CVEs published May 25, 2018
46 CVEs were published on May 25, 2018: 0 critical, 4 high.
- Published
- 46
- Critical
- 0
- High
- 4
- Medium
- 3
- Low
- 1
- Unrated
- 38
- Now in CISA KEV
- 0
- Fix available
- 8
Most affected products
- IBM DB2 for Linux, UNIX and Windows
- 9
- Moodle 3.x unknown · moodle/moodle
- 5
- Trend Micro Maximum Security
- 5
- Trend Micro Smart Protection Server
- 2
- Acoustic Technology, Inc. (ATI Systems) ATI Emergency Mass…
- 1
- Acoustic Technology, Inc. (ATI Systems) Emergency Mass Noti…
- 1
- Delta Electronics Automation TPEditor
- 1
- Fortinet FortiOS
- 1
- IBM Storwize V7000 Unified
- 1
- IBM UrbanCode Deploy
- 1
High 4
- CVE-2018-1488IBM DB2 for Linux, UNIX and Windows (includes DB2 Connect Server) 10.5 and 11.1 is vulnerable to a buffer overflow, which could allow an autIBM DB2 for Linux, UNIX and Windows
- CVE-2018-1515IBM DB2 for Linux, UNIX and Windows (includes DB2 Connect Server) 10.5 and 11.1, under specific or unusual conditions, could allow a local uIBM DB2 for Linux, UNIX and Windows
- CVE-2018-1544IBM DB2 for Linux, UNIX and Windows (includes DB2 Connect Server) 9.7, 10.1, 10.5, and 11.1 could allow a local user to overflow a buffer whIBM DB2 for Linux, UNIX and Windows
- CVE-2018-1565IBM DB2 for Linux, UNIX and Windows (includes DB2 Connect Server) 9.7, 10.1, 10.5, and 11.1 could allow a local user to overflow a buffer whIBM DB2 for Linux, UNIX and Windows
Medium, low and unrated 42
- CVE-2018-11471Cockpit 0.5.5 has XSS via a collection, form, or region.
- CVE-2018-11472Monstra CMS 3.0.4 has Reflected XSS during Login (i.e., the login parameter to admin/index.php).
- CVE-2018-11473Monstra CMS 3.0.4 has XSS in the registration Form (i.e., the login parameter to users/registration).
- CVE-2018-11474Monstra CMS 3.0.4 has a Session Management Issue in the Administrations Tab.
- CVE-2018-11475Monstra CMS 3.0.4 has a Session Management Issue in the Users tab.
- CVE-2018-11479The VPN component in Windscribe 1.81 uses the OpenVPN client for connections.
- CVE-2018-9091A critical vulnerability in the KEMP LoadMaster Operating System (LMOS) 6.0.44 through 7.2.41.2 and Long Term Support (LTS) LMOS before 7.1.
- CVE-2017-14185An Information Disclosure vulnerability in Fortinet FortiOS 5.6.0 to 5.6.2, 5.4.0 to 5.4.8 and 5.2 all versions allows SSL VPN web portal usFortinet FortiOS
- CVE-2018-8862In ATI Systems Emergency Mass Notification Systems (HPSS16, HPSS32, MHPSS, and ALERT4000) devices, an improper authentication vulnerability Acoustic Technology, Inc. (ATI Systems) Emergency Mass Noti…
- CVE-2018-8864In ATI Systems Emergency Mass Notification Systems (HPSS16, HPSS32, MHPSS, and ALERT4000) devices, a missing encryption of sensitive data vuAcoustic Technology, Inc. (ATI Systems) ATI Emergency Mass…
- CVE-2018-8871In Delta Electronics Automation TPEditor version 1.89 or prior, parsing a malformed program file may cause heap-based buffer overflow vulnerDelta Electronics Automation TPEditor
- CVE-2017-9641PI Coresight 2016 R2 contains a cross-site request forgery vulnerability that may allow access to the PI system.OSIsoft PI Coresight
- CVE-2018-10350A SQL injection remote code execution vulnerability in Trend Micro Smart Protection Server (Standalone) 3.x could allow a remote attacker toTrend Micro Smart Protection Server
- CVE-2018-6232A buffer overflow privilege escalation vulnerability in Trend Micro Maximum Security (Consumer) 2018 could allow a local attacker to escalatTrend Micro Maximum Security
- CVE-2018-6233A buffer overflow privilege escalation vulnerability in Trend Micro Maximum Security (Consumer) 2018 could allow a local attacker to escalatTrend Micro Maximum Security
- CVE-2018-6234An Out-of-Bounds Read Information Disclosure vulnerability in Trend Micro Maximum Security (Consumer) 2018 could allow a local attacker to dTrend Micro Maximum Security
- CVE-2018-6235An Out-of-Bounds write privilege escalation vulnerability in Trend Micro Maximum Security (Consumer) 2018 could allow a local attacker to esTrend Micro Maximum Security
- CVE-2018-6236A Time-of-Check Time-of-Use privilege escalation vulnerability in Trend Micro Maximum Security (Consumer) 2018 could allow a local attacker Trend Micro Maximum Security
- CVE-2018-6237A vulnerability in Trend Micro Smart Protection Server (Standalone) 3.x could allow an unauthenticated remote attacker to manipulate the proTrend Micro Smart Protection Server
- CVE-2017-1752IBM UrbanCode Deploy 6.1 and 6.2 could allow an authenticated privileged user to obtain highly sensitive information.IBM UrbanCode Deploy
- CVE-2018-11469Incorrect caching of responses to requests including an Authorization header in HAProxy 1.8.0 through 1.8.9 (if cache enabled) allows attack
- CVE-2018-11470iScripts eSwap v2.4 has SQL injection via the "search.php" 'Told' parameter in the User Panel.
