CVEs published April 12, 2018
112 CVEs were published on April 12, 2018: 0 critical, 6 high.
- Published
- 112
- Critical
- 0
- High
- 6
- Medium
- 1
- Low
- 0
- Unrated
- 105
- Now in CISA KEV
- 0
- Fix available
- 8
Most affected products
- Microsoft Windows
- 17
- Microsoft Internet Explorer
- 12
- Microsoft Edge · Microsoft ChakraCore +1
- 7
- Microsoft Windows Server · Microsoft Windows
- 4
- Talos Computerinsel Photoline
- 4
- Microsoft Office
- 3
- Microsoft SharePoint
- 3
- Microsoft Windows Server 2012 R2 · Microsoft Windows RT +2
- 3
- Microsoft Edge
- 2
- Microsoft Excel
- 2
High 6
- CVE-2018-3861A specially crafted TIFF image processed via the application can lead to an out-of-bounds write, overwriting arbitrary data.Talos Computerinsel Photoline
- CVE-2018-3862A specially crafted TIFF image processed via the application can lead to an out-of-bounds write, overwritingTalos Computerinsel Photoline
- CVE-2018-3868A specially crafted TIFF image processed via the application can lead to an out-of-bounds write, overwriting arbitrary data.Talos Computerinsel Photoline
- CVE-2018-3889A specially crafted PCX image processed via the application can lead to an out-of-bounds write, overwriting arbitrary data.Talos Computerinsel Photoline
- CVE-2018-1079pcs before version 0.9.164 and 0.10 is vulnerable to a privilege escalation via authorized user malicious REST call.pcs
- CVE-2018-1084corosync before version 2.4.4 is vulnerable to an integer overflow in exec/totemcrypto.c.corosync
Medium, low and unrated 106
- CVE-2018-6870Reflected XSS exists in PHP Scripts Mall Website Seller Script 2.0.3 via the Listings Search feature.
- CVE-2018-6879PHP Scripts Mall Website Seller Script 2.0.3 uses the client side to enforce validation of an e-mail address, which allows remote attackers
- CVE-2018-6900PHP Scripts Mall Website Broker Script 3.0.6 has XSS via the Last Name field on the My Profile page.
- CVE-2018-6902PHP Scripts Mall Image Sharing Script 1.3.3 has XSS via the Full Name field in an Edit Profile action.
- CVE-2018-6903PHP Scripts Mall Hot Scripts Clone Script Classified v3.1 uses the client side to enforce validation of an e-mail address, which allows remo
- CVE-2018-6904PHP Scripts Mall Car Rental Script 2.0.8 has XSS via the User Name field in an Edit Profile action.
- CVE-2018-6934CSRF exists in student/personal-info in PHP Scripts Mall Online Tutoring Script 2.0.3.
- CVE-2018-6935PHP Scripts Mall Student Profile Management System Script v2.0.6 has XSS via the Name field to list_student.php.
- CVE-2014-6120IBM Rational AppScan Source 8.0 through 8.0.0.2 and 8.5 through 8.5.0.1 and Security AppScan Source 8.6 through 8.6.0.2, 8.7 through 8.7.0.1
- CVE-2014-6169Cross-site scripting (XSS) vulnerability in IBM Forms Experience Builder 8.5.0 and 8.5.1 allows remote attackers to inject arbitrary web scr
- CVE-2014-6412WordPress before 4.4 makes it easier for remote attackers to predict password-recovery tokens via a brute-force approach.
- CVE-2014-8421Unify (former Siemens) OpenStage SIP and OpenScape Desk Phone IP V3 devices before R3.32.0 allow remote attackers to gain super-user privile
- CVE-2014-8422The web-based management (WBM) interface in Unify (former Siemens) OpenStage SIP and OpenScape Desk Phone IP V3 devices before R3.32.0 gener
- CVE-2014-8888The remote administration interface in D-Link DIR-815 devices with firmware before 2.03.B02 allows remote attackers to execute arbitrary com
- CVE-2014-9563CRLF injection vulnerability in the web-based management (WBM) interface in Unify (former Siemens) OpenStage SIP and OpenScape Desk Phone IP
- CVE-2015-0150The remote administration UI in D-Link DIR-815 devices with firmware before 2.07.B01 allows remote attackers to bypass intended access restr
- CVE-2015-0151Cross-site request forgery (CSRF) vulnerability in D-Link DIR-815 devices with firmware before 2.07.B01 allows remote attackers to hijack th
- CVE-2015-0152D-Link DIR-815 devices with firmware before 2.07.B01 allow remote attackers to obtain sensitive information by leveraging cleartext storage
- CVE-2015-0153D-Link DIR-815 devices with firmware before 2.07.B01 allow remote attackers to obtain sensitive information by leveraging cleartext storage
- CVE-2018-5254Arista EOS before 4.20.2F allows remote BGP peers to cause a denial of service (Rib agent restart) via a malformed path attribute in an UPDA
- CVE-2018-10063The Convert Forms extension before 2.0.4 for Joomla! is vulnerable to Remote Command Execution using CSV Injection that is mishandled when e
- CVE-2018-10068The jDownloads extension before 3.2.59 for Joomla! has XSS.
