# CVEs published 2018-06-04

136 CVEs were published on June 4, 2018: 0 critical, 3 high. Days are UTC.

- [CVE-2016-1000344](https://cve.now/CVE-2016-1000344.md): In the Bouncy Castle JCE Provider version 1.55 and earlier the DHIES implementation allowed the use of ECB mode. (no CVSS, org.bouncycastle:bcprov-jdk14 · org.bouncycastle:bcprov-… +1)
- [CVE-2016-1000345](https://cve.now/CVE-2016-1000345.md): In the Bouncy Castle JCE Provider version 1.55 and earlier the DHIES/ECIES CBC mode vulnerable to padding oracle attack. (no CVSS, org.bouncycastle:bcprov-jdk14 · org.bouncycastle:bcprov-… +1)
- [CVE-2016-1000346](https://cve.now/CVE-2016-1000346.md): In the Bouncy Castle JCE Provider version 1.55 and earlier the other party DH public key is not fully validated. (no CVSS, org.bouncycastle:bcprov-jdk14 · org.bouncycastle:bcprov-… +1)
- [CVE-2016-1000352](https://cve.now/CVE-2016-1000352.md): In the Bouncy Castle JCE Provider version 1.55 and earlier the ECIES implementation allowed the use of ECB mode. (no CVSS, org.bouncycastle:bcprov-jdk14 · org.bouncycastle:bcprov-… +1)
- [CVE-2016-9042](https://cve.now/CVE-2016-9042.md): An exploitable denial of service vulnerability exists in the origin timestamp check functionality of ntpd 4.2.8p9. (CVSS 3.7, Talos Network Time Protocol)
- [CVE-2017-12092](https://cve.now/CVE-2017-12092.md): An exploitable file write vulnerability exists in the memory module functionality of Allen Bradley Micrologix 1400 Series B FRN 21.2 and bef (CVSS 3.7, Talos Allen Bradley)
- [CVE-2018-3853](https://cve.now/CVE-2018-3853.md): An exploitable use-after-free vulnerability exists in the JavaScript engine of Foxit Software Foxit PDF Reader version 9.0.1.1049. (CVSS 8.8, Talos Foxit)
- [CVE-2016-10695](https://cve.now/CVE-2016-10695.md): The npm-test-sqlite3-trunk module provides asynchronous, non-blocking SQLite3 bindings. (no CVSS, HackerOne npm-test-sqlite3-trunk node module · npm-test-sql…)
- [CVE-2016-10696](https://cve.now/CVE-2016-10696.md): windows-latestchromedriver downloads the latest version of chromedriver.exe. (no CVSS, HackerOne windows-latestchromedriver node module · windows-…)
- [CVE-2016-10697](https://cve.now/CVE-2016-10697.md): react-native-baidu-voice-synthesizer is a baidu voice speech synthesizer for react native. (no CVSS, HackerOne react-native-baidu-voice-synthesizer node module…)
- [CVE-2016-8390](https://cve.now/CVE-2016-8390.md): An exploitable out of bounds write vulnerability exists in the parsing of ELF Section Headers of Hopper Disassembler 3.11.20. (CVSS 7.5, Talos Hopper)
- [CVE-2017-0928](https://cve.now/CVE-2017-0928.md): html-janitor node module suffers from an External Control of Critical State Data vulnerability via user-control of the '\_sanitized' variable (no CVSS, HackerOne html-janitor node module · html-janitor)
- [CVE-2017-0930](https://cve.now/CVE-2017-0930.md): augustine node module suffers from a Path Traversal vulnerability due to lack of validation of url, which allows a malicious user to read co (no CVSS, HackerOne augustine node module · augustine)
- [CVE-2017-0931](https://cve.now/CVE-2017-0931.md): html-janitor node module suffers from a Cross-Site Scripting (XSS) vulnerability via clean() accepting user-controlled values. (no CVSS, HackerOne html-janitor node module · html-janitor)
- [CVE-2017-16005](https://cve.now/CVE-2017-16005.md): Http-signature is a "Reference implementation of Joyent's HTTP Signature Scheme". (no CVSS, HackerOne http-signature node module · http-signature)
