# CVEs published 2018-05-02

63 CVEs were published on May 2, 2018: 0 critical, 0 high. Days are UTC.

- [CVE-2016-10721](https://cve.now/CVE-2016-10721.md): partclone.restore in Partclone 0.2.87 is prone to a heap-based buffer overflow vulnerability due to insufficient validation of the partclone (no CVSS)
- [CVE-2016-10722](https://cve.now/CVE-2016-10722.md): partclone.fat in Partclone before 0.2.88 is prone to a heap-based buffer overflow vulnerability due to insufficient validation of the FAT su (no CVSS)
- [CVE-2018-0226](https://cve.now/CVE-2018-0226.md): A vulnerability in the assignment and management of default user accounts for Secure Shell (SSH) access to Cisco Aironet 1800, 2800, and 380 (no CVSS, Cisco Aironet 1800, 2800, and 3800 Series Access Points)
- [CVE-2018-0234](https://cve.now/CVE-2018-0234.md): A vulnerability in the implementation of Point-to-Point Tunneling Protocol (PPTP) functionality in Cisco Aironet 1810, 1830, and 1850 Series (no CVSS, Cisco Aironet 1810, 1830, and 1850 Series Access Points)
- [CVE-2018-0235](https://cve.now/CVE-2018-0235.md): A vulnerability in the 802.11 frame validation functionality of the Cisco Wireless LAN Controller (WLC) could allow an unauthenticated, adja (no CVSS, Cisco Wireless LAN Controller)
- [CVE-2018-0245](https://cve.now/CVE-2018-0245.md): A vulnerability in the REST API of Cisco 5500 and 8500 Series Wireless LAN Controller (WLC) Software could allow an unauthenticated, remote (no CVSS, Cisco 5500 and 8500 Series Wireless LAN Controller)
- [CVE-2018-0247](https://cve.now/CVE-2018-0247.md): A vulnerability in Web Authentication (WebAuth) clients for the Cisco Wireless LAN Controller (WLC) and Aironet Access Points running Cisco (no CVSS, Cisco Wireless LAN Controller and Aironet Access Points)
- [CVE-2018-0249](https://cve.now/CVE-2018-0249.md): A vulnerability when handling incoming 802.11 Association Requests for Cisco Aironet 1800 Series Access Point (APs) on Qualcomm Atheros (QCA (no CVSS, Cisco Aironet 1800 Series Access Point)
- [CVE-2018-0250](https://cve.now/CVE-2018-0250.md): A vulnerability in Central Web Authentication (CWA) with FlexConnect Access Points (APs) for Cisco Aironet 1560, 1810, 1810w, 1815, 1830, 18 (no CVSS, Cisco Aironet Access Points)
- [CVE-2018-0252](https://cve.now/CVE-2018-0252.md): A vulnerability in the IP Version 4 (IPv4) fragment reassembly function of Cisco 3500, 5500, and 8500 Series Wireless LAN Controller Softwar (no CVSS, Cisco Wireless LAN Controller)
- [CVE-2018-0253](https://cve.now/CVE-2018-0253.md): A vulnerability in the ACS Report component of Cisco Secure Access Control System (ACS) could allow an unauthenticated, remote attacker to e (no CVSS, Cisco Secure Access Control System)
- [CVE-2018-0258](https://cve.now/CVE-2018-0258.md): A vulnerability in the Cisco Prime File Upload servlet affecting multiple Cisco products could allow a remote attacker to upload arbitrary f (no CVSS, Cisco Prime File Upload Servlet)
- [CVE-2018-0262](https://cve.now/CVE-2018-0262.md): A vulnerability in Cisco Meeting Server could allow an unauthenticated, remote attacker to gain unauthorized access to components of, or sen (no CVSS, Cisco Meeting Server)
- [CVE-2018-0264](https://cve.now/CVE-2018-0264.md): A vulnerability in the Cisco WebEx Network Recording Player for Advanced Recording Format (ARF) files could allow an unauthenticated, remote (no CVSS, Cisco WebEx Advanced Recording Format file players)
