# CVEs published 2018-03-26 51 CVEs were published on March 26, 2018: 0 critical, 0 high. Days are UTC. - [CVE-2017-12410](https://cve.now/CVE-2017-12410.md): It is possible to exploit a Time of Check & Time of Use (TOCTOU) vulnerability by winning a race condition when Kaseya Virtual System… (no CVSS) - [CVE-2017-12815](https://cve.now/CVE-2017-12815.md): Analysis of the Bomgar Remote Support Portal JavaStart.jar Applet 52790 and earlier revealed that it is vulnerable to a path traversal… (no CVSS) - [CVE-2018-7658](https://cve.now/CVE-2018-7658.md): NTSServerSvc.exe in the server in Softros Network Time System 2.3.4 allows remote attackers to cause a denial of service (daemon crash) by… (no CVSS) - [CVE-2018-8802](https://cve.now/CVE-2018-8802.md): SQL injection vulnerability in the management interface in ePortal Manager allows remote attackers to execute arbitrary SQL commands via… (no CVSS) - [CVE-2017-18249](https://cve.now/CVE-2017-18249.md): The add\_free\_nid function in fs/f2fs/node.c in the Linux kernel before 4.12 does not properly track an allocated nid, which allows local… (no CVSS) - [CVE-2018-1348](https://cve.now/CVE-2018-1348.md): NetIQ Identity Manager SSL Renegotiation (CVSS 5.3, NetIQ Identity Manager) - [CVE-2018-1349](https://cve.now/CVE-2018-1349.md): NetIQ Identity Manager Driver Component Log File Information Leakage (CVSS 2.3, NetIQ Identity Manager) - [CVE-2018-1350](https://cve.now/CVE-2018-1350.md): NetIQ Identity Manager Driver Component Information Leakage (CVSS 2.3, NetIQ Identity Manager) - [CVE-2018-7673](https://cve.now/CVE-2018-7673.md): NetIQ Identity Manager DoS Attack (CVSS 5.1, NetIQ Identity Manager) - [CVE-2014-2048](https://cve.now/CVE-2014-2048.md): The user\_openid app in ownCloud Server before 5.0.15 allows remote attackers to obtain access by leveraging an insecure OpenID… (no CVSS) - [CVE-2014-2293](https://cve.now/CVE-2014-2293.md): Zikula Application Framework before 1.3.7 build 11 allows remote attackers to conduct PHP object injection attacks and delete arbitrary… (no CVSS) - [CVE-2014-2312](https://cve.now/CVE-2014-2312.md): The main function in android\_main.cpp in thermald allows local users to write to arbitrary files via a symlink attack on /tmp/thermald.pid. (no CVSS) - [CVE-2015-5039](https://cve.now/CVE-2015-5039.md): The Remote Client and change management integrations in IBM Rational ClearCase 7.1.x, 8.0.0.x before 8.0.0.18, and 8.0.1.x before 8.0.1.11… (no CVSS) - [CVE-2015-5045](https://cve.now/CVE-2015-5045.md): The Administration and Reporting tool in IBM Rational License Key Server (RLKS) before 8.1.4.9 iFix 04 allows local users to obtain… (no CVSS) - [CVE-2015-7401](https://cve.now/CVE-2015-7401.md): IBM Curam Social Program Management 6.1.x before 6.1.1.1 allows remote authenticated users to bypass intended access restrictions and… (no CVSS) - [CVE-2015-7423](https://cve.now/CVE-2015-7423.md): Multiple cross-site scripting (XSS) vulnerabilities in IBM InfoSphere Master Data Management (MDM) - Collaborative Edition 9.1, 10.1… (no CVSS) - [CVE-2015-7424](https://cve.now/CVE-2015-7424.md): IBM InfoSphere Master Data Management (MDM) - Collaborative Edition 9.1, 10.1, 11.0, 11.3, 11.4, and 11.5 allow remote authenticated users… (no CVSS) - [CVE-2015-7432](https://cve.now/CVE-2015-7432.md): IBM Capacity Management Analytics 2.1.0.0 allows local users to decrypt usernames and passwords by leveraging access to setenv.sh and… (no CVSS) - [CVE-2015-7433](https://cve.now/CVE-2015-7433.md): IBM Capacity Management Analytics 2.1.0.0 allows local users to discover cleartext usernames and passwords by leveraging access