CVEs published May 9, 2018
103 CVEs were published on May 9, 2018: 9 critical, 4 high. 3 are now in CISA KEV.
- Published
- 103
- Critical
- 9
- High
- 4
- Medium
- 9
- Low
- 1
- Unrated
- 80
- Now in CISA KEV
- 3
- Fix available
- 14
Most affected products
- Microsoft Windows
- 10
- Talos MySql MMM
- 8
- Microsoft Windows Server · Microsoft Windows
- 7
- Microsoft Edge · Microsoft ChakraCore +1
- 6
- Microsoft Edge
- 5
- Microsoft Exchange Server
- 5
- Microsoft Internet Explorer
- 4
- SAP SE SAP Internet Graphics Server
- 4
- Microsoft Office · Microsoft Excel
- 3
- ICS-CERT VGo Robot
- 2
Critical 9
- CVE-2017-14474In the MMM::Agent::Helpers::_execute function in MySQL Multi-Master Replication Manager (MMM) mmm_agentd 2.2.1, a specially crafted MMM protTalos MySql MMM
- CVE-2017-14475In the MMM::Agent::Helpers::Network::add_ip function in MySQL Multi-Master Replication Manager (MMM) mmm_agentd 2.2.1 (for Linux), a specialTalos MySql MMM
- CVE-2017-14476In the MMM::Agent::Helpers::Network::add_ip function in MySQL Multi-Master Replication Manager (MMM) mmm_agentd 2.2.1 (for Solaris), a speciTalos MySql MMM
- CVE-2017-14477In the MMM::Agent::Helpers::Network::add_ip function in MySQL Multi-Master Replication Manager (MMM) mmm_agentd 2.2.1 (for FreeBSD), a speciTalos MySql MMM
- CVE-2017-14478In the MMM::Agent::Helpers::Network::clear_ip function in MySQL Multi-Master Replication Manager (MMM) mmm_agentd 2.2.1 (for Linux), a speciTalos MySql MMM
- CVE-2017-14479In the MMM::Agent::Helpers::Network::clear_ip function in MySQL Multi-Master Replication Manager (MMM) mmm_agentd 2.2.1 (for Solaris), a speTalos MySql MMM
- CVE-2017-14480In the MMM::Agent::Helpers::Network::clear_ip function in MySQL Multi-Master Replication Manager (MMM) mmm_agentd 2.2.1 (for FreeBSD), a speTalos MySql MMM
- CVE-2017-14481In the MMM::Agent::Helpers::Network::send_arp function in MySQL Multi-Master Replication Manager (MMM) mmm_agentd 2.2.1 (for Solaris), a speTalos MySql MMM
- CVE-2018-10682An issue was discovered in WildFly 10.1.2.Final.
High 4
- CVE-2018-0824A remote code execution vulnerability exists in "Microsoft COM for Windows" when it fails to properly handle serialized objects, aka "Micros
- CVE-2018-8120An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in memory, aka "Win32k Microsoft Windows Server · Microsoft Windows
- CVE-2018-8174A remote code execution vulnerability exists in the way that the VBScript engine handles objects in memory, aka "Windows VBScript Engine RemMicrosoft Windows
- CVE-2018-1089389-ds-base before versions 1.4.0.9, 1.3.8.1, 1.3.6.15 did not properly handle long search filters with characters needing escapes, possibly389-ds-base
Medium, low and unrated 90
- CVE-2018-6020In Silex SX-500 all versions and GE MobileLink(GEH-500) version 1.54 and prior, authentication is not verified when making certain POST requ
- CVE-2018-6021Silex SD-320AN version 2.01 and prior and GE MobileLink(GEH-SD-320AN) version GEH-1.1 and prior have a system call parameter that is not pro
- CVE-2018-8860In Vecna VGo Robot versions prior to 3.0.3.52164, an attacker may be able to capture firmware updates through the adjacent network.ICS-CERT VGo Robot
- CVE-2018-2415SAP NetWeaver Application Server Java Web Container and HTTP Service (Engine API, from 7.10 to 7.11, 7.30, 7.31, 7.40, 7.50; J2EE Engine SerSAP SE SAP NetWeaver Application Server
- CVE-2018-2416SAP Identity Management 7.2 and 8.0 do not sufficiently validate an XML document accepted from an untrusted source.SAP Identity Management
- CVE-2018-2417Under certain conditions, the SAP Identity Management 8.0 (pass of type ToASCII) allows an attacker to access information which would otherwSAP SE SAP Identity Management
- CVE-2018-2418SAP MaxDB ODBC driver (all versions before 7.9.09.07) allows an attacker to inject code that can be executed by the application.SAP SE SAP MaxDB ODBC driver
- CVE-2018-2419SAP Enterprise Financial Services (SAPSCORE 1.11, 1.12; S4CORE 1.01, 1.02; EA-FINSERV 6.04, 6.05, 6.06, 6.16, 6.17, 6.18, 8.0) does not perfSAP SE SAP Enterprise Financial Services
- CVE-2018-2420SAP Internet Graphics Server (IGS), 7.20, 7.20EXT, 7.45, 7.49, 7.53, allows an attacker to upload any file (including script files) without SAP SE SAP Internet Graphics Server
