# CVEs published 2018-04-26

36 CVEs were published on April 26, 2018: 0 critical, 6 high. Days are UTC.

- [CVE-2018-10237](https://cve.now/CVE-2018-10237.md): Unbounded memory allocation in Google Guava 11.0 through 24.x before 24.1.1 allows remote attackers to conduct denial of service attacks aga (no CVSS, com.google.guava:guava · com.google.guava:guava-jdk5 +4)
- [CVE-2017-17543](https://cve.now/CVE-2017-17543.md): Users' VPN authentication credentials are unsafely encrypted in Fortinet FortiClient for Windows 5.6.0 and below versions, FortiClient for M (no CVSS, Fortinet FortiClient for Windows · Fortinet FortiClient… +1)
- [CVE-2018-3844](https://cve.now/CVE-2018-3844.md): In Hyland Perceptive Document Filters 11.4.0.2647 - x86/x64 Windows/Linux, a crafted DOCX document can lead to a use-after-free resulting in (CVSS 8.8, Hyland Software Perceptive Document Filters)
- [CVE-2018-3845](https://cve.now/CVE-2018-3845.md): In Hyland Perceptive Document Filters 11.4.0.2647 - x86/x64 Windows/Linux, a crafted OpenDocument document can lead to a SkCanvas object dou (CVSS 8.8, Hyland Software Perceptive Document Filters)
- [CVE-2018-3851](https://cve.now/CVE-2018-3851.md): In Hyland Perceptive Document Filters 11.4.0.2647 - x86/x64 Windows/Linux, an exploitable stack-based buffer overflow exists in the DOC-to-H (CVSS 8.8, Hyland Software Perceptive Document Filters)
- [CVE-2018-3855](https://cve.now/CVE-2018-3855.md): In Hyland Perceptive Document Filters 11.4.0.2647 - x86/x64 Windows/Linux, a crafted OpenDocument document can lead to a SkCanvas object dou (CVSS 8.8, Hyland Software Perceptive Document Filters)
- [CVE-2018-7527](https://cve.now/CVE-2018-7527.md): A buffer overflow can be triggered in LeviStudio HMI Editor, Version 1.10 part of Wecon LeviStudioU 1.8.29, and PI Studio HMI Project Progra (no CVSS, WECON Technology Co. LeviStudio HMI Editor · WECON Technolo…)
- [CVE-2016-9602](https://cve.now/CVE-2016-9602.md): Qemu before version 2.9 is vulnerable to an improper link following when built with the VirtFS. (CVSS 7.6, Qemu)
- [CVE-2017-14010](https://cve.now/CVE-2017-14010.md): In SpiderControl MicroBrowser Windows XP, Vista 7, 8 and 10, Versions 1.6.30.144 and prior, an uncontrolled search path element vulnerabilit (no CVSS, SpiderControl MicroBrowser)
- [CVE-2018-7465](https://cve.now/CVE-2018-7465.md): An XSS issue was discovered in VirtueMart before 3.2.14. (no CVSS)
- [CVE-2016-9590](https://cve.now/CVE-2016-9590.md): puppet-swift before versions 8.2.1, 9.4.4 is vulnerable to an information-disclosure in Red Hat OpenStack Platform director's installation o (CVSS 6.5, puppet-swift)
- [CVE-2017-15691](https://cve.now/CVE-2017-15691.md): In Apache uimaj prior to 2.10.2, Apache uimaj 3.0.0-xxx prior to 3.0.0-beta, Apache uima-as prior to 2.10.2, Apache uimaFIT prior to 2.4.0, (no CVSS, Apache Software Foundation Apache UIMA · org.apache.uima… +2)
- [CVE-2018-10429](https://cve.now/CVE-2018-10429.md): Cosmo 1.0.0Beta6 allows attackers to execute arbitrary PHP code via the Database Prefix field on the Database Info screen of install.php. (no CVSS)
- [CVE-2018-10430](https://cve.now/CVE-2018-10430.md): An issue was discovered in DiliCMS (aka DiligentCMS) 2.4.0. (no CVSS)
- [CVE-2018-10431](https://cve.now/CVE-2018-10431.md): D-Link DIR-615 2.5.17 devices allow Remote Code Execution via shell metacharacters in the Host field of the System / Traceroute screen. (no CVSS)
- [CVE-2018-1074](https://cve.now/CVE-2018-1074.md): ovirt-engine API and administration web portal before versions 4.2.2.5, 4.1.11.2 is vulnerable to an exposure of Power Management credential (CVSS 7.7, ovirt-engine)
