# CVEs published 2018-05-29

80 CVEs were published on May 29, 2018: 0 critical, 0 high. Days are UTC.

- [CVE-2018-11544](https://cve.now/CVE-2018-11544.md): The Olive Tree Ftp Server application 1.32 for Android has Insecure Data Storage because a username and password are stored in the /data/dat (no CVSS)
- [CVE-2018-11545](https://cve.now/CVE-2018-11545.md): md4c 0.2.5 has a heap-based buffer overflow in md\_merge\_lines because md\_is\_link\_label mishandles the case of a link label composed solely o (no CVSS)
- [CVE-2018-11546](https://cve.now/CVE-2018-11546.md): md4c 0.2.5 has a heap-based buffer over-read because md\_is\_named\_entity\_contents has an off-by-one error. (no CVSS)
- [CVE-2018-11547](https://cve.now/CVE-2018-11547.md): md\_is\_link\_reference\_definition\_helper in md4c 0.2.5 has a heap-based buffer over-read because md\_is\_link\_label mishandles loop termination. (no CVSS)
- [CVE-2018-11548](https://cve.now/CVE-2018-11548.md): An issue was discovered in EOS.IO DAWN 4.2. (no CVSS)
- [CVE-2018-11549](https://cve.now/CVE-2018-11549.md): An issue was discovered in WUZHI CMS 4.1.0 There is a Stored XSS Vulnerability in "Account Settings -\> Member Centre -\> Chinese information (no CVSS)
- [CVE-2014-10067](https://cve.now/CVE-2014-10067.md): paypal-ipn before 3.0.0 uses the \`test\_ipn\` parameter (which is set by the PayPal IPN simulator) to determine if it should use the productio (no CVSS, HackerOne paypal-ipn node module · paypal-ipn)
- [CVE-2014-10068](https://cve.now/CVE-2014-10068.md): The inert directory handler in inert node module before 1.1.1 always allows files in hidden directories to be served, even when \`showHidden\` (no CVSS, HackerOne inert node module · inert)
- [CVE-2015-9235](https://cve.now/CVE-2015-9235.md): In jsonwebtoken node module before 4.2.2 it is possible for an attacker to bypass verification when a token digitally signed with an asymmet (no CVSS, HackerOne jsonwebtoken node module · jsonwebtoken)
- [CVE-2015-9240](https://cve.now/CVE-2015-9240.md): Due to a bug in the the default sign in functionality in the keystone node module before 0.3.16, incomplete email addresses could be matched (no CVSS, HackerOne keystone node module · keystone)
- [CVE-2015-9241](https://cve.now/CVE-2015-9241.md): Certain input passed into the If-Modified-Since or Last-Modified headers will cause an 'illegal access' exception to be raised. (no CVSS, HackerOne hapi node module · hapi)
- [CVE-2015-9242](https://cve.now/CVE-2015-9242.md): Certain input strings when passed to new Date() or Date.parse() in ecstatic node module before 1.4.0 will cause v8 to raise an exception. (no CVSS, HackerOne ecstatic node module · ecstatic)
- [CVE-2015-9243](https://cve.now/CVE-2015-9243.md): When server level, connection level or route level CORS configurations in hapi node module before 11.1.4 are combined and when a higher leve (no CVSS, HackerOne hapi node module · hapi)
- [CVE-2015-9244](https://cve.now/CVE-2015-9244.md): Keys of objects in mysql node module v2.0.0-alpha7 and earlier are not escaped with \`mysql.escape()\` which could lead to SQL Injection. (no CVSS, HackerOne mysql node module · mysql)
- [CVE-2016-10525](https://cve.now/CVE-2016-10525.md): When attempting to allow authentication mode \`try\` in hapi, hapi-auth-jwt2 version 5.1.1 introduced an issue whereby people could bypass aut (no CVSS, HackerOne hapi-auth-jwt2 node module · hapi-auth-jwt2)
