CVEs published May 18, 2018
31 CVEs were published on May 18, 2018: 0 critical, 0 high.
- Published
- 31
- Critical
- 0
- High
- 0
- Medium
- 1
- Low
- 0
- Unrated
- 30
- Now in CISA KEV
- 0
- Fix available
- 1
Most affected products
- Schneider Electric SE Ampla MES
- 2
- Tenable Nessus
- 2
- Apache Software Foundation Apache ORC · org.apache.orc:orc
- 1
- ICS-CERT GE PACSystems RX3i CPE305/310
- 1
- Medtronic N'Vision Clinician Programmer · Medtronic 8870 N’…
- 1
Medium, low and unrated 31
- CVE-2018-1147In Nessus before 7.1.0, a XSS vulnerability exists due to improper input validation.Tenable Nessus
- CVE-2018-1148In Nessus before 7.1.0, Session Fixation exists due to insufficient session management within the application.Tenable Nessus
- CVE-2018-6562totemomail Encryption Gateway before 6.0_b567 allows remote attackers to obtain sensitive information about user sessions and encryption key
- CVE-2018-8867In GE PACSystems RX3i CPE305/310 version 9.20 and prior, RX3i CPE330 version 9.21 and prior, RX3i CPE 400 version 9.30 and prior, PACSystemsICS-CERT GE PACSystems RX3i CPE305/310
- CVE-2017-18271In ImageMagick 7.0.7-16 Q16 x86_64 2017-12-22, an infinite loop vulnerability was found in the function ReadMIFFImage in coders/miff.c, whic
- CVE-2017-18272In ImageMagick 7.0.7-16 Q16 x86_64 2017-12-25, there is a use-after-free in ReadOneMNGImage in coders/png.c, which allows attackers to cause
- CVE-2017-18273In ImageMagick 7.0.7-16 Q16 x86_64 2017-12-22, an infinite loop vulnerability was found in the function ReadTXTImage in coders/txt.c, which
- CVE-2018-11251In ImageMagick 7.0.7-23 Q16 x86_64 2018-01-24, there is a heap-based buffer over-read in ReadSUNImage in coders/sun.c, which allows attacker
- CVE-2018-11254An issue was discovered in PoDoFo 0.9.5.
- CVE-2018-11255An issue was discovered in PoDoFo 0.9.5.
- CVE-2018-11256An issue was discovered in PoDoFo 0.9.5.
- CVE-2018-1000400Kubernetes CRI-O version prior to 1.9 contains a Privilege Context Switching Error (CWE-270) vulnerability in the handling of ambient capabi
- CVE-2018-11245app/webroot/js/misp.js in MISP 2.4.91 has a DOM based XSS with cortex type attributes.
- CVE-2018-11248util/FileDownloadUtils.java in FileDownloader 1.7.3 does not check an attachment's name.
- CVE-2018-11243PackLinuxElf64::unpack in p_lx_elf.cpp in UPX 3.95 allows remote attackers to cause a denial of service (double free), limit the ability of
- CVE-2018-11244The BBE theme before 1.53 for WordPress allows a direct launch of an HTML editor.
- CVE-2018-8015In Apache ORC 1.0.0 to 1.4.3 a malformed ORC file can trigger an endlessly recursive function call in the C++ or Java parser.Apache Software Foundation Apache ORC · org.apache.orc:orc
- CVE-2017-18269An SSE2-optimized memmove implementation for i386 in sysdeps/i386/i686/multiarch/memcpy-sse2-unaligned.S in the GNU C Library (aka glibc or
- CVE-2017-18270In the Linux kernel before 4.13.5, a local user could create keyrings for other users via keyctl commands, setting unwanted defaults or caus
- CVE-2018-11236stdlib/canonicalize.c in the GNU C Library (aka glibc or libc6) 2.27 and earlier, when processing very long pathname arguments to the realpa
- CVE-2018-11237An AVX-512-optimized implementation of the mempcpy function in the GNU C Library (aka glibc or libc6) 2.27 and earlier may write data beyond
- CVE-2018-5256CoreOS Tectonic 1.7.x before 1.7.9-tectonic.4 and 1.8.x before 1.8.4-tectonic.3 mounts a direct proxy to the kubernetes cluster at /api/kube
- CVE-2018-10967On D-Link DIR-550A and DIR-604M devices through v2.10KR, a malicious user can forge an HTTP request to inject operating system commands that
- CVE-2018-10968On D-Link DIR-550A and DIR-604M devices through v2.10KR, a malicious user can use a default TELNET account to get unauthorized access to vul
- CVE-2018-9250interface\super\edit_list.php in OpenEMR before v5_0_1_1 allows remote authenticated users to execute arbitrary SQL commands via the newlist
- CVE-2017-9635Schneider Electric Ampla MES 6.4 provides capability to configure users and their privileges.Schneider Electric SE Ampla MES
- CVE-2017-9637Schneider Electric Ampla MES 6.4 provides capability to interact with data from third party databases.Schneider Electric SE Ampla MES
- CVE-2018-10306Services/Form/classes/class.ilDateDurationInputGUI.php and Services/Form/classes/class.ilDateTimeInputGUI.php in ILIAS 5.1.x through 5.3.x b
- CVE-2018-10307error.php in ILIAS 5.2.x through 5.3.x before 5.3.4 allows XSS via the text of a PDO exception.
- CVE-2018-8849Medtronic N'Vision Clinician Programmer Missing Encryption of Sensitive DataMedtronic N'Vision Clinician Programmer · Medtronic 8870 N’…
- CVE-2018-11232The etm_setup_aux function in drivers/hwtracing/coresight/coresight-etm-perf.c in the Linux kernel before 4.10.2 allows attackers to cause a