# CVEs published 2018-05-25

46 CVEs were published on May 25, 2018: 0 critical, 4 high. Days are UTC.

- [CVE-2018-11471](https://cve.now/CVE-2018-11471.md): Cockpit 0.5.5 has XSS via a collection, form, or region. (no CVSS)
- [CVE-2018-11472](https://cve.now/CVE-2018-11472.md): Monstra CMS 3.0.4 has Reflected XSS during Login (i.e., the login parameter to admin/index.php). (no CVSS)
- [CVE-2018-11473](https://cve.now/CVE-2018-11473.md): Monstra CMS 3.0.4 has XSS in the registration Form (i.e., the login parameter to users/registration). (no CVSS)
- [CVE-2018-11474](https://cve.now/CVE-2018-11474.md): Monstra CMS 3.0.4 has a Session Management Issue in the Administrations Tab. (no CVSS)
- [CVE-2018-11475](https://cve.now/CVE-2018-11475.md): Monstra CMS 3.0.4 has a Session Management Issue in the Users tab. (no CVSS)
- [CVE-2018-11479](https://cve.now/CVE-2018-11479.md): The VPN component in Windscribe 1.81 uses the OpenVPN client for connections. (no CVSS)
- [CVE-2018-9091](https://cve.now/CVE-2018-9091.md): A critical vulnerability in the KEMP LoadMaster Operating System (LMOS) 6.0.44 through 7.2.41.2 and Long Term Support (LTS) LMOS before 7.1. (no CVSS)
- [CVE-2017-14185](https://cve.now/CVE-2017-14185.md): An Information Disclosure vulnerability in Fortinet FortiOS 5.6.0 to 5.6.2, 5.4.0 to 5.4.8 and 5.2 all versions allows SSL VPN web portal us (no CVSS, Fortinet FortiOS)
- [CVE-2018-8862](https://cve.now/CVE-2018-8862.md): In ATI Systems Emergency Mass Notification Systems (HPSS16, HPSS32, MHPSS, and ALERT4000) devices, an improper authentication vulnerability (no CVSS, Acoustic Technology, Inc. (ATI Systems) Emergency Mass Noti…)
- [CVE-2018-8864](https://cve.now/CVE-2018-8864.md): In ATI Systems Emergency Mass Notification Systems (HPSS16, HPSS32, MHPSS, and ALERT4000) devices, a missing encryption of sensitive data vu (no CVSS, Acoustic Technology, Inc. (ATI Systems) ATI Emergency Mass…)
- [CVE-2018-8871](https://cve.now/CVE-2018-8871.md): In Delta Electronics Automation TPEditor version 1.89 or prior, parsing a malformed program file may cause heap-based buffer overflow vulner (no CVSS, Delta Electronics Automation TPEditor)
- [CVE-2017-9641](https://cve.now/CVE-2017-9641.md): PI Coresight 2016 R2 contains a cross-site request forgery vulnerability that may allow access to the PI system. (no CVSS, OSIsoft PI Coresight)
- [CVE-2018-10350](https://cve.now/CVE-2018-10350.md): A SQL injection remote code execution vulnerability in Trend Micro Smart Protection Server (Standalone) 3.x could allow a remote attacker to (no CVSS, Trend Micro Smart Protection Server)
- [CVE-2018-6232](https://cve.now/CVE-2018-6232.md): A buffer overflow privilege escalation vulnerability in Trend Micro Maximum Security (Consumer) 2018 could allow a local attacker to escalat (no CVSS, Trend Micro Maximum Security)
- [CVE-2018-6233](https://cve.now/CVE-2018-6233.md): A buffer overflow privilege escalation vulnerability in Trend Micro Maximum Security (Consumer) 2018 could allow a local attacker to escalat (no CVSS, Trend Micro Maximum Security)
