# CVEs published 2018-04-11

88 CVEs were published on April 11, 2018: 3 critical, 8 high. 1 is now in CISA KEV. Days are UTC.

- [CVE-2018-10048](https://cve.now/CVE-2018-10048.md): iScripts eSwap v2.4 has CSRF via "registration\_settings.php" in the Admin Panel. (no CVSS)
- [CVE-2018-10049](https://cve.now/CVE-2018-10049.md): iScripts eSwap v2.4 has XSS via the "registration\_settings.php" txtDate parameter in the Admin Panel. (no CVSS)
- [CVE-2018-10050](https://cve.now/CVE-2018-10050.md): iScripts eSwap v2.4 has SQL injection via the "registration\_settings.php" ddlFree parameter in the Admin Panel. (no CVSS)
- [CVE-2018-10051](https://cve.now/CVE-2018-10051.md): iScripts SupportDesk v4.3 has XSS via the staff/inteligentsearchresult.php txtinteligentsearch parameter. (no CVSS)
- [CVE-2018-10052](https://cve.now/CVE-2018-10052.md): iScripts SupportDesk v4.3 has XSS via the admin/inteligentsearchresult.php txtinteligentsearch parameter. (no CVSS)
- [CVE-2018-3886](https://cve.now/CVE-2018-3886.md): A memory corruption vulnerability exists in the PCX-parsing functionality of Computerinsel Photoline 20.53. (CVSS 8.8, Talos Computerinsel Photoline)
- [CVE-2018-3887](https://cve.now/CVE-2018-3887.md): A memory corruption vulnerability exists in the PCX-parsing functionality of Computerinsel Photoline 20.53. (CVSS 8.8, Talos Computerinsel Photoline)
- [CVE-2018-3888](https://cve.now/CVE-2018-3888.md): A memory corruption vulnerability exists in the PCX-parsing functionality of Computerinsel Photoline 20.53. (CVSS 8.8, Talos Computerinsel Photoline)
- [CVE-2017-7534](https://cve.now/CVE-2017-7534.md): OpenShift Enterprise version 3.x is vulnerable to a stored XSS via the log viewer for pods. (no CVSS, Red Hat Openshift)
- [CVE-2018-0016](https://cve.now/CVE-2018-0016.md): Junos OS: Kernel crash upon receipt of crafted CLNP datagrams (CVSS 9.8, Juniper Networks Junos OS)
- [CVE-2018-0017](https://cve.now/CVE-2018-0017.md): SRX Series: Denial of service vulnerability in flowd daemon on devices configured with NAT-PT (CVSS 7.5, Juniper Networks Junos OS)
- [CVE-2018-0018](https://cve.now/CVE-2018-0018.md): SRX Series: A crafted packet may lead to information disclosure and firewall rule bypass during compilation of IDP policies. (CVSS 7.5, Juniper Networks Junos OS)
- [CVE-2018-0019](https://cve.now/CVE-2018-0019.md): Junos: Denial of service vulnerability in SNMP MIB-II subagent daemon (mib2d). (CVSS 5.3, Juniper Networks Junos OS)
- [CVE-2018-0020](https://cve.now/CVE-2018-0020.md): Junos OS: rpd daemon cores due to malformed BGP UPDATE packet (CVSS 7.5, Juniper Networks Junos OS)
- [CVE-2018-0021](https://cve.now/CVE-2018-0021.md): Junos OS: Short MacSec keys may allow man-in-the-middle attacks. (CVSS 8.8, Juniper Networks Junos OS)
- [CVE-2018-0022](https://cve.now/CVE-2018-0022.md): Junos OS: Mbuf leak due to processing MPLS packets in VPLS network. (CVSS 7.5, Juniper Networks Junos OS)
- [CVE-2018-0023](https://cve.now/CVE-2018-0023.md): Junos Snapshot Administrator (JSNAPy) world writeable default configuration file permission (CVSS 5.5, Juniper Networks Junos Snapshot Administrator · jsnapy)
