CVEs published April 5, 2018
57 CVEs were published on April 5, 2018: 16 critical, 4 high.
- Published
- 57
- Critical
- 16
- High
- 4
- Medium
- 2
- Low
- 0
- Unrated
- 35
- Now in CISA KEV
- 0
- Fix available
- 12
Most affected products
- Talos Allen Bradley
- 16
- Google Android
- 6
- Natus Medical Incorporated Natus
- 5
- org.jenkins-ci.plugins:vsphere-cloud
- 3
- Phoenix Contact ILC PLCs
- 3
- Apache Software Foundation Apache Hive · org.apache.hive… +2
- 2
- org.jenkins-ci.plugins:ghprb
- 2
- org.jvnet.hudson.plugins:perforce
- 2
- Apache Software Foundation Apache Hive · org.apache.hive:hi…
- 1
- Circle Media Circle
- 1
Critical 16
- CVE-2017-14462An exploitable access control vulnerability exists in the data, program, and function file permissions functionality of Allen Bradley MicrolTalos Allen Bradley
- CVE-2017-14463An exploitable access control vulnerability exists in the data, program, and function file permissions functionality of Allen Bradley MicrolTalos Allen Bradley
- CVE-2017-14464An exploitable access control vulnerability exists in the data, program, and function file permissions functionality of Allen Bradley MicrolTalos Allen Bradley
- CVE-2017-14465An exploitable access control vulnerability exists in the data, program, and function file permissions functionality of Allen Bradley MicrolTalos Allen Bradley
- CVE-2017-14466An exploitable access control vulnerability exists in the data, program, and function file permissions functionality of Allen Bradley MicrolTalos Allen Bradley
- CVE-2017-14467An exploitable access control vulnerability exists in the data, program, and function file permissions functionality of Allen Bradley MicrolTalos Allen Bradley
- CVE-2017-14468An exploitable access control vulnerability exists in the data, program, and function file permissions functionality of Allen Bradley MicrolTalos Allen Bradley
- CVE-2017-14469An exploitable access control vulnerability exists in the data, program, and function file permissions functionality of Allen Bradley MicrolTalos Allen Bradley
- CVE-2017-14470An exploitable access control vulnerability exists in the data, program, and function file permissions functionality of Allen Bradley MicrolTalos Allen Bradley
- CVE-2017-14471An exploitable access control vulnerability exists in the data, program, and function file permissions functionality of Allen Bradley MicrolTalos Allen Bradley
- CVE-2017-14472An exploitable access control vulnerability exists in the data, program, and function file permissions functionality of Allen Bradley MicrolTalos Allen Bradley
- CVE-2017-14473An exploitable access control vulnerability exists in the data, program, and function file permissions functionality of Allen Bradley MicrolTalos Allen Bradley
- CVE-2017-2853An exploitable Code Execution vulnerability exists in the RequestForPatientInfoEEGfile functionality of Natus Xltek NeuroWorks 8.Natus Medical Incorporated Natus
- CVE-2017-2867An exploitable code execution vulnerability exists in the SavePatientMontage functionality of Natus Xltek NeuroWorks 8.Natus Medical Incorporated Natus
- CVE-2017-2868An exploitable code execution vulnerability exists in the NewProducerStream functionality of Natus Xltek NeuroWorks 8.Natus Medical Incorporated Natus
- CVE-2017-2869An exploitable code execution vulnerability exists in the OpenProducer functionality of Natus Xltek NeuroWorks 8.Natus Medical Incorporated Natus
High 4
- CVE-2017-12088An exploitable denial of service vulnerability exists in the Ethernet functionality of the Allen Bradley Micrologix 1400 Series B FRN 21.2 aTalos Allen Bradley
- CVE-2017-12089An exploitable denial of service vulnerability exists in the program download functionality of Allen Bradley Micrologix 1400 Series B FRN 21Talos Allen Bradley
- CVE-2017-12090An exploitable denial of service vulnerability exists in the processing of snmp-set commands of the Allen Bradley Micrologix 1400 Series B FTalos Allen Bradley
- CVE-2017-2861An exploitable Denial of Service vulnerability exists in the use of a return value in the NewProducerStream command in Natus Xltek NeuroWorkNatus Medical Incorporated Natus
Medium, low and unrated 37
- CVE-2017-12093An exploitable insufficient resource pool vulnerability exists in the session communication functionality of Allen Bradley Micrologix 1400 STalos Allen Bradley
- CVE-2018-1096An input sanitization flaw was found in the id field in the dashboard controller of Foreman before 1.16.1.Foreman Project Foreman
- CVE-2017-12095An exploitable vulnerability exists in the WiFi Access Point feature of Circle with Disney running firmware 2.0.1.Circle Media Circle
- CVE-2018-9328PHP Scripts Mall Redbus Clone Script 3.0.6 has XSS via the ter_from or tag parameter to results.php.
