# CVEs published 2018-05-24

55 CVEs were published on May 24, 2018: 1 critical, 0 high. Days are UTC.

- [CVE-2013-3018](https://cve.now/CVE-2013-3018.md): The AXIS webapp in deploy-tomcat/axis in IBM Tivoli Application Dependency Discovery Manager (TADDM) 7.1.2 and 7.2.0 through 7.2.1.4 allows (no CVSS)
- [CVE-2013-3023](https://cve.now/CVE-2013-3023.md): IBM Tivoli Application Dependency Discovery Manager (TADDM) 7.1.2 and 7.2.0 through 7.2.1.4 might allow remote attackers to obtain sensitive (no CVSS)
- [CVE-2013-3024](https://cve.now/CVE-2013-3024.md): IBM WebSphere Application Server (WAS) 8.5 through 8.5.0.2 on UNIX allows local users to gain privileges by leveraging improper process init (no CVSS)
- [CVE-2018-5674](https://cve.now/CVE-2018-5674.md): This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader before 9.1 and PhantomPDF b (no CVSS)
- [CVE-2018-5675](https://cve.now/CVE-2018-5675.md): This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader before 9.1 and PhantomPDF b (no CVSS)
- [CVE-2018-5676](https://cve.now/CVE-2018-5676.md): This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader before 9.1 and PhantomPDF b (no CVSS)
- [CVE-2018-5677](https://cve.now/CVE-2018-5677.md): This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader before 9.1 and PhantomPDF b (no CVSS)
- [CVE-2018-5678](https://cve.now/CVE-2018-5678.md): This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader before 9.1 and PhantomPDF b (no CVSS)
- [CVE-2018-5679](https://cve.now/CVE-2018-5679.md): This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader before 9.1 and PhantomPDF b (no CVSS)
- [CVE-2018-5680](https://cve.now/CVE-2018-5680.md): This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader before 9.1 and PhantomPDF b (no CVSS)
- [CVE-2018-7406](https://cve.now/CVE-2018-7406.md): An issue was discovered in Foxit Reader before 9.1 and PhantomPDF before 9.1. (no CVSS)
- [CVE-2018-7407](https://cve.now/CVE-2018-7407.md): An issue was discovered in Foxit Reader before 9.1 and PhantomPDF before 9.1. (no CVSS)
- [CVE-2017-14187](https://cve.now/CVE-2017-14187.md): A local privilege escalation and local code execution vulnerability in Fortinet FortiOS 5.6.0 to 5.6.2, 5.4.0 to 5.4.8, and 5.2 and below ve (no CVSS, Fortinet FortiOS)
- [CVE-2017-9664](https://cve.now/CVE-2017-9664.md): In ABB SREA-01 revisions A, B, C: application versions up to 3.31.5, and SREA-50 revision A: application versions up to 3.32.8, an attacker (no CVSS, ICS-CERT ABB SREA-01 and SREA-50)
- [CVE-2018-11416](https://cve.now/CVE-2018-11416.md): jpegoptim.c in jpegoptim 1.4.5 (fixed in 1.4.6) has an invalid use of realloc() and free(), which allows remote attackers to cause a denial (no CVSS)
- [CVE-2018-11418](https://cve.now/CVE-2018-11418.md): An issue was discovered in JerryScript 1.0. (no CVSS)
- [CVE-2018-11419](https://cve.now/CVE-2018-11419.md): An issue was discovered in JerryScript 1.0. (no CVSS)
- [CVE-2018-7518](https://cve.now/CVE-2018-7518.md): In TotalAlert Web Application in BeaconMedaes Scroll Medical Air Systems prior to v4107600010.23, an attacker with network access to the int (no CVSS, ICS-CERT BeaconMedæs TotalAlert Scroll Medical A…)
- [CVE-2018-7526](https://cve.now/CVE-2018-7526.md): In TotalAlert Web Application in BeaconMedaes Scroll Medical Air Systems prior to v4107600010.23, by accessing a specific uniform resource l (no CVSS)
- [CVE-2018-11415](https://cve.now/CVE-2018-11415.md): SAP Internet Transaction Server (ITS) 6200.X.X has Reflected Cross Site Scripting (XSS) via certain wgate URIs. (no CVSS)
