# CVEs published 2018-05-16 28 CVEs were published on May 16, 2018: 0 critical, 0 high. Days are UTC. - [CVE-2018-1172](https://cve.now/CVE-2018-1172.md): This vulnerability allows remote attackers to deny service on vulnerable installations of The Squid Software Foundation Squid 3.5.27-2018031 (no CVSS, The Squid Software Foundation Squid) - [CVE-2017-17688](https://cve.now/CVE-2017-17688.md): The OpenPGP specification allows a Cipher Feedback Mode (CFB) malleability-gadget attack that can indirectly lead to plaintext exfiltration, (no CVSS) - [CVE-2017-17689](https://cve.now/CVE-2017-17689.md): The S/MIME specification allows a Cipher Block Chaining (CBC) malleability-gadget attack that can indirectly lead to plaintext exfiltration, (no CVSS) - [CVE-2018-11212](https://cve.now/CVE-2018-11212.md): An issue was discovered in libjpeg 9a and 9d. (no CVSS) - [CVE-2018-11213](https://cve.now/CVE-2018-11213.md): An issue was discovered in libjpeg 9a. (no CVSS) - [CVE-2018-11214](https://cve.now/CVE-2018-11214.md): An issue was discovered in libjpeg 9a. (no CVSS) - [CVE-2018-4850](https://cve.now/CVE-2018-4850.md): A vulnerability has been identified in SIMATIC S7-400 (incl. (no CVSS, Siemens AG SIMATIC S7-400 (incl. F) CPU hardware) - [CVE-2018-8014](https://cve.now/CVE-2018-8014.md): The defaults settings for the CORS filter provided in Apache Tomcat 9.0.0.M1 to 9.0.8, 8.5.0 to 8.5.31, 8.0.0.RC1 to 8.0.52, 7.0.41 to 7.0.8 (no CVSS, Apache Software Foundation Apache Tomcat · org.apache.tomca…) - [CVE-2018-11202](https://cve.now/CVE-2018-11202.md): A NULL pointer dereference was discovered in H5S\_hyper\_make\_spans in H5Shyper.c in the HDF HDF5 1.10.2 library. (no CVSS) - [CVE-2018-11203](https://cve.now/CVE-2018-11203.md): A division by zero was discovered in H5D\_\_btree\_decode\_key in H5Dbtree.c in the HDF HDF5 1.10.2 library. (no CVSS) - [CVE-2018-11204](https://cve.now/CVE-2018-11204.md): A NULL pointer dereference was discovered in H5O\_\_chunk\_deserialize in H5Ocache.c in the HDF HDF5 1.10.2 library. (no CVSS) - [CVE-2018-11205](https://cve.now/CVE-2018-11205.md): A out of bounds read was discovered in H5VM\_memcpyvv in H5VM.c in the HDF HDF5 1.10.2 library. (no CVSS) - [CVE-2018-11207](https://cve.now/CVE-2018-11207.md): A division by zero was discovered in H5D\_\_chunk\_init in H5Dchunk.c in the HDF HDF5 1.10.2 library. (no CVSS) - [CVE-2018-11208](https://cve.now/CVE-2018-11208.md): An issue was discovered in Z-BlogPHP 2.0.0. (no CVSS) - [CVE-2018-11209](https://cve.now/CVE-2018-11209.md): An issue was discovered in Z-BlogPHP 2.0.0. (no CVSS) - [CVE-2018-11210](https://cve.now/CVE-2018-11210.md): TinyXML2 6.2.0 has a heap-based buffer over-read in the XMLDocument::Parse function in libtinyxml2.so. (no CVSS) - [CVE-2018-10240](https://cve.now/CVE-2018-10240.md): SolarWinds Serv-U MFT before 15.1.6 HFv1 assigns authenticated users a low-entropy session token that can be included in requests to the app (no CVSS) - [CVE-2018-10241](https://cve.now/CVE-2018-10241.md): A denial of service vulnerability in SolarWinds Serv-U before 15.1.6 HFv1 allows an authenticated user to crash the application (with a NULL (no CVSS) - [CVE-2018-10759](https://cve.now/CVE-2018-10759.md): PHP remote file inclusion vulnerability in public/patch/patch.php in Project Pier 0.8.8 and earlier allows remote attackers to execute arbit (no CVSS) - [CVE-2018-10760](https://cve.now/CVE-2018-10760.md): Unrestricted file upload vulnerability in the Files plugin in ProjectPier 0.88 and earlier allows remote authenticated users to execute arbi (no CVSS) - [CVE-2018-10123](https://cve.now/CVE-2018-10123.md): p910nd on Inteno IOPSYS 2.0 through 4.2.0 allows remote attackers to read, or append data to, arbitrary files via requests on TCP port 9100. (no CVSS) - [CVE-2018-10735](https://cve.now/CVE-2018-10735.md): A SQL injection issue was discovered in Nagios XI before 5.4.13 via the admin/commandline.php cname parameter. (no CVSS) - [CVE-2018-10736](https://cve.now/CVE-2018-10736.md): A SQL injection issue was discovered in Nagios XI before 5.4.13 via the admin/info.php key1 parameter. (no CVSS) - [CVE-2018-10737](https://cve.now/CVE-2018-10737.md): A SQL injection issue was discovered in Nagios XI before 5.4.13 via the admin/logbook.php txtSearch parameter. (no CVSS) - [CVE-2018-10738](https://cve.now/CVE-2018-10738.md): A SQL injection issue was discovered in Nagios XI before 5.4.13 via the admin/menuaccess.php chbKey1 parameter. (no CVSS) - [CVE-2018-10810](https://cve.now/CVE-2018-10810.md): chat/mobile/index.php in LiveZilla Live Chat 7.0.9.5 and prior is affected by Cross-Site Scripting via the Accept-Language HTTP header. (no CVSS) - [CVE-2018-5231](https://cve.now/CVE-2018-5231.md): The ForgotLoginDetails resource in Atlassian Jira before version 7.6.6, from version 7.7.0 before version 7.7.4, from version 7.8.0 before v (no CVSS, Atlassian Jira) - [CVE-2018-11206](https://cve.now/CVE-2018-11206.md): An out of bounds read was discovered in H5O\_fill\_new\_decode and H5O\_fill\_old\_decode in H5Ofill.c in the HDF HDF5 1.10.2 library. (no CVSS) --- Source: cve.now, built and run by Sazabi (AI-native observability and security) Page: https://cve.now/daily/2018-05-16 Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.