# CVEs published 2018-06-01

151 CVEs were published on June 1, 2018: 0 critical, 3 high. Days are UTC.

- [CVE-2018-1002100](https://cve.now/CVE-2018-1002100.md): In Kubernetes versions 1.5.x, 1.6.x, 1.7.x, 1.8.x, and prior to version 1.9.6, the kubectl cp command insecurely handles tar data returned f (CVSS 4.2, Kubernetes · k8s.io/kubernetes)
- [CVE-2018-11143](https://cve.now/CVE-2018-11143.md): Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 1 of 46). (no CVSS)
- [CVE-2018-11144](https://cve.now/CVE-2018-11144.md): Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 2 of 46). (no CVSS)
- [CVE-2018-11145](https://cve.now/CVE-2018-11145.md): Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 3 of 46). (no CVSS)
- [CVE-2018-11146](https://cve.now/CVE-2018-11146.md): Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 4 of 46). (no CVSS)
- [CVE-2018-11147](https://cve.now/CVE-2018-11147.md): Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 5 of 46). (no CVSS)
- [CVE-2018-11148](https://cve.now/CVE-2018-11148.md): Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 6 of 46). (no CVSS)
- [CVE-2018-11149](https://cve.now/CVE-2018-11149.md): Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 7 of 46). (no CVSS)
- [CVE-2018-11150](https://cve.now/CVE-2018-11150.md): Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 8 of 46). (no CVSS)
- [CVE-2018-11151](https://cve.now/CVE-2018-11151.md): Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 9 of 46). (no CVSS)
- [CVE-2018-11152](https://cve.now/CVE-2018-11152.md): Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 10 of 46). (no CVSS)
- [CVE-2018-11153](https://cve.now/CVE-2018-11153.md): Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 11 of 46). (no CVSS)
- [CVE-2018-11154](https://cve.now/CVE-2018-11154.md): Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 12 of 46). (no CVSS)
- [CVE-2018-11155](https://cve.now/CVE-2018-11155.md): Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 13 of 46). (no CVSS)
- [CVE-2018-11156](https://cve.now/CVE-2018-11156.md): Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 14 of 46). (no CVSS)
- [CVE-2018-11157](https://cve.now/CVE-2018-11157.md): Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 15 of 46). (no CVSS)
- [CVE-2018-11158](https://cve.now/CVE-2018-11158.md): Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 16 of 46). (no CVSS)
- [CVE-2018-11159](https://cve.now/CVE-2018-11159.md): Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 17 of 46). (no CVSS)
- [CVE-2018-11160](https://cve.now/CVE-2018-11160.md): Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 18 of 46). (no CVSS)
- [CVE-2018-11161](https://cve.now/CVE-2018-11161.md): Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 19 of 46). (no CVSS)
- [CVE-2018-11162](https://cve.now/CVE-2018-11162.md): Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 20 of 46). (no CVSS)
- [CVE-2018-11163](https://cve.now/CVE-2018-11163.md): Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 21 of 46). (no CVSS)
- [CVE-2018-11164](https://cve.now/CVE-2018-11164.md): Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 22 of 46). (no CVSS)
- [CVE-2018-11165](https://cve.now/CVE-2018-11165.md): Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 23 of 46). (no CVSS)
- [CVE-2018-11166](https://cve.now/CVE-2018-11166.md): Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 24 of 46). (no CVSS)
- [CVE-2018-11167](https://cve.now/CVE-2018-11167.md): Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 25 of 46). (no CVSS)
- [CVE-2018-11168](https://cve.now/CVE-2018-11168.md): Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 26 of 46). (no CVSS)
- [CVE-2018-11169](https://cve.now/CVE-2018-11169.md): Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 27 of 46). (no CVSS)