- CVE-2018-2421SAP Internet Graphics Server (IGS) Portwatcher, 7.20, 7.20EXT, 7.45, 7.49, 7.53, allows an attacker to prevent legitimate users from accessiSAP SE SAP Internet Graphics Server
- CVE-2018-2422SAP Internet Graphics Server (IGS) Portwatcher, 7.20, 7.20EXT, 7.45, 7.49, 7.53, allows an attacker to prevent legitimate users from accessiSAP SE SAP Internet Graphics Server
- CVE-2018-2423SAP Internet Graphics Server (IGS), 7.20, 7.20EXT, 7.45, 7.49, 7.53, HTTP and RFC listener allows an attacker to prevent legitimate users frSAP SE SAP Internet Graphics Server
- CVE-2017-5175Advantech WebAccess 8.1 and earlier contains a DLL hijacking vulnerability which may allow an attacker to run a malicious DLL file within thICS-CERT Advantech WebAccess Versions 8.1 and prior.
- CVE-2018-0765A denial of service vulnerability exists when .NET and .NET Core improperly process XML documents, aka ".NET and .NET Core Denial of ServiceSystem.Security.Cryptography.Xml
- CVE-2018-0854A security feature bypass vulnerability exists in Windows Scripting Host which could allow an attacker to bypass Device Guard, aka "Windows Microsoft Windows Server · Microsoft Windows
- CVE-2018-0943A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka "CMicrosoft Edge · Microsoft ChakraCore +1
- CVE-2018-0945A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Microsoft Edge, aka "ScriptinMicrosoft Edge · Microsoft ChakraCore +1
- CVE-2018-0946A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Microsoft Edge, aka "ScriptinMicrosoft Edge · Microsoft ChakraCore +1
- CVE-2018-0951A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Microsoft Edge, aka "ScriptinMicrosoft Edge
- CVE-2018-0953A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Microsoft Edge, aka "ScriptinMicrosoft Edge · Microsoft ChakraCore
- CVE-2018-0954A remote code execution vulnerability exists in the way the scripting engine handles objects in memory in Microsoft browsers, aka "ScriptingMicrosoft Internet Explorer · Microsoft ChakraCore +2
- CVE-2018-0955A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Internet Explorer, aka "ScripMicrosoft Internet Explorer
- CVE-2018-0958A security feature bypass vulnerability exists in Windows which could allow an attacker to bypass Device Guard, aka "Windows Security FeaturMicrosoft Windows Server · Microsoft Windows
- CVE-2018-0959A remote code execution vulnerability exists when Windows Hyper-V on a host server fails to properly validate input from an authenticated usMicrosoft Windows
- CVE-2018-0961A remote code execution vulnerability exists when Windows Hyper-V on a host server fails to properly validate vSMB packet data, aka "Hyper-VMicrosoft Windows Server · Microsoft Windows
- CVE-2018-1021An information disclosure vulnerability exists when Microsoft Edge improperly handles objects in memory, aka "Microsoft Edge Information DisMicrosoft Edge
- CVE-2018-1022A remote code execution vulnerability exists in the way the scripting engine handles objects in memory in Microsoft browsers, aka "ScriptingMicrosoft ChakraCore · Microsoft Internet Explorer +2
- CVE-2018-1025An information disclosure vulnerability exists when affected Microsoft browsers improperly handle objects in memory, aka "Microsoft Browser Microsoft Internet Explorer · Microsoft Edge
- CVE-2018-1039A security feature bypass vulnerability exists in .Net Framework which could allow an attacker to bypass Device Guard, aka ".NET Framework DMicrosoft .NET Framework
- CVE-2018-8112A security feature bypass vulnerability exists when Microsoft Edge improperly handles requests of different origins, aka "Microsoft Edge SecMicrosoft Edge
- CVE-2018-8114A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Internet Explorer, aka "ScripMicrosoft Internet Explorer
- CVE-2018-8119A spoofing vulnerability exists when the Azure IoT Device Provisioning AMQP Transport library improperly validates certificates over the AMQMicrosoft C# SDK · Microsoft C SDK +1
- CVE-2018-8122A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Internet Explorer, aka "ScripMicrosoft Internet Explorer
- CVE-2018-8123An information disclosure vulnerability exists when Microsoft Edge improperly handles objects in memory, aka "Microsoft Edge Information DisMicrosoft Edge
- CVE-2018-8124An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in memory, aka "Win32k Microsoft Windows
