# CVEs published 2018-04-13

46 CVEs were published on April 13, 2018: 0 critical, 1 high. Days are UTC.

- [CVE-2014-1686](https://cve.now/CVE-2014-1686.md): MediaWiki 1.18.0 allows remote attackers to obtain the installation path via vectors related to thumbnail creation. (no CVSS)
- [CVE-2014-2069](https://cve.now/CVE-2014-2069.md): Absolute path traversal vulnerability in Eshtery CMS allows remote attackers to read arbitrary files via a full pathname in the file paramet (no CVSS)
- [CVE-2018-1000169](https://cve.now/CVE-2018-1000169.md): An exposure of sensitive information vulnerability exists in Jenkins 2.115 and older, LTS 2.107.1 and older, in CLICommand.java and ViewOpti (no CVSS, org.jenkins-ci.main:jenkins-core)
- [CVE-2018-1000170](https://cve.now/CVE-2018-1000170.md): A cross-site scripting vulnerability exists in Jenkins 2.115 and older, LTS 2.107.1 and older, in confirmationList.jelly and stopButton.jell (no CVSS, org.jenkins-ci.main:jenkins-core)
- [CVE-2018-10097](https://cve.now/CVE-2018-10097.md): XSS exists in Domain Trader 2.5.3 via the recoverlogin.php email\_address parameter. (no CVSS)
- [CVE-2018-4173](https://cve.now/CVE-2018-4173.md): An issue was discovered in certain Apple products. (no CVSS)
- [CVE-2017-0359](https://cve.now/CVE-2017-0359.md): diffoscope writes to arbitrary locations on disk based on the contents of an untrusted archive (no CVSS, Debian diffoscope · diffoscope)
- [CVE-2017-0361](https://cve.now/CVE-2017-0361.md): api.log contains passwords in plaintext (no CVSS, mediawiki)
- [CVE-2017-0362](https://cve.now/CVE-2017-0362.md): "Mark all pages visited" on the watchlist does not require a CSRF token (no CVSS, mediawiki)
- [CVE-2017-0363](https://cve.now/CVE-2017-0363.md): Special:UserLogin?returnto=interwiki:foo will redirect to external sites (no CVSS, mediawiki)
- [CVE-2017-0364](https://cve.now/CVE-2017-0364.md): Special:Search allows redirects to any interwiki link (no CVSS, mediawiki)
- [CVE-2017-0365](https://cve.now/CVE-2017-0365.md): XSS in SearchHighlighter::highlightText() \[requires non-default config\] (no CVSS, mediawiki)
- [CVE-2017-0366](https://cve.now/CVE-2017-0366.md): SVG filter evasion using default attribute values in DTD declaration (no CVSS, mediawiki)
- [CVE-2017-0367](https://cve.now/CVE-2017-0367.md): Having LocalisationCache directory default to system tmp directory is insecure (no CVSS, mediawiki)
- [CVE-2017-0368](https://cve.now/CVE-2017-0368.md): Make rawHTML mode not apply to system messages (no CVSS, mediawiki)
- [CVE-2017-0369](https://cve.now/CVE-2017-0369.md): Sysops can undelete pages, although the page is protected against it (no CVSS, mediawiki)
- [CVE-2017-0370](https://cve.now/CVE-2017-0370.md): Spam blacklist ineffective on encoded URLs inside file inclusion syntax's link parameter (no CVSS, mediawiki)
- [CVE-2017-0372](https://cve.now/CVE-2017-0372.md): Parameters injection in SyntaxHighlight results in multiple vulnerabilities (no CVSS, mediawiki)
- [CVE-2018-10096](https://cve.now/CVE-2018-10096.md): joyplus-cms 1.6.0 has XSS via the device\_name parameter in a manager/admin\_ajax.php?action=save flag=add request. (no CVSS)
- [CVE-2018-6546](https://cve.now/CVE-2018-6546.md): plays\_service.exe in the plays.tv service before 1.27.7.0, as distributed in AMD driver-installation packages and Gaming Evolved products, e (no CVSS)
- [CVE-2018-6547](https://cve.now/CVE-2018-6547.md): plays\_service.exe in the plays.tv service before 1.27.7.0, as distributed in AMD driver-installation packages and Gaming Evolved products, c (no CVSS)
- [CVE-2016-9646](https://cve.now/CVE-2016-9646.md): Commit metadata forgery via CGI::FormBuilder context-dependent APIs (no CVSS, ikiwiki)
- [CVE-2017-0356](https://cve.now/CVE-2017-0356.md): Authentication bypass via repeated parameters (no CVSS, ikiwiki)
- [CVE-2017-0357](https://cve.now/CVE-2017-0357.md): iucode-tool: heap buffer overflow on -tr loader (no CVSS, iucode-tool)
- [CVE-2017-0358](https://cve.now/CVE-2017-0358.md): ntfs-3g: Modprobe influence vulnerability via environment variables (CVSS 7.8, ntfs-3g)
- [CVE-2017-6143](https://cve.now/CVE-2017-6143.md): X509 certificate verification was not correctly implemented in the IP Intelligence Subscription and IP Intelligence feed-list features, and (no CVSS, F5 Networks BIG-IP)