- [CVE-2018-11170](https://cve.now/CVE-2018-11170.md): Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 28 of 46). (no CVSS)
- [CVE-2018-11171](https://cve.now/CVE-2018-11171.md): Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 29 of 46). (no CVSS)
- [CVE-2018-11172](https://cve.now/CVE-2018-11172.md): Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 30 of 46). (no CVSS)
- [CVE-2018-11173](https://cve.now/CVE-2018-11173.md): Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 31 of 46). (no CVSS)
- [CVE-2018-11174](https://cve.now/CVE-2018-11174.md): Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 32 of 46). (no CVSS)
- [CVE-2018-11175](https://cve.now/CVE-2018-11175.md): Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 33 of 46). (no CVSS)
- [CVE-2018-11176](https://cve.now/CVE-2018-11176.md): Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 34 of 46). (no CVSS)
- [CVE-2018-11177](https://cve.now/CVE-2018-11177.md): Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 35 of 46). (no CVSS)
- [CVE-2018-11178](https://cve.now/CVE-2018-11178.md): Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 36 of 46). (no CVSS)
- [CVE-2018-11179](https://cve.now/CVE-2018-11179.md): Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 37 of 46). (no CVSS)
- [CVE-2018-11180](https://cve.now/CVE-2018-11180.md): Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 38 of 46). (no CVSS)
- [CVE-2018-11181](https://cve.now/CVE-2018-11181.md): Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 39 of 46). (no CVSS)
- [CVE-2018-11182](https://cve.now/CVE-2018-11182.md): Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 40 of 46). (no CVSS)
- [CVE-2018-11183](https://cve.now/CVE-2018-11183.md): Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 41 of 46). (no CVSS)
- [CVE-2018-11184](https://cve.now/CVE-2018-11184.md): Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 42 of 46). (no CVSS)
- [CVE-2018-11185](https://cve.now/CVE-2018-11185.md): Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 43 of 46). (no CVSS)
- [CVE-2018-11186](https://cve.now/CVE-2018-11186.md): Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 44 of 46). (no CVSS)
- [CVE-2018-11187](https://cve.now/CVE-2018-11187.md): Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 45 of 46). (no CVSS)
- [CVE-2018-11188](https://cve.now/CVE-2018-11188.md): Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 46 of 46). (no CVSS)
- [CVE-2018-11189](https://cve.now/CVE-2018-11189.md): Quest DR Series Disk Backup software version before 4.0.3.1 allows privilege escalation (issue 1 of 6). (no CVSS)
- [CVE-2018-11190](https://cve.now/CVE-2018-11190.md): Quest DR Series Disk Backup software version before 4.0.3.1 allows privilege escalation (issue 2 of 6). (no CVSS)
- [CVE-2018-11191](https://cve.now/CVE-2018-11191.md): Quest DR Series Disk Backup software version before 4.0.3.1 allows privilege escalation (issue 3 of 6). (no CVSS)
- [CVE-2018-11192](https://cve.now/CVE-2018-11192.md): Quest DR Series Disk Backup software version before 4.0.3.1 allows privilege escalation (issue 4 of 6). (no CVSS)
- [CVE-2018-11193](https://cve.now/CVE-2018-11193.md): Quest DR Series Disk Backup software version before 4.0.3.1 allows privilege escalation (issue 5 of 6). (no CVSS)
- [CVE-2018-11194](https://cve.now/CVE-2018-11194.md): Quest DR Series Disk Backup software version before 4.0.3.1 allows privilege escalation (issue 6 of 6). (no CVSS)
- [CVE-2018-11522](https://cve.now/CVE-2018-11522.md): Yosoro 1.0.4 has stored XSS. (no CVSS)
- [CVE-2018-11564](https://cve.now/CVE-2018-11564.md): Stored XSS in YOOtheme Pagekit 1.0.13 and earlier allows a user to upload malicious code via the picture upload feature. (no CVSS, pagekit/pagekit)
