CVEs published April 11, 2018
88 CVEs were published on April 11, 2018: 3 critical, 8 high. 1 is now in CISA KEV.
- Published
- 88
- Critical
- 3
- High
- 8
- Medium
- 4
- Low
- 0
- Unrated
- 73
- Now in CISA KEV
- 1
- Fix available
- 14
Most affected products
- Qualcomm Snapdragon Mobile, Snapdragon Wear
- 16
- Qualcomm Snapdragon Mobile
- 8
- Juniper Networks Junos OS
- 7
- Qualcomm Snapdragon Automobile, Snapdragon Mobile, Snapdrag…
- 7
- dolibarr/dolibarr
- 4
- Symantec Advanced Secure Gateway · Symantec ProxySG
- 3
- Talos Computerinsel Photoline
- 3
- Qualcomm Snapdragon Automobile, Snapdragon Mobile
- 2
- [UNKNOWN] jenkins · org.jenkins-ci.main:jenkins-core
- 1
- CA Technologies Workload Automation AE
- 1
Critical 3
- CVE-2018-0016Junos OS: Kernel crash upon receipt of crafted CLNP datagramsJuniper Networks Junos OS
- CVE-2017-14459An exploitable OS Command Injection vulnerability exists in the Telnet, SSH, and console login functionality of Moxa AWK-3131A Industrial IETalos Moxa
- CVE-2018-1273Spring Data Commons, versions prior to 1.13 to 1.13.10, 2.0 to 2.0.5, and older unsupported versions, contain a property binder vulnerabilitSpring by Pivotal Spring Framework · org.springframework.da…
High 8
- CVE-2018-3886A memory corruption vulnerability exists in the PCX-parsing functionality of Computerinsel Photoline 20.53.Talos Computerinsel Photoline
- CVE-2018-3887A memory corruption vulnerability exists in the PCX-parsing functionality of Computerinsel Photoline 20.53.Talos Computerinsel Photoline
- CVE-2018-3888A memory corruption vulnerability exists in the PCX-parsing functionality of Computerinsel Photoline 20.53.Talos Computerinsel Photoline
- CVE-2018-0017SRX Series: Denial of service vulnerability in flowd daemon on devices configured with NAT-PTJuniper Networks Junos OS
- CVE-2018-0018SRX Series: A crafted packet may lead to information disclosure and firewall rule bypass during compilation of IDP policies.Juniper Networks Junos OS
- CVE-2018-0020Junos OS: rpd daemon cores due to malformed BGP UPDATE packetJuniper Networks Junos OS
- CVE-2018-0021Junos OS: Short MacSec keys may allow man-in-the-middle attacks.Juniper Networks Junos OS
- CVE-2018-0022Junos OS: Mbuf leak due to processing MPLS packets in VPLS network.Juniper Networks Junos OS
Medium, low and unrated 77
- CVE-2018-10048iScripts eSwap v2.4 has CSRF via "registration_settings.php" in the Admin Panel.
- CVE-2018-10049iScripts eSwap v2.4 has XSS via the "registration_settings.php" txtDate parameter in the Admin Panel.
- CVE-2018-10050iScripts eSwap v2.4 has SQL injection via the "registration_settings.php" ddlFree parameter in the Admin Panel.
- CVE-2018-10051iScripts SupportDesk v4.3 has XSS via the staff/inteligentsearchresult.php txtinteligentsearch parameter.
- CVE-2018-10052iScripts SupportDesk v4.3 has XSS via the admin/inteligentsearchresult.php txtinteligentsearch parameter.
- CVE-2017-7534OpenShift Enterprise version 3.x is vulnerable to a stored XSS via the log viewer for pods.Red Hat Openshift
- CVE-2018-0019Junos: Denial of service vulnerability in SNMP MIB-II subagent daemon (mib2d).Juniper Networks Junos OS
- CVE-2018-0023Junos Snapshot Administrator (JSNAPy) world writeable default configuration file permissionJuniper Networks Junos Snapshot Administrator · jsnapy
- CVE-2018-10029CMS Made Simple (aka CMSMS) 2.2.7 has Reflected XSS in admin/moduleinterface.php via the m1_name parameter, related to moduledepends, a diff
- CVE-2018-10030CMS Made Simple (aka CMSMS) 2.2.7 has CSRF in admin/siteprefs.php.
- CVE-2018-10031CMS Made Simple (aka CMSMS) 2.2.7 has CSRF in admin/moduleinterface.php.
- CVE-2018-10032CMS Made Simple (aka CMSMS) 2.2.7 has Reflected XSS in admin/moduleinterface.php via the m1_version parameter.
- CVE-2018-10033CMS Made Simple (aka CMSMS) 2.2.7 has Stored XSS in admin/siteprefs.php via the metadata parameter.