- [CVE-2018-10029](https://cve.now/CVE-2018-10029.md): CMS Made Simple (aka CMSMS) 2.2.7 has Reflected XSS in admin/moduleinterface.php via the m1\_name parameter, related to moduledepends, a diff (no CVSS)
- [CVE-2018-10030](https://cve.now/CVE-2018-10030.md): CMS Made Simple (aka CMSMS) 2.2.7 has CSRF in admin/siteprefs.php. (no CVSS)
- [CVE-2018-10031](https://cve.now/CVE-2018-10031.md): CMS Made Simple (aka CMSMS) 2.2.7 has CSRF in admin/moduleinterface.php. (no CVSS)
- [CVE-2018-10032](https://cve.now/CVE-2018-10032.md): CMS Made Simple (aka CMSMS) 2.2.7 has Reflected XSS in admin/moduleinterface.php via the m1\_version parameter. (no CVSS)
- [CVE-2018-10033](https://cve.now/CVE-2018-10033.md): CMS Made Simple (aka CMSMS) 2.2.7 has Stored XSS in admin/siteprefs.php via the metadata parameter. (no CVSS)
- [CVE-2018-1100](https://cve.now/CVE-2018-1100.md): zsh through version 5.4.2 is vulnerable to a stack-based buffer overflow in the utils.c:checkmailpath function. (no CVSS, zsh)
- [CVE-2018-10026](https://cve.now/CVE-2018-10026.md): The WeChat module in YzmCMS 3.7.1 has reflected XSS via the admin/module/init.html echostr parameter, related to the valid function in appli (no CVSS)
- [CVE-2018-10028](https://cve.now/CVE-2018-10028.md): joyplus-cms 1.6.0 allows remote attackers to obtain sensitive information via a direct request to the install/ or log/ URI. (no CVSS)
- [CVE-2017-15327](https://cve.now/CVE-2017-15327.md): S12700 V200R005C00, V200R006C00, V200R006C01, V200R007C00, V200R007C01, V200R007C20, V200R008C00, V200R008C06, V200R009C00, V200R010C00, S77 (no CVSS, Huawei Technologies Co. S12700, S7700, S9700)
- [CVE-2017-17308](https://cve.now/CVE-2017-17308.md): SCCPX module in Huawei DP300 V500R002C00, RP200 V500R002C00, V600R006C00, TE30 V100R001C10, V500R002C00, V600R006C00, TE40 V500R002C00, V600 (no CVSS, Huawei Technologies Co. DP300, RP200, TE30, TE40, TE50, TE60)
- [CVE-2017-8154](https://cve.now/CVE-2017-8154.md): The Themes App Honor 8 Lite Huawei mobile phones with software of versions before Prague-L31C576B172, versions before Prague-L31C530B160, ve (no CVSS, Huawei Technologies Co. Honor 8 Lite)
- [CVE-2018-10021](https://cve.now/CVE-2018-10021.md): drivers/scsi/libsas/sas\_scsi\_host.c in the Linux kernel before 4.16 allows local users to cause a denial of service (ata qc leak) by trigger (no CVSS)
- [CVE-2018-10023](https://cve.now/CVE-2018-10023.md): Catfish CMS V4.7.21 allows XSS via the pinglun parameter to cat/index/index/pinglun (aka an authenticated comment). (no CVSS)
- [CVE-2018-10024](https://cve.now/CVE-2018-10024.md): ubiQuoss Switch VP5208A creates a bcm\_password file at /cgi-bin/ with the user credentials in cleartext when a failed login attempt occurs. (no CVSS)
- [CVE-2018-7930](https://cve.now/CVE-2018-7930.md): The Near Field Communication (NFC) module in Mate 9 Huawei mobile phones with the versions before MHA-L29B 8.0.0.366(C567) has an informatio (no CVSS, Huawei Technologies Co. Mate)
- [CVE-2018-8953](https://cve.now/CVE-2018-8953.md): CA Workload Automation AE before r11.3.6 SP7 allows remote attackers to a perform SQL injection via a crafted HTTP request. (no CVSS, CA Technologies Workload Automation AE)