- [CVE-2016-10551](https://cve.now/CVE-2016-10551.md): waterline-sequel is a module that helps generate SQL statements for Waterline apps Any user input that goes into Waterline's \`like\`, \`contai (no CVSS, HackerOne waterline-sequel node module · waterline-sequel)
- [CVE-2016-10556](https://cve.now/CVE-2016-10556.md): sequelize is an Object-relational mapping, or a middleman to convert things from Postgres, MySQL, MariaDB, SQLite and Microsoft SQL Server i (no CVSS, HackerOne sequelize node module · sequelize)
- [CVE-2016-10558](https://cve.now/CVE-2016-10558.md): aerospike is an Aerospike add-on module for Node.js. (no CVSS, HackerOne aerospike node module · aerospike)
- [CVE-2016-10559](https://cve.now/CVE-2016-10559.md): selenium-download downloads the latest versions of the selenium standalone server and the chromedriver. (no CVSS, HackerOne selenium-download node module · selenium-download)
- [CVE-2016-10566](https://cve.now/CVE-2016-10566.md): install-nw is a module which quickly and robustly installs and caches NW.js. (no CVSS, HackerOne install-nw node module · install-nw)
- [CVE-2016-10567](https://cve.now/CVE-2016-10567.md): product-monitor is a HTML/JavaScript template for monitoring a product by encouraging product developers to gather all the information about (no CVSS, HackerOne product-monitor node module · product-monitor)
- [CVE-2016-10568](https://cve.now/CVE-2016-10568.md): geoip-lite-country is a stripped down version of geoip-lite, supporting only country lookup. (no CVSS, HackerOne geoip-lite-country node module · geoip-lite-count…)
- [CVE-2016-10570](https://cve.now/CVE-2016-10570.md): pngcrush-installer is an installer for Pngcrush. (no CVSS, HackerOne pngcrush-installer node module · pngcrush-install…)
- [CVE-2016-10573](https://cve.now/CVE-2016-10573.md): baryton-saxophone is a module to install and launch Selenium Server for Mac, Linux and Windows. (no CVSS, HackerOne baryton-saxophone node module · baryton-saxophone)
- [CVE-2016-10577](https://cve.now/CVE-2016-10577.md): ibm\_db is an asynchronous/synchronous interface for node.js to IBM DB2 and IBM Informix. (no CVSS, HackerOne ibm\_db node module · ibm\_db)
- [CVE-2016-10578](https://cve.now/CVE-2016-10578.md): unicode loads unicode data downloaded from unicode.org into nodejs. (no CVSS, HackerOne unicode node module · unicode)
- [CVE-2016-10584](https://cve.now/CVE-2016-10584.md): dalek-browser-chrome-canary provides Google Chrome bindings for DalekJS. (no CVSS, HackerOne dalek-browser-chrome-canary node module · dalek-b…)
- [CVE-2016-10586](https://cve.now/CVE-2016-10586.md): macaca-chromedriver is a Node.js wrapper for the selenium chromedriver. (no CVSS, HackerOne macaca-chromedriver node module · macaca-chromedr…)
- [CVE-2016-10589](https://cve.now/CVE-2016-10589.md): selenium-binaries downloads Selenium related binaries for your OS. (no CVSS, HackerOne selenium-binaries node module · selenium-binaries)
- [CVE-2016-10590](https://cve.now/CVE-2016-10590.md): cue-sdk-node is a Corsair Cue SDK wrapper for node.js. (no CVSS, HackerOne cue-sdk-node node module · cue-sdk-node)
- [CVE-2016-10591](https://cve.now/CVE-2016-10591.md): Prince is a Node API for executing XML/HTML to PDF renderer PrinceXML via prince(1) CLI. (no CVSS, HackerOne prince node module · prince)
