# CVEs published 2018-05-04

35 CVEs were published on May 4, 2018: 2 critical, 0 high. 2 are now in CISA KEV. Days are UTC.

- [CVE-2018-9154](https://cve.now/CVE-2018-9154.md): There is a reachable abort in the function jpc\_dec\_process\_sot in libjasper/jpc/jpc\_dec.c of JasPer 2.0.14 that will lead to a remote denial (no CVSS)
- [CVE-2011-0704](https://cve.now/CVE-2011-0704.md): 389 Directory Server 1.2.7.5, when built with mozldap, allows remote attackers to cause a denial of service (replica crash) by sending an em (no CVSS)
- [CVE-2012-5628](https://cve.now/CVE-2012-5628.md): gofer before 0.68 uses world-writable permissions for /var/lib/gofer/journal/watchdog, which allows local users to cause a denial of service (no CVSS)
- [CVE-2013-2233](https://cve.now/CVE-2013-2233.md): Ansible before 1.2.1 makes it easier for remote attackers to conduct man-in-the-middle attacks by leveraging failure to cache SSH host keys. (no CVSS, ansible)
- [CVE-2017-15043](https://cve.now/CVE-2017-15043.md): A vulnerability in Sierra Wireless AirLink GX400, GX440, ES440, and LS300 routers with firmware before 4.4.5 and GX450, ES450, RV50, RV50X, (no CVSS)
- [CVE-2018-10229](https://cve.now/CVE-2018-10229.md): A hardware vulnerability in GPU memory modules allows attackers to accelerate micro-architectural attacks through the use of the JavaScript (no CVSS)
- [CVE-2018-10251](https://cve.now/CVE-2018-10251.md): A vulnerability in Sierra Wireless AirLink GX400, GX440, ES440, and LS300 routers with firmware before 4.4.7 and GX450, ES450, RV50, RV50X, (no CVSS)
- [CVE-2018-7494](https://cve.now/CVE-2018-7494.md): WPLSoft in Delta Electronics versions 2.45.0 and prior utilizes a fixed length stack buffer where a value larger than the buffer can be read (no CVSS, ICS-CERT Delta Electronics WPLSoft)
- [CVE-2018-7507](https://cve.now/CVE-2018-7507.md): WPLSoft in Delta Electronics versions 2.45.0 and prior utilizes a fixed length heap buffer where a value larger than the buffer can be read (no CVSS, ICS-CERT Delta Electronics WPLSoft)
- [CVE-2018-7509](https://cve.now/CVE-2018-7509.md): WPLSoft in Delta Electronics versions 2.45.0 and prior writes data from a file outside the bounds of the intended buffer space, which could (no CVSS, ICS-CERT Delta Electronics WPLSoft)
- [CVE-2018-10740](https://cve.now/CVE-2018-10740.md): Axublog 1.1.0 allows remote Code Execution as demonstrated by injection of PHP code (contained in the webkeywords parameter) into the cmscon (no CVSS)
- [CVE-2018-10746](https://cve.now/CVE-2018-10746.md): An issue was discovered on D-Link DSL-3782 EU 1.01 devices. (no CVSS)
- [CVE-2018-10747](https://cve.now/CVE-2018-10747.md): An issue was discovered on D-Link DSL-3782 EU 1.01 devices. (no CVSS)
- [CVE-2018-10748](https://cve.now/CVE-2018-10748.md): An issue was discovered on D-Link DSL-3782 EU 1.01 devices. (no CVSS)
- [CVE-2018-10749](https://cve.now/CVE-2018-10749.md): An issue was discovered on D-Link DSL-3782 EU 1.01 devices. (no CVSS)
- [CVE-2018-10750](https://cve.now/CVE-2018-10750.md): An issue was discovered on D-Link DSL-3782 EU 1.01 devices. (no CVSS)
- [CVE-2018-5446](https://cve.now/CVE-2018-5446.md): Medtronic 2090 Carelink Programmer Storing Passwords in a Recoverable Format (CVSS 4.9, Medtronic 2090 CareLink Programmer · Medtronic 29901 Encore…)
- [CVE-2018-5448](https://cve.now/CVE-2018-5448.md): Medtronic 2090 Carelink Programmer Relative Path Traversal (CVSS 4.8, Medtronic 2090 CareLink Programmer · Medtronic 29901 Encore…)
