# CVEs published 2018-04-16

41 CVEs were published on April 16, 2018: 0 critical, 3 high. Days are UTC.

- [CVE-2018-10177](https://cve.now/CVE-2018-10177.md): In ImageMagick 7.0.7-28, there is an infinite loop in the ReadOneMNGImage function of the coders/png.c file. (no CVSS)
- [CVE-2018-10172](https://cve.now/CVE-2018-10172.md): 7-Zip through 18.01 on Windows implements the "Large memory pages" option by calling the LsaAddAccountRights function to add the SeLockMemor (no CVSS)
- [CVE-2018-10070](https://cve.now/CVE-2018-10070.md): A vulnerability in MikroTik Version 6.41.4 could allow an unauthenticated remote attacker to exhaust all available CPU and all available RAM (no CVSS)
- [CVE-2018-10169](https://cve.now/CVE-2018-10169.md): ProtonVPN 1.3.3 for Windows suffers from a SYSTEM privilege escalation vulnerability through the "ProtonVPN Service" service. (no CVSS)
- [CVE-2018-10170](https://cve.now/CVE-2018-10170.md): NordVPN 6.12.7.0 for Windows suffers from a SYSTEM privilege escalation vulnerability through the "nordvpn-service" service. (no CVSS)
- [CVE-2018-10138](https://cve.now/CVE-2018-10138.md): The CATALooK.netStore module through 7.2.8 for DNN (formerly DotNetNuke) allows XSS via the /ViewEditGoogleMaps.aspx PortalID or CATSkin par (no CVSS)
- [CVE-2016-9093](https://cve.now/CVE-2016-9093.md): A version of the SymEvent Driver that shipped with Symantec Endpoint Protection 12.1 RU6 MP6 and earlier fails to properly sanitize logged-i (no CVSS, Symantec Endpoint Protection)
- [CVE-2016-9094](https://cve.now/CVE-2016-9094.md): Symantec Endpoint Protection clients place detected malware in quarantine as part of the intended product functionality. (no CVSS, Symantec Endpoint Protection)
- [CVE-2017-6323](https://cve.now/CVE-2017-6323.md): The Symantec Management Console prior to ITMS 8.1 RU1, ITMS 8.0\_POST\_HF6, and ITMS 7.6\_POST\_HF7 has an issue whereby XML input containing a (no CVSS, Symantec ITMS)
- [CVE-2015-1952](https://cve.now/CVE-2015-1952.md): Cross-site scripting (XSS) vulnerability in IBM AppScan Enterprise Edition 9.0.x before 9.0.2 iFix 001 allows remote attackers to inject arb (no CVSS)
- [CVE-2018-0737](https://cve.now/CVE-2018-0737.md): Cache timing vulnerability in RSA Key Generation (no CVSS, OpenSSL)
- [CVE-2018-10135](https://cve.now/CVE-2018-10135.md): iScripts eSwap v2.4 has Reflected XSS via the "catwiseproducts.php" catid parameter in the User Panel. (no CVSS)
- [CVE-2018-10136](https://cve.now/CVE-2018-10136.md): iScripts UberforX 2.2 has Stored XSS in the "manage\_settings" section of the Admin Panel via a value field to the /cms?section=manage\_settin (no CVSS)
- [CVE-2018-10137](https://cve.now/CVE-2018-10137.md): iScripts UberforX 2.2 has CSRF in the "manage\_settings" section of the Admin Panel via the /cms?section=manage\_settings&action=edit URI. (no CVSS)
- [CVE-2017-10140](https://cve.now/CVE-2017-10140.md): Postfix before 2.11.10, 3.0.x before 3.0.10, 3.1.x before 3.1.6, and 3.2.x before 3.2.2 might allow local users to gain privileges by levera (no CVSS)
- [CVE-2018-3846](https://cve.now/CVE-2018-3846.md): In the ffgphd and ffgtkn functions in NASA CFITSIO 3.42, specially crafted images parsed via the library can cause a stack-based buffer over (CVSS 8.8, Talos NASA CFITSIO)
- [CVE-2018-3848](https://cve.now/CVE-2018-3848.md): In the ffghbn function in NASA CFITSIO 3.42, specially crafted images parsed via the library can cause a stack-based buffer overflow overwri (CVSS 8.8, Talos NASA CFITSIO)
- [CVE-2018-3849](https://cve.now/CVE-2018-3849.md): In the ffghtb function in NASA CFITSIO 3.42, specially crafted images parsed via the library can cause a stack-based buffer overflow overwri (CVSS 8.8, Talos NASA CFITSIO)
- [CVE-2016-9592](https://cve.now/CVE-2016-9592.md): openshift before versions 3.3.1.11, 3.2.1.23, 3.4 is vulnerable to a flaw when a volume fails to detach, which causes the delete operation t (CVSS 4.3, openshift)
- [CVE-2016-9593](https://cve.now/CVE-2016-9593.md): foreman-debug before version 1.15.0 is vulnerable to a flaw in foreman-debug's logging. (CVSS 4.7, foreman-debug)