- [CVE-2018-8954](https://cve.now/CVE-2018-8954.md): CA Workload Control Center before r11.4 SP6 allows remote attackers to execute arbitrary code via a crafted HTTP request. (no CVSS, CA Technologies Workload Control Center)
- [CVE-2017-14459](https://cve.now/CVE-2017-14459.md): An exploitable OS Command Injection vulnerability exists in the Telnet, SSH, and console login functionality of Moxa AWK-3131A Industrial IE (CVSS 10.0, Talos Moxa)
- [CVE-2017-2599](https://cve.now/CVE-2017-2599.md): Jenkins before versions 2.44 and 2.32.2 is vulnerable to an insufficient permission check. (CVSS 5.4, \[UNKNOWN\] jenkins · org.jenkins-ci.main:jenkins-core)
- [CVE-2018-1483](https://cve.now/CVE-2018-1483.md): IBM WebSphere Portal 8.5 and 9.0 is vulnerable to cross-site scripting. (CVSS 6.1, IBM WebSphere Portal)
- [CVE-2017-11011](https://cve.now/CVE-2017-11011.md): In Android before security patch level 2018-04-05 on Qualcomm Snapdragon Mobile and Snapdragon Wear MDM9206, MDM9607, SD 210/SD 212/SD 205, (no CVSS, Qualcomm Snapdragon Mobile, Snapdragon Wear)
- [CVE-2017-18071](https://cve.now/CVE-2017-18071.md): In Android before security patch level 2018-04-05 on Qualcomm Snapdragon Mobile and Snapdragon Wear MDM9206, MDM9607, MSM8909W, SD 210/SD 21 (no CVSS, Qualcomm Snapdragon Mobile, Snapdragon Wear)
- [CVE-2017-18072](https://cve.now/CVE-2017-18072.md): In Android before security patch level 2018-04-05 on Qualcomm Snapdragon Mobile and Snapdragon Wear MDM9206, MDM9607, MDM9640, MDM9650, QCA4 (no CVSS, Qualcomm Snapdragon Mobile, Snapdragon Wear)
- [CVE-2017-18073](https://cve.now/CVE-2017-18073.md): In Android before security patch level 2018-04-05 on Qualcomm Snapdragon Automobile, Snapdragon Mobile, and Snapdragon Wear MDM9206, MDM9607 (no CVSS, Qualcomm Snapdragon Automobile, Snapdragon Mobile, Snapdrag…)
- [CVE-2017-18074](https://cve.now/CVE-2017-18074.md): In Android before security patch level 2018-04-05 on Qualcomm Snapdragon Mobile and Snapdragon Wear MDM9607, MDM9625, MDM9635M, MDM9640, MDM (no CVSS, Qualcomm Snapdragon Mobile, Snapdragon Wear)
- [CVE-2017-18125](https://cve.now/CVE-2017-18125.md): In Android before security patch level 2018-04-05 on Qualcomm Snapdragon Mobile and Snapdragon Wear MDM9206, MDM9607, MDM9650, SD 210/SD 212 (no CVSS, Qualcomm Snapdragon Mobile, Snapdragon Wear)
- [CVE-2017-18126](https://cve.now/CVE-2017-18126.md): In Android before security patch level 2018-04-05 on Qualcomm Snapdragon Mobile and Snapdragon Wear MDM9206, MDM9607, MDM9640, MDM9650, QCA6 (no CVSS, Qualcomm Snapdragon Mobile, Snapdragon Wear)
- [CVE-2017-18127](https://cve.now/CVE-2017-18127.md): In Android before security patch level 2018-04-05 on Qualcomm Snapdragon Mobile and Snapdragon Wear MSM8909W, SD 210/SD 212/SD 205, SD 430, (no CVSS, Qualcomm Snapdragon Mobile, Snapdragon Wear)
- [CVE-2017-18128](https://cve.now/CVE-2017-18128.md): In Android before security patch level 2018-04-05 on Qualcomm Snapdragon Mobile SD 845, SD 850, improper access control while configuring MP (no CVSS, Qualcomm Snapdragon Mobile)
- [CVE-2017-18129](https://cve.now/CVE-2017-18129.md): In Android before security patch level 2018-04-05 on Qualcomm Snapdragon Automobile and Snapdragon Mobile MDM9206, MDM9607, SD 845, MSM8996, (no CVSS, Qualcomm Snapdragon Automobile, Snapdragon Mobile)
