# CVEs published 2018-05-23

32 CVEs were published on May 23, 2018: 0 critical, 2 high. Days are UTC.

- [CVE-2018-10428](https://cve.now/CVE-2018-10428.md): ILIAS before 5.1.26, 5.2.x before 5.2.15, and 5.3.x before 5.3.4, due to inconsistencies in parameter handling, is vulnerable to various ins (no CVSS)
- [CVE-2018-6495](https://cve.now/CVE-2018-6495.md): MFSBGN03808 rev.1 - Micro Focus UCMDB, Cross-Site Scripting (CVSS 6.3, Micro Focus UCMDB · Micro Focus CMS Server)
- [CVE-2018-10648](https://cve.now/CVE-2018-10648.md): There are Unauthenticated File Upload Vulnerabilities in Citrix XenMobile Server 10.8 before RP2 and 10.7 before RP3. (no CVSS)
- [CVE-2018-10649](https://cve.now/CVE-2018-10649.md): There is a Cross-Site Scripting Vulnerability in Citrix XenMobile Server 10.7 before RP3. (no CVSS)
- [CVE-2018-10650](https://cve.now/CVE-2018-10650.md): There is an Insufficient Path Validation Vulnerability in Citrix XenMobile Server 10.8 before RP2 and 10.7 before RP3. (no CVSS)
- [CVE-2018-10651](https://cve.now/CVE-2018-10651.md): There are Open Redirect Vulnerabilities in Citrix XenMobile Server 10.8 before RP2 and 10.7 before RP3. (no CVSS)
- [CVE-2018-10652](https://cve.now/CVE-2018-10652.md): There is a Sensitive Data Leakage issue in Citrix XenMobile Server 10.7 before RP3. (no CVSS)
- [CVE-2018-10653](https://cve.now/CVE-2018-10653.md): There is an XML External Entity (XXE) Processing Vulnerability in Citrix XenMobile Server 10.8 before RP2 and 10.7 before RP3. (no CVSS)
- [CVE-2018-10654](https://cve.now/CVE-2018-10654.md): There is a Hazelcast Library Java Deserialization Vulnerability in Citrix XenMobile Server 10.8 before RP2 and 10.7 before RP3. (no CVSS)
- [CVE-2018-10351](https://cve.now/CVE-2018-10351.md): A vulnerability in Trend Micro Email Encryption Gateway 5.5 could allow a remote attacker to execute arbitrary SQL statements on vulnerable (no CVSS, Trend Micro Email Encryption Gateway)
- [CVE-2018-10352](https://cve.now/CVE-2018-10352.md): A vulnerability in Trend Micro Email Encryption Gateway 5.5 could allow a remote attacker to execute arbitrary SQL statements on vulnerable (no CVSS, Trend Micro Email Encryption Gateway)
- [CVE-2018-10353](https://cve.now/CVE-2018-10353.md): A SQL injection information disclosure vulnerability in Trend Micro Email Encryption Gateway 5.5 could allow a remote attacker to disclose s (no CVSS, Trend Micro Email Encryption Gateway)
- [CVE-2018-10354](https://cve.now/CVE-2018-10354.md): A command injection remote command execution vulnerability in Trend Micro Email Encryption Gateway 5.5 could allow a remote attacker to exec (no CVSS, Trend Micro Email Encryption Gateway)
- [CVE-2018-10355](https://cve.now/CVE-2018-10355.md): An authentication weakness vulnerability in Trend Micro Email Encryption Gateway 5.5 could allow an attacker to recover user passwords on vu (no CVSS, Trend Micro Email Encryption Gateway)
- [CVE-2018-10356](https://cve.now/CVE-2018-10356.md): A SQL injection remote code execution vulnerability in Trend Micro Email Encryption Gateway 5.5 could allow an attacker to execute arbitrary (no CVSS, Trend Micro Email Encryption Gateway)
- [CVE-2018-10357](https://cve.now/CVE-2018-10357.md): A directory traversal vulnerability in Trend Micro Endpoint Application Control 2.0 could allow a remote attacker to execute arbitrary code (no CVSS, Trend Micro Endpoint Application Control)
