# CVEs published 2018-04-04

163 CVEs were published on April 4, 2018: 1 critical, 4 high. Days are UTC.

- [CVE-2018-1081](https://cve.now/CVE-2018-1081.md): A flaw was found in Moodle 3.4 to 3.4.1, 3.3 to 3.3.4, 3.2 to 3.2.7, 3.1 to 3.1.10 and earlier unsupported versions. (no CVSS, Red Hat Moodle · moodle/moodle)
- [CVE-2018-1082](https://cve.now/CVE-2018-1082.md): A flaw was found in Moodle 3.4 to 3.4.1, and 3.3 to 3.3.4. (no CVSS, Red Hat Moodle · moodle/moodle)
- [CVE-2018-1097](https://cve.now/CVE-2018-1097.md): A flaw was found in foreman before 1.16.1. (no CVSS, Foreman Project foreman)
- [CVE-2018-9303](https://cve.now/CVE-2018-9303.md): In Exiv2 0.26, an assertion failure in BigTiffImage::readData in bigtiffimage.cpp results in an abort. (no CVSS)
- [CVE-2018-9304](https://cve.now/CVE-2018-9304.md): In Exiv2 0.26, a divide by zero in BigTiffImage::printIFD in bigtiffimage.cpp could result in denial of service. (no CVSS)
- [CVE-2018-9305](https://cve.now/CVE-2018-9305.md): In Exiv2 0.26, an out-of-bounds read in IptcData::printStructure in iptc.c could result in a crash or information leak, related to the "== 0 (no CVSS)
- [CVE-2018-9307](https://cve.now/CVE-2018-9307.md): dsmall v20180320 allows XSS via the pdr\_sn parameter to public/index.php/home/predeposit/index.html. (no CVSS)
- [CVE-2018-1002150](https://cve.now/CVE-2018-1002150.md): Koji version 1.12, 1.13, 1.14 and 1.15 contain an incorrect access control vulnerability resulting in arbitrary filesystem read/write access (no CVSS, koji)
- [CVE-2018-8719](https://cve.now/CVE-2018-8719.md): An issue was discovered in the WP Security Audit Log plugin 3.1.1 for WordPress. (no CVSS)
- [CVE-2018-9034](https://cve.now/CVE-2018-9034.md): Cross-site scripting (XSS) vulnerability in lib/interface.php of the Relevanssi plugin 4.0.4 for WordPress allows remote attackers to inject (no CVSS)
- [CVE-2018-9035](https://cve.now/CVE-2018-9035.md): CSV Injection vulnerability in ExportToCsvUtf8.php of the Contact Form 7 to Database Extension plugin 2.10.32 for WordPress allows remote at (no CVSS)
- [CVE-2018-9115](https://cve.now/CVE-2018-9115.md): Systematic SitaWare 6.4 SP2 does not validate input from other sources sufficiently. (no CVSS)
- [CVE-2018-9126](https://cve.now/CVE-2018-9126.md): The DNNArticle module 11 for DNN (formerly DotNetNuke) allows remote attackers to read the web.config file, and consequently discover databa (no CVSS)
- [CVE-2018-9284](https://cve.now/CVE-2018-9284.md): authentication.cgi on D-Link DIR-868L devices with Singapore StarHub firmware before v1.21SHCb03 allows remote attackers to execute arbitrar (no CVSS)
- [CVE-2018-9285](https://cve.now/CVE-2018-9285.md): Main\_Analysis\_Content.asp in /apply.cgi on ASUS RT-AC66U, RT-AC68U, RT-AC86U, RT-AC88U, RT-AC1900, RT-AC2900, and RT-AC3100 devices before 3 (no CVSS)
- [CVE-2014-9953](https://cve.now/CVE-2014-9953.md): An elevation of privilege vulnerability in Qualcomm closed source components. (no CVSS, Google Android)
- [CVE-2014-9954](https://cve.now/CVE-2014-9954.md): An elevation of privilege vulnerability in Qualcomm closed source components. (no CVSS, Google Android)
- [CVE-2014-9955](https://cve.now/CVE-2014-9955.md): An elevation of privilege vulnerability in Qualcomm closed source components. (no CVSS, Google Android)
- [CVE-2014-9956](https://cve.now/CVE-2014-9956.md): An elevation of privilege vulnerability in Qualcomm closed source components. (no CVSS, Google Android)
- [CVE-2014-9957](https://cve.now/CVE-2014-9957.md): An elevation of privilege vulnerability in Qualcomm closed source components. (no CVSS, Google Android)