- [CVE-2018-11412](https://cve.now/CVE-2018-11412.md): In the Linux kernel 4.13 through 4.16.11, ext4\_read\_inline\_data() in fs/ext4/inline.c performs a memcpy with an untrusted length value in ce (no CVSS)
- [CVE-2018-11413](https://cve.now/CVE-2018-11413.md): An issue was discovered in BearAdmin 0.5. (no CVSS)
- [CVE-2018-11414](https://cve.now/CVE-2018-11414.md): An issue was discovered in BearAdmin 0.5. (no CVSS)
- [CVE-2018-10593](https://cve.now/CVE-2018-10593.md): A vulnerability in DB Manager version 3.0.1.0 and previous and PerformA version 3.0.0.0 and previous allows an authorized user with access t (no CVSS, Becton, Dickinson and Company Kiestra and InoqulA systems)
- [CVE-2018-10595](https://cve.now/CVE-2018-10595.md): A vulnerability in ReadA version 1.1.0.2 and previous allows an authorized user with access to a privileged account on a BD Kiestra system ( (no CVSS, Becton, Dickinson and Company Kiestra and InoqulA systems)
- [CVE-2018-11332](https://cve.now/CVE-2018-11332.md): Stored cross-site scripting (XSS) vulnerability in the "Site Name" field found in the "site" tab under configurations in ClipperCMS 1.3.3 al (no CVSS)
- [CVE-2018-8013](https://cve.now/CVE-2018-8013.md): In Apache Batik 1.x before 1.10, when deserializing subclass of \`AbstractDocument\`, the class takes a string from the inputStream as the cla (no CVSS, Apache Software Foundation Apache Batik · org.apache.xmlgra…)
- [CVE-2017-17158](https://cve.now/CVE-2017-17158.md): Some Huawei smart phones with the versions before Berlin-L21HNC185B381; the versions before Prague-AL00AC00B223; the versions before Prague- (no CVSS, Huawei Technologies Co. Berlin-L21HN; Prague-AL00A; Prague-…)
- [CVE-2017-17315](https://cve.now/CVE-2017-17315.md): Huawei DP300 V500R002C00; RP200 V600R006C00; TE30 V100R001C10; V500R002C00; V600R006C00; TE40 V500R002C00; V600R006C00; TE50 V500R002C00; V6 (no CVSS, Huawei Technologies Co. DP300; RP200; TE30; TE40; TE50; TE60)
- [CVE-2018-5485](https://cve.now/CVE-2018-5485.md): NetApp OnCommand Unified Manager for Windows versions 7.2 through 7.3 are susceptible to a vulnerability which could lead to a privilege esc (no CVSS, NetApp OnCommand Unified Manager for Windows)
- [CVE-2018-5487](https://cve.now/CVE-2018-5487.md): NetApp OnCommand Unified Manager for Linux versions 7.2 through 7.3 ship with the Java Management Extension Remote Method Invocation (JMX RM (no CVSS, NetApp OnCommand Unified Manager for Linux)
- [CVE-2018-7902](https://cve.now/CVE-2018-7902.md): Huawei 1288H V5 and 288H V5 with software of V100R005C00 have a JSON injection vulnerability. (no CVSS, Huawei Technologies Co. 1288H V5; 2288H)
- [CVE-2018-7903](https://cve.now/CVE-2018-7903.md): Huawei 1288H V5 and 288H V5 with software of V100R005C00 have a JSON injection vulnerability. (no CVSS, Huawei Technologies Co. 1288H V5; 2288H)
- [CVE-2018-7904](https://cve.now/CVE-2018-7904.md): Huawei 1288H V5 and 288H V5 with software of V100R005C00 have a JSON injection vulnerability. (no CVSS, Huawei Technologies Co. 1288H V5; 2288H)
- [CVE-2018-7942](https://cve.now/CVE-2018-7942.md): The iBMC (Intelligent Baseboard Management Controller) of some Huawei servers have an authentication bypass vulnerability. (no CVSS, Huawei Technologies Co. 1288H V5; 2288H V5; 2488 V5; CH121…)
- [CVE-2017-9421](https://cve.now/CVE-2017-9421.md): Authentication Bypass vulnerability in Accellion kiteworks before 2017.01.00 allows remote attackers to execute certain API calls on behalf (no CVSS)
- [CVE-2018-1000036](https://cve.now/CVE-2018-1000036.md): In Artifex MuPDF 1.12.0 and earlier, multiple memory leaks in the PDF parser allow an attacker to cause a denial of service (memory leak) vi (no CVSS)
