CVEs published May 1, 2018
31 CVEs were published on May 1, 2018: 0 critical, 0 high.
- Published
- 31
- Critical
- 0
- High
- 0
- Medium
- 2
- Low
- 0
- Unrated
- 29
- Now in CISA KEV
- 0
- Fix available
- 2
Most affected products
- Boston Scientific ZOOM LATITUDE PRM
- 2
- TIBCO Software TIBCO DataSynapse GridServer Manager
- 2
- CA Technologies CA Spectrum
- 1
- IBM Content Manager
- 1
- phpmyadmin/phpmyadmin
- 1
- Some NVIDIA Tegra Mobile Processors
- 1
Medium, low and unrated 31
- CVE-2018-6242Some NVIDIA Tegra mobile processors released prior to 2016 contain a buffer overflow vulnerability in BootROM Recovery Mode (RCM).Some NVIDIA Tegra Mobile Processors
- CVE-2013-0159The fedora-business-cards package before 1-0.1.beta1.fc17 on Fedora 17 and before 1-0.1.beta1.fc18 on Fedora 18 allows local users to cause
- CVE-2013-0185Cross-site request forgery (CSRF) vulnerability in ManageIQ Enterprise Virtualization Manager (EVM) allows remote attackers to hijack the au
- CVE-2013-2049Red Hat CloudForms 2 Management Engine (CFME) allows remote attackers to conduct session tampering attacks by leveraging use of a static sec
- CVE-2013-4201Katello allows remote authenticated users to call the "system remove_deletion" CLI command via vectors related to "remove system" permission
- CVE-2013-4209Automatic Bug Reporting Tool (ABRT) before 2.1.6 allows local users to obtain sensitive information about arbitrary files via vectors relate
- CVE-2016-10036Unrestricted file upload vulnerability in ui/artifact/upload in JFrog Artifactory before 4.16 allows remote attackers to (1) deploy an arbit
- CVE-2018-10255A CSV Injection vulnerability was discovered in clustercoding Blog Master Pro v1.0 that allows a user with low level privileges to inject a
- CVE-2018-10256A SQL Injection vulnerability was discovered in HRSALE The Ultimate HRM v1.0.2 that allows a user with low level privileges to directly modi
- CVE-2018-10257A CSV Injection vulnerability was discovered in HRSALE The Ultimate HRM v1.0.2 that allows a user with low level privileges to inject a comm
- CVE-2018-10258A CSV Injection vulnerability was discovered in Shopy Point of Sale v1.0 that allows a user with low level privileges to inject a command th
- CVE-2018-10259An Authenticated Stored XSS vulnerability was found in HRSALE The Ultimate HRM v1.0.2, exploitable by a low privileged user.
- CVE-2018-10260A Local File Inclusion vulnerability was found in HRSALE The Ultimate HRM v1.0.2, exploitable by a low privileged user.
- CVE-2013-4035IBM Sterling Connect:Direct for OpenVMS 3.4.00, 3.4.01, 3.5.00, 3.6.0, and 3.6.0.1 allow remote attackers to have unspecified impact by leve
- CVE-2013-4040IBM Tivoli Application Dependency Discovery Manager (TADDM) 7.1.2.x before 7.2.1.5 and 7.2.x before 7.2.2.0 on Unix use weak permissions (75
- CVE-2017-14012Boston Scientific ZOOM LATITUDE PRM Model 3120 does not encrypt PHI at rest.Boston Scientific ZOOM LATITUDE PRM
- CVE-2017-14014Boston Scientific ZOOM LATITUDE PRM Model 3120 uses a hard-coded cryptographic key to encrypt PHI prior to having it transferred to removablBoston Scientific ZOOM LATITUDE PRM
- CVE-2017-5535TIBCO DataSynapse GridServer improper use of encryptionTIBCO Software TIBCO DataSynapse GridServer Manager
- CVE-2017-5536TIBCO DataSynapse GridServer manager component vulnerable to cross-site scripting attacksTIBCO Software TIBCO DataSynapse GridServer Manager
- CVE-2018-6589CA Spectrum 10.1 prior to 10.01.02.PTF_10.1.239 and 10.2.x prior to 10.2.3 allows remote attackers to cause a denial of service via unspecifCA Technologies CA Spectrum
- CVE-2018-9232Due to the lack of firmware authentication in the upgrade process of T&W WIFI Repeater BE126 devices, an attacker can craft a malicious firm
- CVE-2018-9336openvpnserv.exe (aka the interactive service helper) in OpenVPN 2.4.x before 2.4.6 allows a local attacker to cause a double-free of memory
- CVE-2017-18264An issue was discovered in libraries/common.inc.php in phpMyAdmin 4.0 before 4.0.10.20, 4.4.x, 4.6.x, and 4.7.0 prereleases.phpmyadmin/phpmyadmin
- CVE-2017-17020On D-Link DCS-5009 devices with firmware 1.08.11 and earlier, DCS-5010 devices with firmware 1.14.09 and earlier, and DCS-5020L devices with
- CVE-2018-10365An XSS issue was discovered in the Threads to Link plugin 1.3 for MyBB.
- CVE-2018-10583An information disclosure vulnerability occurs when LibreOffice 6.0.3 and Apache OpenOffice Writer 4.1.5 automatically process and initiate
- CVE-2018-8938A Code Injection issue was discovered in DlgSelectMibFile.asp in Ipswitch WhatsUp Gold before 2018 (18.0).
- CVE-2018-8939An SSRF issue was discovered in NmAPI.exe in Ipswitch WhatsUp Gold before 2018 (18.0).
- CVE-2018-1502IBM Content Manager Enterprise Edition Resource Manager 8.4.3 and 9.5 is vulnerable to cross-site scripting.IBM Content Manager
- CVE-2018-10371An issue was discovered in the wunderfarm WF Cookie Consent plugin 1.1.3 for WordPress.
- CVE-2018-10581In Octopus Deploy 3.4.x before 2018.4.7, an authenticated user is able to view/update/save variable values within the Tenant Variables area