- [CVE-2017-18130](https://cve.now/CVE-2017-18130.md): In Android before security patch level 2018-04-05 on Qualcomm Snapdragon Automobile, Snapdragon Mobile, and Snapdragon Wear MDM9206, MDM9607 (no CVSS, Qualcomm Snapdragon Automobile, Snapdragon Mobile, Snapdrag…)
- [CVE-2017-18132](https://cve.now/CVE-2017-18132.md): In Android before security patch level 2018-04-05 on Qualcomm Snapdragon Automobile and Snapdragon Mobile MDM9206, MDM9607, MDM8996, an out- (no CVSS, Qualcomm Snapdragon Automobile, Snapdragon Mobile)
- [CVE-2017-18133](https://cve.now/CVE-2017-18133.md): In Android before security patch level 2018-04-05 on Qualcomm Snapdragon Mobile and Snapdragon Wear MDM9206, MDM9607, MDM9650, SD 210/SD 212 (no CVSS, Qualcomm Snapdragon Mobile, Snapdragon Wear)
- [CVE-2017-18134](https://cve.now/CVE-2017-18134.md): In Android before security patch level 2018-04-05 on Qualcomm Snapdragon Mobile SD 845, SD 850, a buffer overflow may potentially occur whil (no CVSS, Qualcomm Snapdragon Mobile)
- [CVE-2017-18135](https://cve.now/CVE-2017-18135.md): In Android before security patch level 2018-04-05 on Qualcomm Snapdragon Mobile MDM9650, MDM9655, SD 450, SD 625, SD 650/52, SD 835, SD 845, (no CVSS, Qualcomm Snapdragon Mobile)
- [CVE-2017-18136](https://cve.now/CVE-2017-18136.md): In Android before security patch level 2018-04-05 on Qualcomm Snapdragon Automobile, Snapdragon Mobile, and Snapdragon Wear MDM9206, MDM9607 (no CVSS, Qualcomm Snapdragon Automobile, Snapdragon Mobile, Snapdrag…)
- [CVE-2017-18137](https://cve.now/CVE-2017-18137.md): In Android before security patch level 2018-04-05 on Qualcomm Snapdragon Mobile MDM9640, MDM9645, MDM9650, MDM9655, SD 450, SD 625, SD 650/5 (no CVSS, Qualcomm Snapdragon Mobile)
- [CVE-2017-18138](https://cve.now/CVE-2017-18138.md): In Android before security patch level 2018-04-05 on Qualcomm Snapdragon Mobile and Snapdragon Wear MDM9206, MDM9607, MDM9635M, MDM9640, MDM (no CVSS, Qualcomm Snapdragon Mobile, Snapdragon Wear)
- [CVE-2017-18139](https://cve.now/CVE-2017-18139.md): In Android before security patch level 2018-04-05 on Qualcomm Snapdragon Mobile and Snapdragon Wear MDM9206, MDM9607, MDM9635M, MDM9640, MDM (no CVSS, Qualcomm Snapdragon Mobile, Snapdragon Wear)
- [CVE-2017-18140](https://cve.now/CVE-2017-18140.md): In Android before security patch level 2018-04-05 on Qualcomm Snapdragon Automobile, Snapdragon Mobile, and Snapdragon Wear MDM9206, MDM9607 (no CVSS, Qualcomm Snapdragon Automobile, Snapdragon Mobile, Snapdrag…)
- [CVE-2017-18142](https://cve.now/CVE-2017-18142.md): In Android before security patch level 2018-04-05 on Qualcomm Snapdragon Mobile MDM9650, MDM9655, SD 835, SD 845, SD 850, while processing t (no CVSS, Qualcomm Snapdragon Mobile)
- [CVE-2017-18143](https://cve.now/CVE-2017-18143.md): In Android before security patch level 2018-04-05 on Qualcomm Snapdragon Mobile SD 845, SD 850, on a secure device, PD dumps are collected w (no CVSS, Qualcomm Snapdragon Mobile)
- [CVE-2017-18144](https://cve.now/CVE-2017-18144.md): In Android before security patch level 2018-04-05 on Qualcomm Snapdragon Mobile and Snapdragon Wear MSM8909W, SD 210/SD 212/SD 205, SD 450, (no CVSS, Qualcomm Snapdragon Mobile, Snapdragon Wear)