- [CVE-2018-11231](https://cve.now/CVE-2018-11231.md): In the Divido plugin for OpenCart, there is SQL injection. (no CVSS)
- [CVE-2018-8898](https://cve.now/CVE-2018-8898.md): A flaw in the authentication mechanism in the Login Panel of router D-Link DSL-3782 (A1\_WI\_20170303 || SWVer="V100R001B012" FWVer="3.10.0.24 (no CVSS)
- [CVE-2017-9317](https://cve.now/CVE-2017-9317.md): Privilege escalation vulnerability found in some Dahua IP devices. (no CVSS, Dahua Technologies XVR 5x04, XVR 5x08, XVR 5x16, XVR 7x16,…)
- [CVE-2018-1193](https://cve.now/CVE-2018-1193.md): Cloud Foundry routing-release, versions prior to 0.175.0, lacks sanitization for user-provided X-Forwarded-Proto headers. (no CVSS, Cloud Foundry Router)
- [CVE-2018-1122](https://cve.now/CVE-2018-1122.md): procps-ng before version 3.3.15 is vulnerable to a local privilege escalation in top. (CVSS 7.3, \[UNKNOWN\] procps-ng, procps)
- [CVE-2018-1123](https://cve.now/CVE-2018-1123.md): procps-ng before version 3.3.15 is vulnerable to a denial of service in ps via mmap buffer overflow. (CVSS 3.9, \[UNKNOWN\] procps-ng, procps)
- [CVE-2018-1125](https://cve.now/CVE-2018-1125.md): procps-ng before version 3.3.15 is vulnerable to a stack buffer overflow in pgrep. (CVSS 4.4, \[UNKNOWN\] procps-ng, procps)
- [CVE-2018-1309](https://cve.now/CVE-2018-1309.md): Apache NiFi External XML Entity issue in SplitXML processor. (no CVSS, Apache Software Foundation Apache NiFi · org.apache.nifi:ni…)
- [CVE-2018-1310](https://cve.now/CVE-2018-1310.md): Apache NiFi JMS Deserialization issue because of ActiveMQ client vulnerability. (no CVSS, Apache Software Foundation Apache NiFi · org.apache.nifi:ni…)
- [CVE-2017-2598](https://cve.now/CVE-2017-2598.md): Jenkins before versions 2.44, 2.32.2 uses AES ECB block cipher mode without IV for encrypting secrets which makes Jenkins and the stored sec (CVSS 4.3, \[UNKNOWN\] jenkins · org.jenkins-ci.main:jenkins-core)
- [CVE-2018-1124](https://cve.now/CVE-2018-1124.md): procps-ng before version 3.3.15 is vulnerable to multiple integer overflows leading to a heap corruption in file2strvec function. (CVSS 7.3, \[UNKNOWN\] procps-ng)
- [CVE-2018-1126](https://cve.now/CVE-2018-1126.md): procps-ng before version 3.3.15 is vulnerable to an incorrect integer size in proc/alloc.\* leading to truncation/integer overflow issues. (CVSS 4.8, \[UNKNOWN\] procps-ng, procps)
- [CVE-2018-11396](https://cve.now/CVE-2018-11396.md): ephy-session.c in libephymain.so in GNOME Web (aka Epiphany) through 3.28.2.1 allows remote attackers to cause a denial of service (applicat (no CVSS)
- [CVE-2018-8176](https://cve.now/CVE-2018-8176.md): A remote code execution vulnerability exists in Microsoft PowerPoint software when the software fails to properly validate XML content, aka (no CVSS, Microsoft Office)
- [CVE-2018-11334](https://cve.now/CVE-2018-11334.md): Windscribe 1.81 creates a named pipe with a NULL DACL that allows Everyone users to gain privileges or cause a denial of service via \\\\.\\pip (no CVSS)
- [CVE-2018-7295](https://cve.now/CVE-2018-7295.md): ffxivlauncher.exe in Square Enix Final Fantasy XIV 4.21 and 4.25 on Windows is affected by Improper Enforcement of Message Integrity During (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2018-05-23
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.