- [CVE-2014-9958](https://cve.now/CVE-2014-9958.md): An elevation of privilege vulnerability in Qualcomm closed source components. (no CVSS, Google Android)
- [CVE-2014-9959](https://cve.now/CVE-2014-9959.md): An elevation of privilege vulnerability in Qualcomm closed source components. (no CVSS, Google Android)
- [CVE-2015-9008](https://cve.now/CVE-2015-9008.md): An elevation of privilege vulnerability in Qualcomm closed source components. (no CVSS, Google Android)
- [CVE-2015-9009](https://cve.now/CVE-2015-9009.md): An elevation of privilege vulnerability in Qualcomm closed source components. (no CVSS, Google Android)
- [CVE-2015-9010](https://cve.now/CVE-2015-9010.md): An elevation of privilege vulnerability in Qualcomm closed source components. (no CVSS, Google Android)
- [CVE-2015-9011](https://cve.now/CVE-2015-9011.md): An elevation of privilege vulnerability in Qualcomm closed source components. (no CVSS, Google Android)
- [CVE-2015-9012](https://cve.now/CVE-2015-9012.md): An elevation of privilege vulnerability in Qualcomm closed source components. (no CVSS, Google Android)
- [CVE-2015-9013](https://cve.now/CVE-2015-9013.md): An elevation of privilege vulnerability in Qualcomm closed source components. (no CVSS, Google Android)
- [CVE-2015-9014](https://cve.now/CVE-2015-9014.md): An elevation of privilege vulnerability in Qualcomm closed source components. (no CVSS, Google Android)
- [CVE-2015-9015](https://cve.now/CVE-2015-9015.md): An elevation of privilege vulnerability in Qualcomm closed source components. (no CVSS, Google Android)
- [CVE-2016-10230](https://cve.now/CVE-2016-10230.md): A remote code execution vulnerability in the Qualcomm crypto driver. (no CVSS, Google Android)
- [CVE-2016-10231](https://cve.now/CVE-2016-10231.md): An elevation of privilege vulnerability in the Qualcomm sound codec driver. (no CVSS, Google Android)
- [CVE-2016-10232](https://cve.now/CVE-2016-10232.md): An elevation of privilege vulnerability in the Qualcomm video driver. (no CVSS, Google Android)
- [CVE-2016-10233](https://cve.now/CVE-2016-10233.md): An elevation of privilege vulnerability in the Qualcomm video driver. (no CVSS, Google Android)
- [CVE-2016-10234](https://cve.now/CVE-2016-10234.md): An information disclosure vulnerability in the Qualcomm IPA driver. (no CVSS, Google Android)
- [CVE-2016-10235](https://cve.now/CVE-2016-10235.md): A denial of service vulnerability in the Qualcomm WiFi driver. (no CVSS, Google Android)
- [CVE-2016-10236](https://cve.now/CVE-2016-10236.md): An information disclosure vulnerability in the Qualcomm USB driver. (no CVSS, Google Android)
- [CVE-2016-10298](https://cve.now/CVE-2016-10298.md): An elevation of privilege vulnerability in Qualcomm closed source components. (no CVSS, Google Android)
- [CVE-2016-10299](https://cve.now/CVE-2016-10299.md): An elevation of privilege vulnerability in Qualcomm closed source components. (no CVSS, Google Android)
- [CVE-2016-8484](https://cve.now/CVE-2016-8484.md): An elevation of privilege vulnerability in Qualcomm closed source components. (no CVSS, Google Android)
- [CVE-2016-8485](https://cve.now/CVE-2016-8485.md): An information disclosure vulnerability in Qualcomm closed source components. (no CVSS, Google Android)
- [CVE-2016-8486](https://cve.now/CVE-2016-8486.md): An information disclosure vulnerability in Qualcomm closed source components. (no CVSS, Google Android)
- [CVE-2016-8487](https://cve.now/CVE-2016-8487.md): An elevation of privilege vulnerability in Qualcomm closed source components. (no CVSS)
- [CVE-2016-8488](https://cve.now/CVE-2016-8488.md): An elevation of privilege vulnerability in Qualcomm closed source components. (no CVSS, Google Android)