- [CVE-2018-6234](https://cve.now/CVE-2018-6234.md): An Out-of-Bounds Read Information Disclosure vulnerability in Trend Micro Maximum Security (Consumer) 2018 could allow a local attacker to d (no CVSS, Trend Micro Maximum Security)
- [CVE-2018-6235](https://cve.now/CVE-2018-6235.md): An Out-of-Bounds write privilege escalation vulnerability in Trend Micro Maximum Security (Consumer) 2018 could allow a local attacker to es (no CVSS, Trend Micro Maximum Security)
- [CVE-2018-6236](https://cve.now/CVE-2018-6236.md): A Time-of-Check Time-of-Use privilege escalation vulnerability in Trend Micro Maximum Security (Consumer) 2018 could allow a local attacker (no CVSS, Trend Micro Maximum Security)
- [CVE-2018-6237](https://cve.now/CVE-2018-6237.md): A vulnerability in Trend Micro Smart Protection Server (Standalone) 3.x could allow an unauthenticated remote attacker to manipulate the pro (no CVSS, Trend Micro Smart Protection Server)
- [CVE-2017-1752](https://cve.now/CVE-2017-1752.md): IBM UrbanCode Deploy 6.1 and 6.2 could allow an authenticated privileged user to obtain highly sensitive information. (no CVSS, IBM UrbanCode Deploy)
- [CVE-2018-11469](https://cve.now/CVE-2018-11469.md): Incorrect caching of responses to requests including an Authorization header in HAProxy 1.8.0 through 1.8.9 (if cache enabled) allows attack (no CVSS)
- [CVE-2018-11470](https://cve.now/CVE-2018-11470.md): iScripts eSwap v2.4 has SQL injection via the "search.php" 'Told' parameter in the User Panel. (no CVSS)
- [CVE-2018-1449](https://cve.now/CVE-2018-1449.md): IBM DB2 for Linux, UNIX and Windows (includes DB2 Connect Server) 9.7, 10.1, 10.5, and 11.1 contains a vulnerability that could allow a loca (no CVSS, IBM DB2 for Linux, UNIX and Windows)
- [CVE-2018-1450](https://cve.now/CVE-2018-1450.md): IBM DB2 for Linux, UNIX and Windows (includes DB2 Connect Server) 9.7, 10.1, 10.5, and 11.1 contains a vulnerability that could allow a loca (no CVSS, IBM DB2 for Linux, UNIX and Windows)
- [CVE-2018-1451](https://cve.now/CVE-2018-1451.md): IBM DB2 for Linux, UNIX and Windows (includes DB2 Connect Server) 9.7, 10.1, 10.5, and 11.1 contains a vulnerability that could allow a loca (no CVSS, IBM DB2 for Linux, UNIX and Windows)
- [CVE-2018-1452](https://cve.now/CVE-2018-1452.md): IBM DB2 for Linux, UNIX and Windows (includes DB2 Connect Server) 9.7, 10.1, 10.5, and 11.1 contains a vulnerability that could allow a loca (no CVSS, IBM DB2 for Linux, UNIX and Windows)
- [CVE-2018-1459](https://cve.now/CVE-2018-1459.md): IBM DB2 for Linux, UNIX and Windows (includes DB2 Connect Server) 9.7, 10.1, 10.5, and 11.1 is vulnerable to stack based buffer overflow, ca (no CVSS, IBM DB2 for Linux, UNIX and Windows)
- [CVE-2018-1467](https://cve.now/CVE-2018-1467.md): The IBM Storwize V7000 Unified management Web interface 1.6 exposes internal cluster details to unauthenticated users. (CVSS 5.3, IBM Storwize V7000 Unified)
- [CVE-2018-1488](https://cve.now/CVE-2018-1488.md): IBM DB2 for Linux, UNIX and Windows (includes DB2 Connect Server) 10.5 and 11.1 is vulnerable to a buffer overflow, which could allow an aut (CVSS 8.4, IBM DB2 for Linux, UNIX and Windows)
