# CVEs published 2018-05-14

50 CVEs were published on May 14, 2018: 1 critical, 13 high. Days are UTC.

- [CVE-2018-10994](https://cve.now/CVE-2018-10994.md): js/views/message\_view.js in Open Whisper Signal (aka Signal-Desktop) before 1.10.1 allows XSS via a URL. (no CVSS)
- [CVE-2018-11090](https://cve.now/CVE-2018-11090.md): An XSS issue was discovered in MyBiz MyProcureNet 5.0.0. (no CVSS)
- [CVE-2018-11091](https://cve.now/CVE-2018-11091.md): An issue was discovered in MyBiz MyProcureNet 5.0.0. (CVSS 9.9)
- [CVE-2017-12120](https://cve.now/CVE-2017-12120.md): An exploitable command injection vulnerability exists in the web server functionality of Moxa EDR-810 V4.1 build 17030317. (CVSS 8.8, Talos Moxa)
- [CVE-2017-12121](https://cve.now/CVE-2017-12121.md): An exploitable command injection vulnerability exists in the web server functionality of Moxa EDR-810 V4.1 build 17030317. (CVSS 8.8, Talos Moxa)
- [CVE-2017-12123](https://cve.now/CVE-2017-12123.md): An exploitable clear text transmission of password vulnerability exists in the web server and telnet functionality of Moxa EDR-810 V4.1 buil (CVSS 5.7, Talos Moxa)
- [CVE-2017-12124](https://cve.now/CVE-2017-12124.md): An exploitable denial of service vulnerability exists in the web server functionality of Moxa EDR-810 V4.1 build 17030317. (CVSS 7.5, Talos Moxa)
- [CVE-2017-12125](https://cve.now/CVE-2017-12125.md): An exploitable command injection vulnerability exists in the web server functionality of Moxa EDR-810 V4.1 build 17030317. (CVSS 8.8, Talos Moxa)
- [CVE-2017-12126](https://cve.now/CVE-2017-12126.md): An exploitable cross-site request forgery vulnerability exists in the web server functionality of Moxa EDR-810 V4.1 build 17030317. (CVSS 8.8, Talos Moxa)
- [CVE-2017-12127](https://cve.now/CVE-2017-12127.md): A password storage vulnerability exists in the operating system functionality of Moxa EDR-810 V4.1 build 17030317. (CVSS 4.4, Talos Moxa)
- [CVE-2017-12128](https://cve.now/CVE-2017-12128.md): An exploitable information disclosure vulnerability exists in the Server Agent functionality of Moxa EDR-810 V4.1 build 17030317. (CVSS 5.3, Talos Moxa)
- [CVE-2017-12129](https://cve.now/CVE-2017-12129.md): An exploitable Weak Cryptography for Passwords vulnerability exists in the web server functionality of Moxa EDR-810 V4.1 build 17030317. (CVSS 3.5, Talos Moxa)
- [CVE-2017-14432](https://cve.now/CVE-2017-14432.md): An exploitable command injection vulnerability exists in the web server functionality of Moxa EDR-810 V4.1 build 17030317. (CVSS 8.8, Talos Moxa)
- [CVE-2017-14433](https://cve.now/CVE-2017-14433.md): An exploitable command injection vulnerability exists in the web server functionality of Moxa EDR-810 V4.1 build 17030317. (CVSS 8.8, Talos Moxa)
- [CVE-2017-14434](https://cve.now/CVE-2017-14434.md): An exploitable command injection vulnerability exists in the web server functionality of Moxa EDR-810 V4.1 build 17030317. (CVSS 8.8, Talos Moxa)
- [CVE-2017-14435](https://cve.now/CVE-2017-14435.md): An exploitable denial of service vulnerability exists in the web server functionality of Moxa EDR-810 V4.1 build 17030317. (CVSS 7.5, Talos Moxa)
- [CVE-2017-14436](https://cve.now/CVE-2017-14436.md): An exploitable denial of service vulnerability exists in the web server functionality of Moxa EDR-810 V4.1 build 17030317. (CVSS 7.5, Talos Moxa)
- [CVE-2017-14437](https://cve.now/CVE-2017-14437.md): An exploitable denial of service vulnerability exists in the web server functionality of Moxa EDR-810 V4.1 build 17030317. (CVSS 7.5, Talos Moxa)