- [CVE-2017-1624](https://cve.now/CVE-2017-1624.md): IBM QRadar 7.3 and 7.3.1 specifies permissions for a security-critical resource in a way that allows that resource to be read or modified by (CVSS 4.2, IBM Security QRadar SIEM)
- [CVE-2017-1733](https://cve.now/CVE-2017-1733.md): IBM QRadar 7.3 stores potentially sensitive information in log files that could be read by a local user. (CVSS 4.0, IBM Security QRadar SIEM)
- [CVE-2017-1772](https://cve.now/CVE-2017-1772.md): IBM Worklight (IBM MobileFirst Platform Foundation 6.3, 7.0, 7.1, and 8.0) is vulnerable to cross-site scripting. (CVSS 6.1, IBM MobileFirst Platform Foundation)
- [CVE-2017-6423](https://cve.now/CVE-2017-6423.md): An elevation of privilege vulnerability in the Qualcomm kyro L2 driver. (no CVSS, Google Android)
- [CVE-2017-6424](https://cve.now/CVE-2017-6424.md): An elevation of privilege vulnerability in the Qualcomm WiFi driver. (no CVSS, Google Android)
- [CVE-2017-6425](https://cve.now/CVE-2017-6425.md): An information disclosure vulnerability in the Qualcomm video driver. (no CVSS, Google Android)
- [CVE-2017-6426](https://cve.now/CVE-2017-6426.md): An information disclosure vulnerability in the Qualcomm SPMI driver. (no CVSS, Google Android)
- [CVE-2018-1421](https://cve.now/CVE-2018-1421.md): IBM WebSphere DataPower Appliances 7.1, 7.2, 7.5, 7.5.1, 7.5.2, and 7.6 is vulnerable to a XML External Entity Injection (XXE) attack when p (CVSS 7.1, IBM DataPower Gateways)
- [CVE-2018-1447](https://cve.now/CVE-2018-1447.md): The GSKit (IBM Spectrum Protect 7.1 and 7.2) and (IBM Spectrum Protect Snapshot 4.1.3, 4.1.4, and 4.1.6) CMS KDB logic fails to salt the has (CVSS 5.1, IBM Spectrum Protect)
- [CVE-2018-1469](https://cve.now/CVE-2018-1469.md): IBM API Connect Developer Portal 5.0.0.0 through 5.0.8.2 could allow an unauthenticated attacker to execute system commands using specially (CVSS 9.8, IBM API Connect)
- [CVE-2018-9275](https://cve.now/CVE-2018-9275.md): In check\_user\_token in util.c in the Yubico PAM module (aka pam\_yubico) 2.18 through 2.25, successful logins can leak file descriptors to th (no CVSS)
- [CVE-2017-13248](https://cve.now/CVE-2017-13248.md): In impeg2\_idct\_recon\_sse42() of impeg2\_idct\_recon\_sse42\_intr.c, there is an out of bound write due to a missing bounds check. (no CVSS, Google Android)
- [CVE-2017-13249](https://cve.now/CVE-2017-13249.md): In impeg2d\_api\_set\_display\_frame of impeg2d\_api\_main.c, there is an out of bound write due to a missing bounds check. (no CVSS, Google Android)
- [CVE-2017-13250](https://cve.now/CVE-2017-13250.md): In ih264d\_fmt\_conv\_420sp\_to\_420p of ih264d\_utils.c, there is an out of bound write due to a missing out of bounds check because of a multipl (no CVSS, Google Android)
- [CVE-2017-13251](https://cve.now/CVE-2017-13251.md): In impeg2d\_dec\_pic\_data\_thread of impeg2d\_dec\_hdr.c, there is a possible out of bounds write due to a missing bounds check. (no CVSS, Google Android)
- [CVE-2017-13252](https://cve.now/CVE-2017-13252.md): In CryptoHal::decrypt of CryptoHal.cpp, there is an out of bounds write due to improper input validation that results in a read from uniniti (no CVSS, Google Android)
- [CVE-2017-13253](https://cve.now/CVE-2017-13253.md): In CryptoPlugin::decrypt of CryptoPlugin.cpp, there is a possible out of bounds write due to a missing bounds check. (no CVSS, Google Android)
- [CVE-2017-13254](https://cve.now/CVE-2017-13254.md): A other vulnerability in the Android media framework (AACExtractor). (no CVSS, Google Android)
- [CVE-2017-13255](https://cve.now/CVE-2017-13255.md): In process\_service\_attr\_req of sdp\_server.c, there is an out of bounds write due to a missing bounds check. (no CVSS, Google Android)
