CVEs published April 26, 2018
36 CVEs were published on April 26, 2018: 0 critical, 6 high.
- Published
- 36
- Critical
- 0
- High
- 6
- Medium
- 2
- Low
- 1
- Unrated
- 27
- Now in CISA KEV
- 0
- Fix available
- 4
Most affected products
- IBM Security QRadar SIEM
- 5
- Hyland Software Perceptive Document Filters
- 4
- Apache Software Foundation Apache UIMA · org.apache.uima… +2
- 1
- com.google.guava:guava · com.google.guava:guava-jdk5 +4
- 1
- Fortinet FortiClient for Windows · Fortinet FortiClient… +1
- 1
- genix/cms
- 1
- NetIQ Identity Reporting
- 1
- NetIQ IDM - Identity Applications
- 1
- ovirt-engine
- 1
- puppet-swift
- 1
High 6
- CVE-2018-3844In Hyland Perceptive Document Filters 11.4.0.2647 - x86/x64 Windows/Linux, a crafted DOCX document can lead to a use-after-free resulting inHyland Software Perceptive Document Filters
- CVE-2018-3845In Hyland Perceptive Document Filters 11.4.0.2647 - x86/x64 Windows/Linux, a crafted OpenDocument document can lead to a SkCanvas object douHyland Software Perceptive Document Filters
- CVE-2018-3851In Hyland Perceptive Document Filters 11.4.0.2647 - x86/x64 Windows/Linux, an exploitable stack-based buffer overflow exists in the DOC-to-HHyland Software Perceptive Document Filters
- CVE-2018-3855In Hyland Perceptive Document Filters 11.4.0.2647 - x86/x64 Windows/Linux, a crafted OpenDocument document can lead to a SkCanvas object douHyland Software Perceptive Document Filters
- CVE-2016-9602Qemu before version 2.9 is vulnerable to an improper link following when built with the VirtFS.Qemu
- CVE-2018-1074ovirt-engine API and administration web portal before versions 4.2.2.5, 4.1.11.2 is vulnerable to an exposure of Power Management credentialovirt-engine
Medium, low and unrated 30
- CVE-2018-10237Unbounded memory allocation in Google Guava 11.0 through 24.x before 24.1.1 allows remote attackers to conduct denial of service attacks agacom.google.guava:guava · com.google.guava:guava-jdk5 +4
- CVE-2017-17543Users' VPN authentication credentials are unsafely encrypted in Fortinet FortiClient for Windows 5.6.0 and below versions, FortiClient for MFortinet FortiClient for Windows · Fortinet FortiClient… +1
- CVE-2018-7527A buffer overflow can be triggered in LeviStudio HMI Editor, Version 1.10 part of Wecon LeviStudioU 1.8.29, and PI Studio HMI Project PrograWECON Technology Co. LeviStudio HMI Editor · WECON Technolo…
- CVE-2017-14010In SpiderControl MicroBrowser Windows XP, Vista 7, 8 and 10, Versions 1.6.30.144 and prior, an uncontrolled search path element vulnerabilitSpiderControl MicroBrowser
- CVE-2018-7465An XSS issue was discovered in VirtueMart before 3.2.14.
- CVE-2016-9590puppet-swift before versions 8.2.1, 9.4.4 is vulnerable to an information-disclosure in Red Hat OpenStack Platform director's installation opuppet-swift
- CVE-2017-15691In Apache uimaj prior to 2.10.2, Apache uimaj 3.0.0-xxx prior to 3.0.0-beta, Apache uima-as prior to 2.10.2, Apache uimaFIT prior to 2.4.0, Apache Software Foundation Apache UIMA · org.apache.uima… +2
- CVE-2018-10429Cosmo 1.0.0Beta6 allows attackers to execute arbitrary PHP code via the Database Prefix field on the Database Info screen of install.php.
- CVE-2018-10430An issue was discovered in DiliCMS (aka DiligentCMS) 2.4.0.
- CVE-2018-10431D-Link DIR-615 2.5.17 devices allow Remote Code Execution via shell metacharacters in the Host field of the System / Traceroute screen.
- CVE-2017-9275NetIQ Identity Reporting XSS exposureNetIQ Identity Reporting
- CVE-2017-9284IDM 4.6 Identity Applications information leakageNetIQ IDM - Identity Applications
- CVE-2018-8072An issue was discovered on EDIMAX IC-3140W through 3.06, IC-5150W through 3.09, and IC-6220DC through 3.06 devices.
- CVE-2017-14740Cross-site scripting (XSS) vulnerability in GeniXCMS 1.1.0 allows remote authenticated users to inject arbitrary web script or HTML via the genix/cms
- CVE-2017-1721IBM Security QRadar SIEM 7.2 and 7.3 could allow an unauthenticated user to execute code remotely with lower level privileges under unusual IBM Security QRadar SIEM
- CVE-2017-1722IBM Security QRadar SIEM 7.2 and 7.3 is vulnerable to SQL injection.IBM Security QRadar SIEM
- CVE-2017-1723IBM Security QRadar SIEM 7.2 and 7.3 could allow a remote attacker to traverse directories on the system.IBM Security QRadar SIEM
- CVE-2017-1724IBM Security QRadar SIEM 7.2 and 7.3 is vulnerable to cross-site scripting.IBM Security QRadar SIEM
- CVE-2018-1418IBM Security QRadar SIEM 7.2 and 7.3 could allow a user to bypass authentication which could lead to code execution.IBM Security QRadar SIEM
- CVE-2018-6518Composr CMS 10.0.13 has XSS via the site_name parameter in a page=admin-setupwizard&type=step3 request to /adminzone/index.php.
- CVE-2018-10425An issue was discovered in Shanghai 2345 Security Guard 3.7.0.
- CVE-2018-8974Centers for Disease Control and Prevention MicrobeTRACE 0.1.11 allows remote attackers to execute arbitrary code, related to code injection
- CVE-2018-9113Centers for Disease Control and Prevention MicrobeTRACE 0.1.12 allows remote attackers to execute arbitrary code, related to code injection
- CVE-2018-10391An issue was discovered in WUZHI CMS 4.1.0.
- CVE-2018-10392mapping0_forward in mapping0.c in Xiph.Org libvorbis 1.3.6 does not validate the number of channels, which allows remote attackers to cause
- CVE-2018-10393bark_noise_hybridmp in psy.c in Xiph.Org libvorbis 1.3.6 has a stack-based buffer over-read.
- CVE-2018-10422An issue was discovered in HongCMS 3.0.0.
- CVE-2018-10423mc-admin/post.php in MiniCMS 1.10 allows remote attackers to obtain a directory listing of the top-level directory of the web root via a lin
- CVE-2018-10424mc-admin/post-edit.php in MiniCMS 1.10 allows full path disclosure via a modified id field.
- CVE-2018-10381TunnelBear 3.2.0.6 for Windows suffers from a SYSTEM privilege escalation vulnerability through the "TunnelBearMaintenance" service.