# CVEs published 2018-04-12

112 CVEs were published on April 12, 2018: 0 critical, 6 high. Days are UTC.

- [CVE-2018-6870](https://cve.now/CVE-2018-6870.md): Reflected XSS exists in PHP Scripts Mall Website Seller Script 2.0.3 via the Listings Search feature. (no CVSS)
- [CVE-2018-6879](https://cve.now/CVE-2018-6879.md): PHP Scripts Mall Website Seller Script 2.0.3 uses the client side to enforce validation of an e-mail address, which allows remote attackers (no CVSS)
- [CVE-2018-6900](https://cve.now/CVE-2018-6900.md): PHP Scripts Mall Website Broker Script 3.0.6 has XSS via the Last Name field on the My Profile page. (no CVSS)
- [CVE-2018-6902](https://cve.now/CVE-2018-6902.md): PHP Scripts Mall Image Sharing Script 1.3.3 has XSS via the Full Name field in an Edit Profile action. (no CVSS)
- [CVE-2018-6903](https://cve.now/CVE-2018-6903.md): PHP Scripts Mall Hot Scripts Clone Script Classified v3.1 uses the client side to enforce validation of an e-mail address, which allows remo (no CVSS)
- [CVE-2018-6904](https://cve.now/CVE-2018-6904.md): PHP Scripts Mall Car Rental Script 2.0.8 has XSS via the User Name field in an Edit Profile action. (no CVSS)
- [CVE-2018-6934](https://cve.now/CVE-2018-6934.md): CSRF exists in student/personal-info in PHP Scripts Mall Online Tutoring Script 2.0.3. (no CVSS)
- [CVE-2018-6935](https://cve.now/CVE-2018-6935.md): PHP Scripts Mall Student Profile Management System Script v2.0.6 has XSS via the Name field to list\_student.php. (no CVSS)
- [CVE-2014-6120](https://cve.now/CVE-2014-6120.md): IBM Rational AppScan Source 8.0 through 8.0.0.2 and 8.5 through 8.5.0.1 and Security AppScan Source 8.6 through 8.6.0.2, 8.7 through 8.7.0.1 (no CVSS)
- [CVE-2014-6169](https://cve.now/CVE-2014-6169.md): Cross-site scripting (XSS) vulnerability in IBM Forms Experience Builder 8.5.0 and 8.5.1 allows remote attackers to inject arbitrary web scr (no CVSS)
- [CVE-2014-6412](https://cve.now/CVE-2014-6412.md): WordPress before 4.4 makes it easier for remote attackers to predict password-recovery tokens via a brute-force approach. (no CVSS)
- [CVE-2014-8421](https://cve.now/CVE-2014-8421.md): Unify (former Siemens) OpenStage SIP and OpenScape Desk Phone IP V3 devices before R3.32.0 allow remote attackers to gain super-user privile (no CVSS)
- [CVE-2014-8422](https://cve.now/CVE-2014-8422.md): The web-based management (WBM) interface in Unify (former Siemens) OpenStage SIP and OpenScape Desk Phone IP V3 devices before R3.32.0 gener (no CVSS)
- [CVE-2014-8888](https://cve.now/CVE-2014-8888.md): The remote administration interface in D-Link DIR-815 devices with firmware before 2.03.B02 allows remote attackers to execute arbitrary com (no CVSS)
- [CVE-2014-9563](https://cve.now/CVE-2014-9563.md): CRLF injection vulnerability in the web-based management (WBM) interface in Unify (former Siemens) OpenStage SIP and OpenScape Desk Phone IP (no CVSS)
- [CVE-2015-0150](https://cve.now/CVE-2015-0150.md): The remote administration UI in D-Link DIR-815 devices with firmware before 2.07.B01 allows remote attackers to bypass intended access restr (no CVSS)
- [CVE-2015-0151](https://cve.now/CVE-2015-0151.md): Cross-site request forgery (CSRF) vulnerability in D-Link DIR-815 devices with firmware before 2.07.B01 allows remote attackers to hijack th (no CVSS)
- [CVE-2015-0152](https://cve.now/CVE-2015-0152.md): D-Link DIR-815 devices with firmware before 2.07.B01 allow remote attackers to obtain sensitive information by leveraging cleartext storage (no CVSS)
- [CVE-2015-0153](https://cve.now/CVE-2015-0153.md): D-Link DIR-815 devices with firmware before 2.07.B01 allow remote attackers to obtain sensitive information by leveraging cleartext storage (no CVSS)
- [CVE-2018-5254](https://cve.now/CVE-2018-5254.md): Arista EOS before 4.20.2F allows remote BGP peers to cause a denial of service (Rib agent restart) via a malformed path attribute in an UPDA (no CVSS)