- [CVE-2017-18145](https://cve.now/CVE-2017-18145.md): In Android before security patch level 2018-04-05 on Qualcomm Snapdragon Mobile and Snapdragon Wear MSM8909W, SD 210/SD 212/SD 205, SD 450, (no CVSS, Qualcomm Snapdragon Mobile, Snapdragon Wear)
- [CVE-2017-18146](https://cve.now/CVE-2017-18146.md): In Android before security patch level 2018-04-05 on Qualcomm Snapdragon Automobile, Snapdragon Mobile, and Snapdragon Wear MDM9206, MDM9607 (no CVSS, Qualcomm Snapdragon Automobile, Snapdragon Mobile, Snapdrag…)
- [CVE-2017-8274](https://cve.now/CVE-2017-8274.md): In Android before security patch level 2018-04-05 on Qualcomm Snapdragon Mobile and Snapdragon Wear MDM9206, MDM9607, MSM8909W, SD 210/SD 21 (no CVSS, Qualcomm Snapdragon Mobile, Snapdragon Wear)
- [CVE-2017-8275](https://cve.now/CVE-2017-8275.md): In Android before security patch level 2018-04-05 on Qualcomm Snapdragon Mobile SD 210/SD 212/SD 205, SD 400, SD 430, SD 450, SD 617, SD 625 (no CVSS, Qualcomm Snapdragon Mobile)
- [CVE-2018-3589](https://cve.now/CVE-2018-3589.md): In Android before security patch level 2018-04-05 on Qualcomm Snapdragon Mobile MDM9650, MDM9655, SD 835, SD 845, SD 850, the vswr capture s (no CVSS, Qualcomm Snapdragon Mobile)
- [CVE-2018-3590](https://cve.now/CVE-2018-3590.md): In Android before security patch level 2018-04-05 on Qualcomm Snapdragon Mobile and Snapdragon Wear MSM8909W, SD 210/SD 212/SD 205, SD 450, (no CVSS, Qualcomm Snapdragon Mobile, Snapdragon Wear)
- [CVE-2018-3591](https://cve.now/CVE-2018-3591.md): In Android before security patch level 2018-04-05 on Qualcomm Snapdragon Mobile and Snapdragon Wear MDM9206, MDM9607, MDM9635M, MDM9650, MDM (no CVSS, Qualcomm Snapdragon Mobile, Snapdragon Wear)
- [CVE-2018-3592](https://cve.now/CVE-2018-3592.md): In Android before security patch level 2018-04-05 on Qualcomm Snapdragon Mobile and Snapdragon Wear MDM9206, MDM9607, MDM9635M, MDM9640, MDM (no CVSS, Qualcomm Snapdragon Mobile, Snapdragon Wear)
- [CVE-2018-3593](https://cve.now/CVE-2018-3593.md): In Android before security patch level 2018-04-05 on Qualcomm Snapdragon Automobile, Snapdragon Mobile, and Snapdragon Wear MDM9206, MDM9607 (no CVSS, Qualcomm Snapdragon Automobile, Snapdragon Mobile, Snapdrag…)
- [CVE-2018-3594](https://cve.now/CVE-2018-3594.md): In Android before security patch level 2018-04-05 on Qualcomm Snapdragon Automobile, Snapdragon Mobile, and Snapdragon Wear MDM9206, MDM9607 (no CVSS, Qualcomm Snapdragon Automobile, Snapdragon Mobile, Snapdrag…)
- [CVE-2016-10258](https://cve.now/CVE-2016-10258.md): Unrestricted file upload vulnerability in the Symantec Advanced Secure Gateway (ASG) and ProxySG management consoles. (no CVSS, Symantec Advanced Secure Gateway · Symantec ProxySG)
- [CVE-2017-13677](https://cve.now/CVE-2017-13677.md): Denial-of-service (DoS) vulnerability in the Symantec Advanced Secure Gateway (ASG) and ProxySG management consoles. (no CVSS, Symantec Advanced Secure Gateway · Symantec ProxySG)
- [CVE-2017-13678](https://cve.now/CVE-2017-13678.md): Stored XSS vulnerability in the Symantec Advanced Secure Gateway (ASG) and ProxySG management consoles. (no CVSS, Symantec Advanced Secure Gateway · Symantec ProxySG)
