# CVEs published 2018-05-10

49 CVEs were published on May 10, 2018: 0 critical, 1 high. Days are UTC.

- [CVE-2018-10982](https://cve.now/CVE-2018-10982.md): An issue was discovered in Xen through 4.10.x allowing x86 HVM guest OS users to cause a denial of service (unexpectedly high interrupt numb (no CVSS)
- [CVE-2018-10981](https://cve.now/CVE-2018-10981.md): An issue was discovered in Xen through 4.10.x allowing x86 HVM guest OS users to cause a denial of service (host OS infinite loop) in situat (no CVSS)
- [CVE-2018-1118](https://cve.now/CVE-2018-1118.md): Linux kernel vhost since version 4.8 does not properly initialize memory in messages passed between virtual guests and the host operating sy (CVSS 2.3, kernel vhost)
- [CVE-2018-3612](https://cve.now/CVE-2018-3612.md): Intel NUC kits with insufficient input validation in system firmware, potentially allows a local attacker to elevate privileges to System Ma (no CVSS)
- [CVE-2018-3649](https://cve.now/CVE-2018-3649.md): DLL injection vulnerability in the installation executables (Autorun.exe and Setup.exe) for Intel's wireless drivers and related software in (no CVSS, Intel Dual Band Wireless-AC, Tri-Band Wireless-AC and Wirel…)
- [CVE-2018-1115](https://cve.now/CVE-2018-1115.md): postgresql before versions 10.4, 9.6.9 is vulnerable in the adminpack extension, the pg\_catalog.pg\_logfile\_rotate() function doesn't follow (CVSS 4.2, postgresql)
- [CVE-2018-10706](https://cve.now/CVE-2018-10706.md): An integer overflow in the transferMulti function of a smart contract implementation for Social Chain (SCA), an Ethereum ERC20 token, allows (no CVSS)
- [CVE-2018-10973](https://cve.now/CVE-2018-10973.md): An integer overflow in the transferMulti function of a smart contract implementation for KoreaShow, an Ethereum ERC20 token, allows attacker (no CVSS)
- [CVE-2018-10974](https://cve.now/CVE-2018-10974.md): In 2345 Security Guard 3.7, the driver file (2345BdPcSafe.sys, X64 version) allows local users to cause a denial of service (BSOD) or possib (no CVSS)
- [CVE-2018-10975](https://cve.now/CVE-2018-10975.md): In 2345 Security Guard 3.7, the driver file (2345BdPcSafe.sys, X64 version) allows local users to cause a denial of service (BSOD) or possib (no CVSS)
- [CVE-2018-10976](https://cve.now/CVE-2018-10976.md): In 2345 Security Guard 3.7, the driver file (2345BdPcSafe.sys, X64 version) allows local users to cause a denial of service (BSOD) or possib (no CVSS)
- [CVE-2018-10977](https://cve.now/CVE-2018-10977.md): In 2345 Security Guard 3.7, the driver file (2345BdPcSafe.sys, X64 version) allows local users to cause a denial of service (BSOD) or possib (no CVSS)
- [CVE-2017-18267](https://cve.now/CVE-2017-18267.md): The FoFiType1C::cvtGlyph function in fofi/FoFiType1C.cc in Poppler through 0.64.0 allows remote attackers to cause a denial of service (infi (no CVSS)
- [CVE-2018-10971](https://cve.now/CVE-2018-10971.md): An issue was discovered in Free Lossless Image Format (FLIF) 0.3. (no CVSS)
- [CVE-2018-10972](https://cve.now/CVE-2018-10972.md): An issue was discovered in Free Lossless Image Format (FLIF) 0.3. (no CVSS)
- [CVE-2017-18266](https://cve.now/CVE-2017-18266.md): The open\_envvar function in xdg-open in xdg-utils before 1.1.3 does not validate strings before launching the program specified by the BROWS (no CVSS)
