of config.cc, it is possible to pair a second BT keyboard without user approval due to improper input validation.Google Android
- CVE-2017-13285In SvoxSsmlParser and startElement of svox_ssml_parser.cpp, there is a possible out of bounds write due to an uninitialized buffer.Google Android
- CVE-2017-13286In writeToParcel and readFromParcel of OutputConfiguration.java, there is a permission bypass due to mismatched serialization.Google Android
- CVE-2017-13287In createFromParcel of VerifyCredentialResponse.java, there is a possible invalid parcel read due to improper input validation.Google Android
- CVE-2017-13288In writeToParcel and readFromParcel of PeriodicAdvertisingReport.java, there is a permission bypass due to a 64/32bit int mismatch.Google Android
- CVE-2017-13289In writeToParcel and createFromParcel of RttManager.java, there is a permission bypass due to a write size mismatch.Google Android
- CVE-2017-13290In sdp_server_handle_client_req of sdp_server.cc, there is an out of bounds read due to a missing bounds check.Google Android
- CVE-2017-13291In avrc_ctrl_pars_vendor_rsp of avrc_pars_ct.cc, there is a possible NULL pointer dereference due to missing bounds checks.Google Android
- CVE-2017-13292In wl_get_assoc_ies of wl_cfg80211.c, there is a possible out of bounds write due to an incorrect bounds check.Google Android
- CVE-2017-13293In the nfc_hci_cmd_received() function of core.c, there is a possible out of bounds write due to a missing bounds check.Google Android
- CVE-2017-13294A information disclosure vulnerability in the Android framework (aosp email application).Google Android
- CVE-2017-13295A denial of service vulnerability in the Android framework (package installer).Google Android
- CVE-2017-13296A information disclosure vulnerability in the Android media framework (libavc).Google Android
- CVE-2017-13297A information disclosure vulnerability in the Android media framework (libhevc).Google Android
- CVE-2017-13298A information disclosure vulnerability in the Android media framework (libhavc).Google Android
- CVE-2017-13299A other vulnerability in the Android media framework (libavc).Google Android
- CVE-2017-13300A denial of service vulnerability in the Android media framework (libhevc).Google Android
- CVE-2017-13301A denial of service vulnerability in the Android system (system ui).Google Android
- CVE-2017-13302A denial of service vulnerability in the Android system (system ui).Google Android
- CVE-2017-13303A information disclosure vulnerability in the Broadcom bcmdhd driver.Google Android
- CVE-2017-13304A information disclosure vulnerability in the Upstream kernel mnh_sm driver.Google Android
- CVE-2017-13305A information disclosure vulnerability in the Upstream kernel encrypted-keys.Google Android
- CVE-2017-13306A elevation of privilege vulnerability in the Upstream kernel mnh driver.Google Android
- CVE-2017-13307A elevation of privilege vulnerability in the Upstream kernel pci sysfs.Google Android
- CVE-2018-8813Open redirect vulnerability in the login[redirect] parameter login functionality in WolfCMS 0.8.3.1 allows remote attackers to redirect user
- CVE-2018-8814Cross-site request forgery (CSRF) vulnerability in WolfCMS 0.8.3.1 allows remote attackers to hijack the authentication of users for request
- CVE-2018-9205Vulnerability in avatar_uploader v7.x-1.0-beta8 , The code in view.php doesn't verify users or sanitize the file path.Robbin Zhao avatar_uploader
- CVE-2018-9248FiberHome VDSL2 Modem HG 150-UB devices allow authentication bypass via a "Cookie: Name=0admin" header.
- CVE-2018-9249FiberHome VDSL2 Modem HG 150-UB devices allow authentication bypass by ignoring the parent.location='login.html' JavaScript code in the resp
- CVE-2018-6917In FreeBSD before 11.1-STABLE, 11.1-RELEASE-p9, 10.4-STABLE, 10.4-RELEASE-p8 and 10.3-RELEASE-p28, insufficient validation of user-provided FreeBSD
- CVE-2018-6918In FreeBSD before 11.1-STABLE, 11.1-RELEASE-p9, 10.4-STABLE, 10.4-RELEASE-p8 and 10.3-RELEASE-p28, the length field of the ipsec option headFreeBSD
- CVE-2018-6919In FreeBSD before 11.1-STABLE, 11.1-RELEASE-p9, 10.4-STABLE, 10.4-RELEASE-p8 and 10.3-RELEASE-p28, due to insufficient initialization of memFreeBSD
- CVE-2017-3964SB10192 - Network Security Management (NSM) - Reflective Cross-Site Scripting (XSS) vulnerabilityMcAfee Network Security Management
- CVE-2017-3966SB10192 - Network Security Management (NSM) - Exploitation of session variables, resource IDs and other trusted credentials vulnerabilityMcAfee Network Security Management
- CVE-2017-3967SB10192 - Network Security Management (NSM) - Target influence via framing vulnerabilityMcAfee Network Security Management
- CVE-2017-18096The OAuth status rest resource in Atlassian Application Links before version 5.2.7, from 5.3.0 before 5.3.4 and from 5.4.0 before 5.4.3 alloAtlassian Application Links
- CVE-2018-9235iScripts SonicBB 1.0 has Reflected Cross-Site Scripting via the query parameter to search.php.
