# CVEs published 2018-05-22

63 CVEs were published on May 22, 2018: 0 critical, 3 high. Days are UTC.

- [CVE-2018-11354](https://cve.now/CVE-2018-11354.md): In Wireshark 2.6.0, the IEEE 1905.1a dissector could crash. (no CVSS)
- [CVE-2018-11355](https://cve.now/CVE-2018-11355.md): In Wireshark 2.6.0, the RTCP dissector could crash. (no CVSS)
- [CVE-2018-11356](https://cve.now/CVE-2018-11356.md): In Wireshark 2.6.0, 2.4.0 to 2.4.6, and 2.2.0 to 2.2.14, the DNS dissector could crash. (no CVSS)
- [CVE-2018-11357](https://cve.now/CVE-2018-11357.md): In Wireshark 2.6.0, 2.4.0 to 2.4.6, and 2.2.0 to 2.2.14, the LTP dissector and other dissectors could consume excessive memory. (no CVSS)
- [CVE-2018-11358](https://cve.now/CVE-2018-11358.md): In Wireshark 2.6.0, 2.4.0 to 2.4.6, and 2.2.0 to 2.2.14, the Q.931 dissector could crash. (no CVSS)
- [CVE-2018-11359](https://cve.now/CVE-2018-11359.md): In Wireshark 2.6.0, 2.4.0 to 2.4.6, and 2.2.0 to 2.2.14, the RRC dissector and other dissectors could crash. (no CVSS)
- [CVE-2018-11360](https://cve.now/CVE-2018-11360.md): In Wireshark 2.6.0, 2.4.0 to 2.4.6, and 2.2.0 to 2.2.14, the GSM A DTAP dissector could crash. (no CVSS)
- [CVE-2018-11361](https://cve.now/CVE-2018-11361.md): In Wireshark 2.6.0, the IEEE 802.11 protocol dissector could crash. (no CVSS)
- [CVE-2018-11362](https://cve.now/CVE-2018-11362.md): In Wireshark 2.6.0, 2.4.0 to 2.4.6, and 2.2.0 to 2.2.14, the LDSS dissector could crash. (no CVSS)
- [CVE-2018-10092](https://cve.now/CVE-2018-10092.md): The admin panel in Dolibarr before 7.0.2 might allow remote attackers to execute arbitrary commands by leveraging support for updating the a (no CVSS, dolibarr/dolibarr)
- [CVE-2018-10094](https://cve.now/CVE-2018-10094.md): SQL injection vulnerability in Dolibarr before 7.0.2 allows remote attackers to execute arbitrary SQL commands via vectors involving integer (no CVSS, dolibarr/dolibarr)
- [CVE-2018-10095](https://cve.now/CVE-2018-10095.md): Cross-site scripting (XSS) vulnerability in Dolibarr before 7.0.2 allows remote attackers to inject arbitrary web script or HTML via the for (no CVSS, dolibarr/dolibarr)
- [CVE-2018-9019](https://cve.now/CVE-2018-9019.md): SQL Injection vulnerability in Dolibarr before version 7.0.2 allows remote attackers to execute arbitrary SQL commands via the sortfield par (no CVSS, dolibarr/dolibarr)
- [CVE-2018-11375](https://cve.now/CVE-2018-11375.md): The \_inst\_\_lds() function in radare2 2.5.0 allows remote attackers to cause a denial of service (heap-based out-of-bounds read and applicati (no CVSS)
- [CVE-2018-11376](https://cve.now/CVE-2018-11376.md): The r\_read\_le32() function in radare2 2.5.0 allows remote attackers to cause a denial of service (heap-based out-of-bounds read and applicat (no CVSS)
- [CVE-2018-11377](https://cve.now/CVE-2018-11377.md): The avr\_op\_analyze() function in radare2 2.5.0 allows remote attackers to cause a denial of service (heap-based out-of-bounds read and appli (no CVSS)
- [CVE-2018-11378](https://cve.now/CVE-2018-11378.md): The wasm\_dis() function in libr/asm/arch/wasm/wasm.c in or possibly have unspecified other impact via a crafted WASM file. (no CVSS)
- [CVE-2018-11379](https://cve.now/CVE-2018-11379.md): The get\_debug\_info() function in radare2 2.5.0 allows remote attackers to cause a denial of service (heap-based out-of-bounds read and appli (no CVSS)
- [CVE-2018-11380](https://cve.now/CVE-2018-11380.md): The parse\_import\_ptr() function in radare2 2.5.0 allows remote attackers to cause a denial of service (heap-based out-of-bounds read and app (no CVSS)
- [CVE-2018-11381](https://cve.now/CVE-2018-11381.md): The string\_scan\_range() function in radare2 2.5.0 allows remote attackers to cause a denial of service (heap-based out-of-bounds read and ap (no CVSS)