- [CVE-2017-16006](https://cve.now/CVE-2017-16006.md): Remarkable is a markdown parser. (no CVSS, HackerOne remarkable node module · remarkable)
- [CVE-2017-16007](https://cve.now/CVE-2017-16007.md): node-jose is a JavaScript implementation of the JSON Object Signing and Encryption (JOSE) for current web browsers and node.js-based servers (no CVSS, HackerOne node-jose node module · node-jose)
- [CVE-2017-16008](https://cve.now/CVE-2017-16008.md): i18next is a language translation framework. (no CVSS, HackerOne i18next node module · i18next)
- [CVE-2017-16009](https://cve.now/CVE-2017-16009.md): ag-grid is an advanced data grid that is library agnostic. (no CVSS, HackerOne ag-grid node module · ag-grid)
- [CVE-2017-16013](https://cve.now/CVE-2017-16013.md): hapi is a web and services application framework. (no CVSS, HackerOne hapi node module · hapi)
- [CVE-2017-16014](https://cve.now/CVE-2017-16014.md): Http-proxy is a proxying library. (no CVSS, HackerOne http-proxy node module · http-proxy)
- [CVE-2017-16015](https://cve.now/CVE-2017-16015.md): Forms is a library for easily creating HTML forms. (no CVSS, HackerOne forms node module · forms)
- [CVE-2017-16016](https://cve.now/CVE-2017-16016.md): Sanitize-html is a library for scrubbing html input of malicious values. (no CVSS, HackerOne sanitize-html node module · sanitize-html)
- [CVE-2017-16017](https://cve.now/CVE-2017-16017.md): sanitize-html is a library for scrubbing html input for malicious values Versions 1.2.2 and below have a cross site scripting vulnerability. (no CVSS, HackerOne sanitize-html node module · sanitize-html)
- [CVE-2017-16018](https://cve.now/CVE-2017-16018.md): Restify is a framework for building REST APIs. (no CVSS, HackerOne restify node module · restify)
- [CVE-2017-16019](https://cve.now/CVE-2017-16019.md): GitBook is a command line tool (and Node.js library) for building beautiful books using GitHub/Git and Markdown (or AsciiDoc). (no CVSS, HackerOne gitbook node module · gitbook)
- [CVE-2017-16020](https://cve.now/CVE-2017-16020.md): Summit is a node web framework. (no CVSS, HackerOne summit node module · summit)
- [CVE-2017-16021](https://cve.now/CVE-2017-16021.md): uri-js is a module that tries to fully implement RFC 3986. (no CVSS, HackerOne uri-js node module · uri-js)
- [CVE-2017-16022](https://cve.now/CVE-2017-16022.md): Morris.js creates an svg graph, with labels that appear when hovering over a point. (no CVSS, HackerOne Morris.js node module · morris.js)
- [CVE-2017-16023](https://cve.now/CVE-2017-16023.md): Decamelize is used to convert a dash/dot/underscore/space separated string to camelCase. (no CVSS, HackerOne decamelize node module · decamelize)
- [CVE-2017-16024](https://cve.now/CVE-2017-16024.md): The sync-exec module is used to simulate child\_process.execSync in node versions \<0.11.9. (no CVSS, HackerOne sync-exec node module · sync-exec)
- [CVE-2017-16025](https://cve.now/CVE-2017-16025.md): Nes is a websocket extension library for hapi. (no CVSS, HackerOne nes node module · nes)
- [CVE-2017-16026](https://cve.now/CVE-2017-16026.md): Request is an http client. (no CVSS, HackerOne request node module · request)
- [CVE-2017-16028](https://cve.now/CVE-2017-16028.md): react-native-meteor-oauth is a library for Oauth2 login to a Meteor server in React Native. (no CVSS, HackerOne react-native-meteor-oauth node module · randomatic)
