# CVEs published 2018-04-25

45 CVEs were published on April 25, 2018: 0 critical, 1 high. Days are UTC.

- [CVE-2018-8833](https://cve.now/CVE-2018-8833.md): Heap-based buffer overflow vulnerabilities in Advantech WebAccess HMI Designer 2.1.7.32 and prior caused by processing specially crafted .pm (no CVSS, ICS-CERT Advantech WebAccess HMI Designer)
- [CVE-2018-8835](https://cve.now/CVE-2018-8835.md): Double free vulnerabilities in Advantech WebAccess HMI Designer 2.1.7.32 and prior caused by processing specially crafted .pm3 files may all (no CVSS, ICS-CERT Advantech WebAccess HMI Designer)
- [CVE-2018-8837](https://cve.now/CVE-2018-8837.md): Processing specially crafted .pm3 files in Advantech WebAccess HMI Designer 2.1.7.32 and prior may cause the system to write outside the int (no CVSS, ICS-CERT Advantech WebAccess HMI Designer)
- [CVE-2017-6888](https://cve.now/CVE-2017-6888.md): An error in the "read\_metadata\_vorbiscomment\_()" function (src/libFLAC/stream\_decoder.c) in FLAC version 1.3.2 can be exploited to cause a m (no CVSS, FLAC)
- [CVE-2018-1335](https://cve.now/CVE-2018-1335.md): From Apache Tika versions 1.7 to 1.17, clients could send carefully crafted headers to tika-server that could be used to inject commands int (no CVSS, Apache Software Foundation Apache Tika · org.apache.tika:ti…)
- [CVE-2018-1338](https://cve.now/CVE-2018-1338.md): A carefully crafted (or fuzzed) file can trigger an infinite loop in Apache Tika's BPGParser in versions of Apache Tika before 1.18. (no CVSS, Apache Software Foundation Apache Tika · org.apache.tika:ti…)
- [CVE-2018-1339](https://cve.now/CVE-2018-1339.md): A carefully crafted (or fuzzed) file can trigger an infinite loop in Apache Tika's ChmParser in versions of Apache Tika before 1.18. (no CVSS, Apache Software Foundation Apache Tika · org.apache.tika:ti…)
- [CVE-2018-5226](https://cve.now/CVE-2018-5226.md): There was an argument injection vulnerability in Sourcetree for Windows via Mercurial repository tag name that is going to be deleted. (no CVSS, Atlassian SourceTree Windows)
- [CVE-2018-5486](https://cve.now/CVE-2018-5486.md): NetApp OnCommand Unified Manager for Linux versions 7.2 though 7.3 ship with the Java Debug Wire Protocol (JDWP) enabled which allows unauth (no CVSS, NetApp OnCommand Unified Manager for Linux)
- [CVE-2014-0872](https://cve.now/CVE-2014-0872.md): The installation process in IBM Security Key Lifecycle Manager 2.5 stores unencrypted credentials, which might allow local users to obtain s (no CVSS)
- [CVE-2014-0881](https://cve.now/CVE-2014-0881.md): The TPM on Integrated Management Module II (IMM2) on IBM Flex System x222 servers with firmware 1.00 through 3.56 allows remote attackers to (no CVSS)
- [CVE-2014-0882](https://cve.now/CVE-2014-0882.md): Integrated Management Module II (IMM2) on IBM Flex System, NeXtScale, System x3xxx, and System x iDataPlex systems might allow remote authen (no CVSS)
- [CVE-2018-8716](https://cve.now/CVE-2018-8716.md): WSO2 Identity Server before 5.5.0 has XSS via the dashboard, allowing attacks by low-privileged attackers. (no CVSS)
- [CVE-2018-9101](https://cve.now/CVE-2018-9101.md): A vulnerability in the conferencing component of Mitel MiVoice Connect, versions R1707-PREM SP1 (21.84.5535.0) and earlier, and Mitel ST 14. (no CVSS)
- [CVE-2018-9102](https://cve.now/CVE-2018-9102.md): A vulnerability in the conferencing component of Mitel MiVoice Connect, versions R1707-PREM SP1 (21.84.5535.0) and earlier, and Mitel ST 14. (no CVSS)
- [CVE-2018-9103](https://cve.now/CVE-2018-9103.md): A vulnerability in the conferencing component of Mitel MiVoice Connect, versions R1707-PREM SP1 (21.84.5535.0) and earlier, and Mitel ST 14. (no CVSS)
- [CVE-2018-9104](https://cve.now/CVE-2018-9104.md): A vulnerability in the conferencing component of Mitel MiVoice Connect, versions R1707-PREM SP1 (21.84.5535.0) and earlier, and Mitel ST 14. (no CVSS)
- [CVE-2018-10206](https://cve.now/CVE-2018-10206.md): An issue was discovered in Vaultize Enterprise File Sharing 17.05.31. (no CVSS)
- [CVE-2018-10207](https://cve.now/CVE-2018-10207.md): An issue was discovered in Vaultize Enterprise File Sharing 17.05.31. (no CVSS)
- [CVE-2018-10208](https://cve.now/CVE-2018-10208.md): An issue was discovered in Vaultize Enterprise File Sharing 17.05.31. (no CVSS)
- [CVE-2018-10209](https://cve.now/CVE-2018-10209.md): An issue was discovered in Vaultize Enterprise File Sharing 17.05.31. (no CVSS)