to the CMA… (no CVSS) - [CVE-2015-7434](https://cve.now/CVE-2015-7434.md): IBM Capacity Management Analytics 2.1.0.0 allows local users to discover encrypted usernames and passwords by leveraging access to the CMA… (no CVSS) - [CVE-2018-1186](https://cve.now/CVE-2018-1186.md): Dell EMC Isilon versions between 8.1.0.0 - 8.1.0.1, 8.0.1.0 - 8.0.1.2, and 8.0.0.0 - 8.0.0.6, versions 7.2.1.x, and version 7.1.1.11 is… (no CVSS, Dell EMC Isilon OneFS) - [CVE-2018-1187](https://cve.now/CVE-2018-1187.md): Dell EMC Isilon versions between 8.1.0.0 - 8.1.0.1, 8.0.1.0 - 8.0.1.2, and 8.0.0.0 - 8.0.0.6 is affected by a cross-site scripting… (no CVSS, Dell EMC Isilon OneFS) - [CVE-2018-1188](https://cve.now/CVE-2018-1188.md): Dell EMC Isilon versions between 8.1.0.0 - 8.1.0.1, 8.0.1.0 - 8.0.1.2, and 8.0.0.0 - 8.0.0.6, and versions 7.2.1.x is affected by a… (no CVSS, Dell EMC Isilon OneFS) - [CVE-2018-1189](https://cve.now/CVE-2018-1189.md): Dell EMC Isilon versions between 8.1.0.0 - 8.1.0.1, 8.0.1.0 - 8.0.1.2, and 8.0.0.0 - 8.0.0.6, versions 7.2.1.x, and version 7.1.1.11 is… (no CVSS, Dell EMC Isilon OneFS) - [CVE-2018-1201](https://cve.now/CVE-2018-1201.md): Dell EMC Isilon versions between 8.1.0.0 - 8.1.0.1, 8.0.1.0 - 8.0.1.2, and 8.0.0.0 - 8.0.0.6, versions 7.2.1.x, and version 7.1.1.11 is… (no CVSS, Dell EMC Isilon OneFS) - [CVE-2018-1202](https://cve.now/CVE-2018-1202.md): Dell EMC Isilon versions between 8.1.0.0 - 8.1.0.1, 8.0.1.0 - 8.0.1.2, and 8.0.0.0 - 8.0.0.6, and version 7.1.1.11 is affected by a… (no CVSS, Dell EMC Isilon OneFS) - [CVE-2018-1203](https://cve.now/CVE-2018-1203.md): In Dell EMC Isilon OneFS, the compadmin is able to run tcpdump binary with root privileges. (no CVSS, Dell EMC Isilon OneFS) - [CVE-2018-1204](https://cve.now/CVE-2018-1204.md): Dell EMC Isilon OneFS versions between 8.1.0.0 - 8.1.0.1, 8.0.1.0 - 8.0.1.2, and 8.0.0.0 - 8.0.0.6, versions 7.2.1.x, and version 7.1.1.11… (no CVSS, Dell EMC Isilon OneFS) - [CVE-2018-1213](https://cve.now/CVE-2018-1213.md): Dell EMC Isilon OneFS versions between 8.1.0.0 - 8.1.0.1, 8.0.1.0 - 8.0.1.2, and 8.0.0.0 - 8.0.0.6, versions 7.2.1.x, and version 7.1.1.11… (no CVSS, Dell EMC Isilon OneFS) - [CVE-2018-7543](https://cve.now/CVE-2018-7543.md): Cross-site scripting (XSS) vulnerability in installer/build/view.step4.php of the SnapCreek Duplicator plugin 1.2.32 for WordPress allows… (no CVSS) - [CVE-2017-18248](https://cve.now/CVE-2017-18248.md): The add\_job function in scheduler/ipp.c in CUPS before 2.2.6, when D-Bus support is enabled, can be crashed by remote attackers by sending… (no CVSS) - [CVE-2018-8937](https://cve.now/CVE-2018-8937.md): An issue was discovered in Open-AudIT Professional 2.1. (no CVSS) - [CVE-2017-15534](https://cve.now/CVE-2017-15534.md): The Norton App Lock prior to version 1.3.0.13 can be susceptible to an authentication bypass exploit. (no CVSS, Symantec Norton App Lock) - [CVE-2017-6278](https://cve.now/CVE-2017-6278.md): NVIDIA Tegra kernel contains a vulnerability in the CORE DVFS Thermal driver where there is the potential to read or write a buffer using… (no CVSS, NVIDIA Tegra) - [CVE-2017-15710](https://cve.now/CVE-2017-15710.md): In Apache httpd 2.0.23 to 2.0.65, 2.2.0 to 2.2.34, and 2.4.0 to 2.4.29, mod\_authnz\_ldap, if configured with AuthLDAPCharsetConfig, uses… (no CVSS, Apache Software Foundation Apache HTTP Server) - [CVE-2017-15715](https://cve.now/CVE-2017-15715.md): In Apache httpd 2.4.0 to 2.4.29, the expression specified in \ could match '$' to a newline character in a malicious filename… (no CVSS, Apache Software Foundation Apache HTTP Server) - [CVE-2018-1283](https://cve.now/CVE-2018-1283.md): In