- [CVE-2018-10127](https://cve.now/CVE-2018-10127.md): An issue was discovered in XYHCMS 3.5. (no CVSS)
- [CVE-2018-10128](https://cve.now/CVE-2018-10128.md): An issue was discovered in XYHCMS 3.5. (no CVSS)
- [CVE-2018-10132](https://cve.now/CVE-2018-10132.md): PbootCMS v0.9.8 has CSRF via an admin.php/Message/mod/id/19.html?backurl=/index.php request, resulting in PHP code injection in the reconten (no CVSS)
- [CVE-2018-10133](https://cve.now/CVE-2018-10133.md): PbootCMS v0.9.8 allows PHP code injection via an IF label in index.php/About/6.html or admin.php/Site/index.html, related to the parserIfLab (no CVSS)
- [CVE-2018-0530](https://cve.now/CVE-2018-0530.md): SQL injection vulnerability in the Cybozu Garoon 3.5.0 to 4.2.6 allows remote authenticated attackers to execute arbitrary SQL commands via (no CVSS, Cybozu Garoon)
- [CVE-2018-0531](https://cve.now/CVE-2018-0531.md): Cybozu Garoon 3.0.0 to 4.2.6 allows remote authenticated attackers to bypass access restriction to view or alter an access privilege of a fo (no CVSS, Cybozu Garoon)
- [CVE-2018-0532](https://cve.now/CVE-2018-0532.md): Cybozu Garoon 3.0.0 to 4.2.6 allows remote authenticated attackers to bypass access restriction to alter setting data of the Standard databa (no CVSS, Cybozu Garoon)
- [CVE-2018-0533](https://cve.now/CVE-2018-0533.md): Cybozu Garoon 3.0.0 to 4.2.6 allows remote authenticated attackers to bypass access restriction to alter setting data of session authenticat (no CVSS, Cybozu Garoon)
- [CVE-2018-0548](https://cve.now/CVE-2018-0548.md): Cybozu Garoon 4.0.0 to 4.6.0 allows remote authenticated attackers to bypass access restriction to view the closed title of "Space" via unsp (no CVSS, Cybozu Garoon)
- [CVE-2018-0549](https://cve.now/CVE-2018-0549.md): Cross-site scripting vulnerability in Cybozu Garoon 3.0.0 to 4.6.0 allows remote authenticated attackers to inject arbitrary web script or H (no CVSS, Cybozu Garoon)
- [CVE-2018-0550](https://cve.now/CVE-2018-0550.md): Cybozu Garoon 3.5.0 to 4.6.1 allows remote authenticated attackers to bypass access restriction to view the closed title of "Cabinet" via un (no CVSS, Cybozu Garoon)
- [CVE-2018-0551](https://cve.now/CVE-2018-0551.md): Cross-site scripting vulnerability in Cybozu Garoon 3.0.0 to 4.6.1 allows remote authenticated attackers to inject arbitrary web script or H (no CVSS, Cybozu Garoon)
- [CVE-2018-0560](https://cve.now/CVE-2018-0560.md): Hatena Bookmark App for iOS Version 3.0 to 3.70 allows remote attackers to spoof the address bar via vectors related to URL display. (no CVSS, Hatena co. Hatena Bookmark App for iOS)
- [CVE-2018-0561](https://cve.now/CVE-2018-0561.md): Untrusted search path vulnerability in The installer of PhishWall Client Internet Explorer edition Ver. (no CVSS, SecureBrain The installer of PhishWall Client Internet Expl…)
- [CVE-2018-0562](https://cve.now/CVE-2018-0562.md): Untrusted search path vulnerability in Installer of SoundEngine Free ver.5.21 and earlier allows an attacker to gain privileges via a Trojan (no CVSS, Coderium Installer of SoundEngine Free)
- [CVE-2018-10124](https://cve.now/CVE-2018-10124.md): The kill\_something\_info function in kernel/signal.c in the Linux kernel before 4.13, when an unspecified architecture and compiler is used, (no CVSS)
- [CVE-2018-5382](https://cve.now/CVE-2018-5382.md): Bouncy Castle BKS-V1 keystore files vulnerable to trivial hash collisions (no CVSS, Legion of the Bouncy Castle Bouncy Castle · org.bouncycastl…)
- [CVE-2018-10106](https://cve.now/CVE-2018-10106.md): D-Link DIR-815 REV. (no CVSS)
- [CVE-2018-10107](https://cve.now/CVE-2018-10107.md): D-Link DIR-815 REV. (no CVSS)
- [CVE-2018-10108](https://cve.now/CVE-2018-10108.md): D-Link DIR-815 REV. (no CVSS)
- [CVE-2018-10122](https://cve.now/CVE-2018-10122.md): QingDao Nature Easy Soft Chanzhi Enterprise Portal System (aka chanzhieps) pro1.6 allows remote attackers to read arbitrary files via direct (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2018-04-16
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.