- [CVE-2018-11195](https://cve.now/CVE-2018-11195.md): Mahara 17.04 before 17.04.8 and 17.10 before 17.10.5 and 18.04 before 18.04.1 are vulnerable to the browser "back and refresh" attack. (no CVSS)
- [CVE-2018-11196](https://cve.now/CVE-2018-11196.md): Mahara 17.04 before 17.04.8 and 17.10 before 17.10.5 and 18.04 before 18.04.1 can be used as medium to transmit viruses by placing infected (no CVSS)
- [CVE-2018-11538](https://cve.now/CVE-2018-11538.md): servlet/UserServlet in SearchBlox 8.6.6 has CSRF via the u\_name, u\_passwd1, u\_passwd2, role, and X-XSRF-TOKEN POST parameters because of CSR (no CVSS)
- [CVE-2018-3756](https://cve.now/CVE-2018-3756.md): Hyperledger Iroha versions v1.0\_beta and v1.0.0\_beta-1 are vulnerable to transaction and block signature verification bypass in the transact (no CVSS)
- [CVE-2018-3757](https://cve.now/CVE-2018-3757.md): Command injection exists in pdf-image v2.0.0 due to an unescaped string parameter. (no CVSS, pdf-image)
- [CVE-2018-3809](https://cve.now/CVE-2018-3809.md): Information exposure through directory listings in serve 6.5.3 allows directory listing and file access even when they have been set to be i (no CVSS, serve)
- [CVE-2016-10574](https://cve.now/CVE-2016-10574.md): apk-parser3 is a module to extract Android Manifest info from an APK file. (no CVSS, HackerOne apk-parser3 node module · apk-parser3)
- [CVE-2016-10575](https://cve.now/CVE-2016-10575.md): Kindlegen is a simple Node.js wrapper of the official kindlegen program. (no CVSS, HackerOne kindlegen node module · kindlegen)
- [CVE-2016-10576](https://cve.now/CVE-2016-10576.md): Fuseki server wrapper and management API in fuseki before 1.0.1 downloads binary resources over HTTP, which leaves it vulnerable to MITM att (no CVSS, HackerOne fuseki node module · fuseki)
- [CVE-2016-10579](https://cve.now/CVE-2016-10579.md): Chromedriver is an NPM wrapper for selenium ChromeDriver. (no CVSS, HackerOne chromedriver node module · chromedriver)
- [CVE-2016-10580](https://cve.now/CVE-2016-10580.md): nodewebkit is an installer for node-webkit. (no CVSS, HackerOne nodewebkit node module · nodewebkit)
- [CVE-2016-10581](https://cve.now/CVE-2016-10581.md): Steroids is PhoneGap on Steroids, providing native UI elements, multiple WebViews and enhancements for better developer productivity. (no CVSS, HackerOne steroids node module · steroids)
- [CVE-2016-10582](https://cve.now/CVE-2016-10582.md): closurecompiler is a Closure Compiler for node.js. (no CVSS, HackerOne closurecompiler node module · closurecompiler)
- [CVE-2016-10583](https://cve.now/CVE-2016-10583.md): closure-utils is Utilities for Closure Library based projects. (no CVSS, closure-util)
- [CVE-2016-10585](https://cve.now/CVE-2016-10585.md): libxl provides Node bindings for the libxl library for reading and writing excel (XLS and XLSX) spreadsheets. (no CVSS, HackerOne libxl node module · libxl)
- [CVE-2016-10587](https://cve.now/CVE-2016-10587.md): wasdk is a toolkit for creating WebAssembly modules. (no CVSS, HackerOne wasdk node module · wasdk)
- [CVE-2016-10588](https://cve.now/CVE-2016-10588.md): nw is an installer for nw.js. (no CVSS, HackerOne nw node module · nw)
- [CVE-2016-10592](https://cve.now/CVE-2016-10592.md): jser-stat is a JSer.info stat library. (no CVSS, HackerOne jser-stat node module · jser-stat)
- [CVE-2016-10594](https://cve.now/CVE-2016-10594.md): ipip is a Node.js module to query geolocation information for an IP or domain, based on database by ipip.net. (no CVSS, HackerOne ipip node module · ipip)
- [CVE-2016-10595](https://cve.now/CVE-2016-10595.md): jdf-sass is a fork from node-sass, jdf use only. (no CVSS, HackerOne jdf-sass node module · jdf-sass)
- [CVE-2016-10596](https://cve.now/CVE-2016-10596.md): imageoptim is a Node.js wrapper for some images compression algorithms. (no CVSS, HackerOne imageoptim node module · imageoptim)