- [CVE-2017-6289](https://cve.now/CVE-2017-6289.md): In Android before the 2018-05-05 security patch level, NVIDIA Trusted Execution Environment (TEE) contains a memory corruption (due to unusu (no CVSS, Nvidia Android)
- [CVE-2017-6293](https://cve.now/CVE-2017-6293.md): In Android before the 2018-05-05 security patch level, NVIDIA Tegra X1 TZ contains a vulnerability in Widevine TA where the software writes (no CVSS, Nvidia Android)
- [CVE-2018-10655](https://cve.now/CVE-2018-10655.md): DLPnpAuditor.exe in DeviceLock Plug and Play Auditor (freeware) 5.72 has a Unicode Buffer Overflow (SEH). (no CVSS)
- [CVE-2018-10803](https://cve.now/CVE-2018-10803.md): Cross-site scripting (XSS) vulnerability in the add credentials functionality in Zoho ManageEngine NetFlow Analyzer v12.3 before 12.3.125 (b (no CVSS)
- [CVE-2018-6246](https://cve.now/CVE-2018-6246.md): In Android before the 2018-05-05 security patch level, NVIDIA Widevine Trustlet contains a vulnerability in Widevine TA where the software r (no CVSS, Nvidia Android)
- [CVE-2018-6254](https://cve.now/CVE-2018-6254.md): In Android before the 2018-05-05 security patch level, NVIDIA Media Server contains an out-of-bounds read (due to improper input validation) (no CVSS, Nvidia Android)
- [CVE-2018-7933](https://cve.now/CVE-2018-7933.md): Huawei home gateway products HiRouter-CD20 and WS5200 with the versions before HiRouter-CD20-10 1.9.6 and the versions before WS5200-10 1.9. (no CVSS, Huawei Technologies Co. HiRouter-CD20, WS5200)
- [CVE-2018-7940](https://cve.now/CVE-2018-7940.md): Huawei smart phones Mate 10 and Mate 10 Pro with earlier versions than 8.0.0.129(SP2C00) and earlier versions than 8.0.0.129(SP2C01) have an (no CVSS, Huawei Technologies Co. HUAWEI Mate 10, HUAWEI Mate 10 Pro)
- [CVE-2018-7941](https://cve.now/CVE-2018-7941.md): Huawei iBMC V200R002C60 have an authentication bypass vulnerability. (no CVSS, Huawei Technologies Co. iBMC)
- [CVE-2018-9849](https://cve.now/CVE-2018-9849.md): Pulse Secure Pulse Connect Secure 8.1.x before 8.1R14, 8.2.x before 8.2R11, and 8.3.x before 8.3R5 do not properly process nested XML entiti (no CVSS)
- [CVE-2018-1130](https://cve.now/CVE-2018-1130.md): Linux kernel before version 4.16-rc7 is vulnerable to a null pointer dereference in dccp\_write\_xmit() function in net/dccp/output.c in that (CVSS 5.5, kernel)
- [CVE-2018-8910](https://cve.now/CVE-2018-8910.md): Cross-site scripting (XSS) vulnerability in Attachment Preview in Synology Drive before 1.0.1-10253 allows remote authenticated users to inj (CVSS 6.5, Synology Drive)
- [CVE-2018-8914](https://cve.now/CVE-2018-8914.md): SQL injection vulnerability in UPnP DMA in Synology Media Server before 1.7.6-2842 and before 1.4-2654 allows remote attackers to execute ar (CVSS 7.3, Synology Media Server)
- [CVE-2018-8915](https://cve.now/CVE-2018-8915.md): Cross-site scripting (XSS) vulnerability in Notification Center in Synology Calendar before 2.1.1-0502 allows remote authenticated users to (CVSS 6.5, Synology Calendar)
- [CVE-2018-10314](https://cve.now/CVE-2018-10314.md): Cross-site scripting (XSS) vulnerability in Open-AudIT Community 2.2.0 allows remote attackers to inject arbitrary web script or HTML via a (no CVSS)
- [CVE-2018-10942](https://cve.now/CVE-2018-10942.md): modules/attributewizardpro/file\_upload.php in the Attribute Wizard addon 1.6.9 for PrestaShop 1.4.0.1 through 1.6.1.18 allows remote attacke (no CVSS)