- [CVE-2018-10063](https://cve.now/CVE-2018-10063.md): The Convert Forms extension before 2.0.4 for Joomla! is vulnerable to Remote Command Execution using CSV Injection that is mishandled when e (no CVSS)
- [CVE-2018-3861](https://cve.now/CVE-2018-3861.md): A specially crafted TIFF image processed via the application can lead to an out-of-bounds write, overwriting arbitrary data. (CVSS 8.8, Talos Computerinsel Photoline)
- [CVE-2018-3862](https://cve.now/CVE-2018-3862.md): A specially crafted TIFF image processed via the application can lead to an out-of-bounds write, overwriting (CVSS 8.8, Talos Computerinsel Photoline)
- [CVE-2018-3868](https://cve.now/CVE-2018-3868.md): A specially crafted TIFF image processed via the application can lead to an out-of-bounds write, overwriting arbitrary data. (CVSS 8.8, Talos Computerinsel Photoline)
- [CVE-2018-3889](https://cve.now/CVE-2018-3889.md): A specially crafted PCX image processed via the application can lead to an out-of-bounds write, overwriting arbitrary data. (CVSS 8.8, Talos Computerinsel Photoline)
- [CVE-2018-10068](https://cve.now/CVE-2018-10068.md): The jDownloads extension before 3.2.59 for Joomla! has XSS. (no CVSS)
- [CVE-2018-10071](https://cve.now/CVE-2018-10071.md): windrvr1260.sys in Jungo DriverWizard WinDriver 12.6.0 allows attackers to cause a denial of service (BSOD) via a 0x953826DB DeviceIoControl (no CVSS)
- [CVE-2018-10072](https://cve.now/CVE-2018-10072.md): windrvr1260.sys in Jungo DriverWizard WinDriver 12.6.0 allows attackers to cause a denial of service (BSOD) via a 0x953827bf DeviceIoControl (no CVSS)
- [CVE-2018-10073](https://cve.now/CVE-2018-10073.md): joyplus-cms 1.6.0 has XSS in manager/admin\_vod.php via the keyword parameter. (no CVSS)
- [CVE-2018-10074](https://cve.now/CVE-2018-10074.md): The hi3660\_stub\_clk\_probe function in drivers/clk/hisilicon/clk-hi3660-stub.c in the Linux kernel before 4.16 allows local users to cause a (no CVSS)
- [CVE-2018-1079](https://cve.now/CVE-2018-1079.md): pcs before version 0.9.164 and 0.10 is vulnerable to a privilege escalation via authorized user malicious REST call. (CVSS 8.7, pcs)
- [CVE-2018-1084](https://cve.now/CVE-2018-1084.md): corosync before version 2.4.4 is vulnerable to an integer overflow in exec/totemcrypto.c. (CVSS 7.5, corosync)
- [CVE-2018-10059](https://cve.now/CVE-2018-10059.md): Cacti before 1.1.37 has XSS because the get\_current\_page function in lib/functions.php relies on $\_SERVER\['PHP\_SELF'\] instead of $\_SERVER\['S (no CVSS)
- [CVE-2018-10060](https://cve.now/CVE-2018-10060.md): Cacti before 1.1.37 has XSS because it does not properly reject unintended characters, related to use of the sanitize\_uri function in lib/fu (no CVSS)
- [CVE-2018-10061](https://cve.now/CVE-2018-10061.md): Cacti before 1.1.37 has XSS because it makes certain htmlspecialchars calls without the ENT\_QUOTES flag (these calls occur when the html\_esc (no CVSS)
- [CVE-2018-1086](https://cve.now/CVE-2018-1086.md): pcs before versions 0.9.164 and 0.10 is vulnerable to a debug parameter removal bypass. (CVSS 4.3, redhat pcs)
- [CVE-2014-6309](https://cve.now/CVE-2014-6309.md): The HTTP and WebSocket engine components in the server in Kaazing Gateway 4.0.2, 4.0.3, and 4.0.4 and Gateway - JMS Edition 4.0.2, 4.0.3, an (no CVSS)
- [CVE-2014-6633](https://cve.now/CVE-2014-6633.md): The safe\_eval function in trytond in Tryton before 2.4.15, 2.6.x before 2.6.14, 2.8.x before 2.8.11, 3.0.x before 3.0.7, and 3.2.x before 3. (no CVSS, trytond · tryton)
- [CVE-2015-1777](https://cve.now/CVE-2015-1777.md): rhnreg\_ks in Red Hat Network Client Tools (aka rhn-client-tools) on Red Hat Gluster Storage 2.1 and Enterprise Linux (RHEL) 5, 6, and 7 does (no CVSS)
- [CVE-2015-4557](https://cve.now/CVE-2015-4557.md): Cross-site scripting (XSS) vulnerability in the new\_Twitter\_sign\_button function in nextend-Twitter-connect.php in the Nextend Twitter Conne (no CVSS)