- [CVE-2016-10597](https://cve.now/CVE-2016-10597.md): cobalt-cli downloads resources over HTTP, which leaves it vulnerable to MITM attacks. (no CVSS, HackerOne cobalt-cli node module · cobalt-cli)
- [CVE-2016-10598](https://cve.now/CVE-2016-10598.md): arrayfire-js is a module for ArrayFire for the Node.js platform. (no CVSS, HackerOne arrayfire-js node module · arrayfire-js)
- [CVE-2016-10599](https://cve.now/CVE-2016-10599.md): sauce-connect is a Node.js wrapper over the SauceLabs SauceConnect.jar program for establishing a secure tunnel for intranet testing. (no CVSS, HackerOne sauce-connect node module · sauce-connect)
- [CVE-2016-10600](https://cve.now/CVE-2016-10600.md): webrtc-native uses WebRTC from chromium project. (no CVSS, HackerOne webrtc-native node module · webrtc-native)
- [CVE-2016-10602](https://cve.now/CVE-2016-10602.md): haxe is a cross-platform toolkit haxe downloads zipped resources over HTTP, which leaves it vulnerable to MITM attacks. (no CVSS, HackerOne haxe node module · haxe)
- [CVE-2016-10603](https://cve.now/CVE-2016-10603.md): air-sdk is a NPM wrapper for the Adobe AIR SDK. (no CVSS, HackerOne air-sdk node module · air-sdk)
- [CVE-2016-10604](https://cve.now/CVE-2016-10604.md): dalek-browser-chrome is Google Chrome bindings for DalekJS. (no CVSS, HackerOne dalek-browser-chrome node module · dalek-browser-…)
- [CVE-2016-10605](https://cve.now/CVE-2016-10605.md): dalek-browser-ie is Internet Explorer bindings for DalekJS. (no CVSS, HackerOne dalek-browser-ie node module · dalek-browser-ie)
- [CVE-2016-10606](https://cve.now/CVE-2016-10606.md): grunt-webdriver-qunit is a grunt plugin to run qunit with webdriver in grunt grunt-webdriver-qunit downloads binary resources over HTTP, whi (no CVSS, HackerOne grunt-webdriver-qunit node module · grunt-webdriv…)
- [CVE-2016-10607](https://cve.now/CVE-2016-10607.md): openframe-glsviewer is a Openframe extension which adds support for shaders via glslViewer. (no CVSS, HackerOne openframe-glslviewer node module · openframe-glsl…)
- [CVE-2016-10608](https://cve.now/CVE-2016-10608.md): robot-js is a module for native system automation for node.js. (no CVSS, HackerOne robot-js node module · robot-js)
- [CVE-2016-10609](https://cve.now/CVE-2016-10609.md): chromedriver126 is chromedriver version 1.26 for linux OS. (no CVSS, HackerOne chromedriver126 node module · chromedriver126)
- [CVE-2016-10610](https://cve.now/CVE-2016-10610.md): unicode-json is a unicode lookup table. (no CVSS, HackerOne unicode-json node module · unicode-json)
- [CVE-2016-10612](https://cve.now/CVE-2016-10612.md): dalek-browser-ie-canary is Internet Explorer bindings for DalekJS. (no CVSS, HackerOne dalek-browser-ie-canary node module · dalek-brows…)
- [CVE-2016-10613](https://cve.now/CVE-2016-10613.md): bionode-sra is a Node.js wrapper for SRA Toolkit. (no CVSS, HackerOne bionode-sra node module · bionode-sra)
- [CVE-2016-10614](https://cve.now/CVE-2016-10614.md): httpsync is a port of libcurl to node.js. (no CVSS, HackerOne httpsync node module · httpsync)
- [CVE-2016-10615](https://cve.now/CVE-2016-10615.md): curses is bindings for the native curses library, a full featured console IO library. (no CVSS, HackerOne curses node module · curses)
- [CVE-2016-10616](https://cve.now/CVE-2016-10616.md): openframe-image is an Openframe extension which adds support for images via fbi. (no CVSS, HackerOne openframe-image node module · openframe-image)
- [CVE-2016-10617](https://cve.now/CVE-2016-10617.md): box2d-native downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. (no CVSS, HackerOne box2d-native node module · box2d-native)
