# CVEs published 2018-04-17

31 CVEs were published on April 17, 2018: 1 critical, 2 high. 1 is now in CISA KEV. Days are UTC.

- [CVE-2018-10191](https://cve.now/CVE-2018-10191.md): In versions of mruby up to and including 1.4.0, an integer overflow exists in src/vm.c::mrb\_vm\_exec() when handling OP\_GETUPVAR in the prese (no CVSS)
- [CVE-2018-10192](https://cve.now/CVE-2018-10192.md): IPVanish 3.0.11 for macOS suffers from a root privilege escalation vulnerability. (no CVSS)
- [CVE-2018-8838](https://cve.now/CVE-2018-8838.md): A weakness in access controls in CENTUM CS 1000 all versions, CENTUM CS 3000 versions R3.09.50 and earlier, CENTUM CS 3000 Small versions R3 (no CVSS, ICS-CERT Yokogawa CENTUM and Exaopc)
- [CVE-2017-2871](https://cve.now/CVE-2017-2871.md): Insufficient security checks exist in the recovery procedure used by the Foscam C1 Indoor HD Camera running application firmware 2.52.2.43. (CVSS 9.6, Talos Foscam)
- [CVE-2018-10186](https://cve.now/CVE-2018-10186.md): In radare2 2.5.0, there is a heap-based buffer over-read in the r\_hex\_bin2str function (libr/util/hex.c). (no CVSS)
- [CVE-2018-10187](https://cve.now/CVE-2018-10187.md): In radare2 2.5.0, there is a heap-based buffer over-read in the dalvik\_op function (libr/anal/p/anal\_dalvik.c). (no CVSS)
- [CVE-2018-10189](https://cve.now/CVE-2018-10189.md): An issue was discovered in Mautic 1.x and 2.x before 2.13.0. (no CVSS, mautic/core)
- [CVE-2018-10190](https://cve.now/CVE-2018-10190.md): A vulnerability in London Trust Media Private Internet Access (PIA) VPN Client v77 for Windows could allow an unauthenticated, local attacke (no CVSS)
- [CVE-2018-6797](https://cve.now/CVE-2018-6797.md): An issue was discovered in Perl 5.18 through 5.26. (no CVSS)
- [CVE-2018-6798](https://cve.now/CVE-2018-6798.md): An issue was discovered in Perl 5.22 through 5.26. (no CVSS)
- [CVE-2018-6913](https://cve.now/CVE-2018-6913.md): Heap-based buffer overflow in the pack function in Perl before 5.26.2 allows context-dependent attackers to execute arbitrary code via a lar (no CVSS)
- [CVE-2018-7539](https://cve.now/CVE-2018-7539.md): On Appear TV XC5000 and XC5100 devices with firmware 3.26.217, it is possible to read OS files with a specially crafted HTTP request (such a (no CVSS)
- [CVE-2014-2294](https://cve.now/CVE-2014-2294.md): Open Web Analytics (OWA) before 1.5.7 allows remote attackers to conduct PHP object injection attacks via a crafted serialized object in the (no CVSS)
- [CVE-2018-10185](https://cve.now/CVE-2018-10185.md): An issue was discovered in TuziCMS v2.0.6. (no CVSS)
- [CVE-2018-7514](https://cve.now/CVE-2018-7514.md): Parsing malformed project files in Omron CX-One versions 4.42 and prior, including the following applications: CX-FLnet versions 1.00 and pr (no CVSS, ICS-CERT Omron CX-One)
- [CVE-2018-7530](https://cve.now/CVE-2018-7530.md): Parsing malformed project files in Omron CX-One versions 4.42 and prior, including the following applications: CX-FLnet versions 1.00 and pr (no CVSS, ICS-CERT Omron CX-One)
- [CVE-2018-8834](https://cve.now/CVE-2018-8834.md): Parsing malformed project files in Omron CX-One versions 4.42 and prior, including the following applications: CX-FLnet versions 1.00 and pr (no CVSS, ICS-CERT Omron CX-One)
- [CVE-2018-5429](https://cve.now/CVE-2018-5429.md): TIBCO JasperReports Library Code Sandboxing Problem (CVSS 8.8, TIBCO Software TIBCO JasperReports Server · TIBCO Softwa… +3)
- [CVE-2018-5430](https://cve.now/CVE-2018-5430.md): TIBCO JasperReports Server Information Disclosure Vulnerability (CVSS 7.7, KEV, TIBCO Software TIBCO JasperReports Server · TIBCO Softwa… +1)
- [CVE-2018-5431](https://cve.now/CVE-2018-5431.md): TIBCO JasperReports Server Cross Site Scripting Vulnerability (CVSS 6.3, TIBCO Software TIBCO JasperReports Server · TIBCO Softwa… +1)
- [CVE-2018-1371](https://cve.now/CVE-2018-1371.md): An IBM WebSphere MQ 8.0.0.8, 9.0.0.2, and 9.0.4 Client connecting to a MQ Queue Manager can cause a SIGSEGV in the AMQRMPPA channel process (no CVSS, IBM MQ)
- [CVE-2018-1445](https://cve.now/CVE-2018-1445.md): IBM WebSphere Portal 8.0.0 through 8.0.0.1, 8.5, and 9.0 is vulnerable to cross-site scripting. (no CVSS, IBM WebSphere Portal)
- [CVE-2017-12701](https://cve.now/CVE-2017-12701.md): BMC Medical Luna CPAP Machines released prior to July 1, 2017, contain an improper input validation vulnerability which may allow an authent (no CVSS, BMC Medical Luna CPAP Machine)
- [CVE-2017-6020](https://cve.now/CVE-2017-6020.md): Leao Consultoria e Desenvolvimento de Sistemas (LCDS) LTDA ME LAquis SCADA software versions prior to version 4.1.0.3237 do not neutralize e (no CVSS, LCDS - Leão Consultoria e Desenvolvimento de Sistemas LTDA…)
- [CVE-2017-9634](https://cve.now/CVE-2017-9634.md): Mitsubishi E-Designer, Version 7.52 Build 344 contains two code sections which may be exploited to allow an attacker to overwrite arbitrary (no CVSS, Mitsubishi Electric Europe B.V. E-Designer)
- [CVE-2017-9636](https://cve.now/CVE-2017-9636.md): Mitsubishi E-Designer, Version 7.52 Build 344 contains five code sections which may be exploited to overwrite the heap. (no CVSS, Mitsubishi Electric Europe B.V. E-Designer)
- [CVE-2017-9638](https://cve.now/CVE-2017-9638.md): Mitsubishi E-Designer, Version 7.52 Build 344 contains six code sections which may be exploited to overwrite the stack. (no CVSS, Mitsubishi Electric Europe B.V. E-Designer)
- [CVE-2018-10183](https://cve.now/CVE-2018-10183.md): An issue was discovered in BigTree 4.2.22. (no CVSS)
- [CVE-2017-18102](https://cve.now/CVE-2017-18102.md): The wiki markup component of atlassian-renderer from version 8.0.0 before version 8.0.22 allows remote attackers to inject arbitrary HTML or (no CVSS, atlassian-renderer)
- [CVE-2018-5190](https://cve.now/CVE-2018-5190.md): PicturesPro Photo Cart 6 and 7 before Security-Patch-2018-B allows remote attackers to access arbitrary customer accounts via a modified coo (no CVSS)
- [CVE-2018-10178](https://cve.now/CVE-2018-10178.md): The FromDocToPDF extension before 13.611.13.2303 for Chrome allows remote attackers to discover visited web sites via vectors involving a mo (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2018-04-17
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.