CVEs published April 20, 2018
36 CVEs were published on April 20, 2018: 0 critical, 0 high.
- Published
- 36
- Critical
- 0
- High
- 0
- Medium
- 0
- Low
- 0
- Unrated
- 36
- Now in CISA KEV
- 0
- Fix available
- 0
Most affected products
- Apache Software Foundation Apache Fineract
- 4
- Check Point Software Technologies Eclipse
- 1
- IBM Power HMC
- 1
- LOCKON CO. EC-CUBE
- 1
- Talos Zabbix
- 1
- VMware Horizon DaaS
- 1
Medium, low and unrated 36
- CVE-2014-0883IBM Power Hardware Management Console cross-site scriptingIBM Power HMC
- CVE-2014-0900The Device Administrator code in Android before 4.4.1_r1 might allow attackers to spoof device administrators and consequently bypass MDM re
- CVE-2014-0912IBM Sterling B2B Integrator 5.1 and 5.2 and Sterling File Gateway 2.1 and 2.2 allow remote attackers to obtain sensitive product information
- CVE-2014-0927The ActiveMQ admin user interface in IBM Sterling B2B Integrator 5.1 and 5.2 and Sterling File Gateway 2.1 and 2.2 allows remote attackers t
- CVE-2014-0931Multiple XML external entity (XXE) vulnerabilities in the (1) CCRC WAN Server / CM Server, (2) Perl CC/CQ integration trigger scripts, (3) C
- CVE-2014-0950Multiple XML external entity (XXE) vulnerabilities in (1) CQWeb / CM Server, (2) ClearQuest Native client, (3) ClearQuest Eclipse client, an
- CVE-2017-2825In the trapper functionality of Zabbix Server 2.4.x, specifically crafted trapper packets can pass database logic checks, resulting in databTalos Zabbix
- CVE-2018-10077XML external entity (XXE) vulnerability in Geist WatchDog Console 3.2.2 allows remote authenticated administrators to read arbitrary files v
- CVE-2018-10078Cross-site scripting (XSS) vulnerability in Geist WatchDog Console 3.2.2 allows remote authenticated administrators to inject arbitrary web
- CVE-2018-10079Geist WatchDog Console 3.2.2 uses a weak ACL for the C:\ProgramData\WatchDog Console directory, which allows local users to modify configura
- CVE-2018-10173Digital Guardian Management Console 7.1.2.0015 allows authenticated remote code execution because of Arbitrary File Upload functionality.
- CVE-2018-10174Digital Guardian Management Console 7.1.2.0015 has an SSRF issue that allows remote attackers to read arbitrary files via file:// URLs, send
- CVE-2018-10175Digital Guardian Management Console 7.1.2.0015 has an XXE issue.
- CVE-2018-10176Digital Guardian Management Console 7.1.2.0015 has a Directory Traversal issue.
- CVE-2018-7747Multiple cross-site scripting (XSS) vulnerabilities in the Caldera Forms plugin before 1.6.0-rc.1 for WordPress allow remote attackers to in
- CVE-2018-9059Stack-based buffer overflow in Easy File Sharing (EFS) Web Server 7.2 allows remote attackers to execute arbitrary code via a malicious logi
- CVE-2014-10073The create_response function in server/server.c in Psensor before 1.1.4 allows Directory Traversal because it lacks a check for whether a fi
- CVE-2014-4782IBM InfoSphere BigInsights 2.1.2 allows remote authenticated users to discover SMTP server credentials via vectors related to the Alert mana
- CVE-2014-6108IBM Tivoli Identity Manager 5.1.x before 5.1.0.15-ISS-TIM-IF0057 and Security Identity Manager 6.0.x before 6.0.0.4-ISS-SIM-IF0001 and 7.0.x
- CVE-2014-6109IBM Tivoli Identity Manager 5.1.x before 5.1.0.15-ISS-TIM-IF0057 and Security Identity Manager 6.0.x before 6.0.0.4-ISS-SIM-IF0001 and 7.0.x
- CVE-2014-6111IBM Tivoli Identity Manager 5.1.x before 5.1.0.15-ISS-TIM-IF0057 and Security Identity Manager 6.0.x before 6.0.0.4-ISS-SIM-IF0001 and 7.0.x
- CVE-2014-6112IBM Tivoli Identity Manager 5.1.x before 5.1.0.15-ISS-TIM-IF0057 and Security Identity Manager 6.0.x before 6.0.0.4-ISS-SIM-IF0001 and 7.0.x
- CVE-2018-8826ASUS RT-AC51U, RT-AC58U, RT-AC66U, RT-AC1750, RT-ACRH13, and RT-N12 D1 routers with firmware before 3.0.0.4.380.8228; RT-AC52U B1, RT-AC1200
- CVE-2017-8315Eclipse XML parser for the Eclipse IDE versions 2017.2.5 and earlier was found vulnerable to an XML External Entity attack.Check Point Software Technologies Eclipse
- CVE-2018-10249baijiacms V3 has CSRF via index.php?mod=site&op=edituser&name=manager&do=user to add an administrator account.
- CVE-2018-10250iCMS V7.0.8 has XSS via the admincp.php keywords parameter in a weixin_category action, aka a WeChat Classified Management keyword search.
- CVE-2018-1289In Apache Fineract versions 1.0.0, 0.6.0-incubating, 0.5.0-incubating, 0.4.0-incubating, the system exposes different REST end points to queApache Software Foundation Apache Fineract
- CVE-2018-1290In Apache Fineract versions 1.0.0, 0.6.0-incubating, 0.5.0-incubating, 0.4.0-incubating, Using a single quotation escape with two continuousApache Software Foundation Apache Fineract
- CVE-2018-1291Apache Fineract 1.0.0, 0.6.0-incubating, 0.5.0-incubating, 0.4.0-incubating exposes different REST end points to query domain specific entitApache Software Foundation Apache Fineract
- CVE-2018-1292Within the 'getReportType' method in Apache Fineract 1.0.0, 0.6.0-incubating, 0.5.0-incubating, 0.4.0-incubating, a hacker could inject SQL Apache Software Foundation Apache Fineract
- CVE-2018-10245A Full Path Disclosure vulnerability in AWStats through 7.6 allows remote attackers to know where the config file is allocated, obtaining th
- CVE-2018-10248An issue was discovered in WUZHI CMS 4.1.0.
- CVE-2018-0564Session fixation vulnerability in EC-CUBE (EC-CUBE 3.0.0, EC-CUBE 3.0.1, EC-CUBE 3.0.2, EC-CUBE 3.0.3, EC-CUBE 3..4, EC-CUBE 3.0.5, EC-CUBE LOCKON CO. EC-CUBE
- CVE-2018-6960VMware Horizon DaaS (7.x before 8.0.0) contains a broken authentication vulnerability that may allow an attacker to bypass two-factor authenVMware Horizon DaaS
- CVE-2018-10201An issue was discovered in NcMonitorServer.exe in NC Monitor Server in NComputing vSpace Pro 10 and 11.
- CVE-2018-10238bvlc.c in skarg BACnet Protocol Stack bacserv 0.9.1 and 0.8.5 is affected by a Buffer Overflow because of a lack of packet-size validation.