- [CVE-2016-10618](https://cve.now/CVE-2016-10618.md): node-browser is a wrapper webdriver by nodejs. (no CVSS, HackerOne node-browser node module · node-browser)
- [CVE-2016-10619](https://cve.now/CVE-2016-10619.md): pennyworth is a natural language templating engine. (no CVSS, HackerOne pennyworth node module · pennyworth)
- [CVE-2016-10620](https://cve.now/CVE-2016-10620.md): atom-node-module-installer installs node modules for atom-shell applications. (no CVSS, HackerOne atom-node-module-installer node module · atom-nod…)
- [CVE-2016-10621](https://cve.now/CVE-2016-10621.md): fibjs is a runtime for javascript applictions built on google v8 JS. (no CVSS, HackerOne fibjs node module · fibjs)
- [CVE-2016-10622](https://cve.now/CVE-2016-10622.md): nodeschnaps is a NodeJS compatibility layer for Java (Rhino). (no CVSS, HackerOne nodeschnaps node module · nodeschnaps)
- [CVE-2016-10623](https://cve.now/CVE-2016-10623.md): macaca-chromedriver-zxa is a Node.js wrapper for the selenium chromedriver. (no CVSS, HackerOne macaca-chromedriver-zxa node module · macaca-chro…)
- [CVE-2016-10624](https://cve.now/CVE-2016-10624.md): selenium-chromedriver is a simple utility for downloading the Selenium Webdriver for Google Chrome selenium-chromedriver downloads binary re (no CVSS, HackerOne selenium-chromedriver node module · selenium-chro…)
- [CVE-2016-10625](https://cve.now/CVE-2016-10625.md): headless-browser-lite is a minimal npm installer for phantomjs and slimerjs with no external dependencies. (no CVSS, HackerOne headless-browser-lite node module · headless-brow…)
- [CVE-2016-10626](https://cve.now/CVE-2016-10626.md): mystem3 is a NodeJS wrapper for the Yandex MyStem 3. (no CVSS, HackerOne mystem3 node module · mystem3)
- [CVE-2016-10628](https://cve.now/CVE-2016-10628.md): selenium-wrapper is a selenium server wrapper, including installation and chrome webdriver. (no CVSS, HackerOne selenium-wrapper node module · selenium-wrapper)
- [CVE-2016-10629](https://cve.now/CVE-2016-10629.md): nw-with-arm is a NW Installer including ARM-Build. (no CVSS, HackerOne nw-with-arm node module · nw-with-arm)
- [CVE-2016-10630](https://cve.now/CVE-2016-10630.md): install-g-test downloads resources over HTTP, which leaves it vulnerable to MITM attacks. (no CVSS, HackerOne install-g-test node module · install-g-test)
- [CVE-2016-10631](https://cve.now/CVE-2016-10631.md): jvminstall is a module for downloading and unpacking jvm to local system. (no CVSS, HackerOne jvminstall node module · jvminstall)
- [CVE-2016-10632](https://cve.now/CVE-2016-10632.md): apk-parser2 is a module which extracts Android Manifest info from an APK file. (no CVSS, HackerOne apk-parser2 node module · apk-parser2)
- [CVE-2016-10633](https://cve.now/CVE-2016-10633.md): dwebp-bin is a dwebp node.js wrapper that convert WebP into PNG. (no CVSS, HackerOne dwebp-bin node module · dwebp-bin)
- [CVE-2016-10634](https://cve.now/CVE-2016-10634.md): scala-standalone-bin is a Binary wrapper for ScalaJS. (no CVSS, HackerOne scalajs-standalone-bin node module · scalajs-stan…)
- [CVE-2018-10382](https://cve.now/CVE-2018-10382.md): MODX Revolution 2.6.3 has XSS. (no CVSS)
- [CVE-2018-11551](https://cve.now/CVE-2018-11551.md): AXON PBX 2.02 contains a DLL hijacking vulnerability that could allow an unauthenticated, remote attacker to execute arbitrary code on a tar (no CVSS)
- [CVE-2018-11552](https://cve.now/CVE-2018-11552.md): There is a reflected XSS vulnerability in AXON PBX 2.02 via the "AXON-\>Auto-Dialer-\>Agents-\>Name" field. (no CVSS)
- [CVE-2018-11581](https://cve.now/CVE-2018-11581.md): Cross-site scripting (XSS) vulnerability on Brother HL series printers allows remote attackers to inject arbitrary web script or HTML via th (no CVSS)
- [CVE-2018-11670](https://cve.now/CVE-2018-11670.md): An issue was discovered in GreenCMS v2.3.0603. (no CVSS)
