CVEs published April 25, 2018
45 CVEs were published on April 25, 2018: 0 critical, 1 high.
- Published
- 45
- Critical
- 0
- High
- 1
- Medium
- 0
- Low
- 0
- Unrated
- 44
- Now in CISA KEV
- 0
- Fix available
- 5
Most affected products
- Apache Software Foundation Apache Tika · org.apache.tika:ti…
- 3
- ICS-CERT Advantech WebAccess HMI Designer
- 3
- Abbott Laboratories Accent/Anthem, Accent MRI, Assurity/All…
- 2
- IBM Jazz Reporting Service
- 2
- Abbott Laboratories Accent and Anthem
- 1
- Atlassian SourceTree Windows
- 1
- FLAC
- 1
- glusterfs
- 1
- NetApp OnCommand Unified Manager for Linux
- 1
- rainlab/user-plugin
- 1
High 1
Medium, low and unrated 44
- CVE-2018-8833Heap-based buffer overflow vulnerabilities in Advantech WebAccess HMI Designer 2.1.7.32 and prior caused by processing specially crafted .pmICS-CERT Advantech WebAccess HMI Designer
- CVE-2018-8835Double free vulnerabilities in Advantech WebAccess HMI Designer 2.1.7.32 and prior caused by processing specially crafted .pm3 files may allICS-CERT Advantech WebAccess HMI Designer
- CVE-2018-8837Processing specially crafted .pm3 files in Advantech WebAccess HMI Designer 2.1.7.32 and prior may cause the system to write outside the intICS-CERT Advantech WebAccess HMI Designer
- CVE-2017-6888An error in the "read_metadata_vorbiscomment_()" function (src/libFLAC/stream_decoder.c) in FLAC version 1.3.2 can be exploited to cause a mFLAC
- CVE-2018-1335From Apache Tika versions 1.7 to 1.17, clients could send carefully crafted headers to tika-server that could be used to inject commands intApache Software Foundation Apache Tika · org.apache.tika:ti…
- CVE-2018-1338A carefully crafted (or fuzzed) file can trigger an infinite loop in Apache Tika's BPGParser in versions of Apache Tika before 1.18.Apache Software Foundation Apache Tika · org.apache.tika:ti…
- CVE-2018-1339A carefully crafted (or fuzzed) file can trigger an infinite loop in Apache Tika's ChmParser in versions of Apache Tika before 1.18.Apache Software Foundation Apache Tika · org.apache.tika:ti…
- CVE-2018-5226There was an argument injection vulnerability in Sourcetree for Windows via Mercurial repository tag name that is going to be deleted.Atlassian SourceTree Windows
- CVE-2018-5486NetApp OnCommand Unified Manager for Linux versions 7.2 though 7.3 ship with the Java Debug Wire Protocol (JDWP) enabled which allows unauthNetApp OnCommand Unified Manager for Linux
- CVE-2014-0872The installation process in IBM Security Key Lifecycle Manager 2.5 stores unencrypted credentials, which might allow local users to obtain s
- CVE-2014-0881The TPM on Integrated Management Module II (IMM2) on IBM Flex System x222 servers with firmware 1.00 through 3.56 allows remote attackers to
- CVE-2014-0882Integrated Management Module II (IMM2) on IBM Flex System, NeXtScale, System x3xxx, and System x iDataPlex systems might allow remote authen
- CVE-2018-8716WSO2 Identity Server before 5.5.0 has XSS via the dashboard, allowing attacks by low-privileged attackers.
- CVE-2018-9101A vulnerability in the conferencing component of Mitel MiVoice Connect, versions R1707-PREM SP1 (21.84.5535.0) and earlier, and Mitel ST 14.
- CVE-2018-9102A vulnerability in the conferencing component of Mitel MiVoice Connect, versions R1707-PREM SP1 (21.84.5535.0) and earlier, and Mitel ST 14.
- CVE-2018-9103A vulnerability in the conferencing component of Mitel MiVoice Connect, versions R1707-PREM SP1 (21.84.5535.0) and earlier, and Mitel ST 14.