- [CVE-2017-16029](https://cve.now/CVE-2017-16029.md): hostr is a simple web server that serves up the contents of the current directory. (no CVSS, HackerOne hostr node module · hostr)
- [CVE-2017-16030](https://cve.now/CVE-2017-16030.md): Useragent is used to parse useragent headers. (no CVSS, HackerOne useragent node module · useragent)
- [CVE-2017-16031](https://cve.now/CVE-2017-16031.md): Socket.io is a realtime application framework that provides communication via websockets. (no CVSS, HackerOne socket.io node module · socket.io)
- [CVE-2017-16035](https://cve.now/CVE-2017-16035.md): The hubl-server module is a wrapper for the HubL Development Server. (no CVSS, HackerOne hubl-server node module · hubl-server)
- [CVE-2017-16036](https://cve.now/CVE-2017-16036.md): \`badjs-sourcemap-server\` receives files sent by \`badjs-sourcemap\`. (no CVSS, HackerOne badjs-sourcemap-server node module · badjs-source…)
- [CVE-2017-16037](https://cve.now/CVE-2017-16037.md): \`gomeplus-h5-proxy\` is vulnerable to a directory traversal issue, allowing attackers to access any file in the system by placing '../' in th (no CVSS, HackerOne gomeplus-h5-proxy node module · gomeplus-h5-proxy)
- [CVE-2017-16038](https://cve.now/CVE-2017-16038.md): \`f2e-server\` 1.12.11 and earlier is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../" (no CVSS, HackerOne f2e-server node module · f2e-server)
- [CVE-2017-16039](https://cve.now/CVE-2017-16039.md): \`hftp\` is a static http or ftp server \`hftp\` is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by pl (no CVSS, HackerOne hftp node module · hftp)
- [CVE-2017-16040](https://cve.now/CVE-2017-16040.md): gfe-sass is a library for promises (CommonJS/Promises/A,B,D) gfe-sass downloads resources over HTTP, which leaves it vulnerable to MITM atta (no CVSS, HackerOne gfe-sass node module · gfe-sass)
- [CVE-2017-16041](https://cve.now/CVE-2017-16041.md): ikst versions before 1.1.2 download resources over HTTP, which leaves it vulnerable to MITM attacks. (no CVSS, HackerOne ikst node module · ikst)
- [CVE-2017-16042](https://cve.now/CVE-2017-16042.md): Growl adds growl notification support to nodejs. (no CVSS, HackerOne growl node module · growl)
- [CVE-2017-16043](https://cve.now/CVE-2017-16043.md): Shout is an IRC client. (no CVSS, HackerOne shout node module · shout)
- [CVE-2017-16044](https://cve.now/CVE-2017-16044.md): \`d3.js\` was a malicious module published with the intent to hijack environment variables. (no CVSS, HackerOne d3.js node module · d3.js)
- [CVE-2017-16045](https://cve.now/CVE-2017-16045.md): \`jquery.js\` was a malicious module published with the intent to hijack environment variables. (no CVSS, HackerOne jquery.js node module · jquery.js)
- [CVE-2017-16046](https://cve.now/CVE-2017-16046.md): \`mariadb\` was a malicious module published with the intent to hijack environment variables. (no CVSS, HackerOne mariadb node module)
- [CVE-2017-16048](https://cve.now/CVE-2017-16048.md): \`node-sqlite\` was a malicious module published with the intent to hijack environment variables. (no CVSS, HackerOne node-sqlite node module · node-sqlite)
- [CVE-2017-16049](https://cve.now/CVE-2017-16049.md): \`nodesqlite\` was a malicious module published with the intent to hijack environment variables. (no CVSS, HackerOne nodesqlite node module · nodesqlite)
- [CVE-2017-16050](https://cve.now/CVE-2017-16050.md): \`sqlite.js\` was a malicious module published with the intent to hijack environment variables. (no CVSS, HackerOne sqlite.js node module · sqlite.js)