- CVE-2018-9236iScripts EasyCreate 3.2.1 has Stored Cross-Site Scripting in the "Site title" field.
- CVE-2018-9237iScripts EasyCreate 3.2.1 has Stored Cross-Site Scripting in the "Site Description" field.
- CVE-2018-9238proberv.php in Yahei-PHP Proberv 0.4.7 has XSS via the funName parameter.
- CVE-2018-9256In Wireshark 2.4.0 to 2.4.5 and 2.2.0 to 2.2.13, the LWAPP dissector could crash.
- CVE-2018-9257In Wireshark 2.4.0 to 2.4.5, the CQL dissector could go into an infinite loop.
- CVE-2018-9258In Wireshark 2.4.0 to 2.4.5, the TCP dissector could crash.
- CVE-2018-9259In Wireshark 2.4.0 to 2.4.5 and 2.2.0 to 2.2.13, the MP4 dissector could crash.
- CVE-2018-9260In Wireshark 2.4.0 to 2.4.5 and 2.2.0 to 2.2.13, the IEEE 802.15.4 dissector could crash.
- CVE-2018-9261In Wireshark 2.4.0 to 2.4.5 and 2.2.0 to 2.2.13, the NBAP dissector could crash with a large loop that ends with a heap-based buffer overflo
- CVE-2018-9262In Wireshark 2.4.0 to 2.4.5 and 2.2.0 to 2.2.13, the VLAN dissector could crash.
- CVE-2018-9263In Wireshark 2.4.0 to 2.4.5 and 2.2.0 to 2.2.13, the Kerberos dissector could crash.
- CVE-2018-9264In Wireshark 2.4.0 to 2.4.5 and 2.2.0 to 2.2.13, the ADB dissector could crash with a heap-based buffer overflow.
- CVE-2018-9265In Wireshark 2.4.0 to 2.4.5 and 2.2.0 to 2.2.13, epan/dissectors/packet-tn3270.c has a memory leak.
- CVE-2018-9266In Wireshark 2.4.0 to 2.4.5 and 2.2.0 to 2.2.13, epan/dissectors/packet-isup.c has a memory leak.
- CVE-2018-9267In Wireshark 2.4.0 to 2.4.5 and 2.2.0 to 2.2.13, epan/dissectors/packet-lapd.c has a memory leak.
- CVE-2018-9268In Wireshark 2.4.0 to 2.4.5 and 2.2.0 to 2.2.13, epan/dissectors/packet-smb2.c has a memory leak.
- CVE-2018-9269In Wireshark 2.4.0 to 2.4.5 and 2.2.0 to 2.2.13, epan/dissectors/packet-giop.c has a memory leak.
- CVE-2018-9270In Wireshark 2.4.0 to 2.4.5 and 2.2.0 to 2.2.13, epan/oids.c has a memory leak.
- CVE-2018-9271In Wireshark 2.4.0 to 2.4.5 and 2.2.0 to 2.2.13, epan/dissectors/packet-multipart.c has a memory leak.
- CVE-2018-9272In Wireshark 2.4.0 to 2.4.5 and 2.2.0 to 2.2.13, epan/dissectors/packet-h223.c has a memory leak.
- CVE-2018-9273In Wireshark 2.4.0 to 2.4.5 and 2.2.0 to 2.2.13, epan/dissectors/packet-pcp.c has a memory leak.
- CVE-2018-9274In Wireshark 2.4.0 to 2.4.5 and 2.2.0 to 2.2.13, ui/failure_message.c has a memory leak.
- CVE-2016-10718Brave Browser before 0.13.0 allows a tab to close itself even if the tab was not opened by a script, resulting in denial of service.
- CVE-2017-18256Brave Browser before 0.13.0 allows remote attackers to cause a denial of service (resource consumption) via a long alert() argument in JavaS
- CVE-2018-9251The xz_decomp function in xzlib.c in libxml2 2.9.8, if --with-lzma is used, allows remote attackers to cause a denial of service (infinite l
- CVE-2018-9252JasPer 2.0.14 allows denial of service via a reachable assertion in the function jpc_abstorelstepsize in libjasper/jpc/jpc_enc.c.
- CVE-2018-9119An attacker with physical access to a BrilliantTS FUZE card (MCU firmware 0.1.73, BLE firmware 0.7.4) can unlock the card, extract credit ca
- CVE-2018-9234GnuPG 2.2.4 and 2.2.5 does not enforce a configuration in which key certification requires an offline master Certify key, which results in a
- CVE-2018-9247The upsql function in \Lib\Lib\Action\Admin\DataAction.class.php in Gxlcms QY v1.0.0713 allows remote attackers to execute arbitrary SQL sta