- [CVE-2018-0278](https://cve.now/CVE-2018-0278.md): A vulnerability in the management console of Cisco Firepower System Software could allow an unauthenticated, remote attacker to access sensi (no CVSS, Cisco Firepower System Software)
- [CVE-2018-0281](https://cve.now/CVE-2018-0281.md): A vulnerability in the detection engine of Cisco Firepower System Software could allow an unauthenticated, remote attacker to restart an ins (no CVSS, Cisco Firepower System Software)
- [CVE-2018-0283](https://cve.now/CVE-2018-0283.md): A vulnerability in the detection engine of Cisco Firepower System Software could allow an unauthenticated, remote attacker to restart an ins (no CVSS, Cisco Firepower System Software)
- [CVE-2018-0285](https://cve.now/CVE-2018-0285.md): A vulnerability in service logging for Cisco Prime Service Catalog could allow an authenticated, remote attacker to deny service to the user (no CVSS, Cisco Prime Service Catalog)
- [CVE-2018-0286](https://cve.now/CVE-2018-0286.md): A vulnerability in the netconf interface of Cisco IOS XR Software could allow an unauthenticated, remote attacker to cause a denial of servi (no CVSS, Cisco IOS XR)
- [CVE-2018-0287](https://cve.now/CVE-2018-0287.md): A vulnerability in the Cisco WebEx Network Recording Player for Advanced Recording Format (ARF) files could allow an unauthenticated, remote (no CVSS, Cisco WebEx Advanced Recording Format Player)
- [CVE-2018-0288](https://cve.now/CVE-2018-0288.md): A vulnerability in Cisco WebEx Recording Format (WRF) Player could allow an unauthenticated, remote attacker to access sensitive data about (no CVSS, Cisco WebEx Recording Format Player)
- [CVE-2018-10685](https://cve.now/CVE-2018-10685.md): In Long Range Zip (aka lrzip) 0.631, there is a use-after-free in the lzma\_decompress\_buf function of stream.c, which allows remote attacker (no CVSS)
- [CVE-2018-10115](https://cve.now/CVE-2018-10115.md): Incorrect initialization logic of RAR decoder objects in 7-Zip 18.03 and before can lead to usage of uninitialized memory, allowing remote a (no CVSS)
- [CVE-2018-10294](https://cve.now/CVE-2018-10294.md): Flexense DiskBoss Enterprise v7.4.28 to v9.1.16 has XSS. (no CVSS)
- [CVE-2018-10563](https://cve.now/CVE-2018-10563.md): An XSS in Flexense SyncBreeze affects all versions (tested from SyncBreeze Enterprise from v10.1 to v10.7). (no CVSS)
- [CVE-2018-10564](https://cve.now/CVE-2018-10564.md): XSS exists in Flexense DiskPulse Enterprise from v10.4 to v10.7. (no CVSS)
- [CVE-2018-10565](https://cve.now/CVE-2018-10565.md): XSS exists in Flexense DiskSavvy Enterprise from v10.4 to v10.7. (no CVSS)
- [CVE-2018-10566](https://cve.now/CVE-2018-10566.md): XSS exists in Flexense DupScout Enterprise from v10.0.18 to v10.7. (no CVSS)
- [CVE-2018-10567](https://cve.now/CVE-2018-10567.md): XSS exists in Flexense VX Search Enterprise from v10.1.12 to v10.7. (no CVSS)
- [CVE-2018-10568](https://cve.now/CVE-2018-10568.md): XSS exists in Flexense DiskSorter Enterprise from v9.5.12 to v10.7. (no CVSS)
- [CVE-2018-10577](https://cve.now/CVE-2018-10577.md): An issue was discovered on WatchGuard AP100, AP102, and AP200 devices with firmware before 1.2.9.15, and AP300 devices with firmware before (no CVSS)