- [CVE-2017-13256](https://cve.now/CVE-2017-13256.md): In process\_service\_search\_attr\_req of sdp\_server.cc, there is an out of bounds write due to a missing bounds check. (no CVSS, Google Android)
- [CVE-2017-13257](https://cve.now/CVE-2017-13257.md): In bta\_pan\_data\_buf\_ind\_cback of bta\_pan\_act.cc there is a use after free that can result in an out of bounds read of memory allocated via m (no CVSS, Google Android)
- [CVE-2017-13258](https://cve.now/CVE-2017-13258.md): In bnep\_data\_ind of bnep\_main.cc, there is a possible out of bounds read due to a missing bounds check. (no CVSS, Google Android)
- [CVE-2017-13259](https://cve.now/CVE-2017-13259.md): In functionality implemented in sdp\_discovery.cc, there are possible out of bounds reads due to missing bounds checks. (no CVSS, Google Android)
- [CVE-2017-13260](https://cve.now/CVE-2017-13260.md): In bnep\_data\_ind of bnep\_main.cc, there is a possible out of bounds read due to a missing bounds check. (no CVSS, Google Android)
- [CVE-2017-13261](https://cve.now/CVE-2017-13261.md): In bnep\_process\_control\_packet of bnep\_utils.cc, there is a possible out of bounds read due to a missing bounds check. (no CVSS, Google Android)
- [CVE-2017-13262](https://cve.now/CVE-2017-13262.md): In bnep\_data\_ind of bnep\_main.cc, there is a possible out of bounds read due to a missing length decrement operation. (no CVSS, Google Android)
- [CVE-2017-13263](https://cve.now/CVE-2017-13263.md): A elevation of privilege vulnerability in the Android framework. (no CVSS, Google Android)
- [CVE-2017-13264](https://cve.now/CVE-2017-13264.md): A other vulnerability in the Android media framework (Avcdec). (no CVSS, Google Android)
- [CVE-2017-13265](https://cve.now/CVE-2017-13265.md): A elevation of privilege vulnerability in the Android system (OTA updates). (no CVSS, Google Android)
- [CVE-2017-13266](https://cve.now/CVE-2017-13266.md): In avrc\_pars\_vendor\_cmd of avrc\_pars\_tg.cc, there is a possible stack corruption due to a missing bounds check. (no CVSS, Google Android)
- [CVE-2017-13268](https://cve.now/CVE-2017-13268.md): A information disclosure vulnerability in the Android system (bluetooth). (no CVSS, Google Android)
- [CVE-2017-13269](https://cve.now/CVE-2017-13269.md): A information disclosure vulnerability in the Android system (bluetooth). (no CVSS, Google Android)
- [CVE-2017-13270](https://cve.now/CVE-2017-13270.md): A elevation of privilege vulnerability in the upstream kernel mnh\_sm driver. (no CVSS, Google Android)
- [CVE-2017-13271](https://cve.now/CVE-2017-13271.md): A elevation of privilege vulnerability in the upstream kernel mnh\_sm driver. (no CVSS, Google Android)
- [CVE-2017-13272](https://cve.now/CVE-2017-13272.md): In alarm\_ready\_generic of alarm.cc, there is a possible out of bounds write due to a use after free. (no CVSS, Google Android)
- [CVE-2017-18257](https://cve.now/CVE-2017-18257.md): The \_\_get\_data\_block function in fs/f2fs/data.c in the Linux kernel before 4.11 allows local users to cause a denial of service (integer ove (no CVSS)
- [CVE-2018-0986](https://cve.now/CVE-2018-0986.md): A remote code execution vulnerability exists when the Microsoft Malware Protection Engine does not properly scan a specially crafted file, l (no CVSS, Microsoft Windows Defender · Microsoft Windows Intune En… +5)
- [CVE-2018-6873](https://cve.now/CVE-2018-6873.md): The Auth0 authentication service before 2017-10-15 allows privilege escalation because the JWT audience is not validated. (no CVSS)
- [CVE-2018-6874](https://cve.now/CVE-2018-6874.md): CSRF exists in the Auth0 authentication service through 14591 if the Legacy Lock API flag is enabled. (no CVSS, auth0-js)