- CVE-2018-8126A security feature bypass vulnerability exists when Internet Explorer fails to validate User Mode Code Integrity (UMCI) policies, aka "InterMicrosoft Internet Explorer
- CVE-2018-8127An information disclosure vulnerability exists when the Windows kernel improperly handles objects in memory, aka "Windows Kernel InformationMicrosoft Windows
- CVE-2018-8128A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Microsoft Edge, aka "ScriptinMicrosoft Edge · Microsoft ChakraCore
- CVE-2018-8129A security feature bypass vulnerability exists in Windows which could allow an attacker to bypass Device Guard, aka "Windows Security FeaturMicrosoft Windows Server · Microsoft Windows
- CVE-2018-8130A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka "CMicrosoft.ChakraCore
- CVE-2018-8132A security feature bypass vulnerability exists in Windows which could allow an attacker to bypass Device Guard, aka "Windows Security FeaturMicrosoft Windows Server · Microsoft Windows
- CVE-2018-8133A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka "CMicrosoft Edge · Microsoft ChakraCore +1
- CVE-2018-8134An elevation of privilege vulnerability exists in the way that the Windows Kernel API enforces permissions, aka "Windows Elevation of PrivilMicrosoft Windows Server 2012 R2 · Microsoft Windows RT +2
- CVE-2018-8136A remote code execution vulnerability exists in the way that Windows handles objects in memory, aka "Windows Remote Code Execution VulnerabiMicrosoft Windows
- CVE-2018-8137A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Microsoft Edge, aka "ScriptinMicrosoft Edge · Microsoft ChakraCore +1
- CVE-2018-8139A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Microsoft Edge, aka "ScriptinMicrosoft Edge · Microsoft ChakraCore +1
- CVE-2018-8141An information disclosure vulnerability exists when the Windows kernel improperly handles objects in memory, aka "Windows Kernel InformationMicrosoft Windows
- CVE-2018-8145An information disclosure vulnerability exists when Chakra improperly discloses the contents of its memory, which could provide an attacker Microsoft ChakraCore · Microsoft Internet Explorer +2
- CVE-2018-8147A remote code execution vulnerability exists in Microsoft Excel software when the software fails to properly handle objects in memory, aka "Microsoft Office · Microsoft Excel
- CVE-2018-8148A remote code execution vulnerability exists in Microsoft Excel software when the software fails to properly handle objects in memory, aka "Microsoft Office · Microsoft Excel
- CVE-2018-8149An elevation of privilege vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request tMicrosoft SharePoint Server · Microsoft SharePoint
- CVE-2018-8150A security feature bypass vulnerability exists when the Microsoft Outlook attachment block filter does not properly handle attachments, aka Microsoft Office
- CVE-2018-8151An information disclosure vulnerability exists when Microsoft Exchange improperly handles objects in memory, aka "Microsoft Exchange Memory Microsoft Exchange Server
- CVE-2018-8152An elevation of privilege vulnerability exists when Microsoft Exchange Outlook Web Access (OWA) fails to properly handle web requests, aka "Microsoft Exchange Server
- CVE-2018-8153A spoofing vulnerability exists in Microsoft Exchange Server when Outlook Web Access (OWA) fails to properly handle web requests, aka "MicroMicrosoft Exchange Server
- CVE-2018-8154A remote code execution vulnerability exists in Microsoft Exchange software when the software fails to properly handle objects in memory, akMicrosoft Exchange Server
- CVE-2018-8155An elevation of privilege vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request tMicrosoft SharePoint
- CVE-2018-8156An elevation of privilege vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request tMicrosoft SharePoint · Microsoft Project Server
- CVE-2018-8157A remote code execution vulnerability exists in Microsoft Office software when the software fails to properly handle objects in memory, aka Microsoft Office
- CVE-2018-8158A remote code execution vulnerability exists in Microsoft Office software when the software fails to properly handle objects in memory, aka
- CVE-2018-8159An elevation of privilege vulnerability exists when Microsoft Exchange Outlook Web Access (OWA) fails to properly handle web requests, aka "Microsoft Exchange Server
