CVEs published May 14, 2018
50 CVEs were published on May 14, 2018: 1 critical, 13 high.
- Published
- 50
- Critical
- 1
- High
- 13
- Medium
- 3
- Low
- 1
- Unrated
- 32
- Now in CISA KEV
- 0
- Fix available
- 2
Most affected products
- Talos Moxa
- 17
- Ultimate Member
- 6
- ASUS Japan RT-AC1200HP
- 1
- ASUS Japan RT-AC68U
- 1
- ASUS Japan RT-AC87U
- 1
- Atlassian Application Links
- 1
- Atlassian Jira
- 1
- CELSYS CLIP STUDIO series
- 1
- Flipper Code WP Google Map Plugin
- 1
- ICS-CERT Rockwell Automation Arena
- 1
Critical 1
High 13
- CVE-2017-12120An exploitable command injection vulnerability exists in the web server functionality of Moxa EDR-810 V4.1 build 17030317.Talos Moxa
- CVE-2017-12121An exploitable command injection vulnerability exists in the web server functionality of Moxa EDR-810 V4.1 build 17030317.Talos Moxa
- CVE-2017-12124An exploitable denial of service vulnerability exists in the web server functionality of Moxa EDR-810 V4.1 build 17030317.Talos Moxa
- CVE-2017-12125An exploitable command injection vulnerability exists in the web server functionality of Moxa EDR-810 V4.1 build 17030317.Talos Moxa
- CVE-2017-12126An exploitable cross-site request forgery vulnerability exists in the web server functionality of Moxa EDR-810 V4.1 build 17030317.Talos Moxa
- CVE-2017-14432An exploitable command injection vulnerability exists in the web server functionality of Moxa EDR-810 V4.1 build 17030317.Talos Moxa
- CVE-2017-14433An exploitable command injection vulnerability exists in the web server functionality of Moxa EDR-810 V4.1 build 17030317.Talos Moxa
- CVE-2017-14434An exploitable command injection vulnerability exists in the web server functionality of Moxa EDR-810 V4.1 build 17030317.Talos Moxa
- CVE-2017-14435An exploitable denial of service vulnerability exists in the web server functionality of Moxa EDR-810 V4.1 build 17030317.Talos Moxa
- CVE-2017-14436An exploitable denial of service vulnerability exists in the web server functionality of Moxa EDR-810 V4.1 build 17030317.Talos Moxa
- CVE-2017-14437An exploitable denial of service vulnerability exists in the web server functionality of Moxa EDR-810 V4.1 build 17030317.Talos Moxa
- CVE-2017-14438Exploitable denial of service vulnerabilities exists in the Service Agent functionality of Moxa EDR-810 V4.1 build 17030317.Talos Moxa
- CVE-2017-14439Exploitable denial of service vulnerabilities exists in the Service Agent functionality of Moxa EDR-810 V4.1 build 17030317.Talos Moxa
Medium, low and unrated 36
- CVE-2018-10994js/views/message_view.js in Open Whisper Signal (aka Signal-Desktop) before 1.10.1 allows XSS via a URL.
- CVE-2018-11090An XSS issue was discovered in MyBiz MyProcureNet 5.0.0.
- CVE-2017-12123An exploitable clear text transmission of password vulnerability exists in the web server and telnet functionality of Moxa EDR-810 V4.1 builTalos Moxa
- CVE-2017-12127A password storage vulnerability exists in the operating system functionality of Moxa EDR-810 V4.1 build 17030317.Talos Moxa
- CVE-2017-12128An exploitable information disclosure vulnerability exists in the Server Agent functionality of Moxa EDR-810 V4.1 build 17030317.Talos Moxa
- CVE-2017-12129An exploitable Weak Cryptography for Passwords vulnerability exists in the web server functionality of Moxa EDR-810 V4.1 build 17030317.Talos Moxa
- CVE-2018-8843Rockwell Automation Arena versions 15.10.00 and prior contains a use after free vulnerability caused by processing specially crafted Arena SICS-CERT Rockwell Automation Arena
- CVE-2017-6021In Schneider Electric ClearSCADA 2014 R1 (build 75.5210) and prior, 2014 R1.1 (build 75.5387) and prior, 2015 R1 (build 76.5648) and prior, Schneider Electric SE ClearSCADA
- CVE-2018-10252An issue was discovered on Actiontec WCB6200Q before 1.1.10.20a devices.