- [CVE-2017-13267](https://cve.now/CVE-2017-13267.md): In avrc\_pars\_vendor\_cmd of avrc\_pars\_tg.cc, there is a possible stack corruption due to a missing bounds check. (no CVSS, Google Android)
- [CVE-2017-13274](https://cve.now/CVE-2017-13274.md): In the getHost() function of UriTest.java, there is the possibility of incorrect web origin determination. (no CVSS, Google Android)
- [CVE-2017-13275](https://cve.now/CVE-2017-13275.md): In getVSCoverage of CmapCoverage.cpp, there is a possible out of bounds read due to an incorrect bounds check. (no CVSS, Google Android)
- [CVE-2017-13276](https://cve.now/CVE-2017-13276.md): In CProgramConfig\_ReadHeightExt of tpdec\_asc.cpp, there is a possible stack buffer overflow due to a missing bounds check. (no CVSS, Google Android)
- [CVE-2017-13277](https://cve.now/CVE-2017-13277.md): In ihevcd\_fmt\_conv of ihevcd\_fmt\_conv.c, there is a possible out of bounds write due to a missing bounds check. (no CVSS, Google Android)
- [CVE-2017-13278](https://cve.now/CVE-2017-13278.md): In MediaPlayerService::Client::notify of MediaPlayerService.cpp, there is a possible use after free. (no CVSS, Google Android)
- [CVE-2017-13279](https://cve.now/CVE-2017-13279.md): In M3UParser::parse of M3UParser.cpp, there is a memory resource exhaustion due to a large loop of pushing items into a vector. (no CVSS, Google Android)
- [CVE-2017-13280](https://cve.now/CVE-2017-13280.md): In the FrameSequence\_gif::FrameSequence\_gif function of libframesequence, there is a out of bounds read due to a missing bounds check. (no CVSS, Google Android)
- [CVE-2017-13281](https://cve.now/CVE-2017-13281.md): In avrc\_pars\_browsing\_cmd of avrc\_pars\_tg.cc, there is a possible stack buffer overflow due to an incorrect bounds check. (no CVSS, Google Android)
- [CVE-2017-13282](https://cve.now/CVE-2017-13282.md): In avrc\_ctrl\_pars\_vendor\_rsp of avrc\_pars\_ct.cc, there is a possible stack buffer overflow due to a missing bounds check. (no CVSS, Google Android)
- [CVE-2017-13283](https://cve.now/CVE-2017-13283.md): In avrc\_ctrl\_pars\_vendor\_rsp of bluetooth avrcp\_ctrl, there is a possible out of bounds write on the stack due to a missing bounds check. (no CVSS, Google Android)
- [CVE-2017-13284](https://cve.now/CVE-2017-13284.md): In config\_set\_string of config.cc, it is possible to pair a second BT keyboard without user approval due to improper input validation. (no CVSS, Google Android)
- [CVE-2017-13285](https://cve.now/CVE-2017-13285.md): In SvoxSsmlParser and startElement of svox\_ssml\_parser.cpp, there is a possible out of bounds write due to an uninitialized buffer. (no CVSS, Google Android)
- [CVE-2017-13286](https://cve.now/CVE-2017-13286.md): In writeToParcel and readFromParcel of OutputConfiguration.java, there is a permission bypass due to mismatched serialization. (no CVSS, Google Android)
- [CVE-2017-13287](https://cve.now/CVE-2017-13287.md): In createFromParcel of VerifyCredentialResponse.java, there is a possible invalid parcel read due to improper input validation. (no CVSS, Google Android)
- [CVE-2017-13288](https://cve.now/CVE-2017-13288.md): In writeToParcel and readFromParcel of PeriodicAdvertisingReport.java, there is a permission bypass due to a 64/32bit int mismatch. (no CVSS, Google Android)
- [CVE-2017-13289](https://cve.now/CVE-2017-13289.md): In writeToParcel and createFromParcel of RttManager.java, there is a permission bypass due to a write size mismatch. (no CVSS, Google Android)
- [CVE-2017-13290](https://cve.now/CVE-2017-13290.md): In sdp\_server\_handle\_client\_req of sdp\_server.cc, there is an out of bounds read due to a missing bounds check. (no CVSS, Google Android)
