# CVEs published 2018-05-11

25 CVEs were published on May 11, 2018: 0 critical, 0 high. Days are UTC.

- [CVE-2018-10992](https://cve.now/CVE-2018-10992.md): lilypond-invoke-editor in LilyPond 2.19.80 does not validate strings before launching the program specified by the BROWSER environment varia (no CVSS)
- [CVE-2018-10832](https://cve.now/CVE-2018-10832.md): ModbusPal 1.6b is vulnerable to an XML External Entity (XXE) attack. (no CVSS)
- [CVE-2018-5303](https://cve.now/CVE-2018-5303.md): An issue was discovered on the Impinj Speedway Connect R420 RFID Reader before 2.2.2. (no CVSS)
- [CVE-2018-5304](https://cve.now/CVE-2018-5304.md): An issue was discovered on the Impinj Speedway Connect R420 RFID Reader before 2.2.2. (no CVSS)
- [CVE-2018-6023](https://cve.now/CVE-2018-6023.md): Fastweb FASTgate 0.00.47 devices are vulnerable to CSRF, with impacts including Wi-Fi password changing, Guest Wi-Fi activating, etc. (no CVSS)
- [CVE-2018-6361](https://cve.now/CVE-2018-6361.md): Easy Hosting Control Panel (EHCP) v0.37.12.b has XSS via the op parameter, as demonstrated by adding a backdoor FTP account. (no CVSS)
- [CVE-2018-6362](https://cve.now/CVE-2018-6362.md): Easy Hosting Control Panel (EHCP) v0.37.12.b has XSS via the domainop action parameter, as demonstrated by reading the PHPSESSID cookie. (no CVSS)
- [CVE-2018-6458](https://cve.now/CVE-2018-6458.md): Easy Hosting Control Panel (EHCP) v0.37.12.b allows remote attackers to conduct cross-site request forgery (CSRF) attacks by leveraging lack (no CVSS)
- [CVE-2018-6617](https://cve.now/CVE-2018-6617.md): Easy Hosting Control Panel (EHCP) v0.37.12.b, when using a local MySQL server, allows attackers to change passwords of arbitrary database us (no CVSS)
- [CVE-2018-6618](https://cve.now/CVE-2018-6618.md): Easy Hosting Control Panel (EHCP) v0.37.12.b allows attackers to obtain sensitive information by leveraging cleartext password storage. (no CVSS)
- [CVE-2018-6619](https://cve.now/CVE-2018-6619.md): Easy Hosting Control Panel (EHCP) v0.37.12.b makes it easier for attackers to crack database passwords by leveraging use of a weak hashing a (no CVSS)
- [CVE-2018-1257](https://cve.now/CVE-2018-1257.md): Spring Framework, versions 5.0.x prior to 5.0.6, versions 4.3.x prior to 4.3.17, and older unsupported versions allows applications to expos (no CVSS, Pivotal Spring Framework · org.springframework:spring-core)
- [CVE-2018-1258](https://cve.now/CVE-2018-1258.md): Spring Framework version 5.0.5 when used in combination with any versions of Spring Security contains an authorization bypass when using met (no CVSS, Pivotal Spring Framework · org.springframework:spring-core)
- [CVE-2018-1259](https://cve.now/CVE-2018-1259.md): Spring Data Commons, versions 1.13 prior to 1.13.12 and 2.0 prior to 2.0.7, used in combination with XMLBeam 1.4.14 or earlier versions, con (no CVSS, Pivotal Spring Data Commons · org.springframework.data:spri…)
- [CVE-2018-1260](https://cve.now/CVE-2018-1260.md): Spring Security OAuth, versions 2.3 prior to 2.3.3, 2.2 prior to 2.2.2, 2.1 prior to 2.1.2, 2.0 prior to 2.0.15 and older unsupported versio (no CVSS, Pivotal Spring Security OAuth · org.springframework.securit…)
- [CVE-2018-1261](https://cve.now/CVE-2018-1261.md): Spring-integration-zip versions prior to 1.0.1 exposes an arbitrary file write vulnerability, which can be achieved using a specially crafte (no CVSS, Pivotal Spring Integration Zip · org.springframework.integr…)
- [CVE-2018-1278](https://cve.now/CVE-2018-1278.md): Apps Manager included in Pivotal Application Service, versions 1.12.x prior to 1.12.22, 2.0.x prior to 2.0.13, and 2.1.x prior to 2.1.4 cont (no CVSS, Pivotal Application Service)
- [CVE-2018-1280](https://cve.now/CVE-2018-1280.md): Pivotal Greenplum Command Center versions 2.x prior to 2.5.1 contains a blind SQL injection vulnerability. (no CVSS, Pivotal Greenplum Command Center)
- [CVE-2009-5150](https://cve.now/CVE-2009-5150.md): Absolute Computrace Agent V80.845 and V80.866 does not have a digital signature for the configuration block, which allows attackers to set u (no CVSS)
- [CVE-2009-5151](https://cve.now/CVE-2009-5151.md): The stub component of Absolute Computrace Agent V70.785 executes code from a disk's inter-partition space without requiring a digital signat (no CVSS)
- [CVE-2009-5152](https://cve.now/CVE-2009-5152.md): Absolute Computrace Agent, as distributed on certain Dell Inspiron systems through 2009, has a race condition with the Dell Client Configura (no CVSS)
- [CVE-2018-10580](https://cve.now/CVE-2018-10580.md): The "Latest Posts on Profile" plugin 1.1 for MyBB has XSS because there is an added section in a user profile that displays that user's most (no CVSS)
- [CVE-2018-7248](https://cve.now/CVE-2018-7248.md): An issue was discovered in Zoho ManageEngine ServiceDesk Plus 9.3 Build 9317. (no CVSS)
- [CVE-2016-8627](https://cve.now/CVE-2016-8627.md): admin-cli before versions 3.0.0.alpha25, 2.2.1.cr2 is vulnerable to an EAP feature to download server log files that allows logs to be avail (CVSS 4.3, \[UNKNOWN\] admin-cli)
- [CVE-2017-6015](https://cve.now/CVE-2017-6015.md): Without quotation marks, any whitespace in the file path for Rockwell Automation FactoryTalk Activation version 4.00.02 remains ambiguous, w (no CVSS, Rockwell Automation FactoryTalk Activation)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2018-05-11
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.