# CVEs published 2018-05-01

31 CVEs were published on May 1, 2018: 0 critical, 0 high. Days are UTC.

- [CVE-2018-6242](https://cve.now/CVE-2018-6242.md): Some NVIDIA Tegra mobile processors released prior to 2016 contain a buffer overflow vulnerability in BootROM Recovery Mode (RCM). (no CVSS, Some NVIDIA Tegra Mobile Processors)
- [CVE-2013-0159](https://cve.now/CVE-2013-0159.md): The fedora-business-cards package before 1-0.1.beta1.fc17 on Fedora 17 and before 1-0.1.beta1.fc18 on Fedora 18 allows local users to cause (no CVSS)
- [CVE-2013-0185](https://cve.now/CVE-2013-0185.md): Cross-site request forgery (CSRF) vulnerability in ManageIQ Enterprise Virtualization Manager (EVM) allows remote attackers to hijack the au (no CVSS)
- [CVE-2013-2049](https://cve.now/CVE-2013-2049.md): Red Hat CloudForms 2 Management Engine (CFME) allows remote attackers to conduct session tampering attacks by leveraging use of a static sec (no CVSS)
- [CVE-2013-4201](https://cve.now/CVE-2013-4201.md): Katello allows remote authenticated users to call the "system remove\_deletion" CLI command via vectors related to "remove system" permission (no CVSS)
- [CVE-2013-4209](https://cve.now/CVE-2013-4209.md): Automatic Bug Reporting Tool (ABRT) before 2.1.6 allows local users to obtain sensitive information about arbitrary files via vectors relate (no CVSS)
- [CVE-2016-10036](https://cve.now/CVE-2016-10036.md): Unrestricted file upload vulnerability in ui/artifact/upload in JFrog Artifactory before 4.16 allows remote attackers to (1) deploy an arbit (no CVSS)
- [CVE-2018-10255](https://cve.now/CVE-2018-10255.md): A CSV Injection vulnerability was discovered in clustercoding Blog Master Pro v1.0 that allows a user with low level privileges to inject a (no CVSS)
- [CVE-2018-10256](https://cve.now/CVE-2018-10256.md): A SQL Injection vulnerability was discovered in HRSALE The Ultimate HRM v1.0.2 that allows a user with low level privileges to directly modi (no CVSS)
- [CVE-2018-10257](https://cve.now/CVE-2018-10257.md): A CSV Injection vulnerability was discovered in HRSALE The Ultimate HRM v1.0.2 that allows a user with low level privileges to inject a comm (no CVSS)
- [CVE-2018-10258](https://cve.now/CVE-2018-10258.md): A CSV Injection vulnerability was discovered in Shopy Point of Sale v1.0 that allows a user with low level privileges to inject a command th (no CVSS)
- [CVE-2018-10259](https://cve.now/CVE-2018-10259.md): An Authenticated Stored XSS vulnerability was found in HRSALE The Ultimate HRM v1.0.2, exploitable by a low privileged user. (no CVSS)
- [CVE-2018-10260](https://cve.now/CVE-2018-10260.md): A Local File Inclusion vulnerability was found in HRSALE The Ultimate HRM v1.0.2, exploitable by a low privileged user. (no CVSS)
- [CVE-2013-4035](https://cve.now/CVE-2013-4035.md): IBM Sterling Connect:Direct for OpenVMS 3.4.00, 3.4.01, 3.5.00, 3.6.0, and 3.6.0.1 allow remote attackers to have unspecified impact by leve (no CVSS)
- [CVE-2013-4040](https://cve.now/CVE-2013-4040.md): IBM Tivoli Application Dependency Discovery Manager (TADDM) 7.1.2.x before 7.2.1.5 and 7.2.x before 7.2.2.0 on Unix use weak permissions (75 (no CVSS)
- [CVE-2017-14012](https://cve.now/CVE-2017-14012.md): Boston Scientific ZOOM LATITUDE PRM Model 3120 does not encrypt PHI at rest. (no CVSS, Boston Scientific ZOOM LATITUDE PRM)
- [CVE-2017-14014](https://cve.now/CVE-2017-14014.md): Boston Scientific ZOOM LATITUDE PRM Model 3120 uses a hard-coded cryptographic key to encrypt PHI prior to having it transferred to removabl (no CVSS, Boston Scientific ZOOM LATITUDE PRM)
- [CVE-2017-5535](https://cve.now/CVE-2017-5535.md): TIBCO DataSynapse GridServer improper use of encryption (CVSS 6.8, TIBCO Software TIBCO DataSynapse GridServer Manager)
- [CVE-2017-5536](https://cve.now/CVE-2017-5536.md): TIBCO DataSynapse GridServer manager component vulnerable to cross-site scripting attacks (CVSS 6.3, TIBCO Software TIBCO DataSynapse GridServer Manager)
- [CVE-2018-6589](https://cve.now/CVE-2018-6589.md): CA Spectrum 10.1 prior to 10.01.02.PTF\_10.1.239 and 10.2.x prior to 10.2.3 allows remote attackers to cause a denial of service via unspecif (no CVSS, CA Technologies CA Spectrum)
- [CVE-2018-9232](https://cve.now/CVE-2018-9232.md): Due to the lack of firmware authentication in the upgrade process of T&W WIFI Repeater BE126 devices, an attacker can craft a malicious firm (no CVSS)
- [CVE-2018-9336](https://cve.now/CVE-2018-9336.md): openvpnserv.exe (aka the interactive service helper) in OpenVPN 2.4.x before 2.4.6 allows a local attacker to cause a double-free of memory (no CVSS)
- [CVE-2017-18264](https://cve.now/CVE-2017-18264.md): An issue was discovered in libraries/common.inc.php in phpMyAdmin 4.0 before 4.0.10.20, 4.4.x, 4.6.x, and 4.7.0 prereleases. (no CVSS, phpmyadmin/phpmyadmin)
- [CVE-2017-17020](https://cve.now/CVE-2017-17020.md): On D-Link DCS-5009 devices with firmware 1.08.11 and earlier, DCS-5010 devices with firmware 1.14.09 and earlier, and DCS-5020L devices with (no CVSS)
- [CVE-2018-10365](https://cve.now/CVE-2018-10365.md): An XSS issue was discovered in the Threads to Link plugin 1.3 for MyBB. (no CVSS)
- [CVE-2018-10583](https://cve.now/CVE-2018-10583.md): An information disclosure vulnerability occurs when LibreOffice 6.0.3 and Apache OpenOffice Writer 4.1.5 automatically process and initiate (no CVSS)
- [CVE-2018-8938](https://cve.now/CVE-2018-8938.md): A Code Injection issue was discovered in DlgSelectMibFile.asp in Ipswitch WhatsUp Gold before 2018 (18.0). (no CVSS)
- [CVE-2018-8939](https://cve.now/CVE-2018-8939.md): An SSRF issue was discovered in NmAPI.exe in Ipswitch WhatsUp Gold before 2018 (18.0). (no CVSS)
- [CVE-2018-1502](https://cve.now/CVE-2018-1502.md): IBM Content Manager Enterprise Edition Resource Manager 8.4.3 and 9.5 is vulnerable to cross-site scripting. (no CVSS, IBM Content Manager)
- [CVE-2018-10371](https://cve.now/CVE-2018-10371.md): An issue was discovered in the wunderfarm WF Cookie Consent plugin 1.1.3 for WordPress. (no CVSS)
- [CVE-2018-10581](https://cve.now/CVE-2018-10581.md): In Octopus Deploy 3.4.x before 2018.4.7, an authenticated user is able to view/update/save variable values within the Tenant Variables area (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2018-05-01
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.