CVEs published April 23, 2018
27 CVEs were published on April 23, 2018: 0 critical, 4 high.
- Published
- 27
- Critical
- 0
- High
- 4
- Medium
- 3
- Low
- 0
- Unrated
- 20
- Now in CISA KEV
- 0
- Fix available
- 1
Most affected products
- IBM Cognos Business Intelligence
- 2
- Talos Foxit
- 2
- Check Point Software Technologies Linux Kernel
- 1
- curl
- 1
- ghostscript
- 1
- IBM MQ
- 1
- IBM Rational Team Concert
- 1
- IBM Security Access Manager
- 1
- Micro Focus Universal CMDB
- 1
- puppet-tripleo
- 1
High 4
- CVE-2016-9599puppet-tripleo before versions 5.5.0, 6.2.0 is vulnerable to an access-control flaw in the IPtables rules management, which allowed the creapuppet-tripleo
- CVE-2018-6491MFSBGN03803 rev.1 - UCMDB, Installation File Access Control Privilege Escalation VulnerabilityMicro Focus Universal CMDB
- CVE-2017-14458An exploitable use-after-free vulnerability exists in the JavaScript engine of Foxit Software's Foxit PDF Reader version 8.3.2.25013.Talos Foxit
- CVE-2018-3850An exploitable use-after-free vulnerability exists in the JavaScript engine Foxit Software Foxit PDF Reader version 9.0.1.1049.Talos Foxit
Medium, low and unrated 23
- CVE-2018-10303A use-after-free in Foxit Reader before 9.1 and PhantomPDF before 9.1 allows remote attackers to execute arbitrary code, aka iDefense ID V-y
- CVE-2017-7893In SaltStack Salt before 2016.3.6, compromised salt-minions can impersonate the salt-master.salt
- CVE-2016-9601ghostscript before version 9.21 is vulnerable to a heap based buffer overflow that was found in the ghostscript jbig2_decode_gray_scale_imagghostscript
- CVE-2018-1106An authentication bypass flaw has been found in PackageKit before 1.1.10 that allows users without administrator privileges to install signeRed Hat PackageKit
- CVE-2016-9594curl before version 7.52.1 is vulnerable to an uninitialized random in libcurl's internal function that returns a good 32bit random value.curl
- CVE-2018-10302A use-after-free in Foxit Reader before 9.1 and PhantomPDF before 9.1 allows remote attackers to execute arbitrary code, aka iDefense ID V-j
- CVE-2018-8781The udl_fb_mmap function in drivers/gpu/drm/udl/udl_fb.c at the Linux kernel version 3.4 and up to and including 4.15 has an integer-overfloCheck Point Software Technologies Linux Kernel
- CVE-2016-9586curl before version 7.52.0 is vulnerable to a buffer overflow when doing a large floating point output in libcurl's implementation of the prredhat curl
- CVE-2017-17833OpenSLP releases in the 1.0.2 and 1.1.0 code streams have a heap-related memory corruption issue which may manifest itself as a denial-of-se
- CVE-2018-10300Cross-site scripting (XSS) vulnerability in the Web-Dorado Instagram Feed WD plugin before 1.3.1 for WordPress allows remote attackers to in
- CVE-2018-10301Cross-site scripting (XSS) vulnerability in the Web-Dorado Instagram Feed WD plugin before 1.3.1 Premium for WordPress allows remote attacke
- CVE-2018-8880Lutron Quantum BACnet Integration 2.0 (firmware 3.2.243) doesn't check for correct user authentication before showing the /deviceIP informat
- CVE-2018-9921In CMS Made Simple 2.2.7, a Directory Traversal issue makes it possible to determine the existence of files and directories outside the web-
- CVE-2018-4847A vulnerability has been identified in SIMATIC WinCC OA Operator iOS App (All versions < V1.4).Siemens AG SIMATIC WinCC OA Operator iOS App
- CVE-2017-13073Cross-site scripting (XSS) vulnerability in QNAP NAS application Photo Station versions 5.2.7, 5.4.3, and their earlier versions could allowQNAP Photo Station
- CVE-2018-10233The User Profile & Membership plugin before 2.0.7 for WordPress has no mitigations implemented against cross site request forgery attacks.
- CVE-2018-10234Authenticated Cross site Scripting exists in the User Profile & Membership plugin before 2.0.11 for WordPress via the "Account Deletion Cust
- CVE-2017-1473IBM Security Access Manager Appliance 8.0.0 through 8.0.1.6 and 9.0.0 through 9.0.3.1 uses weaker than expected cryptographic algorithms thaIBM Security Access Manager
- CVE-2017-1486IBM Cognos Business Intelligence 10.2, 10.2.1, 10.2.1.1, and 10.2.2 is vulnerable to cross-site scripting.IBM Cognos Business Intelligence
- CVE-2017-1701IBM Team Concert (RTC) 5.0, 5.0.1, 5.0.2, 6.0, 6.0.1, 6.0.2, 6.0.3, 6.0.4, and 6.0.5 stores credentials for users using a weak encryption alIBM Rational Team Concert
- CVE-2017-1764IBM Cognos Business Intelligence 10.2, 10.2.1, 10.2.1.1, and 10.2.2, under specialized circumstances, could expose plain text credentials toIBM Cognos Business Intelligence
- CVE-2017-1786IBM WebSphere MQ 8.0 through 8.0.0.8 and 9.0 through 9.0.4 under special circumstances could allow an authenticated user to consume all resoIBM MQ
- CVE-2018-10299An integer overflow in the batchTransfer function of a smart contract implementation for Beauty Ecosystem Coin (BEC), the Ethereum ERC20 tok