CVEs published May 2, 2018
63 CVEs were published on May 2, 2018: 0 critical, 0 high.
- Published
- 63
- Critical
- 0
- High
- 0
- Medium
- 0
- Low
- 0
- Unrated
- 63
- Now in CISA KEV
- 0
- Fix available
- 1
Most affected products
- F5 Networks BIG-IP
- 7
- Cisco Firepower System Software
- 3
- Cisco Wireless LAN Controller
- 2
- Red Hat Ansible Tower
- 2
- Cisco 5500 and 8500 Series Wireless LAN Controller
- 1
- Cisco Aironet 1800 Series Access Point
- 1
- Cisco Aironet 1800, 2800, and 3800 Series Access Points
- 1
- Cisco Aironet 1810, 1830, and 1850 Series Access Points
- 1
- Cisco Aironet Access Points
- 1
- Cisco IOS XR
- 1
Medium, low and unrated 63
- CVE-2016-10721partclone.restore in Partclone 0.2.87 is prone to a heap-based buffer overflow vulnerability due to insufficient validation of the partclone
- CVE-2016-10722partclone.fat in Partclone before 0.2.88 is prone to a heap-based buffer overflow vulnerability due to insufficient validation of the FAT su
- CVE-2018-0226A vulnerability in the assignment and management of default user accounts for Secure Shell (SSH) access to Cisco Aironet 1800, 2800, and 380Cisco Aironet 1800, 2800, and 3800 Series Access Points
- CVE-2018-0234A vulnerability in the implementation of Point-to-Point Tunneling Protocol (PPTP) functionality in Cisco Aironet 1810, 1830, and 1850 SeriesCisco Aironet 1810, 1830, and 1850 Series Access Points
- CVE-2018-0235A vulnerability in the 802.11 frame validation functionality of the Cisco Wireless LAN Controller (WLC) could allow an unauthenticated, adjaCisco Wireless LAN Controller
- CVE-2018-0245A vulnerability in the REST API of Cisco 5500 and 8500 Series Wireless LAN Controller (WLC) Software could allow an unauthenticated, remote Cisco 5500 and 8500 Series Wireless LAN Controller
- CVE-2018-0247A vulnerability in Web Authentication (WebAuth) clients for the Cisco Wireless LAN Controller (WLC) and Aironet Access Points running Cisco Cisco Wireless LAN Controller and Aironet Access Points
- CVE-2018-0249A vulnerability when handling incoming 802.11 Association Requests for Cisco Aironet 1800 Series Access Point (APs) on Qualcomm Atheros (QCACisco Aironet 1800 Series Access Point
- CVE-2018-0250A vulnerability in Central Web Authentication (CWA) with FlexConnect Access Points (APs) for Cisco Aironet 1560, 1810, 1810w, 1815, 1830, 18Cisco Aironet Access Points
- CVE-2018-0252A vulnerability in the IP Version 4 (IPv4) fragment reassembly function of Cisco 3500, 5500, and 8500 Series Wireless LAN Controller SoftwarCisco Wireless LAN Controller
- CVE-2018-0253A vulnerability in the ACS Report component of Cisco Secure Access Control System (ACS) could allow an unauthenticated, remote attacker to eCisco Secure Access Control System
- CVE-2018-0258A vulnerability in the Cisco Prime File Upload servlet affecting multiple Cisco products could allow a remote attacker to upload arbitrary fCisco Prime File Upload Servlet
- CVE-2018-0262A vulnerability in Cisco Meeting Server could allow an unauthenticated, remote attacker to gain unauthorized access to components of, or senCisco Meeting Server
- CVE-2018-0264A vulnerability in the Cisco WebEx Network Recording Player for Advanced Recording Format (ARF) files could allow an unauthenticated, remoteCisco WebEx Advanced Recording Format file players
- CVE-2018-0278A vulnerability in the management console of Cisco Firepower System Software could allow an unauthenticated, remote attacker to access sensiCisco Firepower System Software
- CVE-2018-0281A vulnerability in the detection engine of Cisco Firepower System Software could allow an unauthenticated, remote attacker to restart an insCisco Firepower System Software
