# CVEs published 2018-05-26

17 CVEs were published on May 26, 2018: 0 critical, 0 high. Days are UTC.

- [CVE-2018-11505](https://cve.now/CVE-2018-11505.md): The Werewolf Online application 0.8.8 for Android allows attackers to discover the Firebase token by reading logcat output. (no CVSS)
- [CVE-2018-6409](https://cve.now/CVE-2018-6409.md): An issue was discovered in Appnitro MachForm before 4.2.3. (no CVSS)
- [CVE-2018-6410](https://cve.now/CVE-2018-6410.md): An issue was discovered in Appnitro MachForm before 4.2.3. (no CVSS)
- [CVE-2018-6411](https://cve.now/CVE-2018-6411.md): An issue was discovered in Appnitro MachForm before 4.2.3. (no CVSS)
- [CVE-2018-11500](https://cve.now/CVE-2018-11500.md): An issue was discovered in PublicCMS V4.0.20180210. (no CVSS)
- [CVE-2018-11501](https://cve.now/CVE-2018-11501.md): PHP Scripts Mall Website Seller Script 2.0.3 has CSRF via user\_submit.php?upd=2, with resultant XSS. (no CVSS)
- [CVE-2018-11503](https://cve.now/CVE-2018-11503.md): The isfootnote function in markdown.c in libmarkdown.a in DISCOUNT 2.2.3a allows remote attackers to cause a denial of service (heap-based b (no CVSS)
- [CVE-2018-11504](https://cve.now/CVE-2018-11504.md): The islist function in markdown.c in libmarkdown.a in DISCOUNT 2.2.3a allows remote attackers to cause a denial of service (heap-based buffe (no CVSS)
- [CVE-2018-11494](https://cve.now/CVE-2018-11494.md): The "program extension upload" feature in OpenCart through 3.0.2.0 has a six-step process (upload, install, unzip, move, xml, remove) that a (no CVSS, opencart/opencart)
- [CVE-2018-11495](https://cve.now/CVE-2018-11495.md): OpenCart through 3.0.2.0 allows directory traversal in the editDownload function in admin\\model\\catalog\\download.php via admin/index.php?rou (no CVSS, opencart/opencart)
- [CVE-2018-11496](https://cve.now/CVE-2018-11496.md): In Long Range Zip (aka lrzip) 0.631, there is a use-after-free in read\_stream in stream.c, because decompress\_file in lrzip.c lacks certain (no CVSS)
- [CVE-2018-11498](https://cve.now/CVE-2018-11498.md): In Lizard v1.0 and LZ5 v2.0 (the prior release, before the product was renamed), there is an unchecked buffer size during a memcpy in the Li (no CVSS)
- [CVE-2018-11499](https://cve.now/CVE-2018-11499.md): A use-after-free vulnerability exists in handle\_error() in sass\_context.cpp in LibSass 3.4.x and 3.5.x through 3.5.4 that could be leveraged (no CVSS)
- [CVE-2018-11489](https://cve.now/CVE-2018-11489.md): The DGifDecompressLine function in dgif\_lib.c in GIFLIB (possibly version 3.0.x), as later shipped in cgif.c in sam2p 0.49.4, has a heap-bas (no CVSS)
- [CVE-2018-11493](https://cve.now/CVE-2018-11493.md): An issue was discovered in WUZHI CMS 4.1.0. (no CVSS)
- [CVE-2018-11487](https://cve.now/CVE-2018-11487.md): PHPMyWind 5.5 has XSS via the cid parameter to newsshow.php, or the query string to news.php or about.php. (no CVSS)
- [CVE-2018-11490](https://cve.now/CVE-2018-11490.md): The DGifDecompressLine function in dgif\_lib.c in GIFLIB (possibly version 3.0.x), as later shipped in cgif.c in sam2p 0.49.4, has a heap-bas (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2018-05-26
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.