- [CVE-2017-1790](https://cve.now/CVE-2017-1790.md): IBM DOORS Next Generation (DNG/RRC) 5.0, 5.0.1, 5.0.2, and 6.0 through 6.0.5 is vulnerable to cross-site scripting. (no CVSS, IBM Rational DOORS Next Generation)
- [CVE-2017-6910](https://cve.now/CVE-2017-6910.md): The HTTP and WebSocket engine components in the server in Kaazing Gateway before 4.5.3 hotfix-1, Gateway - JMS Edition before 4.0.5 hotfix-1 (no CVSS)
- [CVE-2018-9118](https://cve.now/CVE-2018-9118.md): exports/download.php in the 99 Robots WP Background Takeover Advertisements plugin before 4.1.5 for WordPress has Directory Traversal via a (no CVSS)
- [CVE-2018-9155](https://cve.now/CVE-2018-9155.md): Cross-site scripting (XSS) vulnerability in Open-AudIT Professional 2.1.1 allows remote attackers to inject arbitrary web script or HTML via (no CVSS)
- [CVE-2018-9842](https://cve.now/CVE-2018-9842.md): CyberArk Password Vault before 9.7 allows remote attackers to obtain sensitive information from process memory by replaying a logon message. (no CVSS)
- [CVE-2018-9843](https://cve.now/CVE-2018-9843.md): The REST API in CyberArk Password Vault Web Access before 9.9.5 and 10.x before 10.1 allows remote attackers to execute arbitrary code via a (no CVSS)
- [CVE-2018-9860](https://cve.now/CVE-2018-9860.md): An issue was discovered in Botan 1.11.32 through 2.x before 2.6.0. (no CVSS)
- [CVE-2018-0870](https://cve.now/CVE-2018-0870.md): A remote code execution vulnerability exists when Internet Explorer improperly accesses objects in memory, aka "Internet Explorer Memory Cor (no CVSS, Microsoft Internet Explorer)
- [CVE-2018-0887](https://cve.now/CVE-2018-0887.md): An information disclosure vulnerability exists when the Windows kernel fails to properly initialize a memory address, aka "Windows Kernel In (no CVSS, Microsoft Windows)
- [CVE-2018-0890](https://cve.now/CVE-2018-0890.md): A security feature bypass vulnerability exists when Active Directory incorrectly applies Network Isolation settings, aka "Active Directory S (no CVSS, Microsoft Windows Server · Microsoft Windows)
- [CVE-2018-0892](https://cve.now/CVE-2018-0892.md): An information disclosure vulnerability exists when Microsoft Edge improperly handles objects in memory, aka "Microsoft Edge Information Dis (no CVSS, Microsoft Edge)
- [CVE-2018-0920](https://cve.now/CVE-2018-0920.md): A remote code execution vulnerability exists in Microsoft Excel software when the software fails to properly handle objects in memory, aka " (no CVSS, Microsoft Excel)
- [CVE-2018-0950](https://cve.now/CVE-2018-0950.md): An information disclosure vulnerability exists when Office renders Rich Text Format (RTF) email messages containing OLE objects when a messa (no CVSS, Microsoft Word · Microsoft Office)
- [CVE-2018-0956](https://cve.now/CVE-2018-0956.md): A denial of service vulnerability exists in the HTTP 2.0 protocol stack (HTTP.sys) when HTTP.sys improperly parses specially crafted HTTP 2. (no CVSS, Microsoft Windows Server · Microsoft Windows)
- [CVE-2018-0957](https://cve.now/CVE-2018-0957.md): An information disclosure vulnerability exists when Windows Hyper-V on a host operating system fails to properly validate input from an auth (no CVSS, Microsoft Windows Server 2012 R2 · Microsoft Windows RT +2)
- [CVE-2018-0960](https://cve.now/CVE-2018-0960.md): An information disclosure vulnerability exists when the Windows kernel improperly handles objects in memory, aka "Windows Kernel Information (no CVSS, Microsoft Windows)
- [CVE-2018-0963](https://cve.now/CVE-2018-0963.md): An elevation of privilege vulnerability exists in the way that the Windows Kernel handles objects in memory, aka "Windows Kernel Elevation o (no CVSS, Microsoft Windows Server · Microsoft Windows)
- [CVE-2018-0964](https://cve.now/CVE-2018-0964.md): An information disclosure vulnerability exists when Windows Hyper-V on a host operating system fails to properly validate input from an auth (no CVSS, Microsoft Windows)