- [CVE-2018-1000037](https://cve.now/CVE-2018-1000037.md): In Artifex MuPDF 1.12.0 and earlier, multiple reachable assertions in the PDF parser allow an attacker to cause a denial of service (assert (CVSS 5.5)
- [CVE-2018-1000038](https://cve.now/CVE-2018-1000038.md): In Artifex MuPDF 1.12.0 and earlier, a stack buffer overflow in function pdf\_lookup\_cmap\_full in pdf/pdf-cmap.c could allow an attacker to e (no CVSS)
- [CVE-2018-1000039](https://cve.now/CVE-2018-1000039.md): In Artifex MuPDF 1.12.0 and earlier, multiple heap use after free bugs in the PDF parser could allow an attacker to execute arbitrary code, (CVSS 6.3)
- [CVE-2018-1000040](https://cve.now/CVE-2018-1000040.md): In Artifex MuPDF 1.12.0 and earlier, multiple use of uninitialized value bugs in the PDF parser could allow an attacker to cause a denial of (no CVSS)
- [CVE-2018-1000155](https://cve.now/CVE-2018-1000155.md): OpenFlow version 1.0 onwards contains a Denial of Service and Improper authorization vulnerability in OpenFlow handshake: The DPID (DataPath (no CVSS)
- [CVE-2018-1000199](https://cve.now/CVE-2018-1000199.md): The Linux Kernel version 3.18 contains a dangerous feature vulnerability in modify\_user\_hw\_breakpoint() that can result in crash and possibl (no CVSS)
- [CVE-2018-1000300](https://cve.now/CVE-2018-1000300.md): curl version curl 7.54.1 to and including curl 7.59.0 contains a CWE-122: Heap-based Buffer Overflow vulnerability in denial of service and (no CVSS)
- [CVE-2018-1000301](https://cve.now/CVE-2018-1000301.md): curl version curl 7.20.0 to and including curl 7.59.0 contains a CWE-126: Buffer Over-read vulnerability in denial of service that can resul (CVSS 9.1)
- [CVE-2018-9920](https://cve.now/CVE-2018-9920.md): Server side request forgery exists in the runtime application in K2 smartforms 4.6.11 via a modified hostname in an https://\*/Identity/STS/F (no CVSS)
- [CVE-2018-11411](https://cve.now/CVE-2018-11411.md): The transferFrom function of a smart contract implementation for DimonCoin (FUD), an Ethereum ERC20 token, allows attackers to steal assets (no CVSS)
- [CVE-2018-11403](https://cve.now/CVE-2018-11403.md): DomainMod v4.09.03 has XSS via the assets/edit/account-owner.php oid parameter. (no CVSS)
- [CVE-2018-11404](https://cve.now/CVE-2018-11404.md): DomainMod v4.09.03 has XSS via the assets/edit/ssl-provider-account.php sslpaid parameter. (no CVSS)
- [CVE-2018-11405](https://cve.now/CVE-2018-11405.md): Kliqqi 2.0.2 has CSRF in admin/admin\_users.php. (no CVSS)
- [CVE-2018-11410](https://cve.now/CVE-2018-11410.md): An issue was discovered in Liblouis 3.5.0. (no CVSS)
- [CVE-2018-11399](https://cve.now/CVE-2018-11399.md): SimpliSafe Original has Unencrypted Sensor Transmissions, which allows physically proximate attackers to obtain potentially sensitive inform (no CVSS)
- [CVE-2018-11400](https://cve.now/CVE-2018-11400.md): In SimpliSafe Original, the Base Station fails to detect tamper attempts: it does not send a notification if a physically proximate attacker (no CVSS)
- [CVE-2018-11401](https://cve.now/CVE-2018-11401.md): In SimpliSafe Original, RF Interference (e.g., an extremely strong 433.92 MHz signal) by a physically proximate attacker does not cause a no (no CVSS)
- [CVE-2018-11402](https://cve.now/CVE-2018-11402.md): SimpliSafe Original has Unencrypted Keypad Transmissions, which allows physically proximate attackers to discover the PIN. (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2018-05-24
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.