# CVEs published 2018-05-03

13 CVEs were published on May 3, 2018: 0 critical, 0 high. Days are UTC.

- [CVE-2018-8003](https://cve.now/CVE-2018-8003.md): Apache Ambari, versions 1.4.0 to 2.6.1, is susceptible to a directory traversal attack allowing an unauthenticated user to craft an HTTP req (no CVSS, Apache Software Foundation Apache Ambari)
- [CVE-2018-10164](https://cve.now/CVE-2018-10164.md): Stored Cross-site scripting (XSS) vulnerability in the TP-Link EAP Controller and Omada Controller versions 2.5.4\_Windows/2.6.0\_Windows allo (no CVSS)
- [CVE-2018-10165](https://cve.now/CVE-2018-10165.md): Stored Cross-site scripting (XSS) vulnerability in the TP-Link EAP Controller and Omada Controller versions 2.5.4\_Windows/2.6.0\_Windows allo (no CVSS)
- [CVE-2018-10166](https://cve.now/CVE-2018-10166.md): The web management interface in the TP-Link EAP Controller and Omada Controller versions 2.5.4\_Windows/2.6.0\_Windows does not have Anti-CSRF (no CVSS)
- [CVE-2018-10167](https://cve.now/CVE-2018-10167.md): The web application backup file in the TP-Link EAP Controller and Omada Controller versions 2.5.4\_Windows/2.6.0\_Windows is encrypted with a (no CVSS)
- [CVE-2018-10168](https://cve.now/CVE-2018-10168.md): TP-Link EAP Controller and Omada Controller versions 2.5.4\_Windows/2.6.0\_Windows do not control privileges for usage of the Web API, allowin (no CVSS)
- [CVE-2018-10718](https://cve.now/CVE-2018-10718.md): Stack-based buffer overflow in Activision Infinity Ward Call of Duty Modern Warfare 2 before 2018-04-26 allows remote attackers to execute a (no CVSS)
- [CVE-2018-10716](https://cve.now/CVE-2018-10716.md): An issue was discovered in Shanghai 2345 Security Guard 3.7.0. (no CVSS)
- [CVE-2018-10717](https://cve.now/CVE-2018-10717.md): The DecodeGifImg function in ngiflib.c in MiniUPnP ngiflib 0.4 does not consider the bounds of the pixels data structure, which allows remot (no CVSS)
- [CVE-2018-10713](https://cve.now/CVE-2018-10713.md): An issue was discovered on D-Link DSL-3782 EU 1.01 devices. (no CVSS)
- [CVE-2018-4849](https://cve.now/CVE-2018-4849.md): A vulnerability has been identified in Siveillance VMS Video for Android (All versions \< V12.1a (2018 R1)), Siveillance VMS Video for iOS (A (no CVSS, Siemens AG Siveillance VMS Video for Android, Siveillance V…)
- [CVE-2018-10689](https://cve.now/CVE-2018-10689.md): blktrace (aka Block IO Tracing) 1.2.0, as used with the Linux kernel and Android, has a buffer overflow in the dev\_map\_read function in btt/ (no CVSS)
- [CVE-2018-10666](https://cve.now/CVE-2018-10666.md): The Owned smart contract implementation for Aurora IDEX Membership (IDXM), an Ethereum ERC20 token, allows attackers to acquire contract own (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2018-05-03
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.