- [CVE-2018-0966](https://cve.now/CVE-2018-0966.md): A security feature bypass exists when Device Guard incorrectly validates an untrusted file, aka "Device Guard Security Feature Bypass Vulner (no CVSS, Microsoft Windows Server · Microsoft Windows)
- [CVE-2018-0967](https://cve.now/CVE-2018-0967.md): A denial of service vulnerability exists in the way that Windows SNMP Service handles malformed SNMP traps, aka "Windows SNMP Service Denial (no CVSS)
- [CVE-2018-0968](https://cve.now/CVE-2018-0968.md): An information disclosure vulnerability exists in the Windows kernel that could allow an attacker to retrieve information that could lead to (no CVSS, Microsoft Windows Server 2012 R2 · Microsoft Windows RT +2)
- [CVE-2018-0969](https://cve.now/CVE-2018-0969.md): An information disclosure vulnerability exists in the Windows kernel that could allow an attacker to retrieve information that could lead to (no CVSS, Microsoft Windows)
- [CVE-2018-0970](https://cve.now/CVE-2018-0970.md): An information disclosure vulnerability exists in the Windows kernel that could allow an attacker to retrieve information that could lead to (no CVSS, Microsoft Windows)
- [CVE-2018-0971](https://cve.now/CVE-2018-0971.md): An information disclosure vulnerability exists in the Windows kernel that could allow an attacker to retrieve information that could lead to (no CVSS, Microsoft Windows)
- [CVE-2018-0972](https://cve.now/CVE-2018-0972.md): An information disclosure vulnerability exists in the Windows kernel that could allow an attacker to retrieve information that could lead to (no CVSS, Microsoft Windows)
- [CVE-2018-0973](https://cve.now/CVE-2018-0973.md): An information disclosure vulnerability exists in the Windows kernel that could allow an attacker to retrieve information that could lead to (no CVSS, Microsoft Windows)
- [CVE-2018-0974](https://cve.now/CVE-2018-0974.md): An information disclosure vulnerability exists in the Windows kernel that could allow an attacker to retrieve information that could lead to (no CVSS, Microsoft Windows)
- [CVE-2018-0975](https://cve.now/CVE-2018-0975.md): An information disclosure vulnerability exists in the Windows kernel that could allow an attacker to retrieve information that could lead to (no CVSS, Microsoft Windows)
- [CVE-2018-0976](https://cve.now/CVE-2018-0976.md): A denial of service vulnerability exists in Remote Desktop Protocol (RDP) when an attacker connects to the target system using RDP and sends (no CVSS, Microsoft Windows)
- [CVE-2018-0979](https://cve.now/CVE-2018-0979.md): A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka "C (no CVSS, Microsoft Edge · Microsoft ChakraCore +1)
- [CVE-2018-0980](https://cve.now/CVE-2018-0980.md): A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka "C (no CVSS, Microsoft Edge · Microsoft ChakraCore +1)
- [CVE-2018-0981](https://cve.now/CVE-2018-0981.md): An information disclosure vulnerability exists in the way that the scripting engine handles objects in memory in Internet Explorer, aka "Scr (no CVSS, Microsoft Internet Explorer)
- [CVE-2018-0987](https://cve.now/CVE-2018-0987.md): An information disclosure vulnerability exists when the scripting engine does not properly handle objects in memory in Internet Explorer, ak (no CVSS, Microsoft Internet Explorer)
- [CVE-2018-0988](https://cve.now/CVE-2018-0988.md): A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Internet Explorer, aka "Scrip (no CVSS, Microsoft Internet Explorer)
- [CVE-2018-0989](https://cve.now/CVE-2018-0989.md): An information disclosure vulnerability exists in the way that the scripting engine handles objects in memory in Internet Explorer, aka "Scr (no CVSS, Microsoft Internet Explorer)
- [CVE-2018-0990](https://cve.now/CVE-2018-0990.md): A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka "C (no CVSS, Microsoft Edge · Microsoft ChakraCore +1)
