# CVEs published 2018-05-08

29 CVEs were published on May 8, 2018: 0 critical, 1 high. Days are UTC.

- [CVE-2015-1503](https://cve.now/CVE-2015-1503.md): Multiple directory traversal vulnerabilities in IceWarp Mail Server before 11.2 allow remote attackers to read arbitrary files via a (1) .. (no CVSS)
- [CVE-2017-2606](https://cve.now/CVE-2017-2606.md): Jenkins before versions 2.44, 2.32.2 is vulnerable to an information exposure in the internal API that allows access to item names that shou (CVSS 4.3, jenkins · org.jenkins-ci.main:jenkins-core)
- [CVE-2018-10812](https://cve.now/CVE-2018-10812.md): The Bitpie application through 3.2.4 for Android and iOS uses cleartext storage for digital currency initial keys, which allows local users (no CVSS)
- [CVE-2018-6920](https://cve.now/CVE-2018-6920.md): In FreeBSD before 11.1-STABLE(r332303), 11.1-RELEASE-p10, 10.4-STABLE(r332321), and 10.4-RELEASE-p9, due to insufficient initialization of m (no CVSS, FreeBSD)
- [CVE-2018-6921](https://cve.now/CVE-2018-6921.md): In FreeBSD before 11.1-STABLE(r332066) and 11.1-RELEASE-p10, due to insufficient initialization of memory copied to userland in the network (no CVSS, FreeBSD)
- [CVE-2017-2611](https://cve.now/CVE-2017-2611.md): Jenkins before versions 2.44, 2.32.2 is vulnerable to an insufficient permission check for periodic processes (SECURITY-389). (CVSS 4.3, jenkins · org.jenkins-ci.main:jenkins-core)
- [CVE-2018-6510](https://cve.now/CVE-2018-6510.md): XSS Vulnerability in Puppet Enterprise Console (CVSS 5.4, Puppet Enterprise)
- [CVE-2018-6511](https://cve.now/CVE-2018-6511.md): XSS Vulnerability in Puppet Enterprise Console (CVSS 5.4, Puppet Enterprise)
- [CVE-2018-8897](https://cve.now/CVE-2018-8897.md): A statement in the System Programming Guide of the Intel 64 and IA-32 Architectures Software Developer's Manual (SDM) was mishandled in the (no CVSS)
- [CVE-2017-2592](https://cve.now/CVE-2017-2592.md): python-oslo-middleware before versions 3.8.1, 3.19.1, 3.23.1 is vulnerable to an information disclosure. (CVSS 5.9, python-oslo-middleware · oslo-middleware)
- [CVE-2017-2594](https://cve.now/CVE-2017-2594.md): hawtio before versions 2.0-beta-1, 2.0-beta-2 2.0-m1, 2.0-m2, 2.0-m3, and 1.5 is vulnerable to a path traversal that leads to a NullPointerE (CVSS 5.4, hawtio · io.hawt:project)
- [CVE-2018-1000168](https://cve.now/CVE-2018-1000168.md): nghttp2 version \>= 1.10.0 and nghttp2 \<= v1.31.0 contains an Improper Input Validation CWE-20 vulnerability in ALTSVC frame handling that ca (CVSS 7.5)
- [CVE-2018-1000173](https://cve.now/CVE-2018-1000173.md): A session fixaction vulnerability exists in Jenkins Google Login Plugin 1.3 and older in GoogleOAuth2SecurityRealm.java that allows unauthor (no CVSS, org.jenkins-ci.plugins:google-login)
- [CVE-2018-1000174](https://cve.now/CVE-2018-1000174.md): An open redirect vulnerability exists in Jenkins Google Login Plugin 1.3 and older in GoogleOAuth2SecurityRealm.java that allows attackers t (no CVSS, org.jenkins-ci.plugins:google-login)
- [CVE-2018-1000175](https://cve.now/CVE-2018-1000175.md): A path traversal vulnerability exists in Jenkins HTML Publisher Plugin 1.15 and older in HtmlPublisherTarget.java that allows attackers able (no CVSS, org.jenkins-ci.plugins:htmlpublisher)
- [CVE-2018-1000176](https://cve.now/CVE-2018-1000176.md): An exposure of sensitive information vulnerability exists in Jenkins Email Extension Plugin 2.61 and older in src/main/resources/hudson/plug (no CVSS, org.jenkins-ci.plugins:email-ext)
- [CVE-2018-1000177](https://cve.now/CVE-2018-1000177.md): A cross-site scripting vulnerability exists in Jenkins S3 Plugin 0.10.12 and older in src/main/resources/hudson/plugins/s3/S3ArtifactsProjec (no CVSS, org.jenkins-ci.plugins:s3)
- [CVE-2018-1000178](https://cve.now/CVE-2018-1000178.md): A heap corruption of type CWE-120 exists in quassel version 0.12.4 in quasselcore in void DataStreamPeer::processMessage(const QByteArray &m (no CVSS)
- [CVE-2018-1000179](https://cve.now/CVE-2018-1000179.md): A NULL Pointer Dereference of CWE-476 exists in quassel version 0.12.4 in the quasselcore void CoreAuthHandler::handle(const Login &msg) cor (no CVSS)
- [CVE-2018-1239](https://cve.now/CVE-2018-1239.md): Dell EMC Unity Operating Environment (OE) versions prior to 4.3.0.1522077968 are affected by multiple OS command injection vulnerabilities. (no CVSS, Dell EMC Unity Operating Environment)
- [CVE-2018-1247](https://cve.now/CVE-2018-1247.md): RSA Authentication Manager Security Console, version 8.3 and earlier, contains a XML External Entity (XXE) vulnerability. (no CVSS, Dell EMC RSA Authentication Manager Security Console)
- [CVE-2018-1248](https://cve.now/CVE-2018-1248.md): RSA Authentication Manager Security Console, Operation Console and Self-Service Console, version 8.3 and earlier, is affected by a Host head (no CVSS, Dell EMC RSA Authentication Manager Security Console, Opera…)
- [CVE-2018-10380](https://cve.now/CVE-2018-10380.md): kwallet-pam in KDE KWallet before 5.12.6 allows local users to obtain ownership of arbitrary files via a symlink attack. (no CVSS)
- [CVE-2018-10734](https://cve.now/CVE-2018-10734.md): KONGTOP DVR devices A303, A403, D303, D305, and D403 contain a backdoor that prints the login password via a Print\_Password function call in (no CVSS)
- [CVE-2018-10804](https://cve.now/CVE-2018-10804.md): ImageMagick version 7.0.7-28 contains a memory leak in WriteTIFFImage in coders/tiff.c. (no CVSS)
- [CVE-2018-10805](https://cve.now/CVE-2018-10805.md): ImageMagick version 7.0.7-28 contains a memory leak in ReadYCBCRImage in coders/ycbcr.c. (no CVSS)
- [CVE-2018-10806](https://cve.now/CVE-2018-10806.md): An issue was discovered in Frog CMS 0.9.5. (no CVSS)
- [CVE-2018-10809](https://cve.now/CVE-2018-10809.md): In 2345 Security Guard 3.7, the driver file (2345NetFirewall.sys) allows local users to cause a denial of service (BSOD) or possibly have un (no CVSS)
- [CVE-2018-10801](https://cve.now/CVE-2018-10801.md): TIFFClientOpen in tif\_unix.c in LibTIFF 3.8.2 has memory leaks, as demonstrated by bmp2tiff. (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2018-05-08
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.