CVEs published May 22, 2018
63 CVEs were published on May 22, 2018: 0 critical, 3 high.
- Published
- 63
- Critical
- 0
- High
- 3
- Medium
- 4
- Low
- 0
- Unrated
- 56
- Now in CISA KEV
- 0
- Fix available
- 7
Most affected products
- dolibarr/dolibarr
- 4
- Intel Multiple
- 2
- Micro Focus Network Operations Management Ultimate · Micro…
- 2
- [UNKNOWN] hawtio
- 1
- [UNKNOWN] jenkins · org.jenkins-ci.main:jenkins-core
- 1
- @ckeditor/ckeditor5-link
- 1
- IBM StoredIQ
- 1
- jbossas
- 1
- joomla/joomla-cms
- 1
- Micro Focus HP Service Manager Software
- 1
High 3
- CVE-2018-6493MFSBGN03806 rev.1 - HP Network Automation Software, Network Operations Management (NOM) Suite, Multiple VulnerabilitiesMicro Focus Network Operations Management Ultimate · Micro…
- CVE-2016-8656Jboss jbossas before versions 5.2.0-23, 6.4.13, 7.0.5 is vulnerable to an unsafe file handling in the jboss init script which could result ijbossas
- CVE-2017-2617hawtio before version 1.5.5 is vulnerable to remote code execution via file upload.[UNKNOWN] hawtio
Medium, low and unrated 60
- CVE-2018-11354In Wireshark 2.6.0, the IEEE 1905.1a dissector could crash.
- CVE-2018-11355In Wireshark 2.6.0, the RTCP dissector could crash.
- CVE-2018-11356In Wireshark 2.6.0, 2.4.0 to 2.4.6, and 2.2.0 to 2.2.14, the DNS dissector could crash.
- CVE-2018-11357In Wireshark 2.6.0, 2.4.0 to 2.4.6, and 2.2.0 to 2.2.14, the LTP dissector and other dissectors could consume excessive memory.
- CVE-2018-11358In Wireshark 2.6.0, 2.4.0 to 2.4.6, and 2.2.0 to 2.2.14, the Q.931 dissector could crash.
- CVE-2018-11359In Wireshark 2.6.0, 2.4.0 to 2.4.6, and 2.2.0 to 2.2.14, the RRC dissector and other dissectors could crash.
- CVE-2018-11360In Wireshark 2.6.0, 2.4.0 to 2.4.6, and 2.2.0 to 2.2.14, the GSM A DTAP dissector could crash.
- CVE-2018-11361In Wireshark 2.6.0, the IEEE 802.11 protocol dissector could crash.
- CVE-2018-11362In Wireshark 2.6.0, 2.4.0 to 2.4.6, and 2.2.0 to 2.2.14, the LDSS dissector could crash.
- CVE-2018-10092The admin panel in Dolibarr before 7.0.2 might allow remote attackers to execute arbitrary commands by leveraging support for updating the adolibarr/dolibarr
- CVE-2018-10094SQL injection vulnerability in Dolibarr before 7.0.2 allows remote attackers to execute arbitrary SQL commands via vectors involving integerdolibarr/dolibarr
- CVE-2018-10095Cross-site scripting (XSS) vulnerability in Dolibarr before 7.0.2 allows remote attackers to inject arbitrary web script or HTML via the fordolibarr/dolibarr
- CVE-2018-9019SQL Injection vulnerability in Dolibarr before version 7.0.2 allows remote attackers to execute arbitrary SQL commands via the sortfield pardolibarr/dolibarr
- CVE-2018-11375The _inst__lds() function in radare2 2.5.0 allows remote attackers to cause a denial of service (heap-based out-of-bounds read and applicati
- CVE-2018-11376The r_read_le32() function in radare2 2.5.0 allows remote attackers to cause a denial of service (heap-based out-of-bounds read and applicat
- CVE-2018-11377The avr_op_analyze() function in radare2 2.5.0 allows remote attackers to cause a denial of service (heap-based out-of-bounds read and appli
- CVE-2018-11378The wasm_dis() function in libr/asm/arch/wasm/wasm.c in or possibly have unspecified other impact via a crafted WASM file.
- CVE-2018-11379The get_debug_info() function in radare2 2.5.0 allows remote attackers to cause a denial of service (heap-based out-of-bounds read and appli
- CVE-2018-11380The parse_import_ptr() function in radare2 2.5.0 allows remote attackers to cause a denial of service (heap-based out-of-bounds read and app
- CVE-2018-11381The string_scan_range() function in radare2 2.5.0 allows remote attackers to cause a denial of service (heap-based out-of-bounds read and ap
- CVE-2018-11382The _inst__sts() function in radare2 2.5.0 allows remote attackers to cause a denial of service (heap-based out-of-bounds read and applicati
- CVE-2018-11383The r_strbuf_fini() function in radare2 2.5.0 allows remote attackers to cause a denial of service (invalid free and application crash) via
- CVE-2018-11384The sh_op() function in radare2 2.5.0 allows remote attackers to cause a denial of service (heap-based out-of-bounds read and application cr
- CVE-2018-6492MFSBGN03806 rev.1 - HP Network Automation Software, Network Operations Management (NOM) Suite, Multiple VulnerabilitiesMicro Focus Network Operations Management Ultimate · Micro…
- CVE-2015-8094Open redirect vulnerability in Cloudera HUE before 3.10.0 allows remote attackers to redirect users to arbitrary web sites and conduct phish
- CVE-2018-11093Cross-site scripting (XSS) vulnerability in the Link package for CKEditor 5 before 10.0.1 allows remote attackers to inject arbitrary web sc@ckeditor/ckeditor5-link
- CVE-2018-6494MFSBGN03807 rev.1 - HP Service Manager Software, Multiple VulnerabilitiesMicro Focus HP Service Manager Software
- CVE-2017-2609jenkins before versions 2.44, 2.32.2 is vulnerable to an information disclosure vulnerability in search suggestions (SECURITY-385).[UNKNOWN] jenkins · org.jenkins-ci.main:jenkins-core
- CVE-2018-11372iScripts eSwap v2.4 has SQL injection via the wishlistdetailed.php User Panel ToId parameter.