- [CVE-2017-13291](https://cve.now/CVE-2017-13291.md): In avrc\_ctrl\_pars\_vendor\_rsp of avrc\_pars\_ct.cc, there is a possible NULL pointer dereference due to missing bounds checks. (no CVSS, Google Android)
- [CVE-2017-13292](https://cve.now/CVE-2017-13292.md): In wl\_get\_assoc\_ies of wl\_cfg80211.c, there is a possible out of bounds write due to an incorrect bounds check. (no CVSS, Google Android)
- [CVE-2017-13293](https://cve.now/CVE-2017-13293.md): In the nfc\_hci\_cmd\_received() function of core.c, there is a possible out of bounds write due to a missing bounds check. (no CVSS, Google Android)
- [CVE-2017-13294](https://cve.now/CVE-2017-13294.md): A information disclosure vulnerability in the Android framework (aosp email application). (no CVSS, Google Android)
- [CVE-2017-13295](https://cve.now/CVE-2017-13295.md): A denial of service vulnerability in the Android framework (package installer). (no CVSS, Google Android)
- [CVE-2017-13296](https://cve.now/CVE-2017-13296.md): A information disclosure vulnerability in the Android media framework (libavc). (no CVSS, Google Android)
- [CVE-2017-13297](https://cve.now/CVE-2017-13297.md): A information disclosure vulnerability in the Android media framework (libhevc). (no CVSS, Google Android)
- [CVE-2017-13298](https://cve.now/CVE-2017-13298.md): A information disclosure vulnerability in the Android media framework (libhavc). (no CVSS, Google Android)
- [CVE-2017-13299](https://cve.now/CVE-2017-13299.md): A other vulnerability in the Android media framework (libavc). (no CVSS, Google Android)
- [CVE-2017-13300](https://cve.now/CVE-2017-13300.md): A denial of service vulnerability in the Android media framework (libhevc). (no CVSS, Google Android)
- [CVE-2017-13301](https://cve.now/CVE-2017-13301.md): A denial of service vulnerability in the Android system (system ui). (no CVSS, Google Android)
- [CVE-2017-13302](https://cve.now/CVE-2017-13302.md): A denial of service vulnerability in the Android system (system ui). (no CVSS, Google Android)
- [CVE-2017-13303](https://cve.now/CVE-2017-13303.md): A information disclosure vulnerability in the Broadcom bcmdhd driver. (no CVSS, Google Android)
- [CVE-2017-13304](https://cve.now/CVE-2017-13304.md): A information disclosure vulnerability in the Upstream kernel mnh\_sm driver. (no CVSS, Google Android)
- [CVE-2017-13305](https://cve.now/CVE-2017-13305.md): A information disclosure vulnerability in the Upstream kernel encrypted-keys. (no CVSS, Google Android)
- [CVE-2017-13306](https://cve.now/CVE-2017-13306.md): A elevation of privilege vulnerability in the Upstream kernel mnh driver. (no CVSS, Google Android)
- [CVE-2017-13307](https://cve.now/CVE-2017-13307.md): A elevation of privilege vulnerability in the Upstream kernel pci sysfs. (no CVSS, Google Android)
- [CVE-2018-8813](https://cve.now/CVE-2018-8813.md): Open redirect vulnerability in the login\[redirect\] parameter login functionality in WolfCMS 0.8.3.1 allows remote attackers to redirect user (no CVSS)
- [CVE-2018-8814](https://cve.now/CVE-2018-8814.md): Cross-site request forgery (CSRF) vulnerability in WolfCMS 0.8.3.1 allows remote attackers to hijack the authentication of users for request (no CVSS)
- [CVE-2018-9205](https://cve.now/CVE-2018-9205.md): Vulnerability in avatar\_uploader v7.x-1.0-beta8 , The code in view.php doesn't verify users or sanitize the file path. (no CVSS, Robbin Zhao avatar\_uploader)
- [CVE-2018-9248](https://cve.now/CVE-2018-9248.md): FiberHome VDSL2 Modem HG 150-UB devices allow authentication bypass via a "Cookie: Name=0admin" header. (no CVSS)
