CVEs published April 24, 2018
97 CVEs were published on April 24, 2018: 2 critical, 52 high.
- Published
- 97
- Critical
- 2
- High
- 52
- Medium
- 5
- Low
- 0
- Unrated
- 38
- Now in CISA KEV
- 0
- Fix available
- 2
Most affected products
- Blender
- 21
- Huawei Technologies Co. AR120-S, AR1200, AR1200-S, AR150, A…
- 7
- Sam Lantinga and Mattias Engdegård Simple DirectMedia Layer
- 7
- FreeRDP
- 6
- Antenna House AntennaHouse
- 3
- Corel PHOTO-PAINT
- 3
- Alessandro Furieri FreeXL
- 2
- Artifex Software MuPDF
- 2
- Foscam Indoor IP Camera
- 2
- Kakadu Software Kakadu SDK
- 2
Critical 2
High 52
- CVE-2016-8382An exploitable heap corruption vulnerability exists in the Doc_SetSummary functionality of AntennaHouse DMC HTMLFilter.Antenna House AntennaHouse
- CVE-2016-8383An exploitable heap corruption vulnerability exists in the Doc_GetFontTable functionality of AntennaHouse DMC HTMLFilter.Antenna House AntennaHouse
- CVE-2016-8384An exploitable heap corruption vulnerability exists in the DHFSummary functionality of AntennaHouse DMC HTMLFilter.Antenna House AntennaHouse
- CVE-2016-8728An exploitable heap out of bounds write vulnerability exists in the Fitz graphical library part of the MuPDF renderer.Artifex Software MuPDF
- CVE-2016-8729An exploitable memory corruption vulnerability exists in the JBIG2 parser of Artifex MuPDF 1.9.Artifex Software MuPDF
- CVE-2016-8730An of bound write / memory corruption vulnerability exists in the GIF parsing functionality of Core PHOTO-PAINT X8 18.1.0.661.Corel PHOTO-PAINT
- CVE-2016-8732Multiple security flaws exists in InvProtectDrv.sys which is a part of Invincea Dell Protected Workspace 5.1.1-22303.Invincea Dell Protected Workspace
- CVE-2016-9038An exploitable double fetch vulnerability exists in the SboxDrv.sys driver functionality of Invincea-X 6.1.3-24058.Invincea X
- CVE-2016-9043An out of bound write vulnerability exists in the EMF parsing functionality of CorelDRAW X8 (CdrGfx - Corel Graphics Engine (64-Bit) - 18.1.CorelDRAW
- CVE-2017-12081An exploitable integer overflow exists in the upgrade of a legacy Mesh attribute of the Blender open-source 3d creation suite v2.78c.Blender
- CVE-2017-12082An exploitable integer overflow exists in the 'CustomData' Mesh loading functionality of the Blender open-source 3d creation suite.Blender
- CVE-2017-12086An exploitable integer overflow exists in the 'BKE_mesh_calc_normals_tessface' functionality of the Blender open-source 3d creation suite.Blender
- CVE-2017-12099An exploitable integer overflow exists in the upgrade of the legacy Mesh attribute 'tface' of the Blender open-source 3d creation suite v2.7Blender
- CVE-2017-12100An exploitable integer overflow exists in the 'multires_load_old_dm' functionality of the Blender open-source 3d creation suite v2.78c.Blender
- CVE-2017-12101An exploitable integer overflow exists in the 'modifier_mdef_compact_influences' functionality of the Blender open-source 3d creation suite Blender
- CVE-2017-12102An exploitable integer overflow exists in the way that the Blender open-source 3d creation suite v2.78c converts curves to polygons.Blender
- CVE-2017-12103An exploitable integer overflow exists in the way that the Blender open-source 3d creation suite v2.78c converts text rendered as a font intBlender
- CVE-2017-12104An exploitable integer overflow exists in the way that the Blender open-source 3d creation suite v2.78c draws a Particle object.Blender
- CVE-2017-12105An exploitable integer overflow exists in the way that the Blender open-source 3d creation suite v2.78c applies a particular object modifierBlender
- CVE-2017-12107An memory corruption vulnerability exists in the .PCX parsing functionality of Computerinsel Photoline 20.02.Computerinsel Photoline
- CVE-2017-12108An exploitable integer overflow vulnerability exists in the xls_preparseWorkSheet function of libxls 1.4 when handling a MULBLANK record.libxls
- CVE-2017-12109An exploitable integer overflow vulnerability exists in the xls_preparseWorkSheet function of libxls 1.4 when handling a MULRK record.libxls
- CVE-2017-12122An exploitable code execution vulnerability exists in the ILBM image rendering functionality of SDL2_image-2.0.2.Sam Lantinga and Mattias Engdegård Simple DirectMedia Layer
- CVE-2017-14440An exploitable code execution vulnerability exists in the ILBM image rendering functionality of SDL2_image-2.0.2.Sam Lantinga and Mattias Engdegård Simple DirectMedia Layer
- CVE-2017-14441An exploitable code execution vulnerability exists in the ICO image rendering functionality of SDL2_image-2.0.2.Sam Lantinga and Mattias Engdegård Simple DirectMedia Layer