- [CVE-2017-16051](https://cve.now/CVE-2017-16051.md): \`sqliter\` was a malicious module published with the intent to hijack environment variables. (no CVSS, HackerOne sqliter node module · sqliter)
- [CVE-2017-16052](https://cve.now/CVE-2017-16052.md): \`node-fabric\` was a malicious module published with the intent to hijack environment variables. (no CVSS, HackerOne node-fabric node module · node-fabric)
- [CVE-2017-16053](https://cve.now/CVE-2017-16053.md): \`fabric-js\` was a malicious module published with the intent to hijack environment variables. (no CVSS, HackerOne fabric-js node module · fabric-js)
- [CVE-2017-16054](https://cve.now/CVE-2017-16054.md): \`nodefabric\` was a malicious module published with the intent to hijack environment variables. (no CVSS, HackerOne nodefabric node module · nodefabric)
- [CVE-2017-16055](https://cve.now/CVE-2017-16055.md): \`sqlserver\` was a malicious module published with the intent to hijack environment variables. (no CVSS, HackerOne sqlserver node module · sqlserver)
- [CVE-2017-1748](https://cve.now/CVE-2017-1748.md): IBM Connections 5.0, 5.5, and 6.0 could allow a remote attacker to conduct phishing attacks, using an open redirect attack. (CVSS 6.8, IBM Connections)
- [CVE-2018-11715](https://cve.now/CVE-2018-11715.md): The Recent Threads plugin before 1.1 for MyBB allows XSS via a thread subject. (no CVSS)
- [CVE-2018-1600](https://cve.now/CVE-2018-1600.md): IBM BigFix Platform 9.2 and 9.5 transmits sensitive or security-critical data in clear text in a communication channel that can be sniffed b (CVSS 8.6, IBM BigFix Platform)
- [CVE-2016-10636](https://cve.now/CVE-2016-10636.md): grunt-ccompiler is a Closure Compiler Grunt Plugin. (no CVSS, HackerOne grunt-ccompiler node module · grunt-ccompiler)
- [CVE-2016-10637](https://cve.now/CVE-2016-10637.md): haxe-dev is a cross-platform toolkit. (no CVSS, HackerOne haxe-dev node module · haxe-dev)
- [CVE-2016-10638](https://cve.now/CVE-2016-10638.md): js-given is a JavaScript frontend to jgiven. (no CVSS, HackerOne js-given node module · js-given)
- [CVE-2016-10639](https://cve.now/CVE-2016-10639.md): redis-srvr is a npm wrapper for redis-server. (no CVSS, HackerOne redis-srvr node module · redis-srvr)
- [CVE-2016-10640](https://cve.now/CVE-2016-10640.md): node-thulac is a node binding for thulac. (no CVSS, HackerOne node-thulac node module · node-thulac)
- [CVE-2016-10641](https://cve.now/CVE-2016-10641.md): node-bsdiff-android downloads resources over HTTP, which leaves it vulnerable to MITM attacks. (no CVSS, HackerOne node-bsdiff-android node module · node-bsdiff-and…)
- [CVE-2016-10642](https://cve.now/CVE-2016-10642.md): cmake installs the cmake x86 linux binaries. (no CVSS, HackerOne cmake node module · cmake)
- [CVE-2016-10643](https://cve.now/CVE-2016-10643.md): jstestdriver is a wrapper for Google's jstestdriver. (no CVSS, HackerOne jstestdriver node module · jstestdriver)
- [CVE-2016-10644](https://cve.now/CVE-2016-10644.md): slimerjs-edge is a npm wrapper for installing the bleeding edge version of slimerjs. (no CVSS, HackerOne slimerjs-edge node module · slimerjs-edge)
- [CVE-2016-10645](https://cve.now/CVE-2016-10645.md): grunt-images is a grunt plugin for processing images. (no CVSS, HackerOne grunt-images node module · grunt-images)
- [CVE-2016-10646](https://cve.now/CVE-2016-10646.md): resourcehacker is a Node wrapper of Resource Hacker (windows executable resource editor). (no CVSS, HackerOne resourcehacker node module · resourcehacker)
