CVEs published April 27, 2018
29 CVEs were published on April 27, 2018: 0 critical, 0 high.
- Published
- 29
- Critical
- 0
- High
- 0
- Medium
- 0
- Low
- 0
- Unrated
- 29
- Now in CISA KEV
- 0
- Fix available
- 0
Most affected products
- IBM BigFix Platform
- 3
- IBM Campaign
- 1
Medium, low and unrated 29
- CVE-2018-10515In CMS Made Simple (CMSMS) through 2.2.7, the "file unpack" operation in the admin dashboard contains a remote code execution vulnerability
- CVE-2018-10516In CMS Made Simple (CMSMS) through 2.2.7, the "file rename" operation in the admin dashboard contains a sensitive information disclosure vul
- CVE-2018-10517In CMS Made Simple (CMSMS) through 2.2.7, the "module import" operation in the admin dashboard contains a remote code execution vulnerabilit
- CVE-2018-10518In CMS Made Simple (CMSMS) through 2.2.7, the "file delete" operation in the admin dashboard contains an arbitrary file deletion vulnerabili
- CVE-2018-10519CMS Made Simple (CMSMS) 2.2.7 contains a privilege escalation vulnerability from ordinary user to admin user by arranging for the eff_uid va
- CVE-2018-10520In CMS Made Simple (CMSMS) through 2.2.7, the "module remove" operation in the admin dashboard contains an arbitrary file deletion vulnerabi
- CVE-2018-10521In CMS Made Simple (CMSMS) through 2.2.7, the "file move" operation in the admin dashboard contains an arbitrary file movement vulnerability
- CVE-2018-10522In CMS Made Simple (CMSMS) through 2.2.7, the "file view" operation in the admin dashboard contains a sensitive information disclosure vulne
- CVE-2018-10523CMS Made Simple (CMSMS) through 2.2.7 contains a physical path leakage Vulnerability via /modules/DesignManager/action.ajax_get_templates.ph
- CVE-2013-5391IBM Worklight Consumer and Enterprise Editions 5.0.x before 5.0.6 Fix Pack 2 and 6.0.x before 6.0.0 Fix Pack 2, and Mobile Foundation Consum
- CVE-2013-5461IBM Endpoint Manager for Remote Control 9.0.0 and 9.0.1 and Tivoli Remote Control 5.1.2 store multiple hashes of partial passwords, which ma
- CVE-2013-6739IBM SPSS Modeler before 16 on UNIX allows remote authenticated users to bypass intended access restrictions via an SSO token.
- CVE-2013-7201WebHybridClient.java in PayPal 5.3 and earlier for Android ignores SSL errors, which allows man-in-the-middle attackers to spoof servers and
- CVE-2013-7202The WebHybridClient class in PayPal 5.3 and earlier for Android allows remote attackers to execute arbitrary JavaScript on the system.
- CVE-2014-0841IBM Rational Focal Point 6.4.0, 6.4.1, 6.5.1, 6.5.2, and 6.6.0 use a weak algorithm to hash passwords, which makes it easier for context-dep
- CVE-2014-1845An unspecified setuid root helper in Enlightenment before 0.17.6 allows local users to gain privileges by leveraging failure to properly san
- CVE-2014-1846Enlightenment before 0.17.6 might allow local users to gain privileges via vectors involving the gdb method.
- CVE-2014-2552Brookins Consulting (BC) Collected Information Export extension for eZ Publish 1.1.0 does not properly restrict access, which allows remote
- CVE-2015-1857The odl-mdsal-apidocs feature in OpenDaylight Helium allow remote attackers to obtain sensitive information by leveraging missing AAA restri
- CVE-2018-10503An issue was discovered in index.php in baijiacms V4 v4_1_4_20170105.
- CVE-2018-10504The WebDorado "Form Maker by WD" plugin before 1.12.24 for WordPress allows CSV injection.
- CVE-2018-7669An issue was discovered in Sitecore Sitecore.NET 8.1 rev.
- CVE-2017-1116IBM Campaign 8.6, 9.0, 9.1, 9.1.1, 9.1.2, and 10.0 contains excessive details on the client side which could provide information useful for IBM Campaign
- CVE-2018-10471An issue was discovered in Xen through 4.10.x allowing x86 PV guest OS users to cause a denial of service (out-of-bounds zero write and hype
- CVE-2018-10472An issue was discovered in Xen through 4.10.x allowing x86 HVM guest OS users (in certain configurations) to read arbitrary dom0 files via Q
- CVE-2018-1473IBM BigFix Platform 9.2 and 9.5 is vulnerable to cross-site scripting.IBM BigFix Platform
- CVE-2018-1475IBM BigFix Platform 9.2 and 9.5 uses an inadequate account lockout setting that could allow a remote attacker to brute force account credentIBM BigFix Platform
- CVE-2018-1479IBM BigFix Platform 9.2 and 9.5 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthoriIBM BigFix Platform
- CVE-2018-10469b3log Symphony (aka Sym) 2.6.0 allows remote attackers to upload and execute arbitrary JSP files via the name[] parameter to the /upload URI