- CVE-2017-14442An exploitable code execution vulnerability exists in the BMP image rendering functionality of SDL2_image-2.0.2.Sam Lantinga and Mattias Engdegård Simple DirectMedia Layer
- CVE-2017-14448An exploitable code execution vulnerability exists in the XCF image rendering functionality of SDL2_image-2.0.2.Sam Lantinga and Mattias Engdegård Simple DirectMedia Layer
- CVE-2017-14449A double-Free vulnerability exists in the XCF image rendering functionality of SDL2_image-2.0.2.Sam Lantinga and Mattias Engdegård Simple DirectMedia Layer
- CVE-2017-14450A buffer overflow vulnerability exists in the GIF image parsing functionality of SDL2_image-2.0.2.Sam Lantinga and Mattias Engdegård Simple DirectMedia Layer
- CVE-2017-2803A remote out of bound write vulnerability exists in the TIFF parsing functionality of Core PHOTO-PAINT X8 version 18.1.0.661.Corel PHOTO-PAINT
- CVE-2017-2804A remote out of bound write vulnerability exists in the TIFF parsing functionality of Core PHOTO-PAINT X8 18.1.0.661.Corel PHOTO-PAINT
- CVE-2017-2811A code execution vulnerability exists in the Kakadu SDK 7.9's parsing of compressed JPEG 2000 images.Kakadu Software Kakadu SDK
- CVE-2017-2812A code execution vulnerability exists in the kdu_buffered_expand function of the Kakadu SDK 7.9.Kakadu Software Kakadu SDK
- CVE-2017-2832An exploitable command injection vulnerability exists in the web management interface used by the Foscam C1 Indoor HD Camera running applicaFoscam Indoor IP Camera
- CVE-2017-2833An exploitable command injection vulnerability exists in the web management interface used by the Foscam C1 Indoor HD Camera running applicaFoscam Indoor IP Camera
- CVE-2017-2834An exploitable code execution vulnerability exists in the authentication functionality of FreeRDP 2.0.0-beta1+android11.FreeRDP
- CVE-2017-2835An exploitable code execution vulnerability exists in the RDP receive functionality of FreeRDP 2.0.0-beta1+android11.FreeRDP
- CVE-2017-2840A buffer overflow vulnerability exists in the ISO parsing functionality of EZB Systems UltraISO 9.6.6.3300.EZB Systems UltraISO
- CVE-2017-2899An exploitable integer overflow exists in the TIFF loading functionality of the Blender open-source 3d creation suite version 2.78c.Blender
- CVE-2017-2900An exploitable integer overflow exists in the PNG loading functionality of the Blender open-source 3d creation suite version 2.78c.Blender
- CVE-2017-2901An exploitable integer overflow exists in the IRIS loading functionality of the Blender open-source 3d creation suite version 2.78c.Blender
- CVE-2017-2902An exploitable integer overflow exists in the DPX loading functionality of the Blender open-source 3d creation suite version 2.78c.Blender
- CVE-2017-2903An exploitable integer overflow exists in the DPX loading functionality of the Blender open-source 3d creation suite version 2.78c.Blender
- CVE-2017-2904An exploitable integer overflow exists in the RADIANCE loading functionality of the Blender open-source 3d creation suite version 2.78c.Blender
- CVE-2017-2905An exploitable integer overflow exists in the bmp loading functionality of the Blender open-source 3d creation suite version 2.78c.Blender
- CVE-2017-2906An exploitable integer overflow exists in the animation playing functionality of the Blender open-source 3d creation suite version 2.78c.Blender
- CVE-2017-2907An exploitable integer overflow exists in the animation playing functionality of the Blender open-source 3d creation suite version 2.78c.Blender
- CVE-2017-2908An exploitable integer overflow exists in the thumbnail functionality of the Blender open-source 3d creation suite version 2.78c.Blender
- CVE-2017-2918An exploitable integer overflow exists in the Image loading functionality of the Blender open-source 3d creation suite v2.78c.Blender
- CVE-2017-2923An exploitable heap based buffer overflow vulnerability exists in the 'read_biff_next_record function' of FreeXL 1.0.3.Alessandro Furieri FreeXL
- CVE-2017-2924An exploitable heap-based buffer overflow vulnerability exists in the read_legacy_biff function of FreeXL 1.0.3.Alessandro Furieri FreeXL
- CVE-2018-3836An exploitable command injection vulnerability exists in the gplotMakeOutput function of Leptonica 1.74.4.Dan Bloomberg Leptonica
Medium, low and unrated 43
- CVE-2013-3947Buffer overflow in MedCoreD.sys in AhnLab V3 Internet Security 8.0.7.5 (Build 1373) allows local users to gain privileges via a crafted 0xA3
- CVE-2013-7245The Backup Server component in SAP Sybase ASE 15.7 before SP51 allows remote attackers to bypass access restrictions and perform database du
- CVE-2017-17557In Foxit Reader before 9.1 and Foxit PhantomPDF before 9.1, a flaw exists within the parsing of the BITMAPINFOHEADER record in BMP files.