- CVE-2018-10071windrvr1260.sys in Jungo DriverWizard WinDriver 12.6.0 allows attackers to cause a denial of service (BSOD) via a 0x953826DB DeviceIoControl
- CVE-2018-10072windrvr1260.sys in Jungo DriverWizard WinDriver 12.6.0 allows attackers to cause a denial of service (BSOD) via a 0x953827bf DeviceIoControl
- CVE-2018-10073joyplus-cms 1.6.0 has XSS in manager/admin_vod.php via the keyword parameter.
- CVE-2018-10074The hi3660_stub_clk_probe function in drivers/clk/hisilicon/clk-hi3660-stub.c in the Linux kernel before 4.16 allows local users to cause a
- CVE-2018-10059Cacti before 1.1.37 has XSS because the get_current_page function in lib/functions.php relies on $_SERVER['PHP_SELF'] instead of $_SERVER['S
- CVE-2018-10060Cacti before 1.1.37 has XSS because it does not properly reject unintended characters, related to use of the sanitize_uri function in lib/fu
- CVE-2018-10061Cacti before 1.1.37 has XSS because it makes certain htmlspecialchars calls without the ENT_QUOTES flag (these calls occur when the html_esc
- CVE-2018-1086pcs before versions 0.9.164 and 0.10 is vulnerable to a debug parameter removal bypass.redhat pcs
- CVE-2014-6309The HTTP and WebSocket engine components in the server in Kaazing Gateway 4.0.2, 4.0.3, and 4.0.4 and Gateway - JMS Edition 4.0.2, 4.0.3, an
- CVE-2014-6633The safe_eval function in trytond in Tryton before 2.4.15, 2.6.x before 2.6.14, 2.8.x before 2.8.11, 3.0.x before 3.0.7, and 3.2.x before 3.trytond · tryton
- CVE-2015-1777rhnreg_ks in Red Hat Network Client Tools (aka rhn-client-tools) on Red Hat Gluster Storage 2.1 and Enterprise Linux (RHEL) 5, 6, and 7 does
- CVE-2015-4557Cross-site scripting (XSS) vulnerability in the new_Twitter_sign_button function in nextend-Twitter-connect.php in the Nextend Twitter Conne
- CVE-2017-1790IBM DOORS Next Generation (DNG/RRC) 5.0, 5.0.1, 5.0.2, and 6.0 through 6.0.5 is vulnerable to cross-site scripting.IBM Rational DOORS Next Generation
- CVE-2017-6910The HTTP and WebSocket engine components in the server in Kaazing Gateway before 4.5.3 hotfix-1, Gateway - JMS Edition before 4.0.5 hotfix-1
- CVE-2018-9118exports/download.php in the 99 Robots WP Background Takeover Advertisements plugin before 4.1.5 for WordPress has Directory Traversal via a
- CVE-2018-9155Cross-site scripting (XSS) vulnerability in Open-AudIT Professional 2.1.1 allows remote attackers to inject arbitrary web script or HTML via
- CVE-2018-9842CyberArk Password Vault before 9.7 allows remote attackers to obtain sensitive information from process memory by replaying a logon message.
- CVE-2018-9843The REST API in CyberArk Password Vault Web Access before 9.9.5 and 10.x before 10.1 allows remote attackers to execute arbitrary code via a
- CVE-2018-9860An issue was discovered in Botan 1.11.32 through 2.x before 2.6.0.
