# CVEs published 2018-04-06

14 CVEs were published on April 6, 2018: 0 critical, 0 high. Days are UTC.

- [CVE-2018-9838](https://cve.now/CVE-2018-9838.md): The caml\_ba\_deserialize function in byterun/bigarray.c in the standard library in OCaml 4.06.0 has an integer overflow which, in situations (no CVSS)
- [CVE-2013-6876](https://cve.now/CVE-2013-6876.md): The (1) pty\_init\_terminal and (2) pipe\_init\_terminal functions in main.c in s3dvt 0.2.2 and earlier allows local users to gain privileges by (no CVSS)
- [CVE-2014-1226](https://cve.now/CVE-2014-1226.md): The pipe\_init\_terminal function in main.c in s3dvt allows local users to gain privileges by leveraging setuid permissions and usage of bash (no CVSS)
- [CVE-2014-2359](https://cve.now/CVE-2014-2359.md): OleumTech Wireless Sensor Network devices allow remote attackers to obtain sensitive information about sensor nodes or spoof devices by read (no CVSS)
- [CVE-2014-3539](https://cve.now/CVE-2014-3539.md): base/oi/doa.py in the Rope library in CPython (aka Python) allows remote attackers to execute arbitrary code by leveraging an unsafe call to (no CVSS, rope)
- [CVE-2014-5034](https://cve.now/CVE-2014-5034.md): Cross-site request forgery (CSRF) vulnerability in the Brute Force Login Protection module 1.3 for WordPress allows remote attackers to hija (no CVSS)
- [CVE-2014-5072](https://cve.now/CVE-2014-5072.md): Cross-site request forgery (CSRF) vulnerability in WP Security Audit Log plugin before 1.2.5 for WordPress allows remote attackers to hijack (no CVSS)
- [CVE-2018-7506](https://cve.now/CVE-2018-7506.md): The private key of the web server in Moxa MXview versions 2.8 and prior is able to be read and accessed via an HTTP GET request, which may a (no CVSS, ICS-CERT Moxa MXview)
- [CVE-2017-18097](https://cve.now/CVE-2017-18097.md): The Trello board importer resource in Atlassian Jira before version 7.6.1 allows remote attackers who can convince a Jira administrator to i (no CVSS, Atlassian Jira)
- [CVE-2017-18098](https://cve.now/CVE-2017-18098.md): The searchrequest-xml resource in Atlassian Jira before version 7.6.1 allows remote attackers to inject arbitrary HTML or JavaScript via a c (no CVSS, Atlassian Jira)
- [CVE-2018-1000156](https://cve.now/CVE-2018-1000156.md): GNU Patch version 2.7.6 contains an input validation vulnerability when processing patch files, specifically the EDITOR\_PROGRAM invocation ( (no CVSS)
- [CVE-2018-1270](https://cve.now/CVE-2018-1270.md): Spring Framework, versions 5.0 prior to 5.0.5 and versions 4.3 prior to 4.3.15 and older unsupported versions, allow applications to expose (no CVSS, Spring by Pivotal Spring Framework · org.springframework:sp…)
- [CVE-2018-1271](https://cve.now/CVE-2018-1271.md): Spring Framework, versions 5.0 prior to 5.0.5 and versions 4.3 prior to 4.3.15 and older unsupported versions, allow applications to configu (no CVSS, Spring by Pivotal Spring Framework · org.springframework:sp…)
- [CVE-2018-1272](https://cve.now/CVE-2018-1272.md): Spring Framework, versions 5.0 prior to 5.0.5 and versions 4.3 prior to 4.3.15 and older unsupported versions, provide client-side support f (no CVSS, Spring by Pivotal Spring Framework · org.springframework:sp…)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2018-04-06
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.