CVEs published April 17, 2018
31 CVEs were published on April 17, 2018: 1 critical, 2 high. 1 is now in CISA KEV.
- Published
- 31
- Critical
- 1
- High
- 2
- Medium
- 1
- Low
- 0
- Unrated
- 27
- Now in CISA KEV
- 1
- Fix available
- 2
Most affected products
- ICS-CERT Omron CX-One
- 3
- Mitsubishi Electric Europe B.V. E-Designer
- 3
- TIBCO Software TIBCO JasperReports Server · TIBCO Softwa… +1
- 2
- atlassian-renderer
- 1
- BMC Medical Luna CPAP Machine
- 1
- IBM MQ
- 1
- IBM WebSphere Portal
- 1
- ICS-CERT Yokogawa CENTUM and Exaopc
- 1
- LCDS - Leão Consultoria e Desenvolvimento de Sistemas LTDA…
- 1
- mautic/core
- 1
Critical 1
High 2
Medium, low and unrated 28
- CVE-2018-10191In versions of mruby up to and including 1.4.0, an integer overflow exists in src/vm.c::mrb_vm_exec() when handling OP_GETUPVAR in the prese
- CVE-2018-10192IPVanish 3.0.11 for macOS suffers from a root privilege escalation vulnerability.
- CVE-2018-8838A weakness in access controls in CENTUM CS 1000 all versions, CENTUM CS 3000 versions R3.09.50 and earlier, CENTUM CS 3000 Small versions R3ICS-CERT Yokogawa CENTUM and Exaopc
- CVE-2018-10186In radare2 2.5.0, there is a heap-based buffer over-read in the r_hex_bin2str function (libr/util/hex.c).
- CVE-2018-10187In radare2 2.5.0, there is a heap-based buffer over-read in the dalvik_op function (libr/anal/p/anal_dalvik.c).
- CVE-2018-10189An issue was discovered in Mautic 1.x and 2.x before 2.13.0.mautic/core
- CVE-2018-10190A vulnerability in London Trust Media Private Internet Access (PIA) VPN Client v77 for Windows could allow an unauthenticated, local attacke
- CVE-2018-6797An issue was discovered in Perl 5.18 through 5.26.
- CVE-2018-6798An issue was discovered in Perl 5.22 through 5.26.
- CVE-2018-6913Heap-based buffer overflow in the pack function in Perl before 5.26.2 allows context-dependent attackers to execute arbitrary code via a lar
- CVE-2018-7539On Appear TV XC5000 and XC5100 devices with firmware 3.26.217, it is possible to read OS files with a specially crafted HTTP request (such a
- CVE-2014-2294Open Web Analytics (OWA) before 1.5.7 allows remote attackers to conduct PHP object injection attacks via a crafted serialized object in the
- CVE-2018-10185An issue was discovered in TuziCMS v2.0.6.
- CVE-2018-7514Parsing malformed project files in Omron CX-One versions 4.42 and prior, including the following applications: CX-FLnet versions 1.00 and prICS-CERT Omron CX-One
- CVE-2018-7530Parsing malformed project files in Omron CX-One versions 4.42 and prior, including the following applications: CX-FLnet versions 1.00 and prICS-CERT Omron CX-One
- CVE-2018-8834Parsing malformed project files in Omron CX-One versions 4.42 and prior, including the following applications: CX-FLnet versions 1.00 and prICS-CERT Omron CX-One
- CVE-2018-5431TIBCO JasperReports Server Cross Site Scripting VulnerabilityTIBCO Software TIBCO JasperReports Server · TIBCO Softwa… +1
- CVE-2018-1371An IBM WebSphere MQ 8.0.0.8, 9.0.0.2, and 9.0.4 Client connecting to a MQ Queue Manager can cause a SIGSEGV in the AMQRMPPA channel process IBM MQ
- CVE-2018-1445IBM WebSphere Portal 8.0.0 through 8.0.0.1, 8.5, and 9.0 is vulnerable to cross-site scripting.IBM WebSphere Portal
- CVE-2017-12701BMC Medical Luna CPAP Machines released prior to July 1, 2017, contain an improper input validation vulnerability which may allow an authentBMC Medical Luna CPAP Machine
- CVE-2017-6020Leao Consultoria e Desenvolvimento de Sistemas (LCDS) LTDA ME LAquis SCADA software versions prior to version 4.1.0.3237 do not neutralize eLCDS - Leão Consultoria e Desenvolvimento de Sistemas LTDA…
- CVE-2017-9634Mitsubishi E-Designer, Version 7.52 Build 344 contains two code sections which may be exploited to allow an attacker to overwrite arbitrary Mitsubishi Electric Europe B.V. E-Designer
- CVE-2017-9636Mitsubishi E-Designer, Version 7.52 Build 344 contains five code sections which may be exploited to overwrite the heap.Mitsubishi Electric Europe B.V. E-Designer
- CVE-2017-9638Mitsubishi E-Designer, Version 7.52 Build 344 contains six code sections which may be exploited to overwrite the stack.Mitsubishi Electric Europe B.V. E-Designer
- CVE-2018-10183An issue was discovered in BigTree 4.2.22.
- CVE-2017-18102The wiki markup component of atlassian-renderer from version 8.0.0 before version 8.0.22 allows remote attackers to inject arbitrary HTML oratlassian-renderer
- CVE-2018-5190PicturesPro Photo Cart 6 and 7 before Security-Patch-2018-B allows remote attackers to access arbitrary customer accounts via a modified coo
- CVE-2018-10178The FromDocToPDF extension before 13.611.13.2303 for Chrome allows remote attackers to discover visited web sites via vectors involving a mo