- [CVE-2018-10578](https://cve.now/CVE-2018-10578.md): An issue was discovered on WatchGuard AP100, AP102, and AP200 devices with firmware before 1.2.9.15, and AP300 devices with firmware before (no CVSS)
- [CVE-2018-8900](https://cve.now/CVE-2018-8900.md): The License Manager service of HASP SRM, Sentinel HASP and Sentinel LDK products prior to Sentinel LDK RTE 7.80 allows remote attackers to i (no CVSS)
- [CVE-2018-9919](https://cve.now/CVE-2018-9919.md): A web-accessible backdoor, with resultant SSRF, exists in Tp-shop 2.0.5 through 2.0.8, which allows remote attackers to obtain sensitive inf (no CVSS)
- [CVE-2018-10677](https://cve.now/CVE-2018-10677.md): The DecodeGifImg function in ngiflib.c in MiniUPnP ngiflib 0.4 lacks certain checks against width and height, which allows remote attackers (no CVSS)
- [CVE-2018-10680](https://cve.now/CVE-2018-10680.md): Z-BlogPHP 1.5.2 has a stored Cross Site Scripting Vulnerability exploitable by an administrator who navigates to "Web site settings --\> Basi (no CVSS)
- [CVE-2018-1104](https://cve.now/CVE-2018-1104.md): Ansible Tower through version 3.2.3 has a vulnerability that allows users only with access to define variables for a job template to execute (no CVSS, Red Hat Ansible Tower)
- [CVE-2018-8115](https://cve.now/CVE-2018-8115.md): A remote code execution vulnerability exists when the Windows Host Compute Service Shim (hcsshim) library fails to properly validate input w (no CVSS, Microsoft Windows Host Compute)
- [CVE-2018-10675](https://cve.now/CVE-2018-10675.md): The do\_get\_mempolicy function in mm/mempolicy.c in the Linux kernel before 4.12.9 allows local users to cause a denial of service (use-after (no CVSS)
- [CVE-2018-10676](https://cve.now/CVE-2018-10676.md): CeNova, Night OWL, Novo, Pulnix, QSee, Securus, and TBK Vision DVR devices allow remote attackers to download a file and obtain sensitive cr (no CVSS)
- [CVE-2018-1101](https://cve.now/CVE-2018-1101.md): Ansible Tower before version 3.2.4 has a flaw in the management of system and organization administrators that allows for privilege escalati (no CVSS, Red Hat Ansible Tower)
- [CVE-2018-10665](https://cve.now/CVE-2018-10665.md): ILIAS 5.3.4 has XSS through unsanitized output of PHP\_SELF, related to shib\_logout.php and third-party demo files. (no CVSS)
- [CVE-2018-10657](https://cve.now/CVE-2018-10657.md): Matrix Synapse before 0.28.1 is prone to a denial of service flaw where malicious events injected with depth = 2^63 - 1 render rooms unusabl (no CVSS, matrix-synapse)
- [CVE-2013-6272](https://cve.now/CVE-2013-6272.md): The NotificationBroadcastReceiver class in the com.android.phone process in Google Android 4.1.1 through 4.4.2 allows attackers to bypass in (no CVSS)
- [CVE-2018-9302](https://cve.now/CVE-2018-9302.md): SSRF (Server Side Request Forgery) in /assets/lib/fuc.js.php in Cockpit 0.4.4 through 0.5.5 allows remote attackers to read arbitrary files (no CVSS)
- [CVE-2017-4952](https://cve.now/CVE-2017-4952.md): VMware Xenon 1.x, prior to 1.5.4-CR7\_1, 1.5.7\_7, 1.5.4-CR6\_2, 1.3.7-CR1\_2, 1.1.0-CR0-3, 1.1.0-CR3\_1,1.4.2-CR4\_1, and 1.5.4\_8, contains an au (no CVSS, VMware Xenon)
- [CVE-2017-1255](https://cve.now/CVE-2017-1255.md): IBM Security Guardium 10.0, 10.0.1, and 10.1 through 10.1.4 uses weaker than expected cryptographic algorithms that could allow an attacker (no CVSS, IBM Security Guardium)