- [CVE-2018-1515](https://cve.now/CVE-2018-1515.md): IBM DB2 for Linux, UNIX and Windows (includes DB2 Connect Server) 10.5 and 11.1, under specific or unusual conditions, could allow a local u (CVSS 7.4, IBM DB2 for Linux, UNIX and Windows)
- [CVE-2018-1544](https://cve.now/CVE-2018-1544.md): IBM DB2 for Linux, UNIX and Windows (includes DB2 Connect Server) 9.7, 10.1, 10.5, and 11.1 could allow a local user to overflow a buffer wh (CVSS 8.4, IBM DB2 for Linux, UNIX and Windows)
- [CVE-2018-1565](https://cve.now/CVE-2018-1565.md): IBM DB2 for Linux, UNIX and Windows (includes DB2 Connect Server) 9.7, 10.1, 10.5, and 11.1 could allow a local user to overflow a buffer wh (CVSS 8.4, IBM DB2 for Linux, UNIX and Windows)
- [CVE-2017-3961](https://cve.now/CVE-2017-3961.md): SB10192 - Network Security Management (NSM) - Cross-Site Scripting (XSS) vulnerability (CVSS 3.5, McAfee Network Security Management)
- [CVE-2018-11468](https://cve.now/CVE-2018-11468.md): The \_\_mkd\_trim\_line function in mkdio.c in libmarkdown.a in DISCOUNT 2.2.3a allows remote attackers to cause a denial of service (heap-based (no CVSS)
- [CVE-2018-6664](https://cve.now/CVE-2018-6664.md): SB10233 - Data Loss Prevention (DLP) Endpoint before 10.0.500 and DLP Endpoint before 11.0.400 - Application Protections Bypass vulnerability (CVSS 5.8, McAfee Data Loss Prevention (DLP) Endpoint)
- [CVE-2018-6674](https://cve.now/CVE-2018-6674.md): Privilege escalation vulnerability in McAfee VSE when McTray run with elevated privileges (CVSS 6.8, McAfee VirusScan Enterprise)
- [CVE-2018-1133](https://cve.now/CVE-2018-1133.md): An issue was discovered in Moodle 3.x. (no CVSS, Moodle 3.x unknown · moodle/moodle)
- [CVE-2018-1134](https://cve.now/CVE-2018-1134.md): An issue was discovered in Moodle 3.x. (no CVSS, Moodle 3.x unknown · moodle/moodle)
- [CVE-2018-1135](https://cve.now/CVE-2018-1135.md): An issue was discovered in Moodle 3.x. (no CVSS, Moodle 3.x unknown · moodle/moodle)
- [CVE-2018-1136](https://cve.now/CVE-2018-1136.md): An issue was discovered in Moodle 3.x. (no CVSS, Moodle 3.x unknown · moodle/moodle)
- [CVE-2018-1137](https://cve.now/CVE-2018-1137.md): An issue was discovered in Moodle 3.x. (no CVSS, Moodle 3.x unknown · moodle/moodle)
- [CVE-2018-11442](https://cve.now/CVE-2018-11442.md): A CSRF issue was discovered in EasyService Billing 1.0, which was triggered via a quotation-new3-new2.php?add=true&id= URI, as demonstrated (no CVSS)
- [CVE-2018-11443](https://cve.now/CVE-2018-11443.md): The parameter q is affected by Cross-site Scripting in jobcard-ongoing.php in EasyService Billing 1.0. (no CVSS)
- [CVE-2018-11444](https://cve.now/CVE-2018-11444.md): A SQL Injection issue was observed in the parameter "q" in jobcard-ongoing.php in EasyService Billing 1.0. (no CVSS)
- [CVE-2018-11445](https://cve.now/CVE-2018-11445.md): A CSRF issue was discovered on the User Add/System Settings Page (system-settings-user-new2.php) in EasyService Billing 1.0. (no CVSS)
- [CVE-2018-11440](https://cve.now/CVE-2018-11440.md): Liblouis 3.5.0 has a stack-based Buffer Overflow in the function parseChars in compileTranslationTable.c. (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2018-05-25
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.