CVEs published May 11, 2018
25 CVEs were published on May 11, 2018: 0 critical, 0 high.
- Published
- 25
- Critical
- 0
- High
- 0
- Medium
- 1
- Low
- 0
- Unrated
- 24
- Now in CISA KEV
- 0
- Fix available
- 5
Most affected products
- Pivotal Spring Framework · org.springframework:spring-core
- 2
- [UNKNOWN] admin-cli
- 1
- Pivotal Application Service
- 1
- Pivotal Greenplum Command Center
- 1
- Pivotal Spring Data Commons · org.springframework.data:spri…
- 1
- Pivotal Spring Integration Zip · org.springframework.integr…
- 1
- Pivotal Spring Security OAuth · org.springframework.securit…
- 1
- Rockwell Automation FactoryTalk Activation
- 1
Medium, low and unrated 25
- CVE-2018-10992lilypond-invoke-editor in LilyPond 2.19.80 does not validate strings before launching the program specified by the BROWSER environment varia
- CVE-2018-10832ModbusPal 1.6b is vulnerable to an XML External Entity (XXE) attack.
- CVE-2018-5303An issue was discovered on the Impinj Speedway Connect R420 RFID Reader before 2.2.2.
- CVE-2018-5304An issue was discovered on the Impinj Speedway Connect R420 RFID Reader before 2.2.2.
- CVE-2018-6023Fastweb FASTgate 0.00.47 devices are vulnerable to CSRF, with impacts including Wi-Fi password changing, Guest Wi-Fi activating, etc.
- CVE-2018-6361Easy Hosting Control Panel (EHCP) v0.37.12.b has XSS via the op parameter, as demonstrated by adding a backdoor FTP account.
- CVE-2018-6362Easy Hosting Control Panel (EHCP) v0.37.12.b has XSS via the domainop action parameter, as demonstrated by reading the PHPSESSID cookie.
- CVE-2018-6458Easy Hosting Control Panel (EHCP) v0.37.12.b allows remote attackers to conduct cross-site request forgery (CSRF) attacks by leveraging lack
- CVE-2018-6617Easy Hosting Control Panel (EHCP) v0.37.12.b, when using a local MySQL server, allows attackers to change passwords of arbitrary database us
- CVE-2018-6618Easy Hosting Control Panel (EHCP) v0.37.12.b allows attackers to obtain sensitive information by leveraging cleartext password storage.
- CVE-2018-6619Easy Hosting Control Panel (EHCP) v0.37.12.b makes it easier for attackers to crack database passwords by leveraging use of a weak hashing a
- CVE-2018-1257Spring Framework, versions 5.0.x prior to 5.0.6, versions 4.3.x prior to 4.3.17, and older unsupported versions allows applications to exposPivotal Spring Framework · org.springframework:spring-core
- CVE-2018-1258Spring Framework version 5.0.5 when used in combination with any versions of Spring Security contains an authorization bypass when using metPivotal Spring Framework · org.springframework:spring-core
- CVE-2018-1259Spring Data Commons, versions 1.13 prior to 1.13.12 and 2.0 prior to 2.0.7, used in combination with XMLBeam 1.4.14 or earlier versions, conPivotal Spring Data Commons · org.springframework.data:spri…
- CVE-2018-1260Spring Security OAuth, versions 2.3 prior to 2.3.3, 2.2 prior to 2.2.2, 2.1 prior to 2.1.2, 2.0 prior to 2.0.15 and older unsupported versioPivotal Spring Security OAuth · org.springframework.securit…
- CVE-2018-1261Spring-integration-zip versions prior to 1.0.1 exposes an arbitrary file write vulnerability, which can be achieved using a specially craftePivotal Spring Integration Zip · org.springframework.integr…
- CVE-2018-1278Apps Manager included in Pivotal Application Service, versions 1.12.x prior to 1.12.22, 2.0.x prior to 2.0.13, and 2.1.x prior to 2.1.4 contPivotal Application Service
- CVE-2018-1280Pivotal Greenplum Command Center versions 2.x prior to 2.5.1 contains a blind SQL injection vulnerability.Pivotal Greenplum Command Center
- CVE-2009-5150Absolute Computrace Agent V80.845 and V80.866 does not have a digital signature for the configuration block, which allows attackers to set u
- CVE-2009-5151The stub component of Absolute Computrace Agent V70.785 executes code from a disk's inter-partition space without requiring a digital signat
- CVE-2009-5152Absolute Computrace Agent, as distributed on certain Dell Inspiron systems through 2009, has a race condition with the Dell Client Configura
- CVE-2018-10580The "Latest Posts on Profile" plugin 1.1 for MyBB has XSS because there is an added section in a user profile that displays that user's most
- CVE-2018-7248An issue was discovered in Zoho ManageEngine ServiceDesk Plus 9.3 Build 9317.
- CVE-2016-8627admin-cli before versions 3.0.0.alpha25, 2.2.1.cr2 is vulnerable to an EAP feature to download server log files that allows logs to be avail[UNKNOWN] admin-cli
- CVE-2017-6015Without quotation marks, any whitespace in the file path for Rockwell Automation FactoryTalk Activation version 4.00.02 remains ambiguous, wRockwell Automation FactoryTalk Activation