# CVEs published 2018-03-04

12 CVEs were published on March 4, 2018: 0 critical, 0 high. Days are UTC.

- [CVE-2018-7662](https://cve.now/CVE-2018-7662.md): Couch through 2.0 allows remote attackers to discover the full path via a direct request to includes/mysql2i/mysql2i.func.php or… (no CVSS)
- [CVE-2018-7661](https://cve.now/CVE-2018-7661.md): Papenmeier WiFi Baby Monitor Free & Lite before 2.02.2 allows remote attackers to obtain audio data via certain requests to TCP ports 8258… (no CVSS)
- [CVE-2017-18214](https://cve.now/CVE-2017-18214.md): The moment module before 2.19.3 for Node.js is prone to a regular expression denial of service via a crafted date string, a different… (no CVSS, moment)
- [CVE-2018-7560](https://cve.now/CVE-2018-7560.md): index.js in the Anton Myshenin aws-lambda-multipart-parser NPM package before 0.1.2 has a Regular Expression Denial of Service (ReDoS)… (no CVSS, aws-lambda-multipart-parser)
- [CVE-2018-7567](https://cve.now/CVE-2018-7567.md): In the Admin Package Manager in Open Ticket Request System (OTRS) 5.0.0 through 5.0.24 and 6.0.0 through 6.0.1, authenticated admins are… (no CVSS)
- [CVE-2018-7653](https://cve.now/CVE-2018-7653.md): In YzmCMS 3.6, index.php has XSS via the a, c, or m parameter. (no CVSS)
- [CVE-2017-18213](https://cve.now/CVE-2017-18213.md): In Exponent CMS before 2.4.1 Patch #6, certain admin users can elevate their privileges. (no CVSS)
- [CVE-2018-7449](https://cve.now/CVE-2018-7449.md): SEGGER FTP Server for Windows before 3.22a allows remote attackers to cause a denial of service (daemon crash) via an invalid LIST, STOR… (no CVSS)
- [CVE-2018-7583](https://cve.now/CVE-2018-7583.md): Proxy.exe in DualDesk 20 allows Remote Denial Of Service (daemon crash) via a long string to TCP port 5500. (no CVSS)
- [CVE-2018-7651](https://cve.now/CVE-2018-7651.md): index.js in the ssri module before 5.2.2 for Node.js is prone to a regular expression denial of service vulnerability in strict mode… (no CVSS, ssri)
- [CVE-2018-7652](https://cve.now/CVE-2018-7652.md): lib/Zonemaster/GUI/Dancer/Export.pm in Zonemaster Web GUI before 1.0.11 has XSS. (no CVSS)
- [CVE-2018-7654](https://cve.now/CVE-2018-7654.md): On 3CX 15.5.6354.2 devices, the parameter "file" in the request "/api/RecordingList/download?file=" allows full access to files on the… (no CVSS)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/archive/2018-03-04
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.