- [CVE-2016-10647](https://cve.now/CVE-2016-10647.md): node-air-sdk is an AIR SDK for nodejs. (no CVSS, HackerOne node-air-sdk node module · node-air-sdk)
- [CVE-2016-10648](https://cve.now/CVE-2016-10648.md): marionette-socket-host is a marionette-js-runner host for sending actions over a socket. (no CVSS, HackerOne marionette-socket-host node module · marionette-s…)
- [CVE-2016-10649](https://cve.now/CVE-2016-10649.md): frames-compiler downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. (no CVSS, HackerOne frames-compiler node module · frames-compiler)
- [CVE-2016-10651](https://cve.now/CVE-2016-10651.md): webdriver-launcher is a Node.js Selenium Webdriver Launcher. (no CVSS, HackerOne webdriver-launcher node module · webdriver-launch…)
- [CVE-2016-10652](https://cve.now/CVE-2016-10652.md): prebuild-lwip is a module for comprehensive, fast, and simple image processing and manipulation. (no CVSS, HackerOne prebuild-lwip node module · prebuild-lwip)
- [CVE-2016-10653](https://cve.now/CVE-2016-10653.md): xd-testing is a testing library for cross-device (XD) web applications. (no CVSS, HackerOne xd-testing node module · xd-testing)
- [CVE-2016-10654](https://cve.now/CVE-2016-10654.md): sfml downloads resources over HTTP, which leaves it vulnerable to MITM attacks. (no CVSS, HackerOne sfml node module · sfml)
- [CVE-2016-10655](https://cve.now/CVE-2016-10655.md): The clang-extra module installs LLVM's clang-extra tools. (no CVSS, HackerOne clang-extra node module · clang-extra)
- [CVE-2016-10656](https://cve.now/CVE-2016-10656.md): qbs is a build tool that helps simplify the build process for developing projects across multiple platforms. (no CVSS, HackerOne qbs node module · qbs)
- [CVE-2016-10657](https://cve.now/CVE-2016-10657.md): co-cli-installer downloads the co-cli module as part of the install process, but does so over HTTP, which leaves it vulnerable to MITM attac (no CVSS, HackerOne co-cli-installer node module · co-cli-installer)
- [CVE-2016-10660](https://cve.now/CVE-2016-10660.md): fis-parser-sass-bin a plugin for fis to compile sass using node-sass-binaries. (no CVSS, HackerOne fis-parser-sass-bin node module · fis-parser-sass…)
- [CVE-2016-10661](https://cve.now/CVE-2016-10661.md): phantomjs-cheniu is a Headless WebKit with JS API phantomjs-cheniu downloads binary resources over HTTP, which leaves it vulnerable to MITM (no CVSS, HackerOne phantomjs-cheniu node module · phantomjs-cheniu)
- [CVE-2016-10662](https://cve.now/CVE-2016-10662.md): tomita is a node wrapper for Yandex Tomita Parser tomita downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. (no CVSS, HackerOne tomita node module · tomita)
- [CVE-2016-10663](https://cve.now/CVE-2016-10663.md): wixtoolset is a Node module wrapper around the wixtoolset binaries wixtoolset downloads binary resources over HTTP, which leaves it vulnerab (no CVSS, HackerOne wixtoolset node module · wixtoolset)
- [CVE-2016-10664](https://cve.now/CVE-2016-10664.md): mystem is a Node.js wrapper for MyStem morphology text analyzer by Yandex.ru mystem downloads binary resources over HTTP, which leaves it vu (no CVSS, HackerOne mystem node module · mystem)
- [CVE-2016-10665](https://cve.now/CVE-2016-10665.md): herbivore is a packet sniffing and crafting library. (no CVSS, HackerOne herbivore node module · herbivore)