- [CVE-2018-11382](https://cve.now/CVE-2018-11382.md): The \_inst\_\_sts() function in radare2 2.5.0 allows remote attackers to cause a denial of service (heap-based out-of-bounds read and applicati (no CVSS)
- [CVE-2018-11383](https://cve.now/CVE-2018-11383.md): The r\_strbuf\_fini() function in radare2 2.5.0 allows remote attackers to cause a denial of service (invalid free and application crash) via (no CVSS)
- [CVE-2018-11384](https://cve.now/CVE-2018-11384.md): The sh\_op() function in radare2 2.5.0 allows remote attackers to cause a denial of service (heap-based out-of-bounds read and application cr (no CVSS)
- [CVE-2018-6492](https://cve.now/CVE-2018-6492.md): MFSBGN03806 rev.1 - HP Network Automation Software, Network Operations Management (NOM) Suite, Multiple Vulnerabilities (CVSS 4.7, Micro Focus Network Operations Management Ultimate · Micro…)
- [CVE-2018-6493](https://cve.now/CVE-2018-6493.md): MFSBGN03806 rev.1 - HP Network Automation Software, Network Operations Management (NOM) Suite, Multiple Vulnerabilities (CVSS 8.7, Micro Focus Network Operations Management Ultimate · Micro…)
- [CVE-2015-8094](https://cve.now/CVE-2015-8094.md): Open redirect vulnerability in Cloudera HUE before 3.10.0 allows remote attackers to redirect users to arbitrary web sites and conduct phish (no CVSS)
- [CVE-2018-11093](https://cve.now/CVE-2018-11093.md): Cross-site scripting (XSS) vulnerability in the Link package for CKEditor 5 before 10.0.1 allows remote attackers to inject arbitrary web sc (no CVSS, @ckeditor/ckeditor5-link)
- [CVE-2018-6494](https://cve.now/CVE-2018-6494.md): MFSBGN03807 rev.1 - HP Service Manager Software, Multiple Vulnerabilities (CVSS 6.4, Micro Focus HP Service Manager Software)
- [CVE-2016-8656](https://cve.now/CVE-2016-8656.md): Jboss jbossas before versions 5.2.0-23, 6.4.13, 7.0.5 is vulnerable to an unsafe file handling in the jboss init script which could result i (CVSS 7.0, jbossas)
- [CVE-2017-2609](https://cve.now/CVE-2017-2609.md): jenkins before versions 2.44, 2.32.2 is vulnerable to an information disclosure vulnerability in search suggestions (SECURITY-385). (CVSS 4.3, \[UNKNOWN\] jenkins · org.jenkins-ci.main:jenkins-core)
- [CVE-2017-2617](https://cve.now/CVE-2017-2617.md): hawtio before version 1.5.5 is vulnerable to remote code execution via file upload. (CVSS 7.6, \[UNKNOWN\] hawtio)
- [CVE-2018-11372](https://cve.now/CVE-2018-11372.md): iScripts eSwap v2.4 has SQL injection via the wishlistdetailed.php User Panel ToId parameter. (no CVSS)
- [CVE-2018-11373](https://cve.now/CVE-2018-11373.md): iScripts eSwap v2.4 has SQL injection via the "salelistdetailed.php" User Panel ToId parameter. (no CVSS)
- [CVE-2018-11371](https://cve.now/CVE-2018-11371.md): SkyCaiji 1.2 allows CSRF to add an Administrator user. (no CVSS)
- [CVE-2018-11321](https://cve.now/CVE-2018-11321.md): An issue was discovered in com\_fields in Joomla! Core before 3.8.8. (no CVSS)
- [CVE-2018-11322](https://cve.now/CVE-2018-11322.md): An issue was discovered in Joomla! Core before 3.8.8. (no CVSS)
- [CVE-2018-11323](https://cve.now/CVE-2018-11323.md): An issue was discovered in Joomla! Core before 3.8.8. (no CVSS)
- [CVE-2018-11324](https://cve.now/CVE-2018-11324.md): An issue was discovered in Joomla! Core before 3.8.8. (no CVSS)
- [CVE-2018-11325](https://cve.now/CVE-2018-11325.md): An issue was discovered in Joomla! Core before 3.8.8. (no CVSS)
- [CVE-2018-11326](https://cve.now/CVE-2018-11326.md): An issue was discovered in Joomla! Core before 3.8.8. (no CVSS, joomla/joomla-cms)
- [CVE-2018-11327](https://cve.now/CVE-2018-11327.md): An issue was discovered in Joomla! Core before 3.8.8. (no CVSS)
- [CVE-2018-11328](https://cve.now/CVE-2018-11328.md): An issue was discovered in Joomla! Core before 3.8.8. (no CVSS)
- [CVE-2018-11369](https://cve.now/CVE-2018-11369.md): An issue was discovered in PbootCMS v1.0.9. (no CVSS)