- CVE-2017-2802An exploitable dll hijacking vulnerability exists in the poaService.exe service component of the Dell Precision Optimizer software version 3Dell
- CVE-2017-2836An exploitable denial of service vulnerability exists within the reading of proprietary server certificates in FreeRDP 2.0.0-beta1+android11FreeRDP
- CVE-2017-2837An exploitable denial of service vulnerability exists within the handling of security data in FreeRDP 2.0.0-beta1+android11.FreeRDP
- CVE-2017-2838An exploitable denial of service vulnerability exists within the handling of challenge packets in FreeRDP 2.0.0-beta1+android11.FreeRDP
- CVE-2017-2839An exploitable denial of service vulnerability exists within the handling of challenge packets in FreeRDP 2.0.0-beta1+android11.FreeRDP
- CVE-2018-1059The DPDK vhost-user interface does not check to verify that all the requested guest physical range is mapped and contiguous when performing Red Hat DPDK
- CVE-2018-4832A vulnerability has been identified in OpenPCS 7 V7.1 and earlier (All versions), OpenPCS 7 V8.0 (All versions), OpenPCS 7 V8.1 (All versionSiemens OpenPCS 7 V7.1 and earlier · Siemens OpenPCS 7 +11
- CVE-2016-9587Ansible before versions 2.1.4, 2.2.1 is vulnerable to an improper input validation in Ansible's handling of data sent from client systems.Ansible
- CVE-2017-17251Huawei AR120-S V200R006C10, V200R007C00, V200R008C20, V200R008C30, AR1200 V200R006C10, V200R006C13, V200R007C00, V200R007C01, V200R007C02, VHuawei Technologies Co. AR120-S, AR1200, AR1200-S, AR150, A…
- CVE-2017-17252Huawei AR120-S V200R006C10, V200R007C00, V200R008C20, V200R008C30, AR1200 V200R006C10, V200R006C13, V200R007C00, V200R007C01, V200R007C02, VHuawei Technologies Co. AR120-S, AR1200, AR1200-S, AR150, A…
- CVE-2017-17253Huawei AR120-S V200R006C10, V200R007C00, V200R008C20, V200R008C30, AR1200 V200R006C10, V200R006C13, V200R007C00, V200R007C01, V200R007C02, VHuawei Technologies Co. AR120-S, AR1200, AR1200-S, AR150, A…
- CVE-2017-17254Huawei AR120-S V200R006C10, V200R007C00, V200R008C20, V200R008C30, AR1200 V200R006C10, V200R006C13, V200R007C00, V200R007C01, V200R007C02, V
- CVE-2017-17255Huawei AR120-S V200R006C10, V200R007C00, V200R008C20, V200R008C30, AR1200 V200R006C10, V200R006C13, V200R007C00, V200R007C01, V200R007C02, VHuawei Technologies Co. AR120-S, AR1200, AR1200-S, AR150, A…
- CVE-2017-17256Huawei AR120-S V200R006C10, V200R007C00, V200R008C20, V200R008C30, AR1200 V200R006C10, V200R006C13, V200R007C00, V200R007C01, V200R007C02, VHuawei Technologies Co. AR120-S, AR1200, AR1200-S, AR150, A…
- CVE-2017-17257Huawei AR120-S V200R006C10, V200R007C00, V200R008C20, V200R008C30, AR1200 V200R006C10, V200R006C13, V200R007C00, V200R007C01, V200R007C02, VHuawei Technologies Co. AR120-S, AR1200, AR1200-S, AR150, A…
- CVE-2017-17258Huawei AR120-S V200R006C10, V200R007C00, V200R008C20, V200R008C30, AR1200 V200R006C10, V200R006C13, V200R007C00, V200R007C01, V200R007C02, VHuawei Technologies Co. AR120-S, AR1200, AR1200-S, AR150, A…
- CVE-2017-9654The Philips DoseWise Portal web-based application versions 1.1.7.333 and 2.1.1.3069 stores login credentials in clear text within backend syPhilips DoseWise Portal
- CVE-2017-9656The backend database of the Philips DoseWise Portal application versions 1.1.7.333 and 2.1.1.3069 uses hard-coded credentials for a databasePhilips DoseWise Portal
- CVE-2018-7931Huawei AppGallery versions before 8.0.4.301 has a whitelist mechanism bypass vulnerability.Huawei Technologies Co. AppGallery
- CVE-2018-7932Huawei AppGallery versions before 8.0.4.301 has an arbitrary Javascript running vulnerability.