- [CVE-2017-1601](https://cve.now/CVE-2017-1601.md): IBM Security Guardium 10.0, 10.0.1, and 10.1 through 10.1.4 Database Activity Monitor does not require that users should have strong passwor (no CVSS)
- [CVE-2018-1468](https://cve.now/CVE-2018-1468.md): IBM API Connect 5.0.8.1 and 5.0.8.2 could allow a user to get access to internal environment and sensitive API details to which they are not (no CVSS, IBM API Connect)
- [CVE-2018-5512](https://cve.now/CVE-2018-5512.md): On F5 BIG-IP 13.1.0-13.1.0.5, when Large Receive Offload (LRO) and SYN cookies are enabled (default settings), undisclosed traffic patterns (no CVSS, F5 Networks BIG-IP)
- [CVE-2018-5514](https://cve.now/CVE-2018-5514.md): On F5 BIG-IP 13.1.0-13.1.0.5, maliciously crafted HTTP/2 request frames can lead to denial of service. (no CVSS, F5 Networks BIG-IP)
- [CVE-2018-5515](https://cve.now/CVE-2018-5515.md): On F5 BIG-IP 13.0.0-13.1.0.5, using RADIUS authentication responses from a RADIUS server with IPv6 addresses may cause TMM to crash, leading (no CVSS, F5 Networks BIG-IP)
- [CVE-2018-5516](https://cve.now/CVE-2018-5516.md): On F5 BIG-IP 13.0.0-13.1.0.5, 12.1.0-12.1.2, or 11.2.1-11.6.3.1, Enterprise Manager 3.1.1, BIG-IQ Centralized Management 5.0.0-5.4.0 or 4.6. (no CVSS, F5 Networks BIG-IP · F5 Networks Enterprise Manager +3)
- [CVE-2018-5517](https://cve.now/CVE-2018-5517.md): On F5 BIG-IP 13.1.0-13.1.0.5, malformed TCP packets sent to a self IP address or a FastL4 virtual server may cause an interruption of servic (no CVSS, F5 Networks BIG-IP)
- [CVE-2018-5518](https://cve.now/CVE-2018-5518.md): On F5 BIG-IP 13.0.0-13.1.0.5 or 12.0.0-12.1.3.3, malicious root users with access to a VCMP guest can cause a disruption of service on adjac (no CVSS, F5 Networks BIG-IP)
- [CVE-2018-5519](https://cve.now/CVE-2018-5519.md): On F5 BIG-IP 13.0.0-13.1.0.5, 12.1.0-12.1.3.3, or 11.2.1-11.6.3.1, administrative users by way of undisclosed methods can exploit the ssldum (no CVSS, F5 Networks BIG-IP)
- [CVE-2018-5520](https://cve.now/CVE-2018-5520.md): On an F5 BIG-IP 13.0.0-13.1.0.5, 12.1.0-12.1.3.1, or 11.2.1-11.6.3.1 system configured in Appliance mode, the TMOS Shell (tmsh) may allow an (no CVSS, F5 Networks BIG-IP)
- [CVE-2018-10544](https://cve.now/CVE-2018-10544.md): Meross MSS110 devices through 1.1.24 contain an unauthenticated admin.htm administrative interface. (no CVSS)
- [CVE-2018-10642](https://cve.now/CVE-2018-10642.md): Command injection vulnerability in Combodo iTop 2.4.1 allows remote authenticated administrators to execute arbitrary commands by changing t (no CVSS)
- [CVE-2018-10645](https://cve.now/CVE-2018-10645.md): Golden Frog VyprVPN 2.12.1.8015 for Windows suffers from a SYSTEM privilege escalation vulnerability through the "VyprVPN" service. (no CVSS)
- [CVE-2018-10646](https://cve.now/CVE-2018-10646.md): CyberGhost 6.5.0.3180 for Windows suffers from a SYSTEM privilege escalation vulnerability through the "CG6Service" service. (no CVSS)
- [CVE-2018-10647](https://cve.now/CVE-2018-10647.md): SaferVPN 4.2.5 for Windows suffers from a SYSTEM privilege escalation vulnerability in its "SaferVPN.Service" service. (no CVSS)
- [CVE-2018-6401](https://cve.now/CVE-2018-6401.md): Meross MSS110 devices before 1.1.24 contain a TELNET listener providing access for an undocumented admin account with a blank password. (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2018-05-02
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.