CVEs published April 10, 2018
50 CVEs were published on April 10, 2018: 0 critical, 2 high.
- Published
- 50
- Critical
- 0
- High
- 2
- Medium
- 9
- Low
- 1
- Unrated
- 38
- Now in CISA KEV
- 0
- Fix available
- 2
Most affected products
- SAP SE SAP Disclosure Management
- 4
- Cisco Systems Simple DirectMedia
- 2
- Atlassian Application Links
- 1
- Atlassian Jira
- 1
- Cisco Systems Simple Direct Media
- 1
- FreeBSD
- 1
- ikiwiki
- 1
- SAP SE SAP Business Objects
- 1
- SAP SE SAP Business One
- 1
- SAP SE SAP Cloud Platform Connector
- 1
High 2
- CVE-2018-3839An exploitable code execution vulnerability exists in the XCF image rendering functionality of Simple DirectMedia Layer SDL2_image-2.0.2.Cisco Systems Simple DirectMedia
- CVE-2018-2408Improper Session Management in SAP Business Objects, 4.0, from 4.10, from 4.20, 4.30, CMC/BI Launchpad/Fiorified BI Launchpad.SAP SE SAP Business Objects
Medium, low and unrated 48
- CVE-2016-9645Editing restriction bypass for git revertikiwiki
- CVE-2018-9995TBK DVR4104 and DVR4216 devices, as well as Novo, CeNova, QSee, Pulnix, XVR 5 in 1, Securus, Night OWL, DVR Login, HVR Login, and MDVR Login
- CVE-2018-9996An issue was discovered in cplus-dem.c in GNU libiberty, as distributed in GNU Binutils 2.30.
- CVE-2018-3837An exploitable information disclosure vulnerability exists in the PCX image rendering functionality of Simple DirectMedia Layer SDL2_image-2Cisco Systems Simple Direct Media
- CVE-2018-3838An exploitable information vulnerability exists in the XCF image rendering functionality of Simple DirectMedia Layer SDL2_image-2.0.2.Cisco Systems Simple DirectMedia
- CVE-2018-9993YUNUCMS 1.0.7 has XSS via the content title on an admin/content/addcontent/cid/## page (aka a news center page).
- CVE-2018-9988ARM mbed TLS before 2.1.11, before 2.7.2, and before 2.8.0 has a buffer over-read in ssl_parse_server_key_exchange() that could cause a cras
- CVE-2018-9989ARM mbed TLS before 2.1.11, before 2.7.2, and before 2.8.0 has a buffer over-read in ssl_parse_server_psk_hint() that could cause a crash on
- CVE-2018-8772Coship RT3052 4.0.0.48 devices allow XSS via a crafted SSID field on the "Wireless Setting - Basic" screen.
- CVE-2018-9037Monstra CMS 3.0.4 allows remote code execution via an upload_file request for a .zip file, which is automatically extracted and may contain
- CVE-2018-9038Monstra CMS 3.0.4 allows remote attackers to delete files via an admin/index.php?id=filesmanager&delete_dir=./&path=uploads/ request.
- CVE-2018-9918libqpdf.a in QPDF through 8.0.2 mishandles certain "expected dictionary key but found non-name object" cases, allowing remote attackers to c
- CVE-2018-9985The front page of MetInfo 6.0 allows XSS by sending a feedback message to an administrator.