- CVE-2018-8160An information disclosure vulnerability exists in Outlook when a message is opened, aka "Microsoft Outlook Information Disclosure VulnerabilMicrosoft Word · Microsoft Office
- CVE-2018-8161A remote code execution vulnerability exists in Microsoft Office software when the software fails to properly handle objects in memory, aka Microsoft Word · Microsoft Office +1
- CVE-2018-8162A remote code execution vulnerability exists in Microsoft Excel software when the software fails to properly handle objects in memory, aka "Microsoft Office · Microsoft Excel
- CVE-2018-8163An information disclosure vulnerability exists when Microsoft Excel improperly discloses the contents of its memory, aka "Microsoft Excel In
- CVE-2018-8164An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in memory, aka "Win32k Microsoft Windows
- CVE-2018-8165An elevation of privilege vulnerability exists when the DirectX Graphics Kernel (DXGKRNL) driver improperly handles objects in memory, aka "Microsoft Windows Server · Microsoft Windows
- CVE-2018-8166An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in memory, aka "Win32k Microsoft Windows
- CVE-2018-8167An elevation of privilege vulnerability exists when the Windows Common Log File System (CLFS) driver improperly handles objects in memory, aMicrosoft Windows
- CVE-2018-8168An elevation of privilege vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request tMicrosoft SharePoint Server · Microsoft SharePoint
- CVE-2018-8170An elevation of privilege vulnerability exists in the way that the Windows kernel image handles objects in memory, aka "Windows Image ElevatMicrosoft Windows
- CVE-2018-8173A remote code execution vulnerability exists in Microsoft InfoPath when the software fails to properly handle objects in memory, aka "MicrosMicrosoft Infopath
- CVE-2018-8177A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka "CMicrosoft ChakraCore · Microsoft.ChakraCore
- CVE-2018-8178A remote code execution vulnerability exists in the way that Microsoft browsers access objects in memory, aka "Microsoft Browser Memory CorrMicrosoft ChakraCore · Microsoft Internet Explorer +1
- CVE-2018-8179A remote code execution vulnerability exists when Microsoft Edge improperly accesses objects in memory, aka "Microsoft Edge Memory CorruptioMicrosoft Edge
- CVE-2018-8866In Vecna VGo Robot versions prior to 3.0.3.52164, an attacker on an adjacent network could perform command injection.ICS-CERT VGo Robot
- CVE-2018-10770download.rsp on ShenZhen Anni "5 in 1 XVR" devices allows remote attackers to download the configuration (without a login) to discover the p
- CVE-2018-10828An issue was discovered in Alps Pointing-device Driver 10.1.101.207.
- CVE-2017-18265Prosody before 0.10.0 allows remote attackers to cause a denial of service (application crash), related to an incompatibility with certain v
- CVE-2018-10940The cdrom_ioctl_media_changed function in drivers/cdrom/cdrom.c in the Linux kernel before 4.16.6 allows local attackers to use a incorrect
- CVE-2016-9335A hard-coded cryptographic key vulnerability was identified in Red Lion Controls Sixnet-Managed Industrial Switches running firmware VersionRed Lion Controls Sixnet-Managed Industrial Switches · Auto…
- CVE-2018-8911Cross-site scripting (XSS) vulnerability in Attachment Preview in Synology Note Station before 2.5.1-0844 allows remote authenticated users Synology Note Station
- CVE-2018-8912Cross-site scripting (XSS) vulnerability in SYNO.NoteStation.Note in Synology Note Station before 2.5.1-0844 allows remote authenticated useSynology Note Station
- CVE-2018-10683An issue was discovered in WildFly 10.1.2.Final.
- CVE-2018-10184An issue was discovered in HAProxy before 1.8.8.
- CVE-2018-10830In 2345 Security Guard 3.7, the driver file (2345BdPcSafe.sys, X64 version) allows local users to cause a denial of service (BSOD) or possib
- CVE-2018-10831Z-NOMP before 2018-04-05 has an incorrect Equihash solution verifier that allows attackers to spoof mining shares, as demonstrated by provid
- CVE-2018-10827LiteCart before 2.1.2 allows remote attackers to cause a denial of service (memory consumption) via URIs that do not exist, because public_h
- CVE-2018-10705The Owned smart contract implementation for Aurora DAO (AURA), an Ethereum ERC20 token, allows attackers to acquire contract ownership becau
- CVE-2018-10817Severalnines ClusterControl before 1.6.0-4699 allows XSS.