# CVEs published 2018-04-09

14 CVEs were published on April 9, 2018: 0 critical, 0 high. Days are UTC.

- [CVE-2018-5463](https://cve.now/CVE-2018-5463.md): A structured exception handler overflow vulnerability in Leao Consultoria e Desenvolvimento de Sistemas (LCDS) LTDA ME LAquis SCADA 4.1.0.33 (no CVSS, ICS-CERT LCDS - Leão Consultoria e Desenvolvimen…)
- [CVE-2017-2826](https://cve.now/CVE-2017-2826.md): An information disclosure vulnerability exists in the iConfig proxy request of Zabbix server 2.4.X. (no CVSS, Talos Zabbix)
- [CVE-2018-1217](https://cve.now/CVE-2018-1217.md): Avamar Installation Manager in Dell EMC Avamar Server 7.3.1, 7.4.1, and 7.5.0, and Dell EMC Integrated Data Protection Appliance 2.0 and 2.1 (no CVSS, Dell EMC Avamar, Integrated Data Protection Appliance)
- [CVE-2018-6182](https://cve.now/CVE-2018-6182.md): Mahara 16.10 before 16.10.9 and 17.04 before 17.04.7 and 17.10 before 17.10.4 are vulnerable to bad input when TinyMCE is bypassed by POST p (no CVSS)
- [CVE-2018-9864](https://cve.now/CVE-2018-9864.md): The WP Live Chat Support plugin before 8.0.06 for WordPress has stored XSS via the Name field. (no CVSS)
- [CVE-2018-9862](https://cve.now/CVE-2018-9862.md): util.c in runV 1.0.0 for Docker mishandles a numeric username, which allows attackers to obtain root access by leveraging the presence of an (no CVSS)
- [CVE-2018-0545](https://cve.now/CVE-2018-0545.md): LXR version 1.0.0 to 2.3.0 allows remote attackers to execute arbitrary OS commands via unspecified vectors. (no CVSS, LXR Project LXR)
- [CVE-2018-0553](https://cve.now/CVE-2018-0553.md): The iRemoconWiFi App for Android version 4.1.7 and earlier does not verify X.509 certificates from SSL servers, which allows man-in-the-midd (no CVSS, Glamo iRemoconWiFi App for Android)
- [CVE-2018-0554](https://cve.now/CVE-2018-0554.md): Buffalo WZR-1750DHP2 Ver.2.30 and earlier allows an attacker to bypass authentication and execute arbitrary commands on the device via unspe (no CVSS, BUFFALO WZR-1750DHP2)
- [CVE-2018-0555](https://cve.now/CVE-2018-0555.md): Buffer overflow in Buffalo WZR-1750DHP2 Ver.2.30 and earlier allows an attacker to execute arbitrary code via a specially crafted file. (no CVSS, BUFFALO WZR-1750DHP2)
- [CVE-2018-0556](https://cve.now/CVE-2018-0556.md): Buffalo WZR-1750DHP2 Ver.2.30 and earlier allows an attacker to execute arbitrary OS commands via unspecified vectors. (no CVSS, BUFFALO WZR-1750DHP2)
- [CVE-2018-1308](https://cve.now/CVE-2018-1308.md): This vulnerability in Apache Solr 1.2 to 6.6.2 and 7.0.0 to 7.2.1 relates to an XML external entity expansion (XXE) in the \`&dataConfig=\<inl (no CVSS, Apache Software Foundation Apache Solr · org.apache.solr:so…)
- [CVE-2018-9856](https://cve.now/CVE-2018-9856.md): Kotti before 1.3.2 and 2.x before 2.0.0b2 has CSRF in the local roles implementation, as demonstrated by triggering a permission change via (no CVSS, kotti)
- [CVE-2018-9857](https://cve.now/CVE-2018-9857.md): PHP Scripts Mall Match Clone Script 1.0.4 has XSS via the search field to searchbyid.php (aka the "View Search By Id" screen). (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2018-04-09
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.