- [CVE-2018-11671](https://cve.now/CVE-2018-11671.md): An issue was discovered in GreenCMS v2.3.0603. (no CVSS)
- [CVE-2018-3743](https://cve.now/CVE-2018-3743.md): Open redirect in hekto \<=0.2.3 when target domain name is used as html filename on server. (no CVSS, HackerOne hekto · hekto)
- [CVE-2018-3746](https://cve.now/CVE-2018-3746.md): The pdfinfojs NPM module versions \<= 0.3.6 has a command injection vulnerability that allows an attacker to execute arbitrary commands on th (no CVSS, HackerOne pdfinfojs · pdfinfojs)
- [CVE-2018-3755](https://cve.now/CVE-2018-3755.md): XSS in sexstatic \<=0.6.2 causes HTML injection in directory name(s) leads to Stored XSS when malicious file is embed with \<iframe\> element u (no CVSS, HackerOne sexstatic · sexstatic)
- [CVE-2017-2852](https://cve.now/CVE-2017-2852.md): An exploitable denial-of-service vulnerability exists in the unserialization of lists functionality of Natus Xltek NeuroWorks 8. (CVSS 7.5, Talos Natus)
- [CVE-2017-2858](https://cve.now/CVE-2017-2858.md): An exploitable denial-of-service vulnerability exists in the traversal of lists functionality of Natus Xltek NeuroWorks 8. (CVSS 7.5, Talos Natus)
- [CVE-2017-2860](https://cve.now/CVE-2017-2860.md): An exploitable denial-of-service vulnerability exists in the lookup entry functionality of KeyTrees in Natus Xltek NeuroWorks 8. (CVSS 7.5, Talos Natus)
- [CVE-2018-11485](https://cve.now/CVE-2018-11485.md): The MULTIDOTS WooCommerce Quick Reports plugin 1.0.6 and earlier for WordPress is vulnerable to Stored XSS. (no CVSS)
- [CVE-2018-11486](https://cve.now/CVE-2018-11486.md): An issue was discovered in the MULTIDOTS Advance Search for WooCommerce plugin 1.0.9 and earlier for WordPress. (no CVSS)
- [CVE-2018-11628](https://cve.now/CVE-2018-11628.md): Data input into EMS Master Calendar before 8.0.0.201805210 via URL parameters is not properly sanitized, allowing malicious attackers to sen (no CVSS)
- [CVE-2018-11652](https://cve.now/CVE-2018-11652.md): CSV Injection vulnerability in Nikto 2.1.6 and earlier allows remote attackers to inject arbitrary OS commands via the Server field in an HT (no CVSS)
- [CVE-2018-11655](https://cve.now/CVE-2018-11655.md): In ImageMagick 7.0.7-20 Q16 x86\_64, a memory leak vulnerability was found in the function GetImagePixelCache in MagickCore/cache.c, which al (no CVSS)
- [CVE-2018-11656](https://cve.now/CVE-2018-11656.md): In ImageMagick 7.0.7-20 Q16 x86\_64, a memory leak vulnerability was found in the function ReadDCMImage in coders/dcm.c, which allows attacke (no CVSS)
- [CVE-2018-11657](https://cve.now/CVE-2018-11657.md): ngiflib.c in MiniUPnP ngiflib 0.4 has an infinite loop in DecodeGifImg and LoadGif. (no CVSS)
- [CVE-2017-17171](https://cve.now/CVE-2017-17171.md): Some Huawei smart phones have the denial of service (DoS) vulnerability due to the improper processing of malicious parameters. (no CVSS, Huawei Technologies Co. HUAWEI Mate 8; HUAWEI P9; HUAWEI P9…)
- [CVE-2017-6153](https://cve.now/CVE-2017-6153.md): Features in F5 BIG-IP 13.0.0-13.1.0.3, 12.1.0-12.1.3.1, 11.6.1-11.6.3.1, 11.5.1-11.5.5, or 11.2.1 system that utilizes inflate functionality (no CVSS, F5 Networks BIG-IP)
- [CVE-2018-11649](https://cve.now/CVE-2018-11649.md): Hue 3.12 has XSS via the /pig/save/ name and script parameters. (no CVSS)
- [CVE-2018-11650](https://cve.now/CVE-2018-11650.md): Graylog before v2.4.4 has an XSS security issue with unescaped text in notifications, related to toastr and util/UserNotification.js. (no CVSS, org.graylog2:graylog2-server)
- [CVE-2018-11651](https://cve.now/CVE-2018-11651.md): Graylog before v2.4.4 has an XSS security issue with unescaped text in dashboard names, related to components/dashboard/Dashboard.jsx, compo (no CVSS, org.graylog2:graylog2-server)