- CVE-2018-1100zsh through version 5.4.2 is vulnerable to a stack-based buffer overflow in the utils.c:checkmailpath function.zsh
- CVE-2018-10026The WeChat module in YzmCMS 3.7.1 has reflected XSS via the admin/module/init.html echostr parameter, related to the valid function in appli
- CVE-2018-10028joyplus-cms 1.6.0 allows remote attackers to obtain sensitive information via a direct request to the install/ or log/ URI.
- CVE-2017-15327S12700 V200R005C00, V200R006C00, V200R006C01, V200R007C00, V200R007C01, V200R007C20, V200R008C00, V200R008C06, V200R009C00, V200R010C00, S77Huawei Technologies Co. S12700, S7700, S9700
- CVE-2017-17308SCCPX module in Huawei DP300 V500R002C00, RP200 V500R002C00, V600R006C00, TE30 V100R001C10, V500R002C00, V600R006C00, TE40 V500R002C00, V600Huawei Technologies Co. DP300, RP200, TE30, TE40, TE50, TE60
- CVE-2017-8154The Themes App Honor 8 Lite Huawei mobile phones with software of versions before Prague-L31C576B172, versions before Prague-L31C530B160, veHuawei Technologies Co. Honor 8 Lite
- CVE-2018-10021drivers/scsi/libsas/sas_scsi_host.c in the Linux kernel before 4.16 allows local users to cause a denial of service (ata qc leak) by trigger
- CVE-2018-10023Catfish CMS V4.7.21 allows XSS via the pinglun parameter to cat/index/index/pinglun (aka an authenticated comment).
- CVE-2018-10024ubiQuoss Switch VP5208A creates a bcm_password file at /cgi-bin/ with the user credentials in cleartext when a failed login attempt occurs.
- CVE-2018-7930The Near Field Communication (NFC) module in Mate 9 Huawei mobile phones with the versions before MHA-L29B 8.0.0.366(C567) has an informatioHuawei Technologies Co. Mate
- CVE-2018-8953CA Workload Automation AE before r11.3.6 SP7 allows remote attackers to a perform SQL injection via a crafted HTTP request.CA Technologies Workload Automation AE
- CVE-2018-8954CA Workload Control Center before r11.4 SP6 allows remote attackers to execute arbitrary code via a crafted HTTP request.CA Technologies Workload Control Center
- CVE-2017-2599Jenkins before versions 2.44 and 2.32.2 is vulnerable to an insufficient permission check.[UNKNOWN] jenkins · org.jenkins-ci.main:jenkins-core
- CVE-2018-1483IBM WebSphere Portal 8.5 and 9.0 is vulnerable to cross-site scripting.IBM WebSphere Portal
- CVE-2017-11011In Android before security patch level 2018-04-05 on Qualcomm Snapdragon Mobile and Snapdragon Wear MDM9206, MDM9607, SD 210/SD 212/SD 205, Qualcomm Snapdragon Mobile, Snapdragon Wear
- CVE-2017-18071In Android before security patch level 2018-04-05 on Qualcomm Snapdragon Mobile and Snapdragon Wear MDM9206, MDM9607, MSM8909W, SD 210/SD 21Qualcomm Snapdragon Mobile, Snapdragon Wear
- CVE-2017-18072In Android before security patch level 2018-04-05 on Qualcomm Snapdragon Mobile and Snapdragon Wear MDM9206, MDM9607, MDM9640, MDM9650, QCA4Qualcomm Snapdragon Mobile, Snapdragon Wear
- CVE-2017-18073In Android before security patch level 2018-04-05 on Qualcomm Snapdragon Automobile, Snapdragon Mobile, and Snapdragon Wear MDM9206, MDM9607Qualcomm Snapdragon Automobile, Snapdragon Mobile, Snapdrag…
- CVE-2017-18074In Android before security patch level 2018-04-05 on Qualcomm Snapdragon Mobile and Snapdragon Wear MDM9607, MDM9625, MDM9635M, MDM9640, MDMQualcomm Snapdragon Mobile, Snapdragon Wear
- CVE-2017-18125In Android before security patch level 2018-04-05 on Qualcomm Snapdragon Mobile and Snapdragon Wear MDM9206, MDM9607, MDM9650, SD 210/SD 212Qualcomm Snapdragon Mobile, Snapdragon Wear
- CVE-2017-18126In Android before security patch level 2018-04-05 on Qualcomm Snapdragon Mobile and Snapdragon Wear MDM9206, MDM9607, MDM9640, MDM9650, QCA6Qualcomm Snapdragon Mobile, Snapdragon Wear
- CVE-2017-18127In Android before security patch level 2018-04-05 on Qualcomm Snapdragon Mobile and Snapdragon Wear MSM8909W, SD 210/SD 212/SD 205, SD 430, Qualcomm Snapdragon Mobile, Snapdragon Wear