- [CVE-2018-0991](https://cve.now/CVE-2018-0991.md): A remote code execution vulnerability exists when Internet Explorer improperly accesses objects in memory, aka "Internet Explorer Memory Cor (no CVSS, Microsoft Internet Explorer)
- [CVE-2018-0993](https://cve.now/CVE-2018-0993.md): A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka "C (no CVSS, Microsoft Edge · Microsoft ChakraCore +1)
- [CVE-2018-0994](https://cve.now/CVE-2018-0994.md): A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka "C (no CVSS, Microsoft Edge · Microsoft ChakraCore +1)
- [CVE-2018-0995](https://cve.now/CVE-2018-0995.md): A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka "C (no CVSS, Microsoft Edge · Microsoft ChakraCore +1)
- [CVE-2018-0996](https://cve.now/CVE-2018-0996.md): A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Internet Explorer, aka "Scrip (no CVSS, Microsoft Internet Explorer)
- [CVE-2018-0997](https://cve.now/CVE-2018-0997.md): A remote code execution vulnerability exists when Internet Explorer improperly accesses objects in memory, aka "Internet Explorer Memory Cor (no CVSS, Microsoft Internet Explorer)
- [CVE-2018-0998](https://cve.now/CVE-2018-0998.md): An information disclosure vulnerability exists when Microsoft Edge PDF Reader improperly handles objects in memory, aka "Microsoft Edge Info (no CVSS, Microsoft Edge)
- [CVE-2018-1000](https://cve.now/CVE-2018-1000.md): An information disclosure vulnerability exists in the way that the scripting engine handles objects in memory in Internet Explorer, aka "Scr (no CVSS, Microsoft Internet Explorer)
- [CVE-2018-1001](https://cve.now/CVE-2018-1001.md): A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Internet Explorer, aka "Scrip (no CVSS, Microsoft Internet Explorer)
- [CVE-2018-1003](https://cve.now/CVE-2018-1003.md): A buffer overflow vulnerability exists in the Microsoft JET Database Engine that could allow remote code execution on an affected system, ak (no CVSS, Microsoft Windows)
- [CVE-2018-1004](https://cve.now/CVE-2018-1004.md): A remote code execution vulnerability exists in the way that the VBScript engine handles objects in memory, aka "Windows VBScript Engine Rem (no CVSS, Microsoft Windows · Microsoft Internet Explorer)
- [CVE-2018-1005](https://cve.now/CVE-2018-1005.md): An elevation of privilege vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request t (no CVSS, Microsoft SharePoint)
- [CVE-2018-1007](https://cve.now/CVE-2018-1007.md): An information disclosure vulnerability exists when Microsoft Office improperly discloses the contents of its memory, aka "Microsoft Office (no CVSS, Microsoft Office)
- [CVE-2018-1008](https://cve.now/CVE-2018-1008.md): An elevation of privilege vulnerability exists in Windows Adobe Type Manager Font Driver (ATMFD.dll) when it fails to properly handle object (no CVSS, Microsoft Windows)
- [CVE-2018-1009](https://cve.now/CVE-2018-1009.md): An elevation of privilege vulnerability exists when Windows improperly handles objects in memory and incorrectly maps kernel memory, aka "Mi (no CVSS, Microsoft Windows Server 2012 R2 · Microsoft Windows RT +2)
- [CVE-2018-1010](https://cve.now/CVE-2018-1010.md): A remote code execution vulnerability exists when the Windows font library improperly handles specially crafted embedded fonts, aka "Microso (no CVSS)
- [CVE-2018-1011](https://cve.now/CVE-2018-1011.md): A remote code execution vulnerability exists in Microsoft Excel software when the software fails to properly handle objects in memory, aka " (no CVSS, Microsoft Excel)
- [CVE-2018-1012](https://cve.now/CVE-2018-1012.md): A remote code execution vulnerability exists when the Windows font library improperly handles specially crafted embedded fonts, aka "Microso (no CVSS, Microsoft Windows)
- [CVE-2018-1013](https://cve.now/CVE-2018-1013.md): A remote code execution vulnerability exists when the Windows font library improperly handles specially crafted embedded fonts, aka "Microso (no CVSS, Microsoft Windows)