- CVE-2014-0158Heap-based buffer overflow in the JPEG2000 image tile decoder in OpenJPEG before 1.5.2 allows remote attackers to cause a denial of service
- CVE-2014-1398The entity wrapper access API in the Entity API module 7.x-1.x before 7.x-1.3 for Drupal might allow remote authenticated users to bypass in
- CVE-2014-1399The entity wrapper access API in the Entity API module 7.x-1.x before 7.x-1.3 for Drupal might allow remote authenticated users to bypass in
- CVE-2014-1400The entity_access API in the Entity API module 7.x-1.x before 7.x-1.3 for Drupal might allow remote authenticated users to bypass intended a
- CVE-2014-1889The Group creation process in the Buddypress plugin before 1.9.2 for WordPress allows remote authenticated users to gain control of arbitrar
- CVE-2014-1946OpenDocMan 1.2.7 and earlier does not properly validate allowed actions, which allows remote authenticated users to bypass an intended acces
- CVE-2014-2073Stack-based buffer overflow in Dassault Systemes CATIA V5-6R2013 allows remote attackers to execute arbitrary code via a crafted packet, rel
- CVE-2014-2078The backend in Open-Xchange (OX) AppSuite 7.4.2 before 7.4.2-rev9 allows remote attackers to obtain sensitive information about user email a
- CVE-2014-3114The EZPZ One Click Backup (ezpz-one-click-backup) plugin 12.03.10 and earlier for WordPress allows remote attackers to execute arbitrary com
- CVE-2014-3999The Horde_Ldap library before 2.0.6 for Horde allows remote attackers to bypass authentication by leveraging knowledge of the LDAP bind user
- CVE-2015-0172IBM Security SiteProtector System 3.0, 3.1.0 and 3.1.1 allows remote attackers to bypass intended security restrictions and consequently exe
- CVE-2015-1957IBM WebSphere MQ 7.5.x before 7.5.0.6 and 8.0.x before 8.0.0.3 allows remote authenticated users to obtain sensitive information via a man-i
- CVE-2017-14323SSRF (Server Side Request Forgery) in getRemoteImage.php in Ueditor in Onethink V1.0 and V1.1 allows remote attackers to obtain sensitive in
- CVE-2017-14611SSRF (Server Side Request Forgery) in Cockpit 0.13.0 allows remote attackers to read arbitrary files or send TCP traffic to intranet hosts v
- CVE-2018-2403Under certain conditions, SAP Disclosure Management 10.1 allows an attacker to access information which would otherwise be restricted.SAP SE SAP Disclosure Management
- CVE-2018-2404SAP Disclosure Management 10.1 allows an attacker to upload any file without proper file format validation.SAP SE SAP Disclosure Management
- CVE-2018-2405SAP Solution Manager, 7.10, 7.20, Incident Management Work Center allows an attacker to upload a malicious script as an attachment and this SAP SE SAP Solution Manager
- CVE-2018-2406Unquoted windows search path (directory/path traversal) vulnerability in Crystal Reports Server, OEM Edition (CRSE), 4.0, 4.10, 4.20, 4.30, SAP SE SAP Crystal Reports Server, OEM Edition
- CVE-2018-2409Improper session management when using SAP Cloud Platform 2.0 (Connectivity Service and Cloud Connector).SAP SE SAP Cloud Platform Connector
- CVE-2018-2410SAP Business One, 9.2, 9.3, browser access does not sufficiently encode user controlled inputs, which results in a Cross-Site Scripting (XSSSAP SE SAP Business One
- CVE-2018-2412SAP Disclosure Management 10.1 does not perform necessary authorization checks for an authenticated user, resulting in escalation of privileSAP SE SAP Disclosure Management
- CVE-2018-2413SAP Disclosure Management 10.1 does not perform necessary authorization checks for an authenticated user, resulting in escalation of privileSAP SE SAP Disclosure Management
- CVE-2017-1081In FreeBSD before 11.0-STABLE, 11.0-RELEASE-p10, 10.3-STABLE, and 10.3-RELEASE-p19, ipfilter using "keep state" or "keep frags" options can FreeBSD
- CVE-2017-18100The agile wallboard gadget in Atlassian Jira before version 7.8.1 allows remote attackers to inject arbitrary HTML or JavaScript via a cross
- CVE-2017-18101Various administrative external system import resources in Atlassian JIRA Server (including JIRA Core) before version 7.6.5, from version 7.Atlassian Jira
- CVE-2018-5227Various administrative application link resources in Atlassian Application Links before version 5.4.4 allow remote attackers with administraAtlassian Application Links
- CVE-2018-9934The reset-password feature in MetInfo 6.0 allows remote attackers to change arbitrary passwords via vectors involving a Host HTTP header tha
- CVE-2018-9922An issue was discovered in idreamsoft iCMS through 7.0.7.
- CVE-2018-9923An issue was discovered in idreamsoft iCMS through 7.0.7.
- CVE-2018-9924An issue was discovered in idreamsoft iCMS through 7.0.7.
- CVE-2018-9925An issue was discovered in idreamsoft iCMS through 7.0.7.
- CVE-2018-9926An issue was discovered in WUZHI CMS 4.1.0.
- CVE-2018-9927An issue was discovered in WUZHI CMS 4.1.0.
- CVE-2018-9928Cross-site scripting (XSS) vulnerability in save.php in MetInfo 6.0 allows remote attackers to inject arbitrary web script or HTML via the w
- CVE-2018-9840The Open Whisper Signal app before 2.23.2 for iOS allows physically proximate attackers to bypass the screen locker feature via certain rapi