- [CVE-2018-10210](https://cve.now/CVE-2018-10210.md): An issue was discovered in Vaultize Enterprise File Sharing 17.05.31. (no CVSS)
- [CVE-2018-10211](https://cve.now/CVE-2018-10211.md): An issue was discovered in Vaultize Enterprise File Sharing 17.05.31. (no CVSS)
- [CVE-2018-10212](https://cve.now/CVE-2018-10212.md): An issue was discovered in Vaultize Enterprise File Sharing 17.05.31. (no CVSS)
- [CVE-2018-10213](https://cve.now/CVE-2018-10213.md): An issue was discovered in Vaultize Enterprise File Sharing 17.05.31. (no CVSS)
- [CVE-2014-5014](https://cve.now/CVE-2014-5014.md): The WordPress Flash Uploader plugin before 3.1.3 for WordPress allows remote attackers to execute arbitrary commands via vectors related to (no CVSS)
- [CVE-2017-12712](https://cve.now/CVE-2017-12712.md): The authentication algorithm in Abbott Laboratories pacemakers manufactured prior to Aug 28, 2017, which involves an authentication key and (no CVSS, Abbott Laboratories Accent/Anthem, Accent MRI, Assurity/All…)
- [CVE-2017-12714](https://cve.now/CVE-2017-12714.md): Abbott Laboratories pacemakers manufactured prior to Aug 28, 2017 do not restrict or limit the number of correctly formatted "RF wake-up" co (no CVSS, Abbott Laboratories Accent/Anthem, Accent MRI, Assurity/All…)
- [CVE-2017-12716](https://cve.now/CVE-2017-12716.md): Abbott Laboratories Accent and Anthem pacemakers manufactured prior to Aug 28, 2017 transmit unencrypted patient information via RF communic (no CVSS, Abbott Laboratories Accent and Anthem)
- [CVE-2017-1750](https://cve.now/CVE-2017-1750.md): IBM Jazz Reporting Service (JRS) 5.0 through 5.0.2 and 6.0 through 6.0.5 is vulnerable to cross-site scripting. (no CVSS, IBM Jazz Reporting Service)
- [CVE-2017-7652](https://cve.now/CVE-2017-7652.md): In Eclipse Mosquitto 1.4.14, if a Mosquitto instance is set running with a configuration file, then sending a HUP signal to server triggers (no CVSS, The Eclipse Foundation Eclipse Mosquitto)
- [CVE-2018-1363](https://cve.now/CVE-2018-1363.md): IBM Jazz Reporting Service (JRS) 5.0 through 5.0.2 and 6.0 through 6.0.5 is vulnerable to cross-site scripting. (no CVSS, IBM Jazz Reporting Service)
- [CVE-2018-1112](https://cve.now/CVE-2018-1112.md): glusterfs server before versions 3.10.12, 4.0.2 is vulnerable when using 'auth.allow' option which allows any unauthenticated gluster client (CVSS 8.0, glusterfs)
- [CVE-2018-10310](https://cve.now/CVE-2018-10310.md): A persistent cross-site scripting vulnerability has been identified in the web interface of the Catapult UK Cookie Consent plugin before 2.3 (no CVSS)
- [CVE-2018-10366](https://cve.now/CVE-2018-10366.md): An issue was discovered in the Users (aka Front-end user management) plugin 1.4.5 for October CMS. (no CVSS, rainlab/user-plugin)
- [CVE-2018-10367](https://cve.now/CVE-2018-10367.md): An issue was discovered in WUZHI CMS 4.1.0. (no CVSS)
- [CVE-2018-10368](https://cve.now/CVE-2018-10368.md): An issue was discovered in WUZHI CMS 4.1.0. (no CVSS)
- [CVE-2018-10372](https://cve.now/CVE-2018-10372.md): process\_cu\_tu\_index in dwarf.c in GNU Binutils 2.30 allows remote attackers to cause a denial of service (heap-based buffer over-read and ap (no CVSS)
- [CVE-2018-10373](https://cve.now/CVE-2018-10373.md): concat\_filename in dwarf2.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.30, allows remote att (no CVSS)
- [CVE-2018-10374](https://cve.now/CVE-2018-10374.md): EasyCMS 1.3 has XSS via the s POST parameter (aka a search box value) in an index.php?s=/index/search/index.html request. (no CVSS)
- [CVE-2018-10375](https://cve.now/CVE-2018-10375.md): A file uploading vulnerability exists in /include/helpers/upload.helper.php in DedeCMS V5.7 SP2, which can be utilized by attackers to uploa (no CVSS)
- [CVE-2018-10376](https://cve.now/CVE-2018-10376.md): An integer overflow in the transferProxy function of a smart contract implementation for SmartMesh (aka SMT), an Ethereum ERC20 token, allow (no CVSS)
- [CVE-2018-8801](https://cve.now/CVE-2018-8801.md): GitLab Community and Enterprise Editions version 8.3 up to 10.x before 10.3 are vulnerable to SSRF in the Services and webhooks component. (no CVSS)
- [CVE-2018-10361](https://cve.now/CVE-2018-10361.md): An issue was discovered in KTextEditor 5.34.0 through 5.45.0. (no CVSS)
- [CVE-2018-10362](https://cve.now/CVE-2018-10362.md): An issue was discovered in phpLiteAdmin 1.9.5 through 1.9.7.1. (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2018-04-25
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.