- [CVE-2016-10667](https://cve.now/CVE-2016-10667.md): selenium-portal is a Selenium Testing Framework selenium-portal downloads binary resources over HTTP, which leaves it vulnerable to MITM att (no CVSS, HackerOne selenium-portal node module · selenium-portal)
- [CVE-2016-10668](https://cve.now/CVE-2016-10668.md): libsbml is a module that installs Linux binaries for libSBML libsbml downloads resources over HTTP, which leaves it vulnerable to MITM attac (no CVSS, HackerOne libsbml node module · libsbml)
- [CVE-2016-10669](https://cve.now/CVE-2016-10669.md): soci downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. (no CVSS, HackerOne soci node module · soci)
- [CVE-2016-10670](https://cve.now/CVE-2016-10670.md): windows-seleniumjar-mirror downloads the Selenium Jar file windows-seleniumjar-mirror downloads binary resources over HTTP, which leaves it (no CVSS, HackerOne windows-seleniumjar-mirror node module · windows-…)
- [CVE-2016-10671](https://cve.now/CVE-2016-10671.md): mystem-wrapper is a Yandex mystem app wrapper module. (no CVSS, HackerOne mystem-wrapper node module · mystem-wrapper)
- [CVE-2016-10672](https://cve.now/CVE-2016-10672.md): cloudpub-redis is a module for CloudPub: Redis Backend cloudpub-redis downloads binary resources over HTTP, which leaves it vulnerable to MI (no CVSS, HackerOne cloudpub-redis node module · cloudpub-redis)
- [CVE-2016-10673](https://cve.now/CVE-2016-10673.md): ipip-coffee queries geolocation information from IP ipip-coffee downloads geolocation resources over HTTP, which leaves it vulnerable to MIT (no CVSS, HackerOne ipip-coffee node module · ipip-coffee)
- [CVE-2016-10675](https://cve.now/CVE-2016-10675.md): libsbmlsim is a module that installs linux binaries for libsbmlsim libsbmlsim downloads binary resources over HTTP, which leaves it vulnerab (no CVSS, HackerOne libsbmlsim node module · libsbmlsim)
- [CVE-2016-10676](https://cve.now/CVE-2016-10676.md): rs-brightcove is a wrapper around brightcove's web api rs-brightcove downloads source file resources over HTTP, which leaves it vulnerable t (no CVSS, HackerOne rs-brightcove node module · rs-brightcove)
- [CVE-2016-10677](https://cve.now/CVE-2016-10677.md): google-closure-tools-latest is a Node.js module wrapper for downloading the latest version of the Google Closure tools google-closure-tools- (no CVSS, HackerOne google-closure-tools-latest node module · google-…)
- [CVE-2016-10678](https://cve.now/CVE-2016-10678.md): serc.js is a Selenium RC process wrapper serc.js downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. (no CVSS, HackerOne serc.js node module · serc.js)
- [CVE-2016-10683](https://cve.now/CVE-2016-10683.md): arcanist downloads resources over HTTP, which leaves it vulnerable to MITM attacks. (no CVSS, HackerOne arcanist node module · arcanist)
- [CVE-2016-10684](https://cve.now/CVE-2016-10684.md): healthcenter - IBM Monitoring and Diagnostic Tools health Center agent healthcenter downloads binary resources over HTTP, which leaves it vu (no CVSS, HackerOne healthcenter node module · healthcenter)
- [CVE-2016-10685](https://cve.now/CVE-2016-10685.md): pk-app-wonderbox is an integration with wonderbox pk-app-wonderbox downloads binary resources over HTTP, which leaves it vulnerable to MITM (no CVSS, HackerOne pk-app-wonderbox node module · pk-app-wonderbox)
- [CVE-2016-10686](https://cve.now/CVE-2016-10686.md): fis-sass-all is another libsass wrapper for node. (no CVSS, HackerOne fis-sass-all node module · fis-sass-all)