- [CVE-2017-9275](https://cve.now/CVE-2017-9275.md): NetIQ Identity Reporting XSS exposure (CVSS 2.8, NetIQ Identity Reporting)
- [CVE-2017-9284](https://cve.now/CVE-2017-9284.md): IDM 4.6 Identity Applications information leakage (CVSS 4.8, NetIQ IDM - Identity Applications)
- [CVE-2018-8072](https://cve.now/CVE-2018-8072.md): An issue was discovered on EDIMAX IC-3140W through 3.06, IC-5150W through 3.09, and IC-6220DC through 3.06 devices. (no CVSS)
- [CVE-2017-14740](https://cve.now/CVE-2017-14740.md): Cross-site scripting (XSS) vulnerability in GeniXCMS 1.1.0 allows remote authenticated users to inject arbitrary web script or HTML via the (no CVSS, genix/cms)
- [CVE-2017-1721](https://cve.now/CVE-2017-1721.md): IBM Security QRadar SIEM 7.2 and 7.3 could allow an unauthenticated user to execute code remotely with lower level privileges under unusual (no CVSS, IBM Security QRadar SIEM)
- [CVE-2017-1722](https://cve.now/CVE-2017-1722.md): IBM Security QRadar SIEM 7.2 and 7.3 is vulnerable to SQL injection. (no CVSS, IBM Security QRadar SIEM)
- [CVE-2017-1723](https://cve.now/CVE-2017-1723.md): IBM Security QRadar SIEM 7.2 and 7.3 could allow a remote attacker to traverse directories on the system. (no CVSS, IBM Security QRadar SIEM)
- [CVE-2017-1724](https://cve.now/CVE-2017-1724.md): IBM Security QRadar SIEM 7.2 and 7.3 is vulnerable to cross-site scripting. (no CVSS, IBM Security QRadar SIEM)
- [CVE-2018-1418](https://cve.now/CVE-2018-1418.md): IBM Security QRadar SIEM 7.2 and 7.3 could allow a user to bypass authentication which could lead to code execution. (no CVSS, IBM Security QRadar SIEM)
- [CVE-2018-6518](https://cve.now/CVE-2018-6518.md): Composr CMS 10.0.13 has XSS via the site\_name parameter in a page=admin-setupwizard&type=step3 request to /adminzone/index.php. (no CVSS)
- [CVE-2018-10425](https://cve.now/CVE-2018-10425.md): An issue was discovered in Shanghai 2345 Security Guard 3.7.0. (no CVSS)
- [CVE-2018-8974](https://cve.now/CVE-2018-8974.md): Centers for Disease Control and Prevention MicrobeTRACE 0.1.11 allows remote attackers to execute arbitrary code, related to code injection (no CVSS)
- [CVE-2018-9113](https://cve.now/CVE-2018-9113.md): Centers for Disease Control and Prevention MicrobeTRACE 0.1.12 allows remote attackers to execute arbitrary code, related to code injection (no CVSS)
- [CVE-2018-10391](https://cve.now/CVE-2018-10391.md): An issue was discovered in WUZHI CMS 4.1.0. (no CVSS)
- [CVE-2018-10392](https://cve.now/CVE-2018-10392.md): mapping0\_forward in mapping0.c in Xiph.Org libvorbis 1.3.6 does not validate the number of channels, which allows remote attackers to cause (no CVSS)
- [CVE-2018-10393](https://cve.now/CVE-2018-10393.md): bark\_noise\_hybridmp in psy.c in Xiph.Org libvorbis 1.3.6 has a stack-based buffer over-read. (no CVSS)
- [CVE-2018-10422](https://cve.now/CVE-2018-10422.md): An issue was discovered in HongCMS 3.0.0. (no CVSS)
- [CVE-2018-10423](https://cve.now/CVE-2018-10423.md): mc-admin/post.php in MiniCMS 1.10 allows remote attackers to obtain a directory listing of the top-level directory of the web root via a lin (no CVSS)
- [CVE-2018-10424](https://cve.now/CVE-2018-10424.md): mc-admin/post-edit.php in MiniCMS 1.10 allows full path disclosure via a modified id field. (no CVSS)
- [CVE-2018-10381](https://cve.now/CVE-2018-10381.md): TunnelBear 3.2.0.6 for Windows suffers from a SYSTEM privilege escalation vulnerability through the "TunnelBearMaintenance" service. (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2018-04-26
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.