CVEs published April 13, 2018
46 CVEs were published on April 13, 2018: 0 critical, 1 high.
- Published
- 46
- Critical
- 0
- High
- 1
- Medium
- 0
- Low
- 0
- Unrated
- 45
- Now in CISA KEV
- 0
- Fix available
- 3
Most affected products
- mediawiki
- 11
- F5 Networks BIG-IP
- 10
- ikiwiki
- 2
- org.jenkins-ci.main:jenkins-core
- 2
- VMware vRealize Automation
- 2
- Debian diffoscope · diffoscope
- 1
- iucode-tool
- 1
- ntfs-3g
- 1
High 1
Medium, low and unrated 45
- CVE-2014-1686MediaWiki 1.18.0 allows remote attackers to obtain the installation path via vectors related to thumbnail creation.
- CVE-2014-2069Absolute path traversal vulnerability in Eshtery CMS allows remote attackers to read arbitrary files via a full pathname in the file paramet
- CVE-2018-1000169An exposure of sensitive information vulnerability exists in Jenkins 2.115 and older, LTS 2.107.1 and older, in CLICommand.java and ViewOptiorg.jenkins-ci.main:jenkins-core
- CVE-2018-1000170A cross-site scripting vulnerability exists in Jenkins 2.115 and older, LTS 2.107.1 and older, in confirmationList.jelly and stopButton.jellorg.jenkins-ci.main:jenkins-core
- CVE-2018-10097XSS exists in Domain Trader 2.5.3 via the recoverlogin.php email_address parameter.
- CVE-2018-4173An issue was discovered in certain Apple products.
- CVE-2017-0359diffoscope writes to arbitrary locations on disk based on the contents of an untrusted archiveDebian diffoscope · diffoscope
- CVE-2017-0361api.log contains passwords in plaintextmediawiki
- CVE-2017-0362"Mark all pages visited" on the watchlist does not require a CSRF tokenmediawiki
- CVE-2017-0363Special:UserLogin?returnto=interwiki:foo will redirect to external sitesmediawiki
- CVE-2017-0364Special:Search allows redirects to any interwiki linkmediawiki
- CVE-2017-0365XSS in SearchHighlighter::highlightText() [requires non-default config]mediawiki
- CVE-2017-0366SVG filter evasion using default attribute values in DTD declarationmediawiki
- CVE-2017-0367Having LocalisationCache directory default to system tmp directory is insecuremediawiki
- CVE-2017-0368Make rawHTML mode not apply to system messagesmediawiki
- CVE-2017-0369Sysops can undelete pages, although the page is protected against itmediawiki
- CVE-2017-0370Spam blacklist ineffective on encoded URLs inside file inclusion syntax's link parametermediawiki
- CVE-2017-0372Parameters injection in SyntaxHighlight results in multiple vulnerabilitiesmediawiki
- CVE-2018-10096joyplus-cms 1.6.0 has XSS via the device_name parameter in a manager/admin_ajax.php?action=save flag=add request.
- CVE-2018-6546plays_service.exe in the plays.tv service before 1.27.7.0, as distributed in AMD driver-installation packages and Gaming Evolved products, e
- CVE-2018-6547plays_service.exe in the plays.tv service before 1.27.7.0, as distributed in AMD driver-installation packages and Gaming Evolved products, c
- CVE-2016-9646Commit metadata forgery via CGI::FormBuilder context-dependent APIsikiwiki
- CVE-2017-0356Authentication bypass via repeated parametersikiwiki
- CVE-2017-0357iucode-tool: heap buffer overflow on -tr loaderiucode-tool
- CVE-2017-6143X509 certificate verification was not correctly implemented in the IP Intelligence Subscription and IP Intelligence feed-list features, and F5 Networks BIG-IP
- CVE-2017-6148Responses to SOCKS proxy requests made through F5 BIG-IP version 13.0.0, 12.0.0-12.1.3.1, 11.6.1-11.6.2, or 11.5.1-11.5.5 may cause a disrupF5 Networks BIG-IP
- CVE-2017-6155On F5 BIG-IP 13.0.0, 12.0.0-12.1.3.1, 11.6.0-11.6.2, 11.4.1-11.5.5, or 11.2.1, malformed SPDY or HTTP/2 requests may result in a disruption F5 Networks BIG-IP
- CVE-2017-6156When the F5 BIG-IP 12.1.0-12.1.1, 11.6.0-11.6.1, 11.5.1-11.5.5, or 11.2.1 system is configured with a wildcard IPSec tunnel endpoint, it mayF5 Networks BIG-IP
- CVE-2017-6158In F5 BIG-IP 12.0.0-12.1.2, 11.6.0-11.6.1, 11.5.1-11.5.5, or 11.2.1 there is a vulnerability in TMM related to handling of invalid IP addresF5 Networks BIG-IP
- CVE-2018-10066An issue was discovered in MikroTik RouterOS 6.41.4.