- [CVE-2018-1273](https://cve.now/CVE-2018-1273.md): Spring Data Commons, versions prior to 1.13 to 1.13.10, 2.0 to 2.0.5, and older unsupported versions, contain a property binder vulnerabilit (CVSS 9.8, KEV, Spring by Pivotal Spring Framework · org.springframework.da…)
- [CVE-2018-1275](https://cve.now/CVE-2018-1275.md): Spring Framework, versions 5.0 prior to 5.0.5 and versions 4.3 prior to 4.3.16 and older unsupported versions, allow applications to expose (no CVSS, Spring by Pivotal Spring Framework · org.springframework:sp…)
- [CVE-2018-7659](https://cve.now/CVE-2018-7659.md): In OpenText Documentum D2 Webtop v4.6.0030 build 059, a Stored Cross-Site Scripting Vulnerability could potentially be exploited by maliciou (no CVSS)
- [CVE-2018-7660](https://cve.now/CVE-2018-7660.md): In OpenText Documentum D2 Webtop v4.6.0030 build 059, a Reflected Cross-Site Scripting Vulnerability could potentially be exploited by malic (no CVSS)
- [CVE-2018-9991](https://cve.now/CVE-2018-9991.md): Frog CMS 0.9.5 has XSS via the /admin/?/user/add Name or Username parameter. (no CVSS)
- [CVE-2018-9992](https://cve.now/CVE-2018-9992.md): Frog CMS 0.9.5 has XSS via the name field of a new "File" or "Directory" on the admin/?/plugin/file\_manager/browse/ screen. (no CVSS)
- [CVE-2018-10016](https://cve.now/CVE-2018-10016.md): Netwide Assembler (NASM) 2.14rc0 has a division-by-zero vulnerability in the expr5 function in asm/eval.c via a malformed input file. (no CVSS)
- [CVE-2018-10017](https://cve.now/CVE-2018-10017.md): soundlib/Snd\_fx.cpp in OpenMPT before 1.27.07.00 and libopenmpt before 0.3.8 allows remote attackers to cause a denial of service (out-of-bo (no CVSS)
- [CVE-2017-18259](https://cve.now/CVE-2017-18259.md): Dolibarr ERP/CRM is affected by stored Cross-Site Scripting (XSS) in versions through 7.0.0. (no CVSS, dolibarr/dolibarr)
- [CVE-2017-18260](https://cve.now/CVE-2017-18260.md): Dolibarr ERP/CRM is affected by multiple SQL injection vulnerabilities in versions through 7.0.0 via comm/propal/list.php (viewstatut parame (no CVSS, dolibarr/dolibarr)
- [CVE-2017-9838](https://cve.now/CVE-2017-9838.md): Dolibarr ERP/CRM is affected by multiple reflected Cross-Site Scripting (XSS) vulnerabilities in versions before 5.0.4: index.php (leftmenu (no CVSS, dolibarr/dolibarr)
- [CVE-2017-9839](https://cve.now/CVE-2017-9839.md): Dolibarr ERP/CRM is affected by SQL injection in versions before 5.0.4 via product/stats/card.php (type parameter). (no CVSS, dolibarr/dolibarr)
- [CVE-2018-10000](https://cve.now/CVE-2018-10000.md): The Video Downloader professional extension before 2018-04-05 for Chrome has Universal XSS (UXSS) via vectors related to a link64\_msgAddLink (no CVSS)
- [CVE-2018-10001](https://cve.now/CVE-2018-10001.md): The decode\_init function in libavcodec/utvideodec.c in FFmpeg through 3.4.2 allows remote attackers to cause a denial of service (out of arr (no CVSS)
- [CVE-2018-10054](https://cve.now/CVE-2018-10054.md): H2 1.4.197, as used in Datomic before 0.9.5697 and other products, allows remote code execution because CREATE ALIAS can execute arbitrary J (no CVSS, com.datomic:datomic-free)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2018-04-11
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.