# CVEs published 2018-04-27 29 CVEs were published on April 27, 2018: 0 critical, 0 high. Days are UTC. - [CVE-2018-10515](https://cve.now/CVE-2018-10515.md): In CMS Made Simple (CMSMS) through 2.2.7, the "file unpack" operation in the admin dashboard contains a remote code execution vulnerability (no CVSS) - [CVE-2018-10516](https://cve.now/CVE-2018-10516.md): In CMS Made Simple (CMSMS) through 2.2.7, the "file rename" operation in the admin dashboard contains a sensitive information disclosure vul (no CVSS) - [CVE-2018-10517](https://cve.now/CVE-2018-10517.md): In CMS Made Simple (CMSMS) through 2.2.7, the "module import" operation in the admin dashboard contains a remote code execution vulnerabilit (no CVSS) - [CVE-2018-10518](https://cve.now/CVE-2018-10518.md): In CMS Made Simple (CMSMS) through 2.2.7, the "file delete" operation in the admin dashboard contains an arbitrary file deletion vulnerabili (no CVSS) - [CVE-2018-10519](https://cve.now/CVE-2018-10519.md): CMS Made Simple (CMSMS) 2.2.7 contains a privilege escalation vulnerability from ordinary user to admin user by arranging for the eff\_uid va (no CVSS) - [CVE-2018-10520](https://cve.now/CVE-2018-10520.md): In CMS Made Simple (CMSMS) through 2.2.7, the "module remove" operation in the admin dashboard contains an arbitrary file deletion vulnerabi (no CVSS) - [CVE-2018-10521](https://cve.now/CVE-2018-10521.md): In CMS Made Simple (CMSMS) through 2.2.7, the "file move" operation in the admin dashboard contains an arbitrary file movement vulnerability (no CVSS) - [CVE-2018-10522](https://cve.now/CVE-2018-10522.md): In CMS Made Simple (CMSMS) through 2.2.7, the "file view" operation in the admin dashboard contains a sensitive information disclosure vulne (no CVSS) - [CVE-2018-10523](https://cve.now/CVE-2018-10523.md): CMS Made Simple (CMSMS) through 2.2.7 contains a physical path leakage Vulnerability via /modules/DesignManager/action.ajax\_get\_templates.ph (no CVSS) - [CVE-2013-5391](https://cve.now/CVE-2013-5391.md): IBM Worklight Consumer and Enterprise Editions 5.0.x before 5.0.6 Fix Pack 2 and 6.0.x before 6.0.0 Fix Pack 2, and Mobile Foundation Consum (no CVSS) - [CVE-2013-5461](https://cve.now/CVE-2013-5461.md): IBM Endpoint Manager for Remote Control 9.0.0 and 9.0.1 and Tivoli Remote Control 5.1.2 store multiple hashes of partial passwords, which ma (no CVSS) - [CVE-2013-6739](https://cve.now/CVE-2013-6739.md): IBM SPSS Modeler before 16 on UNIX allows remote authenticated users to bypass intended access restrictions via an SSO token. (no CVSS) - [CVE-2013-7201](https://cve.now/CVE-2013-7201.md): WebHybridClient.java in PayPal 5.3 and earlier for Android ignores SSL errors, which allows man-in-the-middle attackers to spoof servers and (no CVSS) - [CVE-2013-7202](https://cve.now/CVE-2013-7202.md): The WebHybridClient class in PayPal 5.3 and earlier for Android allows remote attackers to execute arbitrary JavaScript on the system. (no CVSS) - [CVE-2014-0841](https://cve.now/CVE-2014-0841.md): IBM Rational Focal Point 6.4.0, 6.4.1, 6.5.1, 6.5.2, and 6.6.0 use a weak algorithm to hash passwords, which makes it easier for context-dep (no CVSS) - [CVE-2014-1845](https://cve.now/CVE-2014-1845.md): An unspecified setuid root helper in Enlightenment before 0.17.6 allows local users to gain privileges by leveraging failure to properly san (no CVSS) - [CVE-2014-1846](https://cve.now/CVE-2014-1846.md): Enlightenment before 0.17.6 might allow local users to gain privileges via vectors involving the gdb method. (no CVSS) - [CVE-2014-2552](https://cve.now/CVE-2014-2552.md): Brookins Consulting (BC) Collected Information Export extension for eZ Publish 1.1.0 does not properly restrict access, which allows remote (no CVSS) - [CVE-2015-1857](https://cve.now/CVE-2015-1857.md): The odl-mdsal-apidocs feature in OpenDaylight Helium allow remote attackers to obtain sensitive information by leveraging missing AAA restri (no CVSS) - [CVE-2018-10503](https://cve.now/CVE-2018-10503.md): An issue was discovered in index.php in baijiacms V4 v4\_1\_4\_20170105. (no CVSS) - [CVE-2018-10504](https://cve.now/CVE-2018-10504.md): The WebDorado "Form Maker by WD" plugin before 1.12.24 for WordPress allows CSV injection. (no CVSS) - [CVE-2018-7669](https://cve.now/CVE-2018-7669.md): An issue was discovered in Sitecore Sitecore.NET 8.1 rev. (no CVSS) - [CVE-2017-1116](https://cve.now/CVE-2017-1116.md): IBM Campaign 8.6, 9.0, 9.1, 9.1.1, 9.1.2, and 10.0 contains excessive details on the client side which could provide information useful for (no CVSS, IBM Campaign) - [CVE-2018-10471](https://cve.now/CVE-2018-10471.md): An issue was discovered in Xen through 4.10.x allowing x86 PV guest OS users to cause a denial of service (out-of-bounds zero write and hype (no CVSS) - [CVE-2018-10472](https://cve.now/CVE-2018-10472.md): An issue was discovered in Xen through 4.10.x allowing x86 HVM guest OS users (in certain configurations) to read arbitrary dom0 files via Q (no CVSS) - [CVE-2018-1473](https://cve.now/CVE-2018-1473.md): IBM BigFix Platform 9.2 and 9.5 is vulnerable to cross-site scripting. (no CVSS, IBM BigFix Platform) - [CVE-2018-1475](https://cve.now/CVE-2018-1475.md): IBM BigFix Platform 9.2 and 9.5 uses an inadequate account lockout setting that could allow a remote attacker to brute force account credent (no CVSS, IBM BigFix Platform) - [CVE-2018-1479](https://cve.now/CVE-2018-1479.md): IBM BigFix Platform 9.2 and 9.5 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthori (no CVSS, IBM BigFix Platform) - [CVE-2018-10469](https://cve.now/CVE-2018-10469.md): b3log Symphony (aka Sym) 2.6.0 allows remote attackers to upload and execute arbitrary JSP files via the name\[\] parameter to the /upload URI (no CVSS) --- Source: cve.now, built and run by Sazabi (AI-native observability and security) Page: https://cve.now/daily/2018-04-27 Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.