- CVE-2018-10087The kernel_wait4 function in kernel/exit.c in the Linux kernel before 4.13, when an unspecified architecture and compiler is used, might all
- CVE-2018-5506In F5 BIG-IP 13.0.0, 12.1.0-12.1.2, 11.6.1, 11.5.1-11.5.5, or 11.2.1 the Apache modules apache_auth_token_mod and mod_auth_f5_auth_token.cppF5 Networks BIG-IP
- CVE-2018-5507On F5 BIG-IP versions 13.0.0, 12.1.0-12.1.3.1, 11.6.1-11.6.2, or 11.5.1-11.5.5, vCMP guests running on VIPRION 2100, 4200 and 4300 series blF5 Networks BIG-IP
- CVE-2018-5508On F5 BIG-IP PEM versions 13.0.0, 12.0.0-12.1.3.1, 11.6.0-11.6.2, 11.5.1-11.5.5, or 11.2.1, under certain conditions, TMM may crash when proF5 Networks BIG-IP
- CVE-2018-5510On F5 BIG-IP 11.5.4 HF4-11.5.5, the Traffic Management Microkernel (TMM) may restart when processing a specific sequence of packets on IPv6 F5 Networks BIG-IP
- CVE-2018-5511On F5 BIG-IP 13.1.0-13.1.0.3 or 13.0.0, when authenticated administrative users execute commands in the Traffic Management User Interface (TF5 Networks BIG-IP
- CVE-2018-6958VMware vRealize Automation (vRA) prior to 7.3.1 contains a vulnerability that may allow for a DOM-based cross-site scripting (XSS) attack.VMware vRealize Automation
- CVE-2018-6959VMware vRealize Automation (vRA) prior to 7.4.0 contains a vulnerability in the handling of session IDs.VMware vRealize Automation
- CVE-2018-10081CMS Made Simple (CMSMS) through 2.2.6 contains an admin password reset vulnerability because data values are improperly compared, as demonst
- CVE-2018-10082CMS Made Simple (CMSMS) through 2.2.7 allows physical path leakage via an invalid /index.php?page= value, a crafted URI starting with /index
- CVE-2018-10083CMS Made Simple (CMSMS) through 2.2.7 contains an arbitrary file deletion vulnerability in the admin dashboard via directory traversal seque
- CVE-2018-10084CMS Made Simple (CMSMS) through 2.2.6 contains a privilege escalation vulnerability from ordinary user to admin user by arranging for the ef
- CVE-2018-10085CMS Made Simple (CMSMS) through 2.2.6 allows PHP object injection because of an unserialize call in the _get_data function of \lib\classes\i
- CVE-2018-10086CMS Made Simple (CMSMS) through 2.2.7 contains an arbitrary code execution vulnerability in the admin dashboard because the implementation u
- CVE-2018-10080Secutech RiS-11, RiS-22, and RiS-33 devices with firmware V5.07.52_es_FRI01 allow DNS settings changes via a goform/AdvSetDns?GO=wan_dns.asp