- CVE-2018-11373iScripts eSwap v2.4 has SQL injection via the "salelistdetailed.php" User Panel ToId parameter.
- CVE-2018-11371SkyCaiji 1.2 allows CSRF to add an Administrator user.
- CVE-2018-11321An issue was discovered in com_fields in Joomla! Core before 3.8.8.
- CVE-2018-11322An issue was discovered in Joomla! Core before 3.8.8.
- CVE-2018-11323An issue was discovered in Joomla! Core before 3.8.8.
- CVE-2018-11324An issue was discovered in Joomla! Core before 3.8.8.
- CVE-2018-11325An issue was discovered in Joomla! Core before 3.8.8.
- CVE-2018-11326An issue was discovered in Joomla! Core before 3.8.8.joomla/joomla-cms
- CVE-2018-11327An issue was discovered in Joomla! Core before 3.8.8.
- CVE-2018-11328An issue was discovered in Joomla! Core before 3.8.8.
- CVE-2018-11369An issue was discovered in PbootCMS v1.0.9.
- CVE-2018-6378In Joomla! Core before 3.8.8, inadequate filtering of file and folder names leads to various XSS attack vectors in the media manager.
- CVE-2018-11366init.php in the Loginizer plugin 1.3.8 through 1.3.9 for WordPress has Unauthenticated Stored Cross-Site Scripting (XSS) because logging is
- CVE-2018-11367An issue was discovered in CppCMS before 1.2.1.
- CVE-2018-1583IBM StoredIQ 7.6 could allow an authenticated attacker to bypass certain security restrictions.IBM StoredIQ
- CVE-2018-6962VMware Fusion (10.x before 10.1.2) contains a signature bypass vulnerability which may lead to a local privilege escalation.VMware Fusion
- CVE-2018-6963VMware Workstation (14.x before 14.1.2) and Fusion (10.x before 10.1.2) contain multiple denial-of-service vulnerabilities that occur due toVMware Workstation · VMware Fusion
- CVE-2018-3639Systems with microprocessors utilizing speculative execution and speculative execution of memory reads before the addresses of all prior memIntel Multiple
- CVE-2018-3640Systems with microprocessors utilizing speculative execution and that perform speculative reads of system registers may allow unauthorized dIntel Multiple
- CVE-2018-11329The DrugDealer function of a smart contract implementation for Ether Cartel, an Ethereum game, allows attackers to take over the contract's
- CVE-2018-11363jpeg_size in pdfgen.c in PDFGen before 2018-04-09 has a heap-based buffer over-read.
- CVE-2018-11364sav_parse_machine_integer_info_record in spss/readstat_sav_read.c in libreadstat.a in ReadStat 0.1.1 has a memory leak related to an iconv_o
- CVE-2018-11365sas/readstat_sas7bcat_read.c in libreadstat.a in ReadStat 0.1.1 has an infinite loop.
- CVE-2018-11339An XSS issue was discovered in Frappe ERPNext v11.x.x-develop b1036e5 via a comment.
- CVE-2018-11340An unrestricted file upload vulnerability in importuser.cgi in ASUSTOR AS6202T ADM 3.1.0.RFQ3 allows attackers to upload supplied data to a
- CVE-2018-11341Directory traversal in importuser.cgi in ASUSTOR AS6202T ADM 3.1.0.RFQ3 allows attackers to navigate the file system via the filename parame
- CVE-2018-11342A path traversal vulnerability in fileExplorer.cgi in ASUSTOR AS6202T ADM 3.1.0.RFQ3 allows attackers to arbitrarily specify a path to a fil
- CVE-2018-11343A persistent cross site scripting vulnerability in playlistmanger.cgi in the ASUSTOR SoundsGood application allows attackers to store cross
- CVE-2018-11344A path traversal vulnerability in download.cgi in ASUSTOR AS6202T ADM 3.1.0.RFQ3 allows attackers to arbitrarily specify a file on the syste
- CVE-2018-11345An unrestricted file upload vulnerability in upload.cgi in ASUSTOR AS6202T ADM 3.1.0.RFQ3 allows attackers to upload supplied data via the P
- CVE-2018-11346An insecure direct object reference vulnerability in download.cgi in ASUSTOR AS6202T ADM 3.1.0.RFQ3 allows the ability to reference the "dow