- CVE-2017-1700IBM Jazz Team Server affecting the following IBM Rational Products: Collaborative Lifecycle Management (CLM), Rational DOORS Next GenerationIBM Rational Team Concert · IBM Rational Engineering Lif… +5
- CVE-2017-1725IBM Jazz Team Server affecting the following IBM Rational Products: Collaborative Lifecycle Management (CLM), Rational DOORS Next GenerationIBM Rational Quality Manager · IBM Rational Collaborativ… +5
- CVE-2017-1734IBM Jazz Team Server affecting the following IBM Rational Products: Collaborative Lifecycle Management (CLM), Rational DOORS Next GenerationIBM Rational Engineering Lifecycle Manager · IBM Rationa… +5
- CVE-2017-7651In Eclipse Mosquitto 1.4.14, a user can shutdown the Mosquitto server simply by filling the RAM memory with a lot of connections with large The Eclipse Foundation Eclipse Mosquitto
- CVE-2018-5228The /browse/~raw resource in Atlassian Fisheye and Crucible before version 4.5.3 allows remote attackers to inject arbitrary HTML or JavaScrAtlassian Fisheye and Crucible
- CVE-2018-10321Frog CMS 0.9.5 has a stored Cross Site Scripting Vulnerability via "Admin Site title" in Settings.
- CVE-2018-10322The xfs_dinode_verify function in fs/xfs/libxfs/xfs_inode_buf.c in the Linux kernel through 4.16.3 allows local users to cause a denial of s
- CVE-2018-10323The xfs_bmap_extents_to_btree function in fs/xfs/libxfs/xfs_bmap.c in the Linux kernel through 4.16.3 allows local users to cause a denial o
- CVE-2018-10328Momentum Axel 720P 5.1.8 devices have a hardcoded password of streaming for the appagent account, which allows remote attackers to view the
- CVE-2018-10329app/tools/mac-lookup/index.php in phpIPAM 1.3.1 has Reflected XSS on /tools/mac-lookup/ via the mac parameter.
- CVE-2018-7751The svg_probe function in libavformat/img2dec.c in FFmpeg through 3.4.2 allows remote attackers to cause a denial of service (Infinite Loop)
- CVE-2018-10305The MessageSearch2 function in PersonalMessage.php in Simple Machines Forum (SMF) before 2.0.15 does not properly use the possible_users var
- CVE-2018-10309The Responsive Cookie Consent plugin before 1.8 for WordPress mishandles number fields, leading to XSS.
- CVE-2018-10311A vulnerability was discovered in WUZHI CMS 4.1.0.
- CVE-2018-10312index.php?m=member&v=pw_reset in WUZHI CMS 4.1.0 allows CSRF to change the password of a common member.
- CVE-2018-10313WUZHI CMS 4.1.0 allows persistent XSS via the form%5Bqq_10%5D parameter to the /index.php?m=member&f=index&v=profile&set_iframe=1 URI.
- CVE-2018-10316Netwide Assembler (NASM) 2.14rc0 has an endless while loop in the assemble_file function of asm/nasm.c because of a globallineno integer ove
- CVE-2018-10318Frog CMS 0.9.5 has XSS via the admin/?/page/edit page[keywords] parameter, aka Edit Page Metadata.
- CVE-2018-10319Frog CMS 0.9.5 has XSS via the admin/?/snippet/edit snippet[name] parameter, aka Edit Snippet.
- CVE-2018-10320Frog CMS 0.9.5 has XSS via the admin/?/layout/edit layout[name] parameter, aka Edit Layout.