- [CVE-2018-10739](https://cve.now/CVE-2018-10739.md): An issue was discovered in Shanghai 2345 Security Guard 3.7.0. (no CVSS)
- [CVE-2018-7522](https://cve.now/CVE-2018-7522.md): In Schneider Electric Triconex Tricon MP model 3008 firmware versions 10.0-10.4, when a system call is made, registers are stored to a fixed (no CVSS, Schneider Electric Triconex Tricon)
- [CVE-2018-8853](https://cve.now/CVE-2018-8853.md): Philips Brilliance CT devices operate user functions from within a contained kiosk in a Microsoft Windows operating system. (no CVSS, Philips Brilliance CT Scanners)
- [CVE-2018-8857](https://cve.now/CVE-2018-8857.md): Philips Brilliance CT software (Brilliance 64 version 2.6.2 and prior, Brilliance iCT versions 4.1.6 and prior, Brillance iCT SP versions 3. (no CVSS, Philips Brilliance CT Scanners)
- [CVE-2018-8861](https://cve.now/CVE-2018-8861.md): Vulnerabilities within the Philips Brilliance CT kiosk environment (Brilliance 64 version 2.6.2 and prior, Brilliance iCT versions 4.1.6 and (no CVSS, Philips Brilliance CT Scanners)
- [CVE-2018-8865](https://cve.now/CVE-2018-8865.md): In Lantech IDS 2102 2.0 and prior, a stack-based buffer overflow vulnerability has been identified which may allow remote code execution. (no CVSS, Lantech IDS)
- [CVE-2018-8869](https://cve.now/CVE-2018-8869.md): In Lantech IDS 2102 2.0 and prior, nearly all input fields allow for arbitrary input on the device. (no CVSS, Lantech IDS)
- [CVE-2018-8872](https://cve.now/CVE-2018-8872.md): In Schneider Electric Triconex Tricon MP model 3008 firmware versions 10.0-10.4, system calls read directly from memory addresses within the (no CVSS, Schneider Electric Triconex Tricon)
- [CVE-2017-3775](https://cve.now/CVE-2017-3775.md): Some Lenovo System x server BIOS/UEFI versions, when Secure Boot mode is enabled by a system administrator, do not properly authenticate sig (no CVSS, Lenovo Group Some Lenovo Flex System and Lenovo System x pr…)
- [CVE-2018-10733](https://cve.now/CVE-2018-10733.md): There is a heap-based buffer over-read in the function ft\_font\_face\_hash of gxps-fonts.c in libgxps through 0.3.0. (no CVSS)
- [CVE-2018-9063](https://cve.now/CVE-2018-9063.md): MapDrv (C:\\Program Files\\Lenovo\\System Update\\mapdrv.exe) In Lenovo System Update versions earlier than 5.07.0072 contains a local vulnerabi (no CVSS, Lenovo Group Lenovo System Update)
- [CVE-2018-10726](https://cve.now/CVE-2018-10726.md): A stored XSS vulnerability was found in Datenstrom Yellow 0.7.3 via an "Edit page" action. (CVSS 5.4)
- [CVE-2017-1743](https://cve.now/CVE-2017-1743.md): IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 could allow a remote attacker to obtain sensitive information caused by improper han (no CVSS, IBM WebSphere Application Server)
- [CVE-2018-10561](https://cve.now/CVE-2018-10561.md): An issue was discovered on Dasan GPON home routers. (CVSS 9.8, KEV)
- [CVE-2018-10562](https://cve.now/CVE-2018-10562.md): An issue was discovered on Dasan GPON home routers. (CVSS 9.8, KEV)
- [CVE-2018-10641](https://cve.now/CVE-2018-10641.md): D-Link DIR-601 A1 1.02NA devices do not require the old password for a password change, which occurs in cleartext. (no CVSS)
- [CVE-2018-10722](https://cve.now/CVE-2018-10722.md): In Cylance CylancePROTECT before 1470, an unprivileged local user can obtain SYSTEM privileges because users have Modify access to the %PROG (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2018-05-04
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.