- CVE-2018-0283A vulnerability in the detection engine of Cisco Firepower System Software could allow an unauthenticated, remote attacker to restart an insCisco Firepower System Software
- CVE-2018-0285A vulnerability in service logging for Cisco Prime Service Catalog could allow an authenticated, remote attacker to deny service to the userCisco Prime Service Catalog
- CVE-2018-0286A vulnerability in the netconf interface of Cisco IOS XR Software could allow an unauthenticated, remote attacker to cause a denial of serviCisco IOS XR
- CVE-2018-0287A vulnerability in the Cisco WebEx Network Recording Player for Advanced Recording Format (ARF) files could allow an unauthenticated, remoteCisco WebEx Advanced Recording Format Player
- CVE-2018-0288A vulnerability in Cisco WebEx Recording Format (WRF) Player could allow an unauthenticated, remote attacker to access sensitive data about Cisco WebEx Recording Format Player
- CVE-2018-10685In Long Range Zip (aka lrzip) 0.631, there is a use-after-free in the lzma_decompress_buf function of stream.c, which allows remote attacker
- CVE-2018-10115Incorrect initialization logic of RAR decoder objects in 7-Zip 18.03 and before can lead to usage of uninitialized memory, allowing remote a
- CVE-2018-10294Flexense DiskBoss Enterprise v7.4.28 to v9.1.16 has XSS.
- CVE-2018-10563An XSS in Flexense SyncBreeze affects all versions (tested from SyncBreeze Enterprise from v10.1 to v10.7).
- CVE-2018-10564XSS exists in Flexense DiskPulse Enterprise from v10.4 to v10.7.
- CVE-2018-10565XSS exists in Flexense DiskSavvy Enterprise from v10.4 to v10.7.
- CVE-2018-10566XSS exists in Flexense DupScout Enterprise from v10.0.18 to v10.7.
- CVE-2018-10567XSS exists in Flexense VX Search Enterprise from v10.1.12 to v10.7.
- CVE-2018-10568XSS exists in Flexense DiskSorter Enterprise from v9.5.12 to v10.7.
- CVE-2018-10577An issue was discovered on WatchGuard AP100, AP102, and AP200 devices with firmware before 1.2.9.15, and AP300 devices with firmware before
- CVE-2018-10578An issue was discovered on WatchGuard AP100, AP102, and AP200 devices with firmware before 1.2.9.15, and AP300 devices with firmware before
- CVE-2018-8900The License Manager service of HASP SRM, Sentinel HASP and Sentinel LDK products prior to Sentinel LDK RTE 7.80 allows remote attackers to i
- CVE-2018-9919A web-accessible backdoor, with resultant SSRF, exists in Tp-shop 2.0.5 through 2.0.8, which allows remote attackers to obtain sensitive inf
- CVE-2018-10677The DecodeGifImg function in ngiflib.c in MiniUPnP ngiflib 0.4 lacks certain checks against width and height, which allows remote attackers
- CVE-2018-10680Z-BlogPHP 1.5.2 has a stored Cross Site Scripting Vulnerability exploitable by an administrator who navigates to "Web site settings --> Basi
- CVE-2018-1104Ansible Tower through version 3.2.3 has a vulnerability that allows users only with access to define variables for a job template to executeRed Hat Ansible Tower
- CVE-2018-8115A remote code execution vulnerability exists when the Windows Host Compute Service Shim (hcsshim) library fails to properly validate input wMicrosoft Windows Host Compute
- CVE-2018-10675The do_get_mempolicy function in mm/mempolicy.c in the Linux kernel before 4.12.9 allows local users to cause a denial of service (use-after
- CVE-2018-10676CeNova, Night OWL, Novo, Pulnix, QSee, Securus, and TBK Vision DVR devices allow remote attackers to download a file and obtain sensitive cr
- CVE-2018-1101Ansible Tower before version 3.2.4 has a flaw in the management of system and organization administrators that allows for privilege escalatiRed Hat Ansible Tower
- CVE-2018-10665ILIAS 5.3.4 has XSS through unsanitized output of PHP_SELF, related to shib_logout.php and third-party demo files.