- CVE-2018-0870A remote code execution vulnerability exists when Internet Explorer improperly accesses objects in memory, aka "Internet Explorer Memory CorMicrosoft Internet Explorer
- CVE-2018-0887An information disclosure vulnerability exists when the Windows kernel fails to properly initialize a memory address, aka "Windows Kernel InMicrosoft Windows
- CVE-2018-0890A security feature bypass vulnerability exists when Active Directory incorrectly applies Network Isolation settings, aka "Active Directory SMicrosoft Windows Server · Microsoft Windows
- CVE-2018-0892An information disclosure vulnerability exists when Microsoft Edge improperly handles objects in memory, aka "Microsoft Edge Information DisMicrosoft Edge
- CVE-2018-0920A remote code execution vulnerability exists in Microsoft Excel software when the software fails to properly handle objects in memory, aka "Microsoft Excel
- CVE-2018-0950An information disclosure vulnerability exists when Office renders Rich Text Format (RTF) email messages containing OLE objects when a messaMicrosoft Word · Microsoft Office
- CVE-2018-0956A denial of service vulnerability exists in the HTTP 2.0 protocol stack (HTTP.sys) when HTTP.sys improperly parses specially crafted HTTP 2.Microsoft Windows Server · Microsoft Windows
- CVE-2018-0957An information disclosure vulnerability exists when Windows Hyper-V on a host operating system fails to properly validate input from an authMicrosoft Windows Server 2012 R2 · Microsoft Windows RT +2
- CVE-2018-0960An information disclosure vulnerability exists when the Windows kernel improperly handles objects in memory, aka "Windows Kernel InformationMicrosoft Windows
- CVE-2018-0963An elevation of privilege vulnerability exists in the way that the Windows Kernel handles objects in memory, aka "Windows Kernel Elevation oMicrosoft Windows Server · Microsoft Windows
- CVE-2018-0964An information disclosure vulnerability exists when Windows Hyper-V on a host operating system fails to properly validate input from an authMicrosoft Windows
- CVE-2018-0966A security feature bypass exists when Device Guard incorrectly validates an untrusted file, aka "Device Guard Security Feature Bypass VulnerMicrosoft Windows Server · Microsoft Windows
- CVE-2018-0967A denial of service vulnerability exists in the way that Windows SNMP Service handles malformed SNMP traps, aka "Windows SNMP Service Denial
- CVE-2018-0968An information disclosure vulnerability exists in the Windows kernel that could allow an attacker to retrieve information that could lead toMicrosoft Windows Server 2012 R2 · Microsoft Windows RT +2
- CVE-2018-0969An information disclosure vulnerability exists in the Windows kernel that could allow an attacker to retrieve information that could lead toMicrosoft Windows
- CVE-2018-0970An information disclosure vulnerability exists in the Windows kernel that could allow an attacker to retrieve information that could lead toMicrosoft Windows
- CVE-2018-0971An information disclosure vulnerability exists in the Windows kernel that could allow an attacker to retrieve information that could lead toMicrosoft Windows
- CVE-2018-0972An information disclosure vulnerability exists in the Windows kernel that could allow an attacker to retrieve information that could lead toMicrosoft Windows
- CVE-2018-0973An information disclosure vulnerability exists in the Windows kernel that could allow an attacker to retrieve information that could lead toMicrosoft Windows
- CVE-2018-0974An information disclosure vulnerability exists in the Windows kernel that could allow an attacker to retrieve information that could lead toMicrosoft Windows
- CVE-2018-0975An information disclosure vulnerability exists in the Windows kernel that could allow an attacker to retrieve information that could lead toMicrosoft Windows
- CVE-2018-0976A denial of service vulnerability exists in Remote Desktop Protocol (RDP) when an attacker connects to the target system using RDP and sendsMicrosoft Windows
- CVE-2018-0979A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka "CMicrosoft Edge · Microsoft ChakraCore +1
- CVE-2018-0980A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka "CMicrosoft Edge · Microsoft ChakraCore +1
- CVE-2018-0981An information disclosure vulnerability exists in the way that the scripting engine handles objects in memory in Internet Explorer, aka "ScrMicrosoft Internet Explorer
- CVE-2018-0987An information disclosure vulnerability exists when the scripting engine does not properly handle objects in memory in Internet Explorer, akMicrosoft Internet Explorer
- CVE-2018-0988A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Internet Explorer, aka "ScripMicrosoft Internet Explorer
- CVE-2018-0989An information disclosure vulnerability exists in the way that the scripting engine handles objects in memory in Internet Explorer, aka "ScrMicrosoft Internet Explorer
- CVE-2018-0990A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka "CMicrosoft Edge · Microsoft ChakraCore +1
- CVE-2018-0991A remote code execution vulnerability exists when Internet Explorer improperly accesses objects in memory, aka "Internet Explorer Memory CorMicrosoft Internet Explorer
- CVE-2018-0993A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka "CMicrosoft Edge · Microsoft ChakraCore +1
- CVE-2018-0994A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka "CMicrosoft Edge · Microsoft ChakraCore +1