Apache httpd 2.4.0 to 2.4.29, when mod\_session is configured to forward its session data to CGI applications (SessionEnv on, not the… (no CVSS, Apache Software Foundation Apache HTTP Server) - [CVE-2018-1301](https://cve.now/CVE-2018-1301.md): A specially crafted request could have crashed the Apache HTTP Server prior to version 2.4.30, due to an out of bound access after a size… (no CVSS, Apache Software Foundation Apache HTTP Server) - [CVE-2018-1302](https://cve.now/CVE-2018-1302.md): When an HTTP/2 stream was destroyed after being handled, the Apache HTTP Server prior to version 2.4.30 could have written a NULL pointer… (no CVSS, Apache Software Foundation Apache HTTP Server) - [CVE-2018-1303](https://cve.now/CVE-2018-1303.md): A specially crafted HTTP request header could have crashed the Apache HTTP Server prior to version 2.4.30 due to an out of bound read… (no CVSS, Apache Software Foundation Apache HTTP Server) - [CVE-2018-1312](https://cve.now/CVE-2018-1312.md): In Apache httpd 2.2.0 to 2.4.29, when generating an HTTP Digest authentication challenge, the nonce sent to prevent reply attacks was not… (no CVSS, Apache Software Foundation Apache HTTP Server) - [CVE-2018-5454](https://cve.now/CVE-2018-5454.md): Philips IntelliSpace Portal all versions of 8.0.x, and 7.0.x have a vulnerability where code debugging methods are enabled, which could… (no CVSS, Philips IntelliSpace Portal) - [CVE-2018-5458](https://cve.now/CVE-2018-5458.md): Philips IntelliSpace Portal all versions of 8.0.x, and 7.0.x have a vulnerability using SSL legacy encryption that could allow an attacker… (no CVSS, Philips IntelliSpace Portal) - [CVE-2018-5462](https://cve.now/CVE-2018-5462.md): Philips IntelliSpace Portal all versions of 8.0.x, and 7.0.x have an SSL incorrect hostname certificate vulnerability this could allow an… (no CVSS, Philips IntelliSpace Portal) - [CVE-2018-5464](https://cve.now/CVE-2018-5464.md): Philips IntelliSpace Portal all versions of 8.0.x, and 7.0.x have an untrusted SSL certificate vulnerability this could allow an attacker… (no CVSS, Philips IntelliSpace Portal) - [CVE-2018-5466](https://cve.now/CVE-2018-5466.md): Philips IntelliSpace Portal all versions of 8.0.x, and 7.0.x have a self-signed SSL certificate vulnerability this could allow an attacker… (no CVSS, Philips IntelliSpace Portal) - [CVE-2018-5468](https://cve.now/CVE-2018-5468.md): Philips Intellispace Portal all versions 7.0.x and 8.0.x have a remote desktop access vulnerability that could allow an attacker to gain… (no CVSS, Philips IntelliSpace Portal) - [CVE-2018-5470](https://cve.now/CVE-2018-5470.md): Philips IntelliSpace Portal all versions of 8.0.x, and 7.0.x have an unquoted search path or element vulnerability that has been… (no CVSS, Philips IntelliSpace Portal) - [CVE-2018-5472](https://cve.now/CVE-2018-5472.md): Philips Intellispace Portal all versions 7.0.x and 8.0.x have an insecure windows permissions vulnerability that could allow an attacker… (no CVSS, Philips IntelliSpace Portal) - [CVE-2018-5474](https://cve.now/CVE-2018-5474.md): Philips Intellispace Portal all versions 7.0.x and 8.0.x have an input validation vulnerability that could allow a remote attacker to… (no CVSS, Philips IntelliSpace Portal) - [CVE-2018-9020](https://cve.now/CVE-2018-9020.md): The Events Manager plugin before 5.8.1.2 for WordPress allows XSS via the events-manager.js mapTitle parameter in the Google Maps miniature. (no CVSS) --- Source: cve.now Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards. Page: https://cve.now/archive/2018-03-26 Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.