# CVEs published 2018-04-05

57 CVEs were published on April 5, 2018: 16 critical, 4 high. Days are UTC.

- [CVE-2017-12088](https://cve.now/CVE-2017-12088.md): An exploitable denial of service vulnerability exists in the Ethernet functionality of the Allen Bradley Micrologix 1400 Series B FRN 21.2 a (CVSS 8.6, Talos Allen Bradley)
- [CVE-2017-12089](https://cve.now/CVE-2017-12089.md): An exploitable denial of service vulnerability exists in the program download functionality of Allen Bradley Micrologix 1400 Series B FRN 21 (CVSS 8.6, Talos Allen Bradley)
- [CVE-2017-12090](https://cve.now/CVE-2017-12090.md): An exploitable denial of service vulnerability exists in the processing of snmp-set commands of the Allen Bradley Micrologix 1400 Series B F (CVSS 7.7, Talos Allen Bradley)
- [CVE-2017-12093](https://cve.now/CVE-2017-12093.md): An exploitable insufficient resource pool vulnerability exists in the session communication functionality of Allen Bradley Micrologix 1400 S (CVSS 5.3, Talos Allen Bradley)
- [CVE-2017-14462](https://cve.now/CVE-2017-14462.md): An exploitable access control vulnerability exists in the data, program, and function file permissions functionality of Allen Bradley Microl (CVSS 10.0, Talos Allen Bradley)
- [CVE-2017-14463](https://cve.now/CVE-2017-14463.md): An exploitable access control vulnerability exists in the data, program, and function file permissions functionality of Allen Bradley Microl (CVSS 10.0, Talos Allen Bradley)
- [CVE-2017-14464](https://cve.now/CVE-2017-14464.md): An exploitable access control vulnerability exists in the data, program, and function file permissions functionality of Allen Bradley Microl (CVSS 10.0, Talos Allen Bradley)
- [CVE-2017-14465](https://cve.now/CVE-2017-14465.md): An exploitable access control vulnerability exists in the data, program, and function file permissions functionality of Allen Bradley Microl (CVSS 10.0, Talos Allen Bradley)
- [CVE-2017-14466](https://cve.now/CVE-2017-14466.md): An exploitable access control vulnerability exists in the data, program, and function file permissions functionality of Allen Bradley Microl (CVSS 10.0, Talos Allen Bradley)
- [CVE-2017-14467](https://cve.now/CVE-2017-14467.md): An exploitable access control vulnerability exists in the data, program, and function file permissions functionality of Allen Bradley Microl (CVSS 10.0, Talos Allen Bradley)
- [CVE-2017-14468](https://cve.now/CVE-2017-14468.md): An exploitable access control vulnerability exists in the data, program, and function file permissions functionality of Allen Bradley Microl (CVSS 10.0, Talos Allen Bradley)
- [CVE-2017-14469](https://cve.now/CVE-2017-14469.md): An exploitable access control vulnerability exists in the data, program, and function file permissions functionality of Allen Bradley Microl (CVSS 10.0, Talos Allen Bradley)
- [CVE-2017-14470](https://cve.now/CVE-2017-14470.md): An exploitable access control vulnerability exists in the data, program, and function file permissions functionality of Allen Bradley Microl (CVSS 10.0, Talos Allen Bradley)
- [CVE-2017-14471](https://cve.now/CVE-2017-14471.md): An exploitable access control vulnerability exists in the data, program, and function file permissions functionality of Allen Bradley Microl (CVSS 10.0, Talos Allen Bradley)
- [CVE-2017-14472](https://cve.now/CVE-2017-14472.md): An exploitable access control vulnerability exists in the data, program, and function file permissions functionality of Allen Bradley Microl (CVSS 10.0, Talos Allen Bradley)
- [CVE-2017-14473](https://cve.now/CVE-2017-14473.md): An exploitable access control vulnerability exists in the data, program, and function file permissions functionality of Allen Bradley Microl (CVSS 10.0, Talos Allen Bradley)
- [CVE-2018-1096](https://cve.now/CVE-2018-1096.md): An input sanitization flaw was found in the id field in the dashboard controller of Foreman before 1.16.1. (no CVSS, Foreman Project Foreman)
- [CVE-2017-12095](https://cve.now/CVE-2017-12095.md): An exploitable vulnerability exists in the WiFi Access Point feature of Circle with Disney running firmware 2.0.1. (CVSS 6.5, Circle Media Circle)