- [CVE-2018-1014](https://cve.now/CVE-2018-1014.md): An elevation of privilege vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request t (no CVSS, Microsoft SharePoint)
- [CVE-2018-1015](https://cve.now/CVE-2018-1015.md): A remote code execution vulnerability exists when the Windows font library improperly handles specially crafted embedded fonts, aka "Microso (no CVSS, Microsoft Windows)
- [CVE-2018-1016](https://cve.now/CVE-2018-1016.md): A remote code execution vulnerability exists when the Windows font library improperly handles specially crafted embedded fonts, aka "Microso (no CVSS)
- [CVE-2018-1018](https://cve.now/CVE-2018-1018.md): A remote code execution vulnerability exists when Internet Explorer improperly accesses objects in memory, aka "Internet Explorer Memory Cor (no CVSS, Microsoft Internet Explorer)
- [CVE-2018-1019](https://cve.now/CVE-2018-1019.md): A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka "C (no CVSS, Microsoft Edge · Microsoft ChakraCore +1)
- [CVE-2018-1020](https://cve.now/CVE-2018-1020.md): A remote code execution vulnerability exists when Internet Explorer improperly accesses objects in memory, aka "Internet Explorer Memory Cor (no CVSS, Microsoft Internet Explorer)
- [CVE-2018-1023](https://cve.now/CVE-2018-1023.md): A remote code execution vulnerability exists in the way that Microsoft browsers access objects in memory, aka "Microsoft Browser Memory Corr (no CVSS, Microsoft Edge · Microsoft ChakraCore)
- [CVE-2018-1026](https://cve.now/CVE-2018-1026.md): A remote code execution vulnerability exists in Microsoft Office software when the software fails to properly handle objects in memory, aka (no CVSS, Microsoft Office)
- [CVE-2018-1027](https://cve.now/CVE-2018-1027.md): A remote code execution vulnerability exists in Microsoft Excel software when the software fails to properly handle objects in memory, aka " (no CVSS, Microsoft Excel · Microsoft Office)
- [CVE-2018-1028](https://cve.now/CVE-2018-1028.md): A remote code execution vulnerability exists when the Office graphics component improperly handles specially crafted embedded fonts, aka "Mi (no CVSS, Microsoft Word · Microsoft Office +2)
- [CVE-2018-1029](https://cve.now/CVE-2018-1029.md): A remote code execution vulnerability exists in Microsoft Excel software when the software fails to properly handle objects in memory, aka " (no CVSS, Microsoft Excel Viewer · Microsoft Office +1)
- [CVE-2018-1030](https://cve.now/CVE-2018-1030.md): A remote code execution vulnerability exists in Microsoft Office software when the software fails to properly handle objects in memory, aka (no CVSS, Microsoft Office)
- [CVE-2018-1032](https://cve.now/CVE-2018-1032.md): An elevation of privilege vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request t (no CVSS, Microsoft SharePoint Server · Microsoft SharePoint)
- [CVE-2018-1034](https://cve.now/CVE-2018-1034.md): An elevation of privilege vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request t (no CVSS, Microsoft SharePoint)
- [CVE-2018-1037](https://cve.now/CVE-2018-1037.md): An information disclosure vulnerability exists when Visual Studio improperly discloses limited contents of uninitialized memory while compil (no CVSS, Microsoft Visual Studio)
- [CVE-2018-8116](https://cve.now/CVE-2018-8116.md): A denial of service vulnerability exists in the way that Windows handles objects in memory, aka "Microsoft Graphics Component Denial of Serv (no CVSS, Microsoft Windows)
- [CVE-2018-8117](https://cve.now/CVE-2018-8117.md): A security feature bypass vulnerability exists in the Microsoft Wireless Keyboard 850 which could allow an attacker to reuse an AES encrypti (no CVSS, Microsoft Wireless Keyboard)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2018-04-12
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.