- [CVE-2016-10687](https://cve.now/CVE-2016-10687.md): windows-selenium-chromedriver is a module that downloads the Selenium Jar file. (no CVSS, HackerOne windows-selenium-chromedriver node module · windo…)
- [CVE-2016-10688](https://cve.now/CVE-2016-10688.md): Haxe 3 : The Cross-Platform Toolkit (a fork from David Mouton's damoebius/haxe-npm) haxe3 downloads resources over HTTP, which leaves it vul (no CVSS, HackerOne haxe3 node module · haxe3)
- [CVE-2016-10689](https://cve.now/CVE-2016-10689.md): The windows-iedriver module downloads fixed version of iedriverserver.exe windows-iedriver downloads binary resources over HTTP, which leave (no CVSS, HackerOne windows-iedriver node module · windows-iedriver)
- [CVE-2016-10690](https://cve.now/CVE-2016-10690.md): openframe-ascii-image module is an openframe plugin which adds support for ascii images via fim. (no CVSS, HackerOne openframe-ascii-image node module · openframe-asc…)
- [CVE-2016-10691](https://cve.now/CVE-2016-10691.md): windows-seleniumjar is a module that downloads the Selenium Jar file windows-seleniumjar downloads binary resources over HTTP, which leaves (no CVSS, HackerOne windows-seleniumjar node module · windows-seleniu…)
- [CVE-2016-10692](https://cve.now/CVE-2016-10692.md): haxeshim haxe shim to deal with coexisting versions. (no CVSS, haxeshim)
- [CVE-2016-10693](https://cve.now/CVE-2016-10693.md): pm2-kafka is a PM2 module that installs and runs a kafka server pm2-kafka downloads binary resources over HTTP, which leaves it vulnerable t (no CVSS, HackerOne pm2-kafka node module · pm2-kafka)
- [CVE-2016-10694](https://cve.now/CVE-2016-10694.md): alto-saxophone is a module to install and launch Chromedriver for Mac, Linux or Windows. (no CVSS, HackerOne alto-saxophone node module · alto-saxophone)
- [CVE-2018-10611](https://cve.now/CVE-2018-10611.md): Java remote method invocation (RMI) input port in GE MDS PulseNET and MDS PulseNET Enterprise version 3.2.1 and prior may be exploited to al (no CVSS, GE MDS PulseNET and MDS PulseNET Enterprise)
- [CVE-2018-10613](https://cve.now/CVE-2018-10613.md): Multiple variants of XML External Entity (XXE) attacks may be used to exfiltrate data from the host Windows platform in GE MDS PulseNET and (no CVSS, GE MDS PulseNET and MDS PulseNET Enterprise)
- [CVE-2018-10615](https://cve.now/CVE-2018-10615.md): Directory traversal may lead to files being exfiltrated or deleted on the GE MDS PulseNET and MDS PulseNET Enterprise version 3.2.1 and prio (no CVSS, GE MDS PulseNET and MDS PulseNET Enterprise)
- [CVE-2018-11712](https://cve.now/CVE-2018-11712.md): WebCore/platform/network/soup/SocketStreamHandleImplSoup.cpp in the libsoup network backend of WebKit, as used in WebKitGTK+ versions 2.20.0 (no CVSS)
- [CVE-2018-11713](https://cve.now/CVE-2018-11713.md): WebCore/platform/network/soup/SocketStreamHandleImplSoup.cpp in the libsoup network backend of WebKit, as used in WebKitGTK+ prior to versio (no CVSS)
- [CVE-2018-11714](https://cve.now/CVE-2018-11714.md): An issue was discovered on TP-Link TL-WR840N v5 00000005 0.9.1 3.16 v0001.0 Build 170608 Rel.58696n and TL-WR841N v13 00000013 0.9.1 4.16 v0 (no CVSS)
- [CVE-2016-1000339](https://cve.now/CVE-2016-1000339.md): In the Bouncy Castle JCE Provider version 1.55 and earlier the primary engine class used for AES was AESFastEngine. (no CVSS, org.bouncycastle:bcprov-jdk14 · org.bouncycastle:bcprov-… +1)
