# CVEs published 2018-05-07 19 CVEs were published on May 7, 2018: 0 critical, 0 high. Days are UTC. - [CVE-2018-1256](https://cve.now/CVE-2018-1256.md): Spring Cloud SSO Connector, version 2.1.2, contains a regression which disables issuer validation in resource servers that are not bound to (no CVSS, Pivotal Spring Cloud SSO Connector · io.pivotal.spring.clou…) - [CVE-2017-17539](https://cve.now/CVE-2017-17539.md): The presence of a hardcoded account in Fortinet FortiWLC 7.0.11 and earlier allows attackers to gain unauthorized read/write access via a re (no CVSS, Fortinet FortiWLC) - [CVE-2017-17540](https://cve.now/CVE-2017-17540.md): The presence of a hardcoded account in Fortinet FortiWLC 8.3.3 allows attackers to gain unauthorized read/write access via a remote shell. (no CVSS, Fortinet FortiWLC) - [CVE-2018-10796](https://cve.now/CVE-2018-10796.md): In 2345 Security Guard 3.7, the driver file (2345NetFirewall.sys) allows local users to cause a denial of service (BSOD) or possibly have un (no CVSS) - [CVE-2018-10798](https://cve.now/CVE-2018-10798.md): A hang issue was discovered in Brave before 0.14.0 (on, for example, Linux). (no CVSS) - [CVE-2018-10799](https://cve.now/CVE-2018-10799.md): A hang issue was discovered in Brave before 0.14.0 (on, for example, Linux). (no CVSS) - [CVE-2018-10795](https://cve.now/CVE-2018-10795.md): Liferay 6.2.x and before has an FCKeditor configuration that allows an attacker to upload or transfer files of dangerous types that can be a (no CVSS) - [CVE-2018-1313](https://cve.now/CVE-2018-1313.md): In Apache Derby 10.3.1.4 to 10.14.1.0, a specially-crafted network packet can be used to request the Derby Network Server to boot a database (no CVSS, Apache Software Foundation Apache Derby · org.apache.derby:…) - [CVE-2018-1413](https://cve.now/CVE-2018-1413.md): IBM Cognos Analytics 11.0 is vulnerable to cross-site scripting. (no CVSS, IBM Cognos Analytics) - [CVE-2018-10773](https://cve.now/CVE-2018-10773.md): NULL pointer deference in the addsn function in serialno.c in libbibcore.a in bibutils through 6.2 allows remote attackers to cause a denial (no CVSS) - [CVE-2018-10774](https://cve.now/CVE-2018-10774.md): Read access violation in the isiin\_keyword function in isiin.c in libbibutils.a in bibutils through 6.2 allows remote attackers to cause a d (no CVSS) - [CVE-2018-10775](https://cve.now/CVE-2018-10775.md): NULL pointer dereference in the \_fields\_add function in fields.c in libbibcore.a in bibutils through 6.2 allows remote attackers to cause a (no CVSS) - [CVE-2018-10776](https://cve.now/CVE-2018-10776.md): The getbits function in mpglibDBL/common.c in mp3gain through 1.5.2-r2 allows remote attackers to cause a denial of service (segmentation fa (no CVSS) - [CVE-2018-10777](https://cve.now/CVE-2018-10777.md): Buffer overflow in the WriteMP3GainAPETag function in apetag.c in mp3gain through 1.5.2-r2 allows remote attackers to cause a denial of serv (no CVSS) - [CVE-2018-10778](https://cve.now/CVE-2018-10778.md): Read access violation in the III\_dequantize\_sample function in mpglibDBL/layer3.c in mp3gain through 1.5.2-r2 allows remote attackers to cau (no CVSS) - [CVE-2018-10779](https://cve.now/CVE-2018-10779.md): TIFFWriteScanline in tif\_write.c in LibTIFF 3.8.2 has a heap-based buffer over-read, as demonstrated by bmp2tiff. (no CVSS) - [CVE-2018-10780](https://cve.now/CVE-2018-10780.md): Exiv2::Image::byteSwap2 in image.cpp in Exiv2 0.26 has a heap-based buffer over-read. (no CVSS) - [CVE-2018-10771](https://cve.now/CVE-2018-10771.md): Stack-based buffer overflow in the get\_key function in parse.c in abcm2ps through 8.13.20 allows remote attackers to cause a denial of servi (no CVSS) - [CVE-2018-10772](https://cve.now/CVE-2018-10772.md): The tEXtToDataBuf function in pngimage.cpp in Exiv2 through 0.26 allows remote attackers to cause a denial of service (application crash) or (no CVSS) --- Source: cve.now, built and run by Sazabi (AI-native observability and security) Page: https://cve.now/daily/2018-05-07 Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.