- [CVE-2018-9249](https://cve.now/CVE-2018-9249.md): FiberHome VDSL2 Modem HG 150-UB devices allow authentication bypass by ignoring the parent.location='login.html' JavaScript code in the resp (no CVSS)
- [CVE-2018-6917](https://cve.now/CVE-2018-6917.md): In FreeBSD before 11.1-STABLE, 11.1-RELEASE-p9, 10.4-STABLE, 10.4-RELEASE-p8 and 10.3-RELEASE-p28, insufficient validation of user-provided (no CVSS, FreeBSD)
- [CVE-2018-6918](https://cve.now/CVE-2018-6918.md): In FreeBSD before 11.1-STABLE, 11.1-RELEASE-p9, 10.4-STABLE, 10.4-RELEASE-p8 and 10.3-RELEASE-p28, the length field of the ipsec option head (no CVSS, FreeBSD)
- [CVE-2018-6919](https://cve.now/CVE-2018-6919.md): In FreeBSD before 11.1-STABLE, 11.1-RELEASE-p9, 10.4-STABLE, 10.4-RELEASE-p8 and 10.3-RELEASE-p28, due to insufficient initialization of mem (no CVSS, FreeBSD)
- [CVE-2017-3964](https://cve.now/CVE-2017-3964.md): SB10192 - Network Security Management (NSM) - Reflective Cross-Site Scripting (XSS) vulnerability (CVSS 3.5, McAfee Network Security Management)
- [CVE-2017-3965](https://cve.now/CVE-2017-3965.md): SB10192 - Network Security Management (NSM) - Cross-Site Request Forgery (CSRF) (aka Session Riding) vulnerability (CVSS 8.8, McAfee Network Security Management)
- [CVE-2017-3966](https://cve.now/CVE-2017-3966.md): SB10192 - Network Security Management (NSM) - Exploitation of session variables, resource IDs and other trusted credentials vulnerability (CVSS 6.4, McAfee Network Security Management)
- [CVE-2017-3967](https://cve.now/CVE-2017-3967.md): SB10192 - Network Security Management (NSM) - Target influence via framing vulnerability (CVSS 6.1, McAfee Network Security Management)
- [CVE-2017-3969](https://cve.now/CVE-2017-3969.md): SB10192 - Network Security Management (NSM) - Abuse of communication channels vulnerability (CVSS 8.2, McAfee Network Security Management)
- [CVE-2017-3971](https://cve.now/CVE-2017-3971.md): SB10192 - Network Security Management (NSM) - Cryptanalysis vulnerability (CVSS 8.2, McAfee Network Security Management)
- [CVE-2017-18096](https://cve.now/CVE-2017-18096.md): The OAuth status rest resource in Atlassian Application Links before version 5.2.7, from 5.3.0 before 5.3.4 and from 5.4.0 before 5.4.3 allo (no CVSS, Atlassian Application Links)
- [CVE-2018-9235](https://cve.now/CVE-2018-9235.md): iScripts SonicBB 1.0 has Reflected Cross-Site Scripting via the query parameter to search.php. (no CVSS)
- [CVE-2018-9236](https://cve.now/CVE-2018-9236.md): iScripts EasyCreate 3.2.1 has Stored Cross-Site Scripting in the "Site title" field. (no CVSS)
- [CVE-2018-9237](https://cve.now/CVE-2018-9237.md): iScripts EasyCreate 3.2.1 has Stored Cross-Site Scripting in the "Site Description" field. (no CVSS)
- [CVE-2018-9238](https://cve.now/CVE-2018-9238.md): proberv.php in Yahei-PHP Proberv 0.4.7 has XSS via the funName parameter. (no CVSS)
- [CVE-2018-9256](https://cve.now/CVE-2018-9256.md): In Wireshark 2.4.0 to 2.4.5 and 2.2.0 to 2.2.13, the LWAPP dissector could crash. (no CVSS)
- [CVE-2018-9257](https://cve.now/CVE-2018-9257.md): In Wireshark 2.4.0 to 2.4.5, the CQL dissector could go into an infinite loop. (no CVSS)
- [CVE-2018-9258](https://cve.now/CVE-2018-9258.md): In Wireshark 2.4.0 to 2.4.5, the TCP dissector could crash. (no CVSS)
- [CVE-2018-9259](https://cve.now/CVE-2018-9259.md): In Wireshark 2.4.0 to 2.4.5 and 2.2.0 to 2.2.13, the MP4 dissector could crash. (no CVSS)
- [CVE-2018-9260](https://cve.now/CVE-2018-9260.md): In Wireshark 2.4.0 to 2.4.5 and 2.2.0 to 2.2.13, the IEEE 802.15.4 dissector could crash. (no CVSS)
- [CVE-2018-9261](https://cve.now/CVE-2018-9261.md): In Wireshark 2.4.0 to 2.4.5 and 2.2.0 to 2.2.13, the NBAP dissector could crash with a large loop that ends with a heap-based buffer overflo (no CVSS)