- CVE-2018-1449IBM DB2 for Linux, UNIX and Windows (includes DB2 Connect Server) 9.7, 10.1, 10.5, and 11.1 contains a vulnerability that could allow a locaIBM DB2 for Linux, UNIX and Windows
- CVE-2018-1450IBM DB2 for Linux, UNIX and Windows (includes DB2 Connect Server) 9.7, 10.1, 10.5, and 11.1 contains a vulnerability that could allow a locaIBM DB2 for Linux, UNIX and Windows
- CVE-2018-1451IBM DB2 for Linux, UNIX and Windows (includes DB2 Connect Server) 9.7, 10.1, 10.5, and 11.1 contains a vulnerability that could allow a locaIBM DB2 for Linux, UNIX and Windows
- CVE-2018-1452IBM DB2 for Linux, UNIX and Windows (includes DB2 Connect Server) 9.7, 10.1, 10.5, and 11.1 contains a vulnerability that could allow a locaIBM DB2 for Linux, UNIX and Windows
- CVE-2018-1459IBM DB2 for Linux, UNIX and Windows (includes DB2 Connect Server) 9.7, 10.1, 10.5, and 11.1 is vulnerable to stack based buffer overflow, caIBM DB2 for Linux, UNIX and Windows
- CVE-2018-1467The IBM Storwize V7000 Unified management Web interface 1.6 exposes internal cluster details to unauthenticated users.IBM Storwize V7000 Unified
- CVE-2017-3961SB10192 - Network Security Management (NSM) - Cross-Site Scripting (XSS) vulnerabilityMcAfee Network Security Management
- CVE-2018-11468The __mkd_trim_line function in mkdio.c in libmarkdown.a in DISCOUNT 2.2.3a allows remote attackers to cause a denial of service (heap-based
- CVE-2018-6664SB10233 - Data Loss Prevention (DLP) Endpoint before 10.0.500 and DLP Endpoint before 11.0.400 - Application Protections Bypass vulnerabilityMcAfee Data Loss Prevention (DLP) Endpoint
- CVE-2018-6674Privilege escalation vulnerability in McAfee VSE when McTray run with elevated privilegesMcAfee VirusScan Enterprise
- CVE-2018-1133An issue was discovered in Moodle 3.x.Moodle 3.x unknown · moodle/moodle
- CVE-2018-1134An issue was discovered in Moodle 3.x.Moodle 3.x unknown · moodle/moodle
- CVE-2018-1135An issue was discovered in Moodle 3.x.Moodle 3.x unknown · moodle/moodle
- CVE-2018-1136An issue was discovered in Moodle 3.x.Moodle 3.x unknown · moodle/moodle
- CVE-2018-1137An issue was discovered in Moodle 3.x.Moodle 3.x unknown · moodle/moodle
- CVE-2018-11442A CSRF issue was discovered in EasyService Billing 1.0, which was triggered via a quotation-new3-new2.php?add=true&id= URI, as demonstrated
- CVE-2018-11443The parameter q is affected by Cross-site Scripting in jobcard-ongoing.php in EasyService Billing 1.0.
- CVE-2018-11444A SQL Injection issue was observed in the parameter "q" in jobcard-ongoing.php in EasyService Billing 1.0.
- CVE-2018-11445A CSRF issue was discovered on the User Add/System Settings Page (system-settings-user-new2.php) in EasyService Billing 1.0.
- CVE-2018-11440Liblouis 3.5.0 has a stack-based Buffer Overflow in the function parseChars in compileTranslationTable.c.