- [CVE-2018-6378](https://cve.now/CVE-2018-6378.md): In Joomla! Core before 3.8.8, inadequate filtering of file and folder names leads to various XSS attack vectors in the media manager. (no CVSS)
- [CVE-2018-11366](https://cve.now/CVE-2018-11366.md): init.php in the Loginizer plugin 1.3.8 through 1.3.9 for WordPress has Unauthenticated Stored Cross-Site Scripting (XSS) because logging is (no CVSS)
- [CVE-2018-11367](https://cve.now/CVE-2018-11367.md): An issue was discovered in CppCMS before 1.2.1. (no CVSS)
- [CVE-2018-1583](https://cve.now/CVE-2018-1583.md): IBM StoredIQ 7.6 could allow an authenticated attacker to bypass certain security restrictions. (no CVSS, IBM StoredIQ)
- [CVE-2018-6962](https://cve.now/CVE-2018-6962.md): VMware Fusion (10.x before 10.1.2) contains a signature bypass vulnerability which may lead to a local privilege escalation. (no CVSS, VMware Fusion)
- [CVE-2018-6963](https://cve.now/CVE-2018-6963.md): VMware Workstation (14.x before 14.1.2) and Fusion (10.x before 10.1.2) contain multiple denial-of-service vulnerabilities that occur due to (no CVSS, VMware Workstation · VMware Fusion)
- [CVE-2018-3639](https://cve.now/CVE-2018-3639.md): Systems with microprocessors utilizing speculative execution and speculative execution of memory reads before the addresses of all prior mem (CVSS 5.5, Intel Multiple)
- [CVE-2018-3640](https://cve.now/CVE-2018-3640.md): Systems with microprocessors utilizing speculative execution and that perform speculative reads of system registers may allow unauthorized d (no CVSS, Intel Multiple)
- [CVE-2018-11329](https://cve.now/CVE-2018-11329.md): The DrugDealer function of a smart contract implementation for Ether Cartel, an Ethereum game, allows attackers to take over the contract's (no CVSS)
- [CVE-2018-11363](https://cve.now/CVE-2018-11363.md): jpeg\_size in pdfgen.c in PDFGen before 2018-04-09 has a heap-based buffer over-read. (no CVSS)
- [CVE-2018-11364](https://cve.now/CVE-2018-11364.md): sav\_parse\_machine\_integer\_info\_record in spss/readstat\_sav\_read.c in libreadstat.a in ReadStat 0.1.1 has a memory leak related to an iconv\_o (no CVSS)
- [CVE-2018-11365](https://cve.now/CVE-2018-11365.md): sas/readstat\_sas7bcat\_read.c in libreadstat.a in ReadStat 0.1.1 has an infinite loop. (no CVSS)
- [CVE-2018-11339](https://cve.now/CVE-2018-11339.md): An XSS issue was discovered in Frappe ERPNext v11.x.x-develop b1036e5 via a comment. (no CVSS)
- [CVE-2018-11340](https://cve.now/CVE-2018-11340.md): An unrestricted file upload vulnerability in importuser.cgi in ASUSTOR AS6202T ADM 3.1.0.RFQ3 allows attackers to upload supplied data to a (no CVSS)
- [CVE-2018-11341](https://cve.now/CVE-2018-11341.md): Directory traversal in importuser.cgi in ASUSTOR AS6202T ADM 3.1.0.RFQ3 allows attackers to navigate the file system via the filename parame (no CVSS)
- [CVE-2018-11342](https://cve.now/CVE-2018-11342.md): A path traversal vulnerability in fileExplorer.cgi in ASUSTOR AS6202T ADM 3.1.0.RFQ3 allows attackers to arbitrarily specify a path to a fil (no CVSS)
- [CVE-2018-11343](https://cve.now/CVE-2018-11343.md): A persistent cross site scripting vulnerability in playlistmanger.cgi in the ASUSTOR SoundsGood application allows attackers to store cross (no CVSS)
- [CVE-2018-11344](https://cve.now/CVE-2018-11344.md): A path traversal vulnerability in download.cgi in ASUSTOR AS6202T ADM 3.1.0.RFQ3 allows attackers to arbitrarily specify a file on the syste (no CVSS)
- [CVE-2018-11345](https://cve.now/CVE-2018-11345.md): An unrestricted file upload vulnerability in upload.cgi in ASUSTOR AS6202T ADM 3.1.0.RFQ3 allows attackers to upload supplied data via the P (no CVSS)
- [CVE-2018-11346](https://cve.now/CVE-2018-11346.md): An insecure direct object reference vulnerability in download.cgi in ASUSTOR AS6202T ADM 3.1.0.RFQ3 allows the ability to reference the "dow (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2018-05-22
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.