- CVE-2018-0995A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka "CMicrosoft Edge · Microsoft ChakraCore +1
- CVE-2018-0996A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Internet Explorer, aka "ScripMicrosoft Internet Explorer
- CVE-2018-0997A remote code execution vulnerability exists when Internet Explorer improperly accesses objects in memory, aka "Internet Explorer Memory CorMicrosoft Internet Explorer
- CVE-2018-0998An information disclosure vulnerability exists when Microsoft Edge PDF Reader improperly handles objects in memory, aka "Microsoft Edge InfoMicrosoft Edge
- CVE-2018-1000An information disclosure vulnerability exists in the way that the scripting engine handles objects in memory in Internet Explorer, aka "ScrMicrosoft Internet Explorer
- CVE-2018-1001A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Internet Explorer, aka "ScripMicrosoft Internet Explorer
- CVE-2018-1003A buffer overflow vulnerability exists in the Microsoft JET Database Engine that could allow remote code execution on an affected system, akMicrosoft Windows
- CVE-2018-1004A remote code execution vulnerability exists in the way that the VBScript engine handles objects in memory, aka "Windows VBScript Engine RemMicrosoft Windows · Microsoft Internet Explorer
- CVE-2018-1005An elevation of privilege vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request tMicrosoft SharePoint
- CVE-2018-1007An information disclosure vulnerability exists when Microsoft Office improperly discloses the contents of its memory, aka "Microsoft Office Microsoft Office
- CVE-2018-1008An elevation of privilege vulnerability exists in Windows Adobe Type Manager Font Driver (ATMFD.dll) when it fails to properly handle objectMicrosoft Windows
- CVE-2018-1009An elevation of privilege vulnerability exists when Windows improperly handles objects in memory and incorrectly maps kernel memory, aka "MiMicrosoft Windows Server 2012 R2 · Microsoft Windows RT +2
- CVE-2018-1010A remote code execution vulnerability exists when the Windows font library improperly handles specially crafted embedded fonts, aka "Microso
- CVE-2018-1011A remote code execution vulnerability exists in Microsoft Excel software when the software fails to properly handle objects in memory, aka "Microsoft Excel
- CVE-2018-1012A remote code execution vulnerability exists when the Windows font library improperly handles specially crafted embedded fonts, aka "MicrosoMicrosoft Windows
- CVE-2018-1013A remote code execution vulnerability exists when the Windows font library improperly handles specially crafted embedded fonts, aka "MicrosoMicrosoft Windows
- CVE-2018-1014An elevation of privilege vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request tMicrosoft SharePoint
- CVE-2018-1015A remote code execution vulnerability exists when the Windows font library improperly handles specially crafted embedded fonts, aka "MicrosoMicrosoft Windows
- CVE-2018-1016A remote code execution vulnerability exists when the Windows font library improperly handles specially crafted embedded fonts, aka "Microso
- CVE-2018-1018A remote code execution vulnerability exists when Internet Explorer improperly accesses objects in memory, aka "Internet Explorer Memory CorMicrosoft Internet Explorer
- CVE-2018-1019A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka "CMicrosoft Edge · Microsoft ChakraCore +1
- CVE-2018-1020A remote code execution vulnerability exists when Internet Explorer improperly accesses objects in memory, aka "Internet Explorer Memory CorMicrosoft Internet Explorer
- CVE-2018-1023A remote code execution vulnerability exists in the way that Microsoft browsers access objects in memory, aka "Microsoft Browser Memory CorrMicrosoft Edge · Microsoft ChakraCore
- CVE-2018-1026A remote code execution vulnerability exists in Microsoft Office software when the software fails to properly handle objects in memory, aka Microsoft Office
- CVE-2018-1027A remote code execution vulnerability exists in Microsoft Excel software when the software fails to properly handle objects in memory, aka "Microsoft Excel · Microsoft Office
- CVE-2018-1028A remote code execution vulnerability exists when the Office graphics component improperly handles specially crafted embedded fonts, aka "MiMicrosoft Word · Microsoft Office +2
- CVE-2018-1029A remote code execution vulnerability exists in Microsoft Excel software when the software fails to properly handle objects in memory, aka "Microsoft Excel Viewer · Microsoft Office +1
- CVE-2018-1030A remote code execution vulnerability exists in Microsoft Office software when the software fails to properly handle objects in memory, aka Microsoft Office
- CVE-2018-1032An elevation of privilege vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request tMicrosoft SharePoint Server · Microsoft SharePoint
- CVE-2018-1034An elevation of privilege vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request tMicrosoft SharePoint
- CVE-2018-1037An information disclosure vulnerability exists when Visual Studio improperly discloses limited contents of uninitialized memory while compilMicrosoft Visual Studio
- CVE-2018-8116A denial of service vulnerability exists in the way that Windows handles objects in memory, aka "Microsoft Graphics Component Denial of ServMicrosoft Windows
- CVE-2018-8117A security feature bypass vulnerability exists in the Microsoft Wireless Keyboard 850 which could allow an attacker to reuse an AES encryptiMicrosoft Wireless Keyboard