- [CVE-2017-14438](https://cve.now/CVE-2017-14438.md): Exploitable denial of service vulnerabilities exists in the Service Agent functionality of Moxa EDR-810 V4.1 build 17030317. (CVSS 7.5, Talos Moxa)
- [CVE-2017-14439](https://cve.now/CVE-2017-14439.md): Exploitable denial of service vulnerabilities exists in the Service Agent functionality of Moxa EDR-810 V4.1 build 17030317. (CVSS 7.5, Talos Moxa)
- [CVE-2018-8843](https://cve.now/CVE-2018-8843.md): Rockwell Automation Arena versions 15.10.00 and prior contains a use after free vulnerability caused by processing specially crafted Arena S (no CVSS, ICS-CERT Rockwell Automation Arena)
- [CVE-2017-6021](https://cve.now/CVE-2017-6021.md): In Schneider Electric ClearSCADA 2014 R1 (build 75.5210) and prior, 2014 R1.1 (build 75.5387) and prior, 2015 R1 (build 76.5648) and prior, (no CVSS, Schneider Electric SE ClearSCADA)
- [CVE-2018-10252](https://cve.now/CVE-2018-10252.md): An issue was discovered on Actiontec WCB6200Q before 1.1.10.20a devices. (no CVSS)
- [CVE-2018-10989](https://cve.now/CVE-2018-10989.md): Arris Touchstone Telephony Gateway TG1682G 9.1.103J6 devices are distributed by some ISPs with a default password of "password" for the admi (no CVSS)
- [CVE-2018-10990](https://cve.now/CVE-2018-10990.md): On Arris Touchstone Telephony Gateway TG1682G 9.1.103J6 devices, a logout action does not immediately destroy all state on the device relate (no CVSS)
- [CVE-2017-16860](https://cve.now/CVE-2017-16860.md): The invalidRedirectUrl template in Atlassian Application Links before version 5.2.7, from version 5.3.0 before version 5.3.4 and from versio (no CVSS, Atlassian Application Links)
- [CVE-2018-0568](https://cve.now/CVE-2018-0568.md): Unrestricted file upload vulnerability in SiteBridge Inc. (no CVSS, SiteBridge Joruri Gw)
- [CVE-2018-0576](https://cve.now/CVE-2018-0576.md): Cross-site scripting vulnerability in Events Manager plugin prior to version 5.9 for WordPress allows remote attackers to inject arbitrary w (no CVSS, NetWebLogic Events Manager)
- [CVE-2018-0577](https://cve.now/CVE-2018-0577.md): Cross-site scripting vulnerability in WP Google Map Plugin prior to version 4.0.4 for WordPress allows remote attackers to inject arbitrary (no CVSS, Flipper Code WP Google Map Plugin)
- [CVE-2018-0578](https://cve.now/CVE-2018-0578.md): Cross-site scripting vulnerability in PixelYourSite plugin prior to version 5.3.0 for WordPress allows remote attackers to inject arbitrary (no CVSS, Minimal Work SRL PixelYourSite)
- [CVE-2018-0579](https://cve.now/CVE-2018-0579.md): Cross-site scripting vulnerability in Open Graph for Facebook, Google+ and Twitter Card Tags plugin prior to version 2.2.4.1 for WordPress a (no CVSS, Webdados Open Graph for Facebook, Google+ and Twitter Card…)
- [CVE-2018-0580](https://cve.now/CVE-2018-0580.md): Untrusted search path vulnerability in CELSYS, Inc CLIP STUDIO series (CLIP STUDIO PAINT (for Windows) EX/PRO/DEBUT Ver.1.7.3 and earlier, C (no CVSS, CELSYS CLIP STUDIO series)
- [CVE-2018-0581](https://cve.now/CVE-2018-0581.md): Cross-site scripting vulnerability in ASUS RT-AC87U Firmware version prior to 3.0.0.4.378.9383 allows remote attackers to inject arbitrary w (no CVSS, ASUS Japan RT-AC87U)
- [CVE-2018-0582](https://cve.now/CVE-2018-0582.md): Cross-site scripting vulnerability in ASUS RT-AC68U Firmware version prior to 3.0.0.4.380.1031 allows remote attackers to inject arbitrary w (no CVSS, ASUS Japan RT-AC68U)