- [CVE-2016-10593](https://cve.now/CVE-2016-10593.md): ibapi is an Interactive Brokers API addon for NodeJS. (no CVSS, HackerOne ibapi node module · ibapi)
- [CVE-2016-10601](https://cve.now/CVE-2016-10601.md): webdrvr is a npm wrapper for Selenium Webdriver including Chromedriver / IEDriver / IOSDriver / Ghostdriver. (no CVSS, HackerOne webdrvr node module · webdrvr)
- [CVE-2016-10611](https://cve.now/CVE-2016-10611.md): strider-sauce is Sauce Labs / Selenium support for Strider. (no CVSS, HackerOne strider-sauce node module · strider-sauce)
- [CVE-2016-10627](https://cve.now/CVE-2016-10627.md): scala-bin is a binary wrapper for Scala. (no CVSS, HackerOne scala-bin node module · scala-bin)
- [CVE-2016-10635](https://cve.now/CVE-2016-10635.md): broccoli-closure is a Closure compiler plugin for Broccoli. (no CVSS, HackerOne broccoli-closure node module · broccoli-closure)
- [CVE-2016-10650](https://cve.now/CVE-2016-10650.md): ntfserver is a Network Testing Framework Server. (no CVSS, HackerOne ntfserver node module · ntfserver)
- [CVE-2016-10658](https://cve.now/CVE-2016-10658.md): native-opencv is the OpenCV library installed via npm native-opencv downloads binary resources over HTTP, which leaves it vulnerable to MITM (no CVSS, HackerOne native-opencv node module · native-opencv)
- [CVE-2016-10659](https://cve.now/CVE-2016-10659.md): poco - The POCO libraries, downloads source file resources used for compilation over HTTP, which leaves it vulnerable to MITM attacks. (no CVSS, HackerOne poco node module · poco)
- [CVE-2016-10666](https://cve.now/CVE-2016-10666.md): tomita-parser is a Node wrapper for Yandex Tomita Parser tomita-parser downloads binary resources over HTTP, which leaves it vulnerable to M (no CVSS, HackerOne tomita-parser node module · tomita-parser)
- [CVE-2016-10674](https://cve.now/CVE-2016-10674.md): limbus-buildgen is a "build anywhere" build system. (no CVSS, HackerOne limbus-buildgen node module · limbus-buildgen)
- [CVE-2016-10679](https://cve.now/CVE-2016-10679.md): selenium-standalone-painful installs a start-selenium command line to start a standalone selenium server with chrome-driver. (no CVSS, HackerOne selenium-standalone-painful node module · seleniu…)
- [CVE-2016-10680](https://cve.now/CVE-2016-10680.md): adamvr-geoip-lite is a light weight native JavaScript implementation of GeoIP API from MaxMind adamvr-geoip-lite downloads geoip resources o (no CVSS, HackerOne adamvr-geoip-lite node module · adamvr-geoip-lite)
- [CVE-2016-10681](https://cve.now/CVE-2016-10681.md): roslib-socketio - The standard ROS Javascript Library fork for add support to socket.io roslib-socketio downloads binary resources over HTTP (no CVSS, HackerOne roslib-socketio node module · roslib-socketio)
- [CVE-2016-10682](https://cve.now/CVE-2016-10682.md): massif is a Phantomjs fork massif downloads resources over HTTP, which leaves it vulnerable to MITM attacks. (no CVSS, HackerOne massif node module · massif)
- [CVE-2016-10698](https://cve.now/CVE-2016-10698.md): mystem-fix is a node.js wrapper for MyStem morphology text analyzer by Yandex.ru mystem-fix downloads binary resources over HTTP, which leav (no CVSS, HackerOne mystem-fix node module · mystem-fix)
- [CVE-2017-16003](https://cve.now/CVE-2017-16003.md): windows-build-tools is a module for installing C++ Build Tools for Windows using npm. (no CVSS, HackerOne windows-build-tools node module · windows-build-t…)
