# CVEs published 2018-05-21

13 CVEs were published on May 21, 2018: 0 critical, 1 high. Days are UTC.

- [CVE-2017-2607](https://cve.now/CVE-2017-2607.md): jenkins before versions 2.44, 2.32.2 is vulnerable to a persisted cross-site scripting vulnerability in console notes (SECURITY-382). (CVSS 4.2, \[UNKNOWN\] jenkins · org.jenkins-ci.main:jenkins-core)
- [CVE-2018-1108](https://cve.now/CVE-2018-1108.md): kernel drivers before version 4.17-rc1 are vulnerable to a weakness in the Linux kernel's implementation of random seed data. (CVSS 5.9, kernel drivers)
- [CVE-2018-11330](https://cve.now/CVE-2018-11330.md): An issue was discovered in Pluck before 4.7.6. (no CVSS)
- [CVE-2018-11331](https://cve.now/CVE-2018-11331.md): An issue was discovered in Pluck before 4.7.6. (no CVSS)
- [CVE-2018-7687](https://cve.now/CVE-2018-7687.md): Client for OES Elevation of Privilege via Buffer Overflow (CVSS 7.8, Micro Focus Client for Open Enterprise Server)
- [CVE-2018-8010](https://cve.now/CVE-2018-8010.md): This vulnerability in Apache Solr 6.0.0 to 6.6.3, 7.0.0 to 7.3.0 relates to an XML external entity expansion (XXE) in Solr config files (sol (no CVSS, Apache Software Foundation Apache Solr · org.apache.solr:so…)
- [CVE-2018-8012](https://cve.now/CVE-2018-8012.md): No authentication/authorization is enforced when a server attempts to join a quorum in Apache ZooKeeper before 3.4.10, and 3.5.0-alpha throu (no CVSS, Apache Software Foundation Apache ZooKeeper · org.apache.zo…)
- [CVE-2018-1067](https://cve.now/CVE-2018-1067.md): In Undertow before versions 7.1.2.CR1, 7.1.2.GA it was found that the fix for CVE-2016-4993 was incomplete and Undertow web server is vulner (CVSS 5.4, \[UNKNOWN\] undertow · org.jboss.eap:wildfly-undertow)
- [CVE-2018-7268](https://cve.now/CVE-2018-7268.md): MagniComp SysInfo before 10-H81, as shipped with BMC BladeLogic Automation and other products, contains an information exposure vulnerabilit (no CVSS)
- [CVE-2018-11092](https://cve.now/CVE-2018-11092.md): An issue was discovered in the Admin Notes plugin 1.1 for MyBB. (no CVSS)
- [CVE-2018-11096](https://cve.now/CVE-2018-11096.md): Horse Market Sell & Rent Portal Script 1.5.7 has a CSRF vulnerability through which an attacker can change all of the target's account infor (no CVSS)
- [CVE-2018-11320](https://cve.now/CVE-2018-11320.md): In Octopus Deploy 2018.4.4 through 2018.5.1, Octopus variables that are sourced from the target do not have sensitive values obfuscated in t (no CVSS)
- [CVE-2018-8142](https://cve.now/CVE-2018-8142.md): A security feature bypass exists when Windows incorrectly validates kernel driver signatures, aka "Windows Security Feature Bypass Vulnerabi (no CVSS, Microsoft Windows Server · Microsoft Windows)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2018-05-21
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.