- [CVE-2017-2853](https://cve.now/CVE-2017-2853.md): An exploitable Code Execution vulnerability exists in the RequestForPatientInfoEEGfile functionality of Natus Xltek NeuroWorks 8. (CVSS 10.0, Natus Medical Incorporated Natus)
- [CVE-2017-2861](https://cve.now/CVE-2017-2861.md): An exploitable Denial of Service vulnerability exists in the use of a return value in the NewProducerStream command in Natus Xltek NeuroWork (CVSS 7.5, Natus Medical Incorporated Natus)
- [CVE-2017-2867](https://cve.now/CVE-2017-2867.md): An exploitable code execution vulnerability exists in the SavePatientMontage functionality of Natus Xltek NeuroWorks 8. (CVSS 9.0, Natus Medical Incorporated Natus)
- [CVE-2017-2868](https://cve.now/CVE-2017-2868.md): An exploitable code execution vulnerability exists in the NewProducerStream functionality of Natus Xltek NeuroWorks 8. (CVSS 10.0, Natus Medical Incorporated Natus)
- [CVE-2017-2869](https://cve.now/CVE-2017-2869.md): An exploitable code execution vulnerability exists in the OpenProducer functionality of Natus Xltek NeuroWorks 8. (CVSS 10.0, Natus Medical Incorporated Natus)
- [CVE-2018-9328](https://cve.now/CVE-2018-9328.md): PHP Scripts Mall Redbus Clone Script 3.0.6 has XSS via the ter\_from or tag parameter to results.php. (no CVSS)
- [CVE-2015-9016](https://cve.now/CVE-2015-9016.md): In blk\_mq\_tag\_to\_rq in blk-mq.c in the upstream kernel, there is a possible use after free due to a race condition when a request has been p (no CVSS, Google Android)
- [CVE-2016-8482](https://cve.now/CVE-2016-8482.md): An elevation of privilege vulnerability in the NVIDIA GPU driver. (no CVSS, Google Android)
- [CVE-2017-0431](https://cve.now/CVE-2017-0431.md): An elevation of privilege vulnerability in Qualcomm closed source components. (no CVSS, Google Android)
- [CVE-2017-0744](https://cve.now/CVE-2017-0744.md): An elevation of privilege vulnerability in the NVIDIA firmware processing code. (no CVSS, Google Android)
- [CVE-2017-0748](https://cve.now/CVE-2017-0748.md): An information disclosure vulnerability in the Qualcomm audio driver. (no CVSS, Google Android)
- [CVE-2017-0751](https://cve.now/CVE-2017-0751.md): An elevation of privilege vulnerability in the Qualcomm QCE driver. (no CVSS, Google Android)
- [CVE-2014-3413](https://cve.now/CVE-2014-3413.md): The MySQL server in Juniper Networks Junos Space before 13.3R1.8 has an unspecified account with a hardcoded password, which allows remote a (no CVSS)
- [CVE-2018-4863](https://cve.now/CVE-2018-4863.md): Sophos Endpoint Protection 10.7 allows local users to bypass an intended tamper protection mechanism by deleting the HKEY\_LOCAL\_MACHINE\\SYST (no CVSS)
- [CVE-2018-9233](https://cve.now/CVE-2018-9233.md): Sophos Endpoint Protection 10.7 uses an unsalted SHA-1 hash for password storage in %PROGRAMDATA%\\Sophos\\Sophos Anti-Virus\\Config\\machine.xm (no CVSS)
- [CVE-2016-8366](https://cve.now/CVE-2016-8366.md): Webvisit in Phoenix Contact ILC PLCs offers a password macro to protect HMI pages on the PLC against casual or coincidental opening of HMI p (no CVSS, Phoenix Contact ILC PLCs)
- [CVE-2016-8371](https://cve.now/CVE-2016-8371.md): The web server in Phoenix Contact ILC PLCs can be accessed without authenticating even if the authentication mechanism is enabled. (no CVSS, Phoenix Contact ILC PLCs)
- [CVE-2016-8380](https://cve.now/CVE-2016-8380.md): The web server in Phoenix Contact ILC PLCs allows access to read and write PLC variables without authentication. (no CVSS, Phoenix Contact ILC PLCs)
- [CVE-2018-3624](https://cve.now/CVE-2018-3624.md): Buffer overflow in ETWS processing module Intel XMM71xx, XMM72xx, XMM73xx, XMM74xx and Sofia 3G/R allows remote attacker to potentially exec (no CVSS, Intel XMM71xx, Intel XMM72xx, Intel XMM73xx, Intel XMM74xx,…)
- [CVE-2018-7035](https://cve.now/CVE-2018-7035.md): Cross-site scripting (XSS) vulnerability in Gleez CMS 1.2.0 and 2.0 might allow remote attackers (users) to inject JavaScript via HTML conte (no CVSS, gleez/cms)
- [CVE-2018-9243](https://cve.now/CVE-2018-9243.md): GitLab Community and Enterprise Editions version 8.4 up to 10.4 are vulnerable to XSS because a lack of input validation in the merge reques (no CVSS)
- [CVE-2018-9244](https://cve.now/CVE-2018-9244.md): GitLab Community and Enterprise Editions version 9.2 up to 10.4 are vulnerable to XSS because a lack of input validation in the milestones c (no CVSS)