- [CVE-2018-9262](https://cve.now/CVE-2018-9262.md): In Wireshark 2.4.0 to 2.4.5 and 2.2.0 to 2.2.13, the VLAN dissector could crash. (no CVSS)
- [CVE-2018-9263](https://cve.now/CVE-2018-9263.md): In Wireshark 2.4.0 to 2.4.5 and 2.2.0 to 2.2.13, the Kerberos dissector could crash. (no CVSS)
- [CVE-2018-9264](https://cve.now/CVE-2018-9264.md): In Wireshark 2.4.0 to 2.4.5 and 2.2.0 to 2.2.13, the ADB dissector could crash with a heap-based buffer overflow. (no CVSS)
- [CVE-2018-9265](https://cve.now/CVE-2018-9265.md): In Wireshark 2.4.0 to 2.4.5 and 2.2.0 to 2.2.13, epan/dissectors/packet-tn3270.c has a memory leak. (no CVSS)
- [CVE-2018-9266](https://cve.now/CVE-2018-9266.md): In Wireshark 2.4.0 to 2.4.5 and 2.2.0 to 2.2.13, epan/dissectors/packet-isup.c has a memory leak. (no CVSS)
- [CVE-2018-9267](https://cve.now/CVE-2018-9267.md): In Wireshark 2.4.0 to 2.4.5 and 2.2.0 to 2.2.13, epan/dissectors/packet-lapd.c has a memory leak. (no CVSS)
- [CVE-2018-9268](https://cve.now/CVE-2018-9268.md): In Wireshark 2.4.0 to 2.4.5 and 2.2.0 to 2.2.13, epan/dissectors/packet-smb2.c has a memory leak. (no CVSS)
- [CVE-2018-9269](https://cve.now/CVE-2018-9269.md): In Wireshark 2.4.0 to 2.4.5 and 2.2.0 to 2.2.13, epan/dissectors/packet-giop.c has a memory leak. (no CVSS)
- [CVE-2018-9270](https://cve.now/CVE-2018-9270.md): In Wireshark 2.4.0 to 2.4.5 and 2.2.0 to 2.2.13, epan/oids.c has a memory leak. (no CVSS)
- [CVE-2018-9271](https://cve.now/CVE-2018-9271.md): In Wireshark 2.4.0 to 2.4.5 and 2.2.0 to 2.2.13, epan/dissectors/packet-multipart.c has a memory leak. (no CVSS)
- [CVE-2018-9272](https://cve.now/CVE-2018-9272.md): In Wireshark 2.4.0 to 2.4.5 and 2.2.0 to 2.2.13, epan/dissectors/packet-h223.c has a memory leak. (no CVSS)
- [CVE-2018-9273](https://cve.now/CVE-2018-9273.md): In Wireshark 2.4.0 to 2.4.5 and 2.2.0 to 2.2.13, epan/dissectors/packet-pcp.c has a memory leak. (no CVSS)
- [CVE-2018-9274](https://cve.now/CVE-2018-9274.md): In Wireshark 2.4.0 to 2.4.5 and 2.2.0 to 2.2.13, ui/failure\_message.c has a memory leak. (no CVSS)
- [CVE-2016-10718](https://cve.now/CVE-2016-10718.md): Brave Browser before 0.13.0 allows a tab to close itself even if the tab was not opened by a script, resulting in denial of service. (no CVSS)
- [CVE-2017-18256](https://cve.now/CVE-2017-18256.md): Brave Browser before 0.13.0 allows remote attackers to cause a denial of service (resource consumption) via a long alert() argument in JavaS (no CVSS)
- [CVE-2018-9251](https://cve.now/CVE-2018-9251.md): The xz\_decomp function in xzlib.c in libxml2 2.9.8, if --with-lzma is used, allows remote attackers to cause a denial of service (infinite l (no CVSS)
- [CVE-2018-9252](https://cve.now/CVE-2018-9252.md): JasPer 2.0.14 allows denial of service via a reachable assertion in the function jpc\_abstorelstepsize in libjasper/jpc/jpc\_enc.c. (no CVSS)
- [CVE-2018-9119](https://cve.now/CVE-2018-9119.md): An attacker with physical access to a BrilliantTS FUZE card (MCU firmware 0.1.73, BLE firmware 0.7.4) can unlock the card, extract credit ca (no CVSS)
- [CVE-2018-9234](https://cve.now/CVE-2018-9234.md): GnuPG 2.2.4 and 2.2.5 does not enforce a configuration in which key certification requires an offline master Certify key, which results in a (no CVSS)
- [CVE-2018-9247](https://cve.now/CVE-2018-9247.md): The upsql function in \\Lib\\Lib\\Action\\Admin\\DataAction.class.php in Gxlcms QY v1.0.0713 allows remote attackers to execute arbitrary SQL sta (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2018-04-04
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.