# CVEs published 2018-05-15

37 CVEs were published on May 15, 2018: 0 critical, 3 high. Days are UTC.

- [CVE-2017-2613](https://cve.now/CVE-2017-2613.md): jenkins before versions 2.44, 2.32.2 is vulnerable to a user creation CSRF using GET by admins. (CVSS 5.4, \[UNKNOWN\] jenkins · org.jenkins-ci.main:jenkins-core)
- [CVE-2018-10589](https://cve.now/CVE-2018-10589.md): In Advantech WebAccess versions V8.2\_20170817 and prior, WebAccess versions V8.3.0 and prior, WebAccess Dashboard versions V.2.0.15 and prio (no CVSS, Advantech WebAccess)
- [CVE-2018-10590](https://cve.now/CVE-2018-10590.md): In Advantech WebAccess versions V8.2\_20170817 and prior, WebAccess versions V8.3.0 and prior, WebAccess Dashboard versions V.2.0.15 and prio (no CVSS, Advantech WebAccess)
- [CVE-2018-10591](https://cve.now/CVE-2018-10591.md): In Advantech WebAccess versions V8.2\_20170817 and prior, WebAccess versions V8.3.0 and prior, WebAccess Dashboard versions V.2.0.15 and prio (no CVSS, Advantech WebAccess)
- [CVE-2018-7495](https://cve.now/CVE-2018-7495.md): In Advantech WebAccess versions V8.2\_20170817 and prior, WebAccess versions V8.3.0 and prior, WebAccess Dashboard versions V.2.0.15 and prio (no CVSS, Advantech WebAccess)
- [CVE-2018-7497](https://cve.now/CVE-2018-7497.md): In Advantech WebAccess versions V8.2\_20170817 and prior, WebAccess versions V8.3.0 and prior, WebAccess Dashboard versions V.2.0.15 and prio (no CVSS, Advantech WebAccess)
- [CVE-2018-7499](https://cve.now/CVE-2018-7499.md): In Advantech WebAccess versions V8.2\_20170817 and prior, WebAccess versions V8.3.0 and prior, WebAccess Dashboard versions V.2.0.15 and prio (no CVSS, Advantech WebAccess)
- [CVE-2018-7501](https://cve.now/CVE-2018-7501.md): In Advantech WebAccess versions V8.2\_20170817 and prior, WebAccess versions V8.3.0 and prior, WebAccess Dashboard versions V.2.0.15 and prio (no CVSS, Advantech WebAccess)
- [CVE-2018-7503](https://cve.now/CVE-2018-7503.md): In Advantech WebAccess versions V8.2\_20170817 and prior, WebAccess versions V8.3.0 and prior, WebAccess Dashboard versions V.2.0.15 and prio (no CVSS, Advantech WebAccess)
- [CVE-2018-7505](https://cve.now/CVE-2018-7505.md): In Advantech WebAccess versions V8.2\_20170817 and prior, WebAccess versions V8.3.0 and prior, WebAccess Dashboard versions V.2.0.15 and prio (no CVSS, Advantech WebAccess)
- [CVE-2018-8841](https://cve.now/CVE-2018-8841.md): In Advantech WebAccess versions V8.2\_20170817 and prior, WebAccess versions V8.3.0 and prior, WebAccess Dashboard versions V.2.0.15 and prio (no CVSS, Advantech WebAccess)
- [CVE-2018-8845](https://cve.now/CVE-2018-8845.md): In Advantech WebAccess versions V8.2\_20170817 and prior, WebAccess versions V8.3.0 and prior, WebAccess Dashboard versions V.2.0.15 and prio (no CVSS, Advantech WebAccess)
- [CVE-2017-2602](https://cve.now/CVE-2017-2602.md): jenkins before versions 2.44, 2.32.2 is vulnerable to an improper blacklisting of the Pipeline metadata files in the agent-to-master securit (CVSS 3.1, \[UNKNOWN\] jenkins · org.jenkins-ci.main:jenkins-core)
- [CVE-2017-2603](https://cve.now/CVE-2017-2603.md): Jenkins before versions 2.44, 2.32.2 is vulnerable to a user data leak in disconnected agents' config.xml API. (CVSS 2.6, \[UNKNOWN\] jenkins · org.jenkins-ci.main:jenkins-core)
- [CVE-2017-2604](https://cve.now/CVE-2017-2604.md): In Jenkins before versions 2.44, 2.32.2 low privilege users were able to act on administrative monitors due to them not being consistently p (CVSS 4.3, \[UNKNOWN\] jenkins · org.jenkins-ci.main:jenkins-core)
- [CVE-2017-2610](https://cve.now/CVE-2017-2610.md): jenkins before versions 2.44, 2.32.2 is vulnerable to a persisted cross-site scripting in search suggestions due to improperly escaping user (CVSS 5.4, \[UNKNOWN\] jenkins · org.jenkins-ci.main:jenkins-core)
- [CVE-2017-2600](https://cve.now/CVE-2017-2600.md): In jenkins before versions 2.44, 2.32.2 node monitor data could be viewed by low privilege users via the remote API. (CVSS 4.3, \[UNKNOWN\] jenkins · org.jenkins-ci.main:jenkins-core)