- [CVE-2018-1000142](https://cve.now/CVE-2018-1000142.md): An exposure of sensitive information vulnerability exists in Jenkins GitHub Pull Request Builder Plugin version 1.39.0 and older in GhprbCau (no CVSS, org.jenkins-ci.plugins:ghprb)
- [CVE-2018-1000143](https://cve.now/CVE-2018-1000143.md): An exposure of sensitive information vulnerability exists in Jenkins GitHub Pull Request Builder Plugin version 1.39.0 and older in GhprbCau (no CVSS, org.jenkins-ci.plugins:ghprb)
- [CVE-2018-1000144](https://cve.now/CVE-2018-1000144.md): A cross site scripting vulnerability exists in Jenkins Cucumber Living Documentation Plugin 1.0.12 and older in CukedoctorBaseAction#doDynam (no CVSS, org.jenkins-ci.plugins:cucumber-living-documentation)
- [CVE-2018-1000145](https://cve.now/CVE-2018-1000145.md): An exposure of sensitive information vulnerability exists in Jenkins Perforce Plugin version 1.3.36 and older in PerforcePasswordEncryptor.j (no CVSS, org.jvnet.hudson.plugins:perforce)
- [CVE-2018-1000146](https://cve.now/CVE-2018-1000146.md): An arbitrary code execution vulnerability exists in Liquibase Runner Plugin version 1.3.0 and older that allows an attacker with permission (no CVSS, org.jenkins-ci.plugins:liquibase-runner)
- [CVE-2018-1000147](https://cve.now/CVE-2018-1000147.md): An exposure of sensitive information vulnerability exists in Jenkins Perforce Plugin version 1.3.36 and older in PerforcePasswordEncryptor.j (no CVSS, org.jvnet.hudson.plugins:perforce)
- [CVE-2018-1000148](https://cve.now/CVE-2018-1000148.md): An exposure of sensitive information vulnerability exists in Jenkins Copy To Slave Plugin version 1.4.4 and older in CopyToSlaveBuildWrapper (no CVSS, org.jenkins-ci.plugins:copy-to-slave)
- [CVE-2018-1000149](https://cve.now/CVE-2018-1000149.md): A man in the middle vulnerability exists in Jenkins Ansible Plugin 0.8 and older in AbstractAnsibleInvocation.java, AnsibleAdHocCommandBuild (no CVSS, org.jenkins-ci.plugins:ansible)
- [CVE-2018-1000150](https://cve.now/CVE-2018-1000150.md): An exposure of sensitive information vulnerability exists in Jenkins Reverse Proxy Auth Plugin 1.5 and older in ReverseProxySecurityRealm#au (no CVSS, org.jenkins-ci.plugins:reverse-proxy-auth-plugin)
- [CVE-2018-1000151](https://cve.now/CVE-2018-1000151.md): A man in the middle vulnerability exists in Jenkins vSphere Plugin 2.16 and older in VSphere.java that disables SSL/TLS certificate validati (no CVSS, org.jenkins-ci.plugins:vsphere-cloud)
- [CVE-2018-1000152](https://cve.now/CVE-2018-1000152.md): An improper authorization vulnerability exists in Jenkins vSphere Plugin 2.16 and older in Clone.java, CloudSelectorParameter.java, ConvertT (no CVSS, org.jenkins-ci.plugins:vsphere-cloud)
- [CVE-2018-1000153](https://cve.now/CVE-2018-1000153.md): A cross-site request forgery vulnerability exists in Jenkins vSphere Plugin 2.16 and older in Clone.java, CloudSelectorParameter.java, Conve (no CVSS, org.jenkins-ci.plugins:vsphere-cloud)
- [CVE-2018-1000154](https://cve.now/CVE-2018-1000154.md): Zammad GmbH Zammad version 2.3.0 and earlier contains a Improper Neutralization of Script-Related HTML Tags in a Web Page (CWE-80) vulnerabi (no CVSS)
- [CVE-2018-1282](https://cve.now/CVE-2018-1282.md): This vulnerability in Apache Hive JDBC driver 0.7.1 to 2.3.2 allows carefully crafted arguments to be used to bypass the argument escaping/c (no CVSS, Apache Software Foundation Apache Hive · org.apache.hive:hi…)
- [CVE-2018-1284](https://cve.now/CVE-2018-1284.md): In Apache Hive 0.6.0 to 2.3.2, malicious user might use any xpath UDFs (xpath/xpath\_string/xpath\_boolean/xpath\_number/xpath\_double/xpath\_flo (no CVSS, Apache Software Foundation Apache Hive · org.apache.hive… +2)
- [CVE-2018-1315](https://cve.now/CVE-2018-1315.md): In Apache Hive 2.1.0 to 2.3.2, when 'COPY FROM FTP' statement is run using HPL/SQL extension to Hive, a compromised/malicious FTP server can (no CVSS, Apache Software Foundation Apache Hive · org.apache.hive… +2)
- [CVE-2018-9309](https://cve.now/CVE-2018-9309.md): An issue was discovered in zzcms 8.2. (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2018-04-05
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.