- [CVE-2018-8060](https://cve.now/CVE-2018-8060.md): HWiNFO AMD64 Kernel driver version 8.98 and lower allows an unprivileged user to send an IOCTL to the device driver. (no CVSS)
- [CVE-2018-8061](https://cve.now/CVE-2018-8061.md): HWiNFO AMD64 Kernel driver version 8.98 and lower allows an unprivileged user to send IOCTL 0x85FE2608 to the device driver with the HWiNFO3 (no CVSS)
- [CVE-2018-8824](https://cve.now/CVE-2018-8824.md): modules/bamegamenu/ajax\_phpcode.php in the Responsive Mega Menu (Horizontal+Vertical+Dropdown) Pro module 1.0.32 for PrestaShop 1.5.5.0 thro (no CVSS)
- [CVE-2018-9111](https://cve.now/CVE-2018-9111.md): Cross Site Scripting (XSS) exists on the Foxconn FEMTO AP-FC4064-T AP\_GT\_B38\_5.8.3lb15-W47 LTE Build 15 via the configuration of a user acco (no CVSS)
- [CVE-2018-9112](https://cve.now/CVE-2018-9112.md): A low privileged admin account with a weak default password of admin exists on the Foxconn FEMTO AP-FC4064-T AP\_GT\_B38\_5.8.3lb15-W47 LTE Bui (no CVSS)
- [CVE-2018-10952](https://cve.now/CVE-2018-10952.md): In 2345 Security Guard 3.7, the driver file (2345BdPcSafe.sys, X64 version) allows local users to cause a denial of service (BSOD) or possib (no CVSS)
- [CVE-2018-10953](https://cve.now/CVE-2018-10953.md): In 2345 Security Guard 3.7, the driver file (2345BdPcSafe.sys, X64 version) allows local users to cause a denial of service (BSOD) or possib (no CVSS)
- [CVE-2018-10954](https://cve.now/CVE-2018-10954.md): In 2345 Security Guard 3.7, the driver file (2345BdPcSafe.sys, X64 version) allows local users to cause a denial of service (BSOD) or possib (no CVSS)
- [CVE-2018-10955](https://cve.now/CVE-2018-10955.md): In 2345 Security Guard 3.7, the driver file (2345BdPcSafe.sys, X64 version) allows local users to cause a denial of service (BSOD) or possib (no CVSS)
- [CVE-2018-10957](https://cve.now/CVE-2018-10957.md): CSRF exists on D-Link DIR-868L devices, leading to (for example) a change to the Admin password. (no CVSS)
- [CVE-2018-10958](https://cve.now/CVE-2018-10958.md): In types.cpp in Exiv2 0.26, a large size value may lead to a SIGABRT during an attempt at memory allocation for an Exiv2::Internal::PngChunk (no CVSS)
- [CVE-2018-10962](https://cve.now/CVE-2018-10962.md): An issue was discovered in Shanghai 2345 Security Guard 3.7.0. (no CVSS)
- [CVE-2018-10963](https://cve.now/CVE-2018-10963.md): The TIFFWriteDirectorySec() function in tif\_dirwrite.c in LibTIFF through 4.0.9 allows remote attackers to cause a denial of service (assert (no CVSS)
- [CVE-2018-10949](https://cve.now/CVE-2018-10949.md): mailboxd in Zimbra Collaboration Suite 8.8 before 8.8.8; 8.7 before 8.7.11.Patch3; and 8.6 allows Account Enumeration by leveraging a Discre (no CVSS)
- [CVE-2018-10950](https://cve.now/CVE-2018-10950.md): mailboxd in Zimbra Collaboration Suite 8.8 before 8.8.8; 8.7 before 8.7.11.Patch3; and 8.6 before 8.6.0.Patch10 allows Information Exposure (no CVSS)
- [CVE-2018-10951](https://cve.now/CVE-2018-10951.md): mailboxd in Zimbra Collaboration Suite 8.8 before 8.8.8; 8.7 before 8.7.11.Patch3; and 8.6 before 8.6.0.Patch10 allows zimbraSSLPrivateKey r (no CVSS)
- [CVE-2017-2601](https://cve.now/CVE-2017-2601.md): Jenkins before versions 2.44, 2.32.2 is vulnerable to a persisted cross-site scripting in parameter names and descriptions (SECURITY-353). (CVSS 6.1, jenkins · org.jenkins-ci.main:jenkins-core)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2018-05-10
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.