- [CVE-2018-5513](https://cve.now/CVE-2018-5513.md): On F5 BIG-IP 13.1.0-13.1.0.3, 13.0.0, 12.1.0-12.1.3.3, 11.6.1-11.6.3.1, 11.5.1-11.5.5, or 11.2.1, a malformed TLS handshake causes TMM to cr (no CVSS, F5 Networks BIG-IP)
- [CVE-2018-5521](https://cve.now/CVE-2018-5521.md): On F5 BIG-IP 12.1.0-12.1.3.1, 11.6.1-11.6.3.1, 11.5.1-11.5.5, or 11.2.1, carefully crafted URLs can be used to reflect arbitrary content int (no CVSS, F5 Networks BIG-IP)
- [CVE-2018-5522](https://cve.now/CVE-2018-5522.md): On F5 BIG-IP 13.0.0, 12.0.0-12.1.2, 11.6.1-11.6.3.1, 11.5.1-11.5.5, or 11.2.1, when processing DIAMETER transactions with carefully crafted (no CVSS, F5 Networks BIG-IP)
- [CVE-2018-5523](https://cve.now/CVE-2018-5523.md): On F5 BIG-IP 13.1.0-13.1.0.3, 13.0.0, 12.1.0-12.1.3.1, 11.6.1-11.6.3.1, 11.5.1-11.5.5, or 11.2.1 and Enterprise Manager 3.1.1, when authenti (no CVSS, F5 Networks BIG-IP · F5 Networks Enterprise Manager)
- [CVE-2018-5524](https://cve.now/CVE-2018-5524.md): Under certain conditions, on F5 BIG-IP 13.0.0-13.1.0.5, 12.1.0-12.1.3.1, or 11.6.1 HF2-11.6.3.1, virtual servers configured with Client SSL (no CVSS, F5 Networks BIG-IP)
- [CVE-2018-5525](https://cve.now/CVE-2018-5525.md): A local file vulnerability exists in the F5 BIG-IP Configuration utility on versions 13.0.0, 12.1.0-12.1.2, 11.6.1-11.6.3.1, 11.5.1-11.5.5, (no CVSS, F5 Networks BIG-IP)
- [CVE-2018-5526](https://cve.now/CVE-2018-5526.md): Under certain conditions, on F5 BIG-IP ASM 13.1.0-13.1.0.5, Behavioral DOS (BADOS) protection may fail during an attack. (no CVSS, F5 Networks BIG-IP)
- [CVE-2018-7949](https://cve.now/CVE-2018-7949.md): The iBMC (Intelligent Baseboard Management Controller) of some Huawei servers have a privilege escalation vulnerability. (no CVSS, Huawei Technologies Co. 1288H V5; 2288H V5; 2488 V5 ; CH121…)
- [CVE-2018-7950](https://cve.now/CVE-2018-7950.md): The iBMC (Intelligent Baseboard Management Controller) of some Huawei servers have a JSON injection vulnerability due to insufficient input (no CVSS, Huawei Technologies Co. 1288H V5; 2288H V5; 2488 V5 ; CH121…)
- [CVE-2018-7951](https://cve.now/CVE-2018-7951.md): The iBMC (Intelligent Baseboard Management Controller) of some Huawei servers have a JSON injection vulnerability due to insufficient input (no CVSS, Huawei Technologies Co. 1288H V5; 2288H V5; 2488 V5 ; CH121…)
- [CVE-2018-7976](https://cve.now/CVE-2018-7976.md): There is a stored cross-site scripting (XSS) vulnerability in Huawei eSpace Desktop V300R001C00 and V300R001C50 version. (no CVSS, Huawei Technologies Co. eSpace Desktop)
- [CVE-2018-11646](https://cve.now/CVE-2018-11646.md): webkitFaviconDatabaseSetIconForPageURL and webkitFaviconDatabaseSetIconURLForPageURL in UIProcess/API/glib/WebKitFaviconDatabase.cpp in WebK (no CVSS)
- [CVE-2018-8921](https://cve.now/CVE-2018-8921.md): Cross-site scripting (XSS) vulnerability in File Sharing Notify Toast in Synology Drive before 1.0.2-10275 allows remote authenticated users (CVSS 6.5, Synology Drive)
- [CVE-2018-8922](https://cve.now/CVE-2018-8922.md): Improper access control vulnerability in Synology Drive before 1.0.2-10275 allows remote authenticated users to access non-shared files or f (CVSS 6.5, Synology Drive)
- [CVE-2018-11645](https://cve.now/CVE-2018-11645.md): psi/zfile.c in Artifex Ghostscript before 9.21rc1 permits the status command even if -dSAFER is used, which might allow remote attackers to (no CVSS)
- [CVE-2016-1000338](https://cve.now/CVE-2016-1000338.md): In Bouncy Castle JCE Provider version 1.55 and earlier the DSA does not fully validate ASN.1 encoding of signature on verification. (no CVSS, org.bouncycastle:bcprov-jdk14 · org.bouncycastle:bcprov-… +1)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2018-06-01
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.