- CVE-2018-10657Matrix Synapse before 0.28.1 is prone to a denial of service flaw where malicious events injected with depth = 2^63 - 1 render rooms unusablmatrix-synapse
- CVE-2013-6272The NotificationBroadcastReceiver class in the com.android.phone process in Google Android 4.1.1 through 4.4.2 allows attackers to bypass in
- CVE-2018-9302SSRF (Server Side Request Forgery) in /assets/lib/fuc.js.php in Cockpit 0.4.4 through 0.5.5 allows remote attackers to read arbitrary files
- CVE-2017-4952VMware Xenon 1.x, prior to 1.5.4-CR7_1, 1.5.7_7, 1.5.4-CR6_2, 1.3.7-CR1_2, 1.1.0-CR0-3, 1.1.0-CR3_1,1.4.2-CR4_1, and 1.5.4_8, contains an auVMware Xenon
- CVE-2017-1255IBM Security Guardium 10.0, 10.0.1, and 10.1 through 10.1.4 uses weaker than expected cryptographic algorithms that could allow an attacker IBM Security Guardium
- CVE-2017-1601IBM Security Guardium 10.0, 10.0.1, and 10.1 through 10.1.4 Database Activity Monitor does not require that users should have strong passwor
- CVE-2018-1468IBM API Connect 5.0.8.1 and 5.0.8.2 could allow a user to get access to internal environment and sensitive API details to which they are notIBM API Connect
- CVE-2018-5512On F5 BIG-IP 13.1.0-13.1.0.5, when Large Receive Offload (LRO) and SYN cookies are enabled (default settings), undisclosed traffic patterns F5 Networks BIG-IP
- CVE-2018-5514On F5 BIG-IP 13.1.0-13.1.0.5, maliciously crafted HTTP/2 request frames can lead to denial of service.F5 Networks BIG-IP
- CVE-2018-5515On F5 BIG-IP 13.0.0-13.1.0.5, using RADIUS authentication responses from a RADIUS server with IPv6 addresses may cause TMM to crash, leadingF5 Networks BIG-IP
- CVE-2018-5516On F5 BIG-IP 13.0.0-13.1.0.5, 12.1.0-12.1.2, or 11.2.1-11.6.3.1, Enterprise Manager 3.1.1, BIG-IQ Centralized Management 5.0.0-5.4.0 or 4.6.F5 Networks BIG-IP · F5 Networks Enterprise Manager +3
- CVE-2018-5517On F5 BIG-IP 13.1.0-13.1.0.5, malformed TCP packets sent to a self IP address or a FastL4 virtual server may cause an interruption of servicF5 Networks BIG-IP
- CVE-2018-5518On F5 BIG-IP 13.0.0-13.1.0.5 or 12.0.0-12.1.3.3, malicious root users with access to a VCMP guest can cause a disruption of service on adjacF5 Networks BIG-IP
- CVE-2018-5519On F5 BIG-IP 13.0.0-13.1.0.5, 12.1.0-12.1.3.3, or 11.2.1-11.6.3.1, administrative users by way of undisclosed methods can exploit the ssldumF5 Networks BIG-IP
- CVE-2018-5520On an F5 BIG-IP 13.0.0-13.1.0.5, 12.1.0-12.1.3.1, or 11.2.1-11.6.3.1 system configured in Appliance mode, the TMOS Shell (tmsh) may allow anF5 Networks BIG-IP
- CVE-2018-10544Meross MSS110 devices through 1.1.24 contain an unauthenticated admin.htm administrative interface.
- CVE-2018-10642Command injection vulnerability in Combodo iTop 2.4.1 allows remote authenticated administrators to execute arbitrary commands by changing t
- CVE-2018-10645Golden Frog VyprVPN 2.12.1.8015 for Windows suffers from a SYSTEM privilege escalation vulnerability through the "VyprVPN" service.
- CVE-2018-10646CyberGhost 6.5.0.3180 for Windows suffers from a SYSTEM privilege escalation vulnerability through the "CG6Service" service.
- CVE-2018-10647SaferVPN 4.2.5 for Windows suffers from a SYSTEM privilege escalation vulnerability in its "SaferVPN.Service" service.
- CVE-2018-6401Meross MSS110 devices before 1.1.24 contain a TELNET listener providing access for an undocumented admin account with a blank password.