# CVEs published 2018-04-20

36 CVEs were published on April 20, 2018: 0 critical, 0 high. Days are UTC.

- [CVE-2014-0883](https://cve.now/CVE-2014-0883.md): IBM Power Hardware Management Console cross-site scripting (no CVSS, IBM Power HMC)
- [CVE-2014-0900](https://cve.now/CVE-2014-0900.md): The Device Administrator code in Android before 4.4.1\_r1 might allow attackers to spoof device administrators and consequently bypass MDM re (no CVSS)
- [CVE-2014-0912](https://cve.now/CVE-2014-0912.md): IBM Sterling B2B Integrator 5.1 and 5.2 and Sterling File Gateway 2.1 and 2.2 allow remote attackers to obtain sensitive product information (no CVSS)
- [CVE-2014-0927](https://cve.now/CVE-2014-0927.md): The ActiveMQ admin user interface in IBM Sterling B2B Integrator 5.1 and 5.2 and Sterling File Gateway 2.1 and 2.2 allows remote attackers t (no CVSS)
- [CVE-2014-0931](https://cve.now/CVE-2014-0931.md): Multiple XML external entity (XXE) vulnerabilities in the (1) CCRC WAN Server / CM Server, (2) Perl CC/CQ integration trigger scripts, (3) C (no CVSS)
- [CVE-2014-0950](https://cve.now/CVE-2014-0950.md): Multiple XML external entity (XXE) vulnerabilities in (1) CQWeb / CM Server, (2) ClearQuest Native client, (3) ClearQuest Eclipse client, an (no CVSS)
- [CVE-2017-2825](https://cve.now/CVE-2017-2825.md): In the trapper functionality of Zabbix Server 2.4.x, specifically crafted trapper packets can pass database logic checks, resulting in datab (no CVSS, Talos Zabbix)
- [CVE-2018-10077](https://cve.now/CVE-2018-10077.md): XML external entity (XXE) vulnerability in Geist WatchDog Console 3.2.2 allows remote authenticated administrators to read arbitrary files v (no CVSS)
- [CVE-2018-10078](https://cve.now/CVE-2018-10078.md): Cross-site scripting (XSS) vulnerability in Geist WatchDog Console 3.2.2 allows remote authenticated administrators to inject arbitrary web (no CVSS)
- [CVE-2018-10079](https://cve.now/CVE-2018-10079.md): Geist WatchDog Console 3.2.2 uses a weak ACL for the C:\\ProgramData\\WatchDog Console directory, which allows local users to modify configura (no CVSS)
- [CVE-2018-10173](https://cve.now/CVE-2018-10173.md): Digital Guardian Management Console 7.1.2.0015 allows authenticated remote code execution because of Arbitrary File Upload functionality. (no CVSS)
- [CVE-2018-10174](https://cve.now/CVE-2018-10174.md): Digital Guardian Management Console 7.1.2.0015 has an SSRF issue that allows remote attackers to read arbitrary files via file:// URLs, send (no CVSS)
- [CVE-2018-10175](https://cve.now/CVE-2018-10175.md): Digital Guardian Management Console 7.1.2.0015 has an XXE issue. (no CVSS)
- [CVE-2018-10176](https://cve.now/CVE-2018-10176.md): Digital Guardian Management Console 7.1.2.0015 has a Directory Traversal issue. (no CVSS)
- [CVE-2018-7747](https://cve.now/CVE-2018-7747.md): Multiple cross-site scripting (XSS) vulnerabilities in the Caldera Forms plugin before 1.6.0-rc.1 for WordPress allow remote attackers to in (no CVSS)
- [CVE-2018-9059](https://cve.now/CVE-2018-9059.md): Stack-based buffer overflow in Easy File Sharing (EFS) Web Server 7.2 allows remote attackers to execute arbitrary code via a malicious logi (no CVSS)
- [CVE-2014-10073](https://cve.now/CVE-2014-10073.md): The create\_response function in server/server.c in Psensor before 1.1.4 allows Directory Traversal because it lacks a check for whether a fi (no CVSS)
- [CVE-2014-4782](https://cve.now/CVE-2014-4782.md): IBM InfoSphere BigInsights 2.1.2 allows remote authenticated users to discover SMTP server credentials via vectors related to the Alert mana (no CVSS)
- [CVE-2014-6108](https://cve.now/CVE-2014-6108.md): IBM Tivoli Identity Manager 5.1.x before 5.1.0.15-ISS-TIM-IF0057 and Security Identity Manager 6.0.x before 6.0.0.4-ISS-SIM-IF0001 and 7.0.x (no CVSS)