- [CVE-2018-0583](https://cve.now/CVE-2018-0583.md): Cross-site scripting vulnerability in ASUS RT-AC1200HP Firmware version prior to 3.0.0.4.380.4180 allows remote attackers to inject arbitrar (no CVSS, ASUS Japan RT-AC1200HP)
- [CVE-2018-0585](https://cve.now/CVE-2018-0585.md): Cross-site scripting vulnerability in Ultimate Member plugin prior to version 2.0.4 for WordPress allows remote attackers to inject arbitrar (no CVSS, Ultimate Member)
- [CVE-2018-0586](https://cve.now/CVE-2018-0586.md): Directory traversal vulnerability in the shortcodes function of Ultimate Member plugin prior to version 2.0.4 for WordPress allows remote au (no CVSS, Ultimate Member)
- [CVE-2018-0587](https://cve.now/CVE-2018-0587.md): Unrestricted file upload vulnerability in Ultimate Member plugin prior to version 2.0.4 for WordPress allows remote authenticated users to u (no CVSS, Ultimate Member)
- [CVE-2018-0588](https://cve.now/CVE-2018-0588.md): Directory traversal vulnerability in the AJAX function of Ultimate Member plugin prior to version 2.0.4 for WordPress allows remote attacker (no CVSS, Ultimate Member)
- [CVE-2018-0589](https://cve.now/CVE-2018-0589.md): Ultimate Member plugin prior to version 2.0.4 for WordPress allows remote authenticated attackers to bypass access restriction to add a new (no CVSS, Ultimate Member)
- [CVE-2018-0590](https://cve.now/CVE-2018-0590.md): Ultimate Member plugin prior to version 2.0.4 for WordPress allows remote authenticated attackers to bypass access restriction to modify the (no CVSS, Ultimate Member)
- [CVE-2018-0591](https://cve.now/CVE-2018-0591.md): The KINEPASS App for Android Ver 3.1.1 and earlier, and for iOS Ver 3.1.2 and earlier do not verify X.509 certificates from SSL servers, whi (no CVSS, T-JOY CO. KINEPASS App)
- [CVE-2018-5230](https://cve.now/CVE-2018-5230.md): The issue collector in Atlassian Jira before version 7.6.6, from version 7.7.0 before version 7.7.4, from version 7.8.0 before version 7.8.4 (no CVSS, Atlassian Jira)
- [CVE-2018-11037](https://cve.now/CVE-2018-11037.md): In Exiv2 0.26, the Exiv2::PngImage::printStructure function in pngimage.cpp allows remote attackers to cause an information leak via a craft (no CVSS)
- [CVE-2018-10944](https://cve.now/CVE-2018-10944.md): The request\_dividend function of a smart contract implementation for ROC (aka Rasputin Online Coin), an Ethereum ERC20 token, allows attacke (no CVSS)
- [CVE-2018-11034](https://cve.now/CVE-2018-11034.md): In 2345 Security Guard 3.7, the driver file (2345NsProtect.sys, X64 version) allows local users to cause a denial of service (BSOD) or possi (no CVSS)
- [CVE-2018-11035](https://cve.now/CVE-2018-11035.md): In 2345 Security Guard 3.7, the driver file (2345NsProtect.sys, X64 version) allows local users to cause a denial of service (BSOD) or possi (no CVSS)
- [CVE-2018-11031](https://cve.now/CVE-2018-11031.md): application/home/controller/debug.php in PHPRAP 1.0.4 through 1.0.8 has SSRF via the /debug URI, as demonstrated by an api\[url\]=file:////etc (no CVSS)
- [CVE-2018-11032](https://cve.now/CVE-2018-11032.md): PHPRAP 1.0.4 through 1.0.8 has SQL Injection via the application/home/controller/project.php search() function. (no CVSS)
- [CVE-2018-11033](https://cve.now/CVE-2018-11033.md): The DCTStream::readHuffSym function in Stream.cc in the DCT decoder in xpdf before 4.00 allows remote attackers to cause a denial of service (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2018-05-14
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.