- [CVE-2017-16010](https://cve.now/CVE-2017-16010.md): i18next is a language translation framework. (no CVSS, HackerOne i18next node module · i18next)
- [CVE-2017-16047](https://cve.now/CVE-2017-16047.md): mysqljs was a malicious module published with the intent to hijack environment variables. (no CVSS, HackerOne mysqljs node module · mysqljs)
- [CVE-2017-16061](https://cve.now/CVE-2017-16061.md): tkinter was a malicious module published with the intent to hijack environment variables. (no CVSS, HackerOne tkinter node module · tkinter)
- [CVE-2017-16062](https://cve.now/CVE-2017-16062.md): node-tkinter was a malicious module published with the intent to hijack environment variables. (no CVSS, HackerOne node-tkinter node module · node-tkinter)
- [CVE-2017-16153](https://cve.now/CVE-2017-16153.md): gaoxuyan is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../" in the url. (no CVSS, HackerOne gaoxuyan node module · gaoxuyan)
- [CVE-2018-10466](https://cve.now/CVE-2018-10466.md): Zoho ManageEngine ADAudit Plus before 5.0.0 build 5100 allows blind SQL Injection. (no CVSS)
- [CVE-2018-10751](https://cve.now/CVE-2018-10751.md): A malformed OMACP WAP push message can cause memory corruption on a Samsung S7 Edge device when processing the String Extension portion of t (no CVSS)
- [CVE-2018-11027](https://cve.now/CVE-2018-11027.md): A reflected XSS vulnerability on Ruckus ICX7450-48 devices allows remote attackers to inject arbitrary web script or HTML. (no CVSS)
- [CVE-2018-11392](https://cve.now/CVE-2018-11392.md): An arbitrary file upload vulnerability in /classes/profile.class.php in Jigowatt "PHP Login & User Management" before 4.1.1, as distributed (no CVSS)
- [CVE-2018-3733](https://cve.now/CVE-2018-3733.md): crud-file-server node module before 0.9.0 suffers from a Path Traversal vulnerability due to incorrect validation of url, which allows a mal (no CVSS, HackerOne crud-file-server node module · crud-file-server)
- [CVE-2018-3734](https://cve.now/CVE-2018-3734.md): stattic node module suffers from a Path Traversal vulnerability due to lack of validation of path, which allows a malicious user to read con (no CVSS, HackerOne stattic node module · stattic)
- [CVE-2018-3744](https://cve.now/CVE-2018-3744.md): The html-pages node module contains a path traversal vulnerabilities that allows an attacker to read any file from the server with cURL. (no CVSS, HackerOne html-pages node module · html-pages)
- [CVE-2018-3745](https://cve.now/CVE-2018-3745.md): atob 2.0.3 and earlier allocates uninitialized Buffers when number is passed in input on Node.js 4.x and below. (no CVSS, HackerOne atob node module · atob)
- [CVE-2018-6964](https://cve.now/CVE-2018-6964.md): VMware Horizon Client for Linux (4.x before 4.8.0 and prior) contains a local privilege escalation vulnerability due to insecure usage of SU (no CVSS, VMware Horizon Client for Linux)
- [CVE-2018-1235](https://cve.now/CVE-2018-1235.md): Dell EMC RecoverPoint versions prior to 5.1.2 and RecoverPoint for VMs versions prior to 5.1.1.3, contain a command injection vulnerability. (no CVSS, Dell EMC RecoverPoint)
- [CVE-2018-1241](https://cve.now/CVE-2018-1241.md): Dell EMC RecoverPoint versions prior to 5.1.2 and RecoverPoint for VMs versions prior to 5.1.1.3, under certain conditions, may leak LDAP pa (no CVSS, Dell EMC RecoverPoint)