- [CVE-2017-2608](https://cve.now/CVE-2017-2608.md): Jenkins before versions 2.44, 2.32.2 is vulnerable to a remote code execution vulnerability involving the deserialization of various types i (CVSS 8.8, \[UNKNOWN\] jenkins · org.jenkins-ci.main:jenkins-core)
- [CVE-2017-2612](https://cve.now/CVE-2017-2612.md): In Jenkins before versions 2.44, 2.32.2 low privilege users were able to override JDK download credentials (SECURITY-392), resulting in futu (CVSS 5.4, \[UNKNOWN\] jenkins · org.jenkins-ci.main:jenkins-core)
- [CVE-2018-1262](https://cve.now/CVE-2018-1262.md): Cloud Foundry Foundation UAA, versions 4.12.X and 4.13.X, introduced a feature which could allow privilege escalation across identity zones (no CVSS, Cloud Foundry CloudFoundry UAA · org.cloudfoundry.identity:…)
- [CVE-2018-1263](https://cve.now/CVE-2018-1263.md): Addresses partial fix in CVE-2018-1261. (no CVSS, Pivotal Spring Integration Zip · org.springframework.integr…)
- [CVE-2018-11094](https://cve.now/CVE-2018-11094.md): An issue was discovered on Intelbras NCLOUD 300 1.0 devices. (no CVSS)
- [CVE-2017-2815](https://cve.now/CVE-2017-2815.md): An exploitable XML entity injection vulnerability exists in OpenFire User Import Export Plugin 2.6.0. (CVSS 8.1, Talos Open Fire User Import Export Plugin)
- [CVE-2018-11126](https://cve.now/CVE-2018-11126.md): dg-user/?controller=users&action=add in doorGets 7.0 has CSRF that results in adding an administrator account. (no CVSS)
- [CVE-2018-11127](https://cve.now/CVE-2018-11127.md): e107 2.1.7 has CSRF resulting in arbitrary user deletion. (no CVSS)
- [CVE-2018-1087](https://cve.now/CVE-2018-1087.md): kernel KVM before versions kernel 4.16, kernel 4.16-rc7, kernel 4.17-rc1, kernel 4.17-rc2 and kernel 4.17-rc3 is vulnerable to a flaw in the (CVSS 8.0, kernel KVM)
- [CVE-2018-11105](https://cve.now/CVE-2018-11105.md): There is stored cross site scripting in the wp-live-chat-support plugin before 8.0.08 for WordPress via the "name" (aka wplc\_name) and "emai (no CVSS)
- [CVE-2018-3611](https://cve.now/CVE-2018-3611.md): Bounds check vulnerability in User Mode Driver in Intel Graphics Driver 15.40.x.4 and 21.20.x.x allows unprivileged user to cause a denial o (no CVSS, Intel Graphics Driver)
- [CVE-2018-3634](https://cve.now/CVE-2018-3634.md): Parameter corruption in NDIS filter driver in Intel Online Connect Access 1.9.22.0 allows an attacker to cause a denial of service via local (no CVSS, Intel Online Connect Access)
- [CVE-2018-3661](https://cve.now/CVE-2018-3661.md): Buffer overflow in Intel system Configuration utilities selview.exe and syscfg.exe before version 14 build 11 allows a local user to crash t (no CVSS, Intel System Configuration Utilities)
- [CVE-2018-1131](https://cve.now/CVE-2018-1131.md): Infinispan permits improper deserialization of trusted data via XML and JSON transcoders under certain server configurations. (no CVSS, Red Hat infinispan · org.infinispan:infinispan-core)
- [CVE-2018-10825](https://cve.now/CVE-2018-10825.md): Mimo Baby 2 devices do not use authentication or encryption for the Bluetooth Low Energy (BLE) communication from a Turtle to a Lilypad, whi (no CVSS)
- [CVE-2018-11102](https://cve.now/CVE-2018-11102.md): An issue was discovered in Libav 12.3. (no CVSS)
- [CVE-2018-11097](https://cve.now/CVE-2018-11097.md): An issue was discovered in cloudwu/cstring through 2016-11-09. (no CVSS)
- [CVE-2018-11098](https://cve.now/CVE-2018-11098.md): An issue was discovered in Frog CMS 0.9.5. (no CVSS)
- [CVE-2018-11100](https://cve.now/CVE-2018-11100.md): The decompileSETTARGET function in decompile.c in libming through 0.4.8 mishandles cases where the header indicates a file size greater than (no CVSS)
- [CVE-2018-11095](https://cve.now/CVE-2018-11095.md): The decompileJUMP function in decompile.c in libming through 0.4.8 mishandles cases where the header indicates a file size greater than the (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2018-05-15
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.