- CVE-2017-18128In Android before security patch level 2018-04-05 on Qualcomm Snapdragon Mobile SD 845, SD 850, improper access control while configuring MPQualcomm Snapdragon Mobile
- CVE-2017-18129In Android before security patch level 2018-04-05 on Qualcomm Snapdragon Automobile and Snapdragon Mobile MDM9206, MDM9607, SD 845, MSM8996,Qualcomm Snapdragon Automobile, Snapdragon Mobile
- CVE-2017-18130In Android before security patch level 2018-04-05 on Qualcomm Snapdragon Automobile, Snapdragon Mobile, and Snapdragon Wear MDM9206, MDM9607Qualcomm Snapdragon Automobile, Snapdragon Mobile, Snapdrag…
- CVE-2017-18132In Android before security patch level 2018-04-05 on Qualcomm Snapdragon Automobile and Snapdragon Mobile MDM9206, MDM9607, MDM8996, an out-Qualcomm Snapdragon Automobile, Snapdragon Mobile
- CVE-2017-18133In Android before security patch level 2018-04-05 on Qualcomm Snapdragon Mobile and Snapdragon Wear MDM9206, MDM9607, MDM9650, SD 210/SD 212Qualcomm Snapdragon Mobile, Snapdragon Wear
- CVE-2017-18134In Android before security patch level 2018-04-05 on Qualcomm Snapdragon Mobile SD 845, SD 850, a buffer overflow may potentially occur whilQualcomm Snapdragon Mobile
- CVE-2017-18135In Android before security patch level 2018-04-05 on Qualcomm Snapdragon Mobile MDM9650, MDM9655, SD 450, SD 625, SD 650/52, SD 835, SD 845,Qualcomm Snapdragon Mobile
- CVE-2017-18136In Android before security patch level 2018-04-05 on Qualcomm Snapdragon Automobile, Snapdragon Mobile, and Snapdragon Wear MDM9206, MDM9607Qualcomm Snapdragon Automobile, Snapdragon Mobile, Snapdrag…
- CVE-2017-18137In Android before security patch level 2018-04-05 on Qualcomm Snapdragon Mobile MDM9640, MDM9645, MDM9650, MDM9655, SD 450, SD 625, SD 650/5Qualcomm Snapdragon Mobile
- CVE-2017-18138In Android before security patch level 2018-04-05 on Qualcomm Snapdragon Mobile and Snapdragon Wear MDM9206, MDM9607, MDM9635M, MDM9640, MDMQualcomm Snapdragon Mobile, Snapdragon Wear
- CVE-2017-18139In Android before security patch level 2018-04-05 on Qualcomm Snapdragon Mobile and Snapdragon Wear MDM9206, MDM9607, MDM9635M, MDM9640, MDMQualcomm Snapdragon Mobile, Snapdragon Wear
- CVE-2017-18140In Android before security patch level 2018-04-05 on Qualcomm Snapdragon Automobile, Snapdragon Mobile, and Snapdragon Wear MDM9206, MDM9607Qualcomm Snapdragon Automobile, Snapdragon Mobile, Snapdrag…
- CVE-2017-18142In Android before security patch level 2018-04-05 on Qualcomm Snapdragon Mobile MDM9650, MDM9655, SD 835, SD 845, SD 850, while processing tQualcomm Snapdragon Mobile
- CVE-2017-18143In Android before security patch level 2018-04-05 on Qualcomm Snapdragon Mobile SD 845, SD 850, on a secure device, PD dumps are collected wQualcomm Snapdragon Mobile
- CVE-2017-18144In Android before security patch level 2018-04-05 on Qualcomm Snapdragon Mobile and Snapdragon Wear MSM8909W, SD 210/SD 212/SD 205, SD 450, Qualcomm Snapdragon Mobile, Snapdragon Wear
- CVE-2017-18145In Android before security patch level 2018-04-05 on Qualcomm Snapdragon Mobile and Snapdragon Wear MSM8909W, SD 210/SD 212/SD 205, SD 450, Qualcomm Snapdragon Mobile, Snapdragon Wear
- CVE-2017-18146In Android before security patch level 2018-04-05 on Qualcomm Snapdragon Automobile, Snapdragon Mobile, and Snapdragon Wear MDM9206, MDM9607Qualcomm Snapdragon Automobile, Snapdragon Mobile, Snapdrag…
- CVE-2017-8274In Android before security patch level 2018-04-05 on Qualcomm Snapdragon Mobile and Snapdragon Wear MDM9206, MDM9607, MSM8909W, SD 210/SD 21Qualcomm Snapdragon Mobile, Snapdragon Wear
- CVE-2017-8275In Android before security patch level 2018-04-05 on Qualcomm Snapdragon Mobile SD 210/SD 212/SD 205, SD 400, SD 430, SD 450, SD 617, SD 625Qualcomm Snapdragon Mobile