- CVE-2018-10989Arris Touchstone Telephony Gateway TG1682G 9.1.103J6 devices are distributed by some ISPs with a default password of "password" for the admi
- CVE-2018-10990On Arris Touchstone Telephony Gateway TG1682G 9.1.103J6 devices, a logout action does not immediately destroy all state on the device relate
- CVE-2017-16860The invalidRedirectUrl template in Atlassian Application Links before version 5.2.7, from version 5.3.0 before version 5.3.4 and from versioAtlassian Application Links
- CVE-2018-0568Unrestricted file upload vulnerability in SiteBridge Inc.SiteBridge Joruri Gw
- CVE-2018-0576Cross-site scripting vulnerability in Events Manager plugin prior to version 5.9 for WordPress allows remote attackers to inject arbitrary wNetWebLogic Events Manager
- CVE-2018-0577Cross-site scripting vulnerability in WP Google Map Plugin prior to version 4.0.4 for WordPress allows remote attackers to inject arbitrary Flipper Code WP Google Map Plugin
- CVE-2018-0578Cross-site scripting vulnerability in PixelYourSite plugin prior to version 5.3.0 for WordPress allows remote attackers to inject arbitrary Minimal Work SRL PixelYourSite
- CVE-2018-0579Cross-site scripting vulnerability in Open Graph for Facebook, Google+ and Twitter Card Tags plugin prior to version 2.2.4.1 for WordPress aWebdados Open Graph for Facebook, Google+ and Twitter Card…
- CVE-2018-0580Untrusted search path vulnerability in CELSYS, Inc CLIP STUDIO series (CLIP STUDIO PAINT (for Windows) EX/PRO/DEBUT Ver.1.7.3 and earlier, CCELSYS CLIP STUDIO series
- CVE-2018-0581Cross-site scripting vulnerability in ASUS RT-AC87U Firmware version prior to 3.0.0.4.378.9383 allows remote attackers to inject arbitrary wASUS Japan RT-AC87U
- CVE-2018-0582Cross-site scripting vulnerability in ASUS RT-AC68U Firmware version prior to 3.0.0.4.380.1031 allows remote attackers to inject arbitrary wASUS Japan RT-AC68U
- CVE-2018-0583Cross-site scripting vulnerability in ASUS RT-AC1200HP Firmware version prior to 3.0.0.4.380.4180 allows remote attackers to inject arbitrarASUS Japan RT-AC1200HP
- CVE-2018-0585Cross-site scripting vulnerability in Ultimate Member plugin prior to version 2.0.4 for WordPress allows remote attackers to inject arbitrarUltimate Member
- CVE-2018-0586Directory traversal vulnerability in the shortcodes function of Ultimate Member plugin prior to version 2.0.4 for WordPress allows remote auUltimate Member
- CVE-2018-0587Unrestricted file upload vulnerability in Ultimate Member plugin prior to version 2.0.4 for WordPress allows remote authenticated users to uUltimate Member
- CVE-2018-0588Directory traversal vulnerability in the AJAX function of Ultimate Member plugin prior to version 2.0.4 for WordPress allows remote attackerUltimate Member
- CVE-2018-0589Ultimate Member plugin prior to version 2.0.4 for WordPress allows remote authenticated attackers to bypass access restriction to add a new Ultimate Member
- CVE-2018-0590Ultimate Member plugin prior to version 2.0.4 for WordPress allows remote authenticated attackers to bypass access restriction to modify theUltimate Member
- CVE-2018-0591The KINEPASS App for Android Ver 3.1.1 and earlier, and for iOS Ver 3.1.2 and earlier do not verify X.509 certificates from SSL servers, whiT-JOY CO. KINEPASS App
- CVE-2018-5230The issue collector in Atlassian Jira before version 7.6.6, from version 7.7.0 before version 7.7.4, from version 7.8.0 before version 7.8.4Atlassian Jira
- CVE-2018-11037In Exiv2 0.26, the Exiv2::PngImage::printStructure function in pngimage.cpp allows remote attackers to cause an information leak via a craft
- CVE-2018-10944The request_dividend function of a smart contract implementation for ROC (aka Rasputin Online Coin), an Ethereum ERC20 token, allows attacke
- CVE-2018-11034In 2345 Security Guard 3.7, the driver file (2345NsProtect.sys, X64 version) allows local users to cause a denial of service (BSOD) or possi
- CVE-2018-11035In 2345 Security Guard 3.7, the driver file (2345NsProtect.sys, X64 version) allows local users to cause a denial of service (BSOD) or possi
- CVE-2018-11031application/home/controller/debug.php in PHPRAP 1.0.4 through 1.0.8 has SSRF via the /debug URI, as demonstrated by an api[url]=file:////etc
- CVE-2018-11032PHPRAP 1.0.4 through 1.0.8 has SQL Injection via the application/home/controller/project.php search() function.
- CVE-2018-11033The DCTStream::readHuffSym function in Stream.cc in the DCT decoder in xpdf before 4.00 allows remote attackers to cause a denial of service