- [CVE-2014-6109](https://cve.now/CVE-2014-6109.md): IBM Tivoli Identity Manager 5.1.x before 5.1.0.15-ISS-TIM-IF0057 and Security Identity Manager 6.0.x before 6.0.0.4-ISS-SIM-IF0001 and 7.0.x (no CVSS)
- [CVE-2014-6111](https://cve.now/CVE-2014-6111.md): IBM Tivoli Identity Manager 5.1.x before 5.1.0.15-ISS-TIM-IF0057 and Security Identity Manager 6.0.x before 6.0.0.4-ISS-SIM-IF0001 and 7.0.x (no CVSS)
- [CVE-2014-6112](https://cve.now/CVE-2014-6112.md): IBM Tivoli Identity Manager 5.1.x before 5.1.0.15-ISS-TIM-IF0057 and Security Identity Manager 6.0.x before 6.0.0.4-ISS-SIM-IF0001 and 7.0.x (no CVSS)
- [CVE-2018-8826](https://cve.now/CVE-2018-8826.md): ASUS RT-AC51U, RT-AC58U, RT-AC66U, RT-AC1750, RT-ACRH13, and RT-N12 D1 routers with firmware before 3.0.0.4.380.8228; RT-AC52U B1, RT-AC1200 (no CVSS)
- [CVE-2017-8315](https://cve.now/CVE-2017-8315.md): Eclipse XML parser for the Eclipse IDE versions 2017.2.5 and earlier was found vulnerable to an XML External Entity attack. (no CVSS, Check Point Software Technologies Eclipse)
- [CVE-2018-10249](https://cve.now/CVE-2018-10249.md): baijiacms V3 has CSRF via index.php?mod=site&op=edituser&name=manager&do=user to add an administrator account. (no CVSS)
- [CVE-2018-10250](https://cve.now/CVE-2018-10250.md): iCMS V7.0.8 has XSS via the admincp.php keywords parameter in a weixin\_category action, aka a WeChat Classified Management keyword search. (no CVSS)
- [CVE-2018-1289](https://cve.now/CVE-2018-1289.md): In Apache Fineract versions 1.0.0, 0.6.0-incubating, 0.5.0-incubating, 0.4.0-incubating, the system exposes different REST end points to que (no CVSS, Apache Software Foundation Apache Fineract)
- [CVE-2018-1290](https://cve.now/CVE-2018-1290.md): In Apache Fineract versions 1.0.0, 0.6.0-incubating, 0.5.0-incubating, 0.4.0-incubating, Using a single quotation escape with two continuous (no CVSS, Apache Software Foundation Apache Fineract)
- [CVE-2018-1291](https://cve.now/CVE-2018-1291.md): Apache Fineract 1.0.0, 0.6.0-incubating, 0.5.0-incubating, 0.4.0-incubating exposes different REST end points to query domain specific entit (no CVSS, Apache Software Foundation Apache Fineract)
- [CVE-2018-1292](https://cve.now/CVE-2018-1292.md): Within the 'getReportType' method in Apache Fineract 1.0.0, 0.6.0-incubating, 0.5.0-incubating, 0.4.0-incubating, a hacker could inject SQL (no CVSS, Apache Software Foundation Apache Fineract)
- [CVE-2018-10245](https://cve.now/CVE-2018-10245.md): A Full Path Disclosure vulnerability in AWStats through 7.6 allows remote attackers to know where the config file is allocated, obtaining th (no CVSS)
- [CVE-2018-10248](https://cve.now/CVE-2018-10248.md): An issue was discovered in WUZHI CMS 4.1.0. (no CVSS)
- [CVE-2018-0564](https://cve.now/CVE-2018-0564.md): Session fixation vulnerability in EC-CUBE (EC-CUBE 3.0.0, EC-CUBE 3.0.1, EC-CUBE 3.0.2, EC-CUBE 3.0.3, EC-CUBE 3..4, EC-CUBE 3.0.5, EC-CUBE (no CVSS, LOCKON CO. EC-CUBE)
- [CVE-2018-6960](https://cve.now/CVE-2018-6960.md): VMware Horizon DaaS (7.x before 8.0.0) contains a broken authentication vulnerability that may allow an attacker to bypass two-factor authen (no CVSS, VMware Horizon DaaS)
- [CVE-2018-10201](https://cve.now/CVE-2018-10201.md): An issue was discovered in NcMonitorServer.exe in NC Monitor Server in NComputing vSpace Pro 10 and 11. (no CVSS)
- [CVE-2018-10238](https://cve.now/CVE-2018-10238.md): bvlc.c in skarg BACnet Protocol Stack bacserv 0.9.1 and 0.8.5 is affected by a Buffer Overflow because of a lack of packet-size validation. (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2018-04-20
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.