- CVE-2018-3589In Android before security patch level 2018-04-05 on Qualcomm Snapdragon Mobile MDM9650, MDM9655, SD 835, SD 845, SD 850, the vswr capture sQualcomm Snapdragon Mobile
- CVE-2018-3590In Android before security patch level 2018-04-05 on Qualcomm Snapdragon Mobile and Snapdragon Wear MSM8909W, SD 210/SD 212/SD 205, SD 450, Qualcomm Snapdragon Mobile, Snapdragon Wear
- CVE-2018-3591In Android before security patch level 2018-04-05 on Qualcomm Snapdragon Mobile and Snapdragon Wear MDM9206, MDM9607, MDM9635M, MDM9650, MDMQualcomm Snapdragon Mobile, Snapdragon Wear
- CVE-2018-3592In Android before security patch level 2018-04-05 on Qualcomm Snapdragon Mobile and Snapdragon Wear MDM9206, MDM9607, MDM9635M, MDM9640, MDMQualcomm Snapdragon Mobile, Snapdragon Wear
- CVE-2018-3593In Android before security patch level 2018-04-05 on Qualcomm Snapdragon Automobile, Snapdragon Mobile, and Snapdragon Wear MDM9206, MDM9607Qualcomm Snapdragon Automobile, Snapdragon Mobile, Snapdrag…
- CVE-2018-3594In Android before security patch level 2018-04-05 on Qualcomm Snapdragon Automobile, Snapdragon Mobile, and Snapdragon Wear MDM9206, MDM9607Qualcomm Snapdragon Automobile, Snapdragon Mobile, Snapdrag…
- CVE-2016-10258Unrestricted file upload vulnerability in the Symantec Advanced Secure Gateway (ASG) and ProxySG management consoles.Symantec Advanced Secure Gateway · Symantec ProxySG
- CVE-2017-13677Denial-of-service (DoS) vulnerability in the Symantec Advanced Secure Gateway (ASG) and ProxySG management consoles.Symantec Advanced Secure Gateway · Symantec ProxySG
- CVE-2017-13678Stored XSS vulnerability in the Symantec Advanced Secure Gateway (ASG) and ProxySG management consoles.Symantec Advanced Secure Gateway · Symantec ProxySG
- CVE-2018-1275Spring Framework, versions 5.0 prior to 5.0.5 and versions 4.3 prior to 4.3.16 and older unsupported versions, allow applications to expose Spring by Pivotal Spring Framework · org.springframework:sp…
- CVE-2018-7659In OpenText Documentum D2 Webtop v4.6.0030 build 059, a Stored Cross-Site Scripting Vulnerability could potentially be exploited by maliciou
- CVE-2018-7660In OpenText Documentum D2 Webtop v4.6.0030 build 059, a Reflected Cross-Site Scripting Vulnerability could potentially be exploited by malic
- CVE-2018-9991Frog CMS 0.9.5 has XSS via the /admin/?/user/add Name or Username parameter.
- CVE-2018-9992Frog CMS 0.9.5 has XSS via the name field of a new "File" or "Directory" on the admin/?/plugin/file_manager/browse/ screen.
- CVE-2018-10016Netwide Assembler (NASM) 2.14rc0 has a division-by-zero vulnerability in the expr5 function in asm/eval.c via a malformed input file.
- CVE-2018-10017soundlib/Snd_fx.cpp in OpenMPT before 1.27.07.00 and libopenmpt before 0.3.8 allows remote attackers to cause a denial of service (out-of-bo
- CVE-2017-18259Dolibarr ERP/CRM is affected by stored Cross-Site Scripting (XSS) in versions through 7.0.0.dolibarr/dolibarr
- CVE-2017-18260Dolibarr ERP/CRM is affected by multiple SQL injection vulnerabilities in versions through 7.0.0 via comm/propal/list.php (viewstatut paramedolibarr/dolibarr
- CVE-2017-9838Dolibarr ERP/CRM is affected by multiple reflected Cross-Site Scripting (XSS) vulnerabilities in versions before 5.0.4: index.php (leftmenu dolibarr/dolibarr
- CVE-2017-9839Dolibarr ERP/CRM is affected by SQL injection in versions before 5.0.4 via product/stats/card.php (type parameter).dolibarr/dolibarr
- CVE-2018-10000The Video Downloader professional extension before 2018-04-05 for Chrome has Universal XSS (UXSS) via vectors related to a link64_msgAddLink
- CVE-2018-10001The decode_init function in libavcodec/utvideodec.c in FFmpeg through 3.4.2 allows remote attackers to cause a denial of service (out of arr
- CVE-2018-10054H2 1.4.197, as used in Datomic before 0.9.5697 and other products, allows remote code execution because CREATE ALIAS can execute arbitrary Jcom.datomic:datomic-free