- [CVE-2018-1242](https://cve.now/CVE-2018-1242.md): Dell EMC RecoverPoint versions prior to 5.1.2 and RecoverPoint for VMs versions prior to 5.1.1.3, contains a command injection vulnerability (no CVSS, Dell EMC RecoverPoint)
- [CVE-2018-1495](https://cve.now/CVE-2018-1495.md): IBM FlashSystem V840 and V900 products could allow an authenticated attacker with specialized access to overwrite arbitrary files which coul (CVSS 6.5, IBM FlashSystem)
- [CVE-2016-7076](https://cve.now/CVE-2016-7076.md): sudo before version 1.8.18p1 is vulnerable to a bypass in the sudo noexec restriction if application run via sudo executed wordexp() C libra (CVSS 6.4, \[UNKNOWN\] sudo)
- [CVE-2017-1768](https://cve.now/CVE-2017-1768.md): IBM Security Guardium Big Data Intelligence (SonarG) 3.1 generates an error message that includes sensitive information about its environmen (CVSS 4.3, IBM Security Guardium Big Data Intelligence)
- [CVE-2018-1369](https://cve.now/CVE-2018-1369.md): IBM Security Guardium Big Data Intelligence (SonarG) 3.1 stores sensitive information in URL parameters. (CVSS 3.7, IBM Security Guardium Big Data Intelligence)
- [CVE-2018-1370](https://cve.now/CVE-2018-1370.md): IBM Security Guardium Big Data Intelligence (SonarG) 3.1 specifies permissions for a security-critical resource in a way that allows that re (CVSS 4.2, IBM Security Guardium Big Data Intelligence)
- [CVE-2018-1375](https://cve.now/CVE-2018-1375.md): IBM Security Guardium Big Data Intelligence (SonarG) 3.1 does not renew a session variable after a successful authentication which could lea (CVSS 5.9, IBM Security Guardium Big Data Intelligence)
- [CVE-2018-1376](https://cve.now/CVE-2018-1376.md): IBM Security Guardium Big Data Intelligence (SonarG) 3.1 is vulnerable to cross-site scripting. (CVSS 6.1, IBM Security Guardium Big Data Intelligence)
- [CVE-2018-5241](https://cve.now/CVE-2018-5241.md): Symantec Advanced Secure Gateway (ASG) 6.6 and 6.7, and ProxySG 6.5, 6.6, and 6.7 are susceptible to a SAML authentication bypass vulnerabil (no CVSS, Symantec Advanced Secure Gateway · Symantec ProxySG)
- [CVE-2018-11488](https://cve.now/CVE-2018-11488.md): A stack exhaustion vulnerability in the search function of dtSearch 7.90.8538.1 and prior allows remote attackers to cause a denial of servi (no CVSS)
- [CVE-2018-11523](https://cve.now/CVE-2018-11523.md): upload.php on NUUO NVRmini 2 devices allows Arbitrary File Upload, such as upload of .php files. (no CVSS)
- [CVE-2018-11527](https://cve.now/CVE-2018-11527.md): An issue was discovered in CScms v4.1. (no CVSS)
- [CVE-2018-11528](https://cve.now/CVE-2018-11528.md): WUZHI CMS 4.1.0 has SQL Injection via an api/sms\_check.php?param= URI. (no CVSS)
- [CVE-2018-11531](https://cve.now/CVE-2018-11531.md): Exiv2 0.26 has a heap-based buffer overflow in getData in preview.cpp. (no CVSS)
- [CVE-2018-11532](https://cve.now/CVE-2018-11532.md): An issue was discovered in the ChangUonDyU Advanced Statistics plugin 1.0.2 for MyBB. (no CVSS)
- [CVE-2018-11535](https://cve.now/CVE-2018-11535.md): An issue was discovered in SITEMAKIN SLAC (Site Login and Access Control) v1.0. (no CVSS)
- [CVE-2018-11536](https://cve.now/CVE-2018-11536.md): md4c before 0.2.5 has a heap-based buffer overflow because md\_split\_simple\_pairing\_mark mishandles splits. (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2018-05-29
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.