- [CVE-2017-6148](https://cve.now/CVE-2017-6148.md): Responses to SOCKS proxy requests made through F5 BIG-IP version 13.0.0, 12.0.0-12.1.3.1, 11.6.1-11.6.2, or 11.5.1-11.5.5 may cause a disrup (no CVSS, F5 Networks BIG-IP)
- [CVE-2017-6155](https://cve.now/CVE-2017-6155.md): On F5 BIG-IP 13.0.0, 12.0.0-12.1.3.1, 11.6.0-11.6.2, 11.4.1-11.5.5, or 11.2.1, malformed SPDY or HTTP/2 requests may result in a disruption (no CVSS, F5 Networks BIG-IP)
- [CVE-2017-6156](https://cve.now/CVE-2017-6156.md): When the F5 BIG-IP 12.1.0-12.1.1, 11.6.0-11.6.1, 11.5.1-11.5.5, or 11.2.1 system is configured with a wildcard IPSec tunnel endpoint, it may (no CVSS, F5 Networks BIG-IP)
- [CVE-2017-6158](https://cve.now/CVE-2017-6158.md): In F5 BIG-IP 12.0.0-12.1.2, 11.6.0-11.6.1, 11.5.1-11.5.5, or 11.2.1 there is a vulnerability in TMM related to handling of invalid IP addres (no CVSS, F5 Networks BIG-IP)
- [CVE-2018-10066](https://cve.now/CVE-2018-10066.md): An issue was discovered in MikroTik RouterOS 6.41.4. (no CVSS)
- [CVE-2018-10087](https://cve.now/CVE-2018-10087.md): The kernel\_wait4 function in kernel/exit.c in the Linux kernel before 4.13, when an unspecified architecture and compiler is used, might all (no CVSS)
- [CVE-2018-5506](https://cve.now/CVE-2018-5506.md): In F5 BIG-IP 13.0.0, 12.1.0-12.1.2, 11.6.1, 11.5.1-11.5.5, or 11.2.1 the Apache modules apache\_auth\_token\_mod and mod\_auth\_f5\_auth\_token.cpp (no CVSS, F5 Networks BIG-IP)
- [CVE-2018-5507](https://cve.now/CVE-2018-5507.md): On F5 BIG-IP versions 13.0.0, 12.1.0-12.1.3.1, 11.6.1-11.6.2, or 11.5.1-11.5.5, vCMP guests running on VIPRION 2100, 4200 and 4300 series bl (no CVSS, F5 Networks BIG-IP)
- [CVE-2018-5508](https://cve.now/CVE-2018-5508.md): On F5 BIG-IP PEM versions 13.0.0, 12.0.0-12.1.3.1, 11.6.0-11.6.2, 11.5.1-11.5.5, or 11.2.1, under certain conditions, TMM may crash when pro (no CVSS, F5 Networks BIG-IP)
- [CVE-2018-5510](https://cve.now/CVE-2018-5510.md): On F5 BIG-IP 11.5.4 HF4-11.5.5, the Traffic Management Microkernel (TMM) may restart when processing a specific sequence of packets on IPv6 (no CVSS, F5 Networks BIG-IP)
- [CVE-2018-5511](https://cve.now/CVE-2018-5511.md): On F5 BIG-IP 13.1.0-13.1.0.3 or 13.0.0, when authenticated administrative users execute commands in the Traffic Management User Interface (T (no CVSS, F5 Networks BIG-IP)
- [CVE-2018-6958](https://cve.now/CVE-2018-6958.md): VMware vRealize Automation (vRA) prior to 7.3.1 contains a vulnerability that may allow for a DOM-based cross-site scripting (XSS) attack. (no CVSS, VMware vRealize Automation)
- [CVE-2018-6959](https://cve.now/CVE-2018-6959.md): VMware vRealize Automation (vRA) prior to 7.4.0 contains a vulnerability in the handling of session IDs. (no CVSS, VMware vRealize Automation)
- [CVE-2018-10081](https://cve.now/CVE-2018-10081.md): CMS Made Simple (CMSMS) through 2.2.6 contains an admin password reset vulnerability because data values are improperly compared, as demonst (no CVSS)
- [CVE-2018-10082](https://cve.now/CVE-2018-10082.md): CMS Made Simple (CMSMS) through 2.2.7 allows physical path leakage via an invalid /index.php?page= value, a crafted URI starting with /index (no CVSS)
- [CVE-2018-10083](https://cve.now/CVE-2018-10083.md): CMS Made Simple (CMSMS) through 2.2.7 contains an arbitrary file deletion vulnerability in the admin dashboard via directory traversal seque (no CVSS)
- [CVE-2018-10084](https://cve.now/CVE-2018-10084.md): CMS Made Simple (CMSMS) through 2.2.6 contains a privilege escalation vulnerability from ordinary user to admin user by arranging for the ef (no CVSS)
- [CVE-2018-10085](https://cve.now/CVE-2018-10085.md): CMS Made Simple (CMSMS) through 2.2.6 allows PHP object injection because of an unserialize call in the \_get\_data function of \\lib\\classes\\i (no CVSS)
- [CVE-2018-10086](https://cve.now/CVE-2018-10086.md): CMS Made Simple (CMSMS) through 2.2.7 contains an arbitrary code execution vulnerability in the admin dashboard because the implementation u (no CVSS)
- [CVE-2018-10080](https://cve.now/CVE-2018-10080.md): Secutech RiS-11, RiS-22, and RiS-33 devices with firmware V5.07.52\_es\_FRI01 allow DNS settings changes via a goform/AdvSetDns?GO=wan\_dns.asp (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2018-04-13
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.