- CVE-2018-9104A vulnerability in the conferencing component of Mitel MiVoice Connect, versions R1707-PREM SP1 (21.84.5535.0) and earlier, and Mitel ST 14.
- CVE-2018-10206An issue was discovered in Vaultize Enterprise File Sharing 17.05.31.
- CVE-2018-10207An issue was discovered in Vaultize Enterprise File Sharing 17.05.31.
- CVE-2018-10208An issue was discovered in Vaultize Enterprise File Sharing 17.05.31.
- CVE-2018-10209An issue was discovered in Vaultize Enterprise File Sharing 17.05.31.
- CVE-2018-10210An issue was discovered in Vaultize Enterprise File Sharing 17.05.31.
- CVE-2018-10211An issue was discovered in Vaultize Enterprise File Sharing 17.05.31.
- CVE-2018-10212An issue was discovered in Vaultize Enterprise File Sharing 17.05.31.
- CVE-2018-10213An issue was discovered in Vaultize Enterprise File Sharing 17.05.31.
- CVE-2014-5014The WordPress Flash Uploader plugin before 3.1.3 for WordPress allows remote attackers to execute arbitrary commands via vectors related to
- CVE-2017-12712The authentication algorithm in Abbott Laboratories pacemakers manufactured prior to Aug 28, 2017, which involves an authentication key and Abbott Laboratories Accent/Anthem, Accent MRI, Assurity/All…
- CVE-2017-12714Abbott Laboratories pacemakers manufactured prior to Aug 28, 2017 do not restrict or limit the number of correctly formatted "RF wake-up" coAbbott Laboratories Accent/Anthem, Accent MRI, Assurity/All…
- CVE-2017-12716Abbott Laboratories Accent and Anthem pacemakers manufactured prior to Aug 28, 2017 transmit unencrypted patient information via RF communicAbbott Laboratories Accent and Anthem
- CVE-2017-1750IBM Jazz Reporting Service (JRS) 5.0 through 5.0.2 and 6.0 through 6.0.5 is vulnerable to cross-site scripting.IBM Jazz Reporting Service
- CVE-2017-7652In Eclipse Mosquitto 1.4.14, if a Mosquitto instance is set running with a configuration file, then sending a HUP signal to server triggers The Eclipse Foundation Eclipse Mosquitto
- CVE-2018-1363IBM Jazz Reporting Service (JRS) 5.0 through 5.0.2 and 6.0 through 6.0.5 is vulnerable to cross-site scripting.IBM Jazz Reporting Service
- CVE-2018-10310A persistent cross-site scripting vulnerability has been identified in the web interface of the Catapult UK Cookie Consent plugin before 2.3
- CVE-2018-10366An issue was discovered in the Users (aka Front-end user management) plugin 1.4.5 for October CMS.rainlab/user-plugin
- CVE-2018-10367An issue was discovered in WUZHI CMS 4.1.0.
- CVE-2018-10368An issue was discovered in WUZHI CMS 4.1.0.
- CVE-2018-10372process_cu_tu_index in dwarf.c in GNU Binutils 2.30 allows remote attackers to cause a denial of service (heap-based buffer over-read and ap
- CVE-2018-10373concat_filename in dwarf2.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.30, allows remote att
- CVE-2018-10374EasyCMS 1.3 has XSS via the s POST parameter (aka a search box value) in an index.php?s=/index/search/index.html request.
- CVE-2018-10375A file uploading vulnerability exists in /include/helpers/upload.helper.php in DedeCMS V5.7 SP2, which can be utilized by attackers to uploa
- CVE-2018-10376An integer overflow in the transferProxy function of a smart contract implementation for SmartMesh (aka SMT), an Ethereum ERC20 token, allow
- CVE-2018-8801GitLab Community and Enterprise Editions version 8.3 up to 10.x before 10.3 are vulnerable to SSRF in the Services and webhooks component.
- CVE-2018-10361An issue was discovered in KTextEditor 5.34.0 through 5.45.0.
- CVE-2018-10362An issue was discovered in phpLiteAdmin 1.9.5 through 1.9.7.1.