- [CVE-2016-1000340](https://cve.now/CVE-2016-1000340.md): In the Bouncy Castle JCE Provider versions 1.51 to 1.55, a carry propagation bug was introduced in the implementation of squaring for severa (no CVSS, org.bouncycastle:bcprov-jdk14 · org.bouncycastle:bcprov-… +1)
- [CVE-2016-1000341](https://cve.now/CVE-2016-1000341.md): In the Bouncy Castle JCE Provider version 1.55 and earlier DSA signature generation is vulnerable to timing attack. (no CVSS, org.bouncycastle:bcprov-jdk14 · org.bouncycastle:bcprov-… +1)
- [CVE-2016-1000342](https://cve.now/CVE-2016-1000342.md): In the Bouncy Castle JCE Provider version 1.55 and earlier ECDSA does not fully validate ASN.1 encoding of signature on verification. (no CVSS, org.bouncycastle:bcprov-jdk14 · org.bouncycastle:bcprov-… +1)
- [CVE-2016-1000343](https://cve.now/CVE-2016-1000343.md): In the Bouncy Castle JCE Provider version 1.55 and earlier the DSA key pair generator generates a weak private key if used with default valu (no CVSS, org.bouncycastle:bcprov-jdk14 · org.bouncycastle:bcprov-… +1)
- [CVE-2018-11709](https://cve.now/CVE-2018-11709.md): wpforo\_get\_request\_uri in wpf-includes/functions.php in the wpForo Forum plugin before 1.4.12 for WordPress allows Unauthenticated Reflected (no CVSS)
- [CVE-2018-11710](https://cve.now/CVE-2018-11710.md): soundlib/pattern.h in libopenmpt before 0.3.9 allows remote attackers to cause a denial of service (application crash) or possibly have unsp (no CVSS)
- [CVE-2018-11711](https://cve.now/CVE-2018-11711.md): A remote attacker can bypass the System Manager Mode on the Canon MF210 and MF220 web interface without knowing the PIN for /login.html via (no CVSS)
- [CVE-2017-18284](https://cve.now/CVE-2017-18284.md): The Gentoo app-backup/burp package before 2.1.32 sets the ownership of the PID file directory to the burp account, which might allow local u (no CVSS)
- [CVE-2017-18285](https://cve.now/CVE-2017-18285.md): The Gentoo app-backup/burp package before 2.1.32 has incorrect group ownership of the /etc/burp directory, which might allow local users to (no CVSS)
- [CVE-2018-11683](https://cve.now/CVE-2018-11683.md): Liblouis 3.5.0 has a stack-based Buffer Overflow in the function parseChars in compileTranslationTable.c, a different vulnerability than CVE (no CVSS)
- [CVE-2018-11684](https://cve.now/CVE-2018-11684.md): Liblouis 3.5.0 has a stack-based Buffer Overflow in the function includeFile in compileTranslationTable.c. (no CVSS)
- [CVE-2018-11685](https://cve.now/CVE-2018-11685.md): Liblouis 3.5.0 has a stack-based Buffer Overflow in the function compileHyphenation in compileTranslationTable.c. (no CVSS)
- [CVE-2018-11692](https://cve.now/CVE-2018-11692.md): An issue was discovered on Canon LBP6650, LBP3370, LBP3460, and LBP7750C devices. (no CVSS)
- [CVE-2018-11693](https://cve.now/CVE-2018-11693.md): An issue was discovered in LibSass through 3.5.4. (no CVSS)
- [CVE-2018-11694](https://cve.now/CVE-2018-11694.md): An issue was discovered in LibSass through 3.5.4. (no CVSS)
- [CVE-2018-11695](https://cve.now/CVE-2018-11695.md): An issue was discovered in LibSass \<3.5.3. (no CVSS)
- [CVE-2018-11696](https://cve.now/CVE-2018-11696.md): An issue was discovered in LibSass through 3.5.4. (no CVSS)
- [CVE-2018-11697](https://cve.now/CVE-2018-11697.md): An issue was discovered in LibSass through 3.5.4. (no CVSS)
- [CVE-2018-11698](https://cve.now/CVE-2018-11698.md): An issue was discovered in LibSass through 3.5.4. (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2018-06-04
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.