CVEs published April 16, 2018
41 CVEs were published on April 16, 2018: 0 critical, 3 high.
- Published
- 41
- Critical
- 0
- High
- 3
- Medium
- 2
- Low
- 0
- Unrated
- 36
- Now in CISA KEV
- 0
- Fix available
- 1
Most affected products
- Cybozu Garoon
- 8
- Talos NASA CFITSIO
- 3
- Symantec Endpoint Protection
- 2
- Coderium Installer of SoundEngine Free
- 1
- foreman-debug
- 1
- Hatena co. Hatena Bookmark App for iOS
- 1
- Legion of the Bouncy Castle Bouncy Castle · org.bouncycastl…
- 1
- openshift
- 1
- OpenSSL
- 1
- SecureBrain The installer of PhishWall Client Internet Expl…
- 1
High 3
- CVE-2018-3846In the ffgphd and ffgtkn functions in NASA CFITSIO 3.42, specially crafted images parsed via the library can cause a stack-based buffer overTalos NASA CFITSIO
- CVE-2018-3848In the ffghbn function in NASA CFITSIO 3.42, specially crafted images parsed via the library can cause a stack-based buffer overflow overwriTalos NASA CFITSIO
- CVE-2018-3849In the ffghtb function in NASA CFITSIO 3.42, specially crafted images parsed via the library can cause a stack-based buffer overflow overwriTalos NASA CFITSIO
Medium, low and unrated 38
- CVE-2018-10177In ImageMagick 7.0.7-28, there is an infinite loop in the ReadOneMNGImage function of the coders/png.c file.
- CVE-2018-101727-Zip through 18.01 on Windows implements the "Large memory pages" option by calling the LsaAddAccountRights function to add the SeLockMemor
- CVE-2018-10070A vulnerability in MikroTik Version 6.41.4 could allow an unauthenticated remote attacker to exhaust all available CPU and all available RAM
- CVE-2018-10169ProtonVPN 1.3.3 for Windows suffers from a SYSTEM privilege escalation vulnerability through the "ProtonVPN Service" service.
- CVE-2018-10170NordVPN 6.12.7.0 for Windows suffers from a SYSTEM privilege escalation vulnerability through the "nordvpn-service" service.
- CVE-2018-10138The CATALooK.netStore module through 7.2.8 for DNN (formerly DotNetNuke) allows XSS via the /ViewEditGoogleMaps.aspx PortalID or CATSkin par
- CVE-2016-9093A version of the SymEvent Driver that shipped with Symantec Endpoint Protection 12.1 RU6 MP6 and earlier fails to properly sanitize logged-iSymantec Endpoint Protection
- CVE-2016-9094Symantec Endpoint Protection clients place detected malware in quarantine as part of the intended product functionality.Symantec Endpoint Protection
- CVE-2017-6323The Symantec Management Console prior to ITMS 8.1 RU1, ITMS 8.0_POST_HF6, and ITMS 7.6_POST_HF7 has an issue whereby XML input containing a Symantec ITMS
- CVE-2015-1952Cross-site scripting (XSS) vulnerability in IBM AppScan Enterprise Edition 9.0.x before 9.0.2 iFix 001 allows remote attackers to inject arb
- CVE-2018-0737Cache timing vulnerability in RSA Key GenerationOpenSSL
- CVE-2018-10135iScripts eSwap v2.4 has Reflected XSS via the "catwiseproducts.php" catid parameter in the User Panel.
- CVE-2018-10136iScripts UberforX 2.2 has Stored XSS in the "manage_settings" section of the Admin Panel via a value field to the /cms?section=manage_settin
- CVE-2018-10137iScripts UberforX 2.2 has CSRF in the "manage_settings" section of the Admin Panel via the /cms?section=manage_settings&action=edit URI.
- CVE-2017-10140Postfix before 2.11.10, 3.0.x before 3.0.10, 3.1.x before 3.1.6, and 3.2.x before 3.2.2 might allow local users to gain privileges by levera
- CVE-2016-9592openshift before versions 3.3.1.11, 3.2.1.23, 3.4 is vulnerable to a flaw when a volume fails to detach, which causes the delete operation topenshift
- CVE-2016-9593foreman-debug before version 1.15.0 is vulnerable to a flaw in foreman-debug's logging.foreman-debug
- CVE-2018-10127An issue was discovered in XYHCMS 3.5.
- CVE-2018-10128An issue was discovered in XYHCMS 3.5.
- CVE-2018-10132PbootCMS v0.9.8 has CSRF via an admin.php/Message/mod/id/19.html?backurl=/index.php request, resulting in PHP code injection in the reconten
- CVE-2018-10133PbootCMS v0.9.8 allows PHP code injection via an IF label in index.php/About/6.html or admin.php/Site/index.html, related to the parserIfLab
- CVE-2018-0530SQL injection vulnerability in the Cybozu Garoon 3.5.0 to 4.2.6 allows remote authenticated attackers to execute arbitrary SQL commands via Cybozu Garoon
- CVE-2018-0531Cybozu Garoon 3.0.0 to 4.2.6 allows remote authenticated attackers to bypass access restriction to view or alter an access privilege of a foCybozu Garoon
- CVE-2018-0532Cybozu Garoon 3.0.0 to 4.2.6 allows remote authenticated attackers to bypass access restriction to alter setting data of the Standard databaCybozu Garoon
- CVE-2018-0533Cybozu Garoon 3.0.0 to 4.2.6 allows remote authenticated attackers to bypass access restriction to alter setting data of session authenticatCybozu Garoon
- CVE-2018-0548Cybozu Garoon 4.0.0 to 4.6.0 allows remote authenticated attackers to bypass access restriction to view the closed title of "Space" via unspCybozu Garoon
- CVE-2018-0549Cross-site scripting vulnerability in Cybozu Garoon 3.0.0 to 4.6.0 allows remote authenticated attackers to inject arbitrary web script or HCybozu Garoon
- CVE-2018-0550Cybozu Garoon 3.5.0 to 4.6.1 allows remote authenticated attackers to bypass access restriction to view the closed title of "Cabinet" via unCybozu Garoon
- CVE-2018-0551Cross-site scripting vulnerability in Cybozu Garoon 3.0.0 to 4.6.1 allows remote authenticated attackers to inject arbitrary web script or HCybozu Garoon
- CVE-2018-0560Hatena Bookmark App for iOS Version 3.0 to 3.70 allows remote attackers to spoof the address bar via vectors related to URL display.Hatena co. Hatena Bookmark App for iOS
- CVE-2018-0561Untrusted search path vulnerability in The installer of PhishWall Client Internet Explorer edition Ver.SecureBrain The installer of PhishWall Client Internet Expl…
- CVE-2018-0562Untrusted search path vulnerability in Installer of SoundEngine Free ver.5.21 and earlier allows an attacker to gain privileges via a TrojanCoderium Installer of SoundEngine Free
- CVE-2018-10124The kill_something_info function in kernel/signal.c in the Linux kernel before 4.13, when an unspecified architecture and compiler is used,
- CVE-2018-5382Bouncy Castle BKS-V1 keystore files vulnerable to trivial hash collisionsLegion of the Bouncy Castle Bouncy Castle · org.bouncycastl…
- CVE-2018-10106D-Link DIR-815 REV.
- CVE-2018-10107D-Link DIR-815 REV.
- CVE-2018-10108D-Link DIR-815 REV.
- CVE-2018-10122QingDao Nature Easy Soft Chanzhi Enterprise Portal System (aka chanzhieps) pro1.6 allows remote attackers to read arbitrary files via direct