- CVE-2015-9016In blk_mq_tag_to_rq in blk-mq.c in the upstream kernel, there is a possible use after free due to a race condition when a request has been pGoogle Android
- CVE-2016-8482An elevation of privilege vulnerability in the NVIDIA GPU driver.Google Android
- CVE-2017-0431An elevation of privilege vulnerability in Qualcomm closed source components.Google Android
- CVE-2017-0744An elevation of privilege vulnerability in the NVIDIA firmware processing code.Google Android
- CVE-2017-0748An information disclosure vulnerability in the Qualcomm audio driver.Google Android
- CVE-2017-0751An elevation of privilege vulnerability in the Qualcomm QCE driver.Google Android
- CVE-2014-3413The MySQL server in Juniper Networks Junos Space before 13.3R1.8 has an unspecified account with a hardcoded password, which allows remote a
- CVE-2018-4863Sophos Endpoint Protection 10.7 allows local users to bypass an intended tamper protection mechanism by deleting the HKEY_LOCAL_MACHINE\SYST
- CVE-2018-9233Sophos Endpoint Protection 10.7 uses an unsalted SHA-1 hash for password storage in %PROGRAMDATA%\Sophos\Sophos Anti-Virus\Config\machine.xm
- CVE-2016-8366Webvisit in Phoenix Contact ILC PLCs offers a password macro to protect HMI pages on the PLC against casual or coincidental opening of HMI pPhoenix Contact ILC PLCs
- CVE-2016-8371The web server in Phoenix Contact ILC PLCs can be accessed without authenticating even if the authentication mechanism is enabled.Phoenix Contact ILC PLCs
- CVE-2016-8380The web server in Phoenix Contact ILC PLCs allows access to read and write PLC variables without authentication.Phoenix Contact ILC PLCs
- CVE-2018-3624Buffer overflow in ETWS processing module Intel XMM71xx, XMM72xx, XMM73xx, XMM74xx and Sofia 3G/R allows remote attacker to potentially execIntel XMM71xx, Intel XMM72xx, Intel XMM73xx, Intel XMM74xx,…
- CVE-2018-7035Cross-site scripting (XSS) vulnerability in Gleez CMS 1.2.0 and 2.0 might allow remote attackers (users) to inject JavaScript via HTML contegleez/cms
- CVE-2018-9243GitLab Community and Enterprise Editions version 8.4 up to 10.4 are vulnerable to XSS because a lack of input validation in the merge reques
- CVE-2018-9244GitLab Community and Enterprise Editions version 9.2 up to 10.4 are vulnerable to XSS because a lack of input validation in the milestones c
- CVE-2018-1000142An exposure of sensitive information vulnerability exists in Jenkins GitHub Pull Request Builder Plugin version 1.39.0 and older in GhprbCauorg.jenkins-ci.plugins:ghprb
- CVE-2018-1000143An exposure of sensitive information vulnerability exists in Jenkins GitHub Pull Request Builder Plugin version 1.39.0 and older in GhprbCauorg.jenkins-ci.plugins:ghprb
- CVE-2018-1000144A cross site scripting vulnerability exists in Jenkins Cucumber Living Documentation Plugin 1.0.12 and older in CukedoctorBaseAction#doDynamorg.jenkins-ci.plugins:cucumber-living-documentation
- CVE-2018-1000145An exposure of sensitive information vulnerability exists in Jenkins Perforce Plugin version 1.3.36 and older in PerforcePasswordEncryptor.jorg.jvnet.hudson.plugins:perforce
- CVE-2018-1000146An arbitrary code execution vulnerability exists in Liquibase Runner Plugin version 1.3.0 and older that allows an attacker with permission org.jenkins-ci.plugins:liquibase-runner
- CVE-2018-1000147An exposure of sensitive information vulnerability exists in Jenkins Perforce Plugin version 1.3.36 and older in PerforcePasswordEncryptor.jorg.jvnet.hudson.plugins:perforce
- CVE-2018-1000148An exposure of sensitive information vulnerability exists in Jenkins Copy To Slave Plugin version 1.4.4 and older in CopyToSlaveBuildWrapperorg.jenkins-ci.plugins:copy-to-slave
- CVE-2018-1000149A man in the middle vulnerability exists in Jenkins Ansible Plugin 0.8 and older in AbstractAnsibleInvocation.java, AnsibleAdHocCommandBuildorg.jenkins-ci.plugins:ansible
- CVE-2018-1000150An exposure of sensitive information vulnerability exists in Jenkins Reverse Proxy Auth Plugin 1.5 and older in ReverseProxySecurityRealm#auorg.jenkins-ci.plugins:reverse-proxy-auth-plugin
- CVE-2018-1000151A man in the middle vulnerability exists in Jenkins vSphere Plugin 2.16 and older in VSphere.java that disables SSL/TLS certificate validatiorg.jenkins-ci.plugins:vsphere-cloud
- CVE-2018-1000152An improper authorization vulnerability exists in Jenkins vSphere Plugin 2.16 and older in Clone.java, CloudSelectorParameter.java, ConvertTorg.jenkins-ci.plugins:vsphere-cloud
- CVE-2018-1000153A cross-site request forgery vulnerability exists in Jenkins vSphere Plugin 2.16 and older in Clone.java, CloudSelectorParameter.java, Conveorg.jenkins-ci.plugins:vsphere-cloud
- CVE-2018-1000154Zammad GmbH Zammad version 2.3.0 and earlier contains a Improper Neutralization of Script-Related HTML Tags in a Web Page (CWE-80) vulnerabi
- CVE-2018-1282This vulnerability in Apache Hive JDBC driver 0.7.1 to 2.3.2 allows carefully crafted arguments to be used to bypass the argument escaping/cApache Software Foundation Apache Hive · org.apache.hive:hi…
- CVE-2018-1284In Apache Hive 0.6.0 to 2.3.2, malicious user might use any xpath UDFs (xpath/xpath_string/xpath_boolean/xpath_number/xpath_double/xpath_floApache Software Foundation Apache Hive · org.apache.hive… +2
- CVE-2018-1315In Apache Hive 2.1.0 to 2.3.2, when 'COPY FROM FTP' statement is run using HPL/SQL extension to Hive, a compromised/malicious FTP server canApache Software Foundation Apache Hive · org.apache.hive… +2
- CVE-2018-9309An issue was discovered in zzcms 8.2.