CVEs published May 8, 2018
29 CVEs were published on May 8, 2018: 0 critical, 1 high.
- Published
- 29
- Critical
- 0
- High
- 1
- Medium
- 6
- Low
- 0
- Unrated
- 22
- Now in CISA KEV
- 0
- Fix available
- 11
Most affected products
- FreeBSD
- 2
- jenkins · org.jenkins-ci.main:jenkins-core
- 2
- org.jenkins-ci.plugins:google-login
- 2
- Puppet Enterprise
- 2
- Dell EMC RSA Authentication Manager Security Console
- 1
- Dell EMC RSA Authentication Manager Security Console, Opera…
- 1
- Dell EMC Unity Operating Environment
- 1
- hawtio · io.hawt:project
- 1
- org.jenkins-ci.plugins:email-ext
- 1
- org.jenkins-ci.plugins:htmlpublisher
- 1
High 1
Medium, low and unrated 28
- CVE-2015-1503Multiple directory traversal vulnerabilities in IceWarp Mail Server before 11.2 allow remote attackers to read arbitrary files via a (1) ..
- CVE-2017-2606Jenkins before versions 2.44, 2.32.2 is vulnerable to an information exposure in the internal API that allows access to item names that shoujenkins · org.jenkins-ci.main:jenkins-core
- CVE-2018-10812The Bitpie application through 3.2.4 for Android and iOS uses cleartext storage for digital currency initial keys, which allows local users
- CVE-2018-6920In FreeBSD before 11.1-STABLE(r332303), 11.1-RELEASE-p10, 10.4-STABLE(r332321), and 10.4-RELEASE-p9, due to insufficient initialization of mFreeBSD
- CVE-2018-6921In FreeBSD before 11.1-STABLE(r332066) and 11.1-RELEASE-p10, due to insufficient initialization of memory copied to userland in the network FreeBSD
- CVE-2017-2611Jenkins before versions 2.44, 2.32.2 is vulnerable to an insufficient permission check for periodic processes (SECURITY-389).jenkins · org.jenkins-ci.main:jenkins-core
- CVE-2018-6510XSS Vulnerability in Puppet Enterprise ConsolePuppet Enterprise
- CVE-2018-6511XSS Vulnerability in Puppet Enterprise ConsolePuppet Enterprise
- CVE-2018-8897A statement in the System Programming Guide of the Intel 64 and IA-32 Architectures Software Developer's Manual (SDM) was mishandled in the
- CVE-2017-2592python-oslo-middleware before versions 3.8.1, 3.19.1, 3.23.1 is vulnerable to an information disclosure.python-oslo-middleware · oslo-middleware
- CVE-2017-2594hawtio before versions 2.0-beta-1, 2.0-beta-2 2.0-m1, 2.0-m2, 2.0-m3, and 1.5 is vulnerable to a path traversal that leads to a NullPointerEhawtio · io.hawt:project
- CVE-2018-1000173A session fixaction vulnerability exists in Jenkins Google Login Plugin 1.3 and older in GoogleOAuth2SecurityRealm.java that allows unauthororg.jenkins-ci.plugins:google-login
- CVE-2018-1000174An open redirect vulnerability exists in Jenkins Google Login Plugin 1.3 and older in GoogleOAuth2SecurityRealm.java that allows attackers torg.jenkins-ci.plugins:google-login
- CVE-2018-1000175A path traversal vulnerability exists in Jenkins HTML Publisher Plugin 1.15 and older in HtmlPublisherTarget.java that allows attackers ableorg.jenkins-ci.plugins:htmlpublisher
- CVE-2018-1000176An exposure of sensitive information vulnerability exists in Jenkins Email Extension Plugin 2.61 and older in src/main/resources/hudson/plugorg.jenkins-ci.plugins:email-ext
- CVE-2018-1000177A cross-site scripting vulnerability exists in Jenkins S3 Plugin 0.10.12 and older in src/main/resources/hudson/plugins/s3/S3ArtifactsProjecorg.jenkins-ci.plugins:s3
- CVE-2018-1000178A heap corruption of type CWE-120 exists in quassel version 0.12.4 in quasselcore in void DataStreamPeer::processMessage(const QByteArray &m
- CVE-2018-1000179A NULL Pointer Dereference of CWE-476 exists in quassel version 0.12.4 in the quasselcore void CoreAuthHandler::handle(const Login &msg) cor
- CVE-2018-1239Dell EMC Unity Operating Environment (OE) versions prior to 4.3.0.1522077968 are affected by multiple OS command injection vulnerabilities.Dell EMC Unity Operating Environment
- CVE-2018-1247RSA Authentication Manager Security Console, version 8.3 and earlier, contains a XML External Entity (XXE) vulnerability.Dell EMC RSA Authentication Manager Security Console
- CVE-2018-1248RSA Authentication Manager Security Console, Operation Console and Self-Service Console, version 8.3 and earlier, is affected by a Host headDell EMC RSA Authentication Manager Security Console, Opera…
- CVE-2018-10380kwallet-pam in KDE KWallet before 5.12.6 allows local users to obtain ownership of arbitrary files via a symlink attack.
- CVE-2018-10734KONGTOP DVR devices A303, A403, D303, D305, and D403 contain a backdoor that prints the login password via a Print_Password function call in
- CVE-2018-10804ImageMagick version 7.0.7-28 contains a memory leak in WriteTIFFImage in coders/tiff.c.
- CVE-2018-10805ImageMagick version 7.0.7-28 contains a memory leak in ReadYCBCRImage in coders/ycbcr.c.
- CVE-2018-10806An issue was discovered in Frog CMS 0.9.5.
- CVE-2018-10809In 2345 Security Guard 3.7, the driver file (2345NetFirewall.sys) allows local users to cause a denial of service (BSOD) or possibly have un
- CVE-2018-10801TIFFClientOpen in tif_unix.c in LibTIFF 3.8.2 has memory leaks, as demonstrated by bmp2tiff.