# CVEs published 2018-05-30 30 CVEs were published on May 30, 2018: 0 critical, 0 high. Days are UTC. - [CVE-2018-11567](https://cve.now/CVE-2018-11567.md): Prior to 2018-04-27, the reprompt feature in Amazon Echo devices could be misused by a custom Alexa skill. (no CVSS) - [CVE-2018-11568](https://cve.now/CVE-2018-11568.md): Reflected XSS is possible in the GamePlan theme through 1.5.13.2 for WordPress because of insufficient input sanitization, as demonstrated b (no CVSS) - [CVE-2015-7610](https://cve.now/CVE-2015-7610.md): Cross-site request forgery (CSRF) vulnerability in the login form in Zimbra Collaboration Suite (aka ZCS) before 8.6.0 Patch 10, 8.7.x befor (no CVSS) - [CVE-2018-10196](https://cve.now/CVE-2018-10196.md): NULL pointer dereference vulnerability in the rebuild\_vlists function in lib/dotgen/conc.c in the dotgen library in Graphviz 2.40.1 allows r (no CVSS) - [CVE-2018-10939](https://cve.now/CVE-2018-10939.md): Zimbra Web Client (ZWC) in Zimbra Collaboration Suite 8.8 before 8.8.8.Patch4 and 8.7 before 8.7.11.Patch4 has Persistent XSS via a contact (no CVSS) - [CVE-2018-11476](https://cve.now/CVE-2018-11476.md): An issue was discovered on Vgate iCar 2 Wi-Fi OBD2 Dongle devices. (no CVSS) - [CVE-2018-11477](https://cve.now/CVE-2018-11477.md): An issue was discovered on Vgate iCar 2 Wi-Fi OBD2 Dongle devices. (no CVSS) - [CVE-2018-11478](https://cve.now/CVE-2018-11478.md): An issue was discovered on Vgate iCar 2 Wi-Fi OBD2 Dongle devices. (no CVSS) - [CVE-2018-11481](https://cve.now/CVE-2018-11481.md): TP-LINK IPC TL-IPC223(P)-6, TL-IPC323K-D, TL-IPC325(KP)-\*, and TL-IPC40A-4 devices allow authenticated remote code execution via crafted JSO (no CVSS) - [CVE-2018-11482](https://cve.now/CVE-2018-11482.md): /usr/lib/lua/luci/websys.lua on TP-LINK IPC TL-IPC223(P)-6, TL-IPC323K-D, TL-IPC325(KP)-\*, and TL-IPC40A-4 devices has a hardcoded zMiVw8Kw0 (no CVSS) - [CVE-2018-11565](https://cve.now/CVE-2018-11565.md): Mahara 17.04 before 17.04.8 and 17.10 before 17.10.5 and 18.04 before 18.04.1 are vulnerable to mentioning the usernames that are already ta (no CVSS) - [CVE-2018-7534](https://cve.now/CVE-2018-7534.md): In Stealth Authorization Server before 3.3.017.0 in Unisys Stealth Solution, an encryption key may be left in memory. (no CVSS) - [CVE-2018-10995](https://cve.now/CVE-2018-10995.md): SchedMD Slurm before 17.02.11 and 17.1x.x before 17.11.7 mishandles user names (aka user\_name fields) and group ids (aka gid fields). (no CVSS) - [CVE-2018-11518](https://cve.now/CVE-2018-11518.md): A vulnerability allows a phreaking attack on HCL legacy IVR systems that do not use VoIP. (no CVSS) - [CVE-2018-11562](https://cve.now/CVE-2018-11562.md): An issue was discovered in MISP 2.4.91. (no CVSS) - [CVE-2018-11432](https://cve.now/CVE-2018-11432.md): The mobi\_parse\_mobiheader function in read.c in Libmobi 0.3 allows remote attackers to cause information disclosure (heap-based buffer over- (no CVSS) - [CVE-2018-11433](https://cve.now/CVE-2018-11433.md): The mobi\_get\_kf8boundary\_seqnumber function in util.c in Libmobi 0.3 allows remote attackers to cause information disclosure (heap-based buf (no CVSS) - [CVE-2018-11434](https://cve.now/CVE-2018-11434.md): The buffer\_fill64 function in compression.c in Libmobi 0.3 allows remote attackers to cause information disclosure (heap-based buffer over-r (no CVSS) - [CVE-2018-11435](https://cve.now/CVE-2018-11435.md): The mobi\_decompress\_huffman\_internal function in compression.c in Libmobi 0.3 allows remote attackers to cause information disclosure (read (no CVSS) - [CVE-2018-11436](https://cve.now/CVE-2018-11436.md): The buffer\_addraw function in buffer.c in Libmobi 0.3 allows remote attackers to cause information disclosure (heap-based buffer over-read) (no CVSS) - [CVE-2018-11437](https://cve.now/CVE-2018-11437.md): The mobi\_reconstruct\_parts function in parse\_rawml.c in Libmobi 0.3 allows remote attackers to cause information disclosure (read access vio (no CVSS) - [CVE-2018-11438](https://cve.now/CVE-2018-11438.md): The mobi\_decompress\_lz77 function in compression.c in Libmobi 0.3 allows remote attackers to cause remote code execution (heap-based buffer (no CVSS) - [CVE-2018-11439](https://cve.now/CVE-2018-11439.md): The TagLib::Ogg::FLAC::File::scan function in oggflacfile.cpp in TagLib 1.11.1 allows remote attackers to cause information disclosure (heap (no CVSS) - [CVE-2018-11233](https://cve.now/CVE-2018-11233.md): In Git before 2.13.7, 2.14.x before 2.14.4, 2.15.x before 2.15.2, 2.16.x before 2.16.4, and 2.17.x before 2.17.1, code to sanity-check pathn (no CVSS) - [CVE-2018-11235](https://cve.now/CVE-2018-11235.md): In Git before 2.13.7, 2.14.x before 2.14.4, 2.15.x before 2.15.2, 2.16.x before 2.16.4, and 2.17.x before 2.17.1, remote code execution can (no CVSS) - [CVE-2018-11555](https://cve.now/CVE-2018-11555.md): tificc in Little CMS 2.9 has an out-of-bounds write in the PrecalculatedXFORM function in cmsxform.c in liblcms2.a via a crafted TIFF file. (no CVSS) - [CVE-2018-11556](https://cve.now/CVE-2018-11556.md): tificc in Little CMS 2.9 has an out-of-bounds write in the cmsPipelineCheckAndRetreiveStages function in cmslut.c in liblcms2.a via a crafte (no CVSS) - [CVE-2018-11557](https://cve.now/CVE-2018-11557.md): YIBAN Easy class education platform 2.0 has XSS via the articlelist.php k parameter. (no CVSS) - [CVE-2018-11558](https://cve.now/CVE-2018-11558.md): DomainMod 4.10.0 has Stored XSS in the "/settings/profile/index.php" new\_first\_name parameter. (no CVSS) - [CVE-2018-11559](https://cve.now/CVE-2018-11559.md): DomainMod 4.10.0 has Stored XSS in the "/settings/profile/index.php" new\_last\_name parameter. (no CVSS) --- Source: cve.now, built and run by Sazabi (AI-native observability and security) Page: https://cve.now/daily/2018-05-30 Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.