CVEs published March 1, 2018
53 CVEs were published on March 1, 2018: 1 critical, 7 high. 1 is now in CISA KEV.
- Published
- 53
- Critical
- 1
- High
- 7
- Medium
- 7
- Low
- 0
- Unrated
- 38
- Now in CISA KEV
- 1
- Fix available
- 19
Most affected products
- Drupal.org Drupal Core · drupal/core +1
- 7
- F5 Networks BIG-IP LTM, AAM, AFM, Analytics, APM, ASM, DNS,…
- 3
- SUSE libzypp
- 3
- NetIQ Access Manager
- 2
- Apache Software Foundation Apache Xerces C++
- 1
- F5 Networks BIG-IP ASM
- 1
- NetIQ Identity Manager Plug-ins
- 1
- openSUSE open build service
- 1
- Red Hat 389-ds-base
- 1
- SAP SE SAP BASIS
- 1
Critical 1
High 7
- CVE-2017-14798local privilege escalation in SUSE postgresql init scriptsuse postgresql-init
- CVE-2017-7435libzypp accepts unsigned 3rd party repo without warningSUSE libzypp
- CVE-2017-7436libzypp accepts unsigned packages even when configured to check signaturesSUSE libzypp
- CVE-2017-9269lack of keypinning in libzypp could lead to repository switchingSUSE libzypp
- CVE-2017-9270post-auth arbitrary file write on cryptctl serverSUSE cryptctl
- CVE-2017-9274osc executes spec code during "osc commit"SUSE obs-service-source_validator
- CVE-2017-9286nextcloud package security issues with /srv/www/htdocsSUSE nextcloud
Medium, low and unrated 45
- CVE-2017-6926In Drupal versions 8.4.x versions before 8.4.5 users with permission to post comments are able to view content and comments they do not haveDrupal.org Drupal Core · drupal/core +1
- CVE-2017-6927Drupal 8.4.x versions before 8.4.5 and Drupal 7.x versions before 7.57 has a Drupal.checkPlain() JavaScript function which is used to escapeDrupal.org Drupal Core · drupal/core +1
- CVE-2017-6928Drupal core 7.x versions before 7.57 when using Drupal's private file system, Drupal will check to make sure a user has access to a file befDrupal.org Drupal Core · drupal/core +1
- CVE-2017-6929A jQuery cross site scripting vulnerability is present when making Ajax requests to untrusted domains.Drupal.org Drupal Core · drupal/core +1
- CVE-2017-6930In Drupal versions 8.4.x versions before 8.4.5 when using node access controls with a multilingual site, Drupal marks the untranslated versiDrupal.org Drupal Core · drupal/core +1
- CVE-2017-6931In Drupal versions 8.4.x versions before 8.4.5 the Settings Tray module has a vulnerability that allows users to update certain data that thDrupal.org Drupal Core · drupal/core +1
- CVE-2017-6932Drupal core 7.x versions before 7.57 has an external link injection vulnerability when the language switcher block is used.Drupal.org Drupal Core · drupal/core +1
- CVE-2018-7634An issue was discovered in Enalean Tuleap 9.17.
- CVE-2017-15134A stack buffer overflow flaw was found in the way 389-ds-base 1.3.6.x before 1.3.6.13, 1.3.7.x before 1.3.7.9, 1.4.x before 1.4.0.5 handled Red Hat 389-ds-base
- CVE-2017-18212An issue was discovered in JerryScript 1.0.
- CVE-2018-7586In the nextgen-gallery plugin before 2.2.50 for WordPress, gallery paths are not secured.
- CVE-2018-7587An issue was discovered in CImg v.220.
- CVE-2018-7588An issue was discovered in CImg v.220.
- CVE-2018-7589An issue was discovered in CImg v.220.
- CVE-2018-7590CSRF exists in Hoosk 1.7.0 via /admin/users/new/add, resulting in account creation.
- CVE-2017-18209In the GetOpenCLCachedFilesDirectory function in magick/opencl.c in ImageMagick 7.0.7, a NULL pointer dereference vulnerability occurs becau
- CVE-2017-18210In ImageMagick 7.0.7, a NULL pointer dereference vulnerability was found in the function BenchmarkOpenCLDevices in MagickCore/opencl.c becau
- CVE-2017-18211In ImageMagick 7.0.7, a NULL pointer dereference vulnerability was found in the function saveBinaryCLProgram in magick/opencl.c because a pr
- CVE-2018-7047An issue was discovered in the MBeans Server in Wowza Streaming Engine before 4.7.1.
- CVE-2018-7048An issue was discovered in Wowza Streaming Engine before 4.7.1.
- CVE-2018-7049An issue was discovered in Wowza Streaming Engine before 4.7.1.
- CVE-2017-14799XSS Vulnerability with ESP URLNetIQ Access Manager
- CVE-2017-14800Reflected xss on Access Manager iManager UINetIQ Access Manager
- CVE-2017-5188OBS worker VM escape via relative symbolic linksopenSUSE open build service
- CVE-2017-7426iManager - XML External Entity vulnerabilitiesNetIQ Identity Manager Plug-ins
- CVE-2017-9268open-build-service retrigger / wipebinaries hitting the wrong project bypassing access permissionsSUSE open build service
- CVE-2017-9271proxy credentials written to log files by zypperSUSE zypper
- CVE-2018-7579\application\admin\controller\update_urls.class.php in YzmCMS 3.6 has SQL Injection via the catids array parameter to admin/update_urls/upda
- CVE-2018-7584In PHP through 5.6.33, 7.0.x before 7.0.28, 7.1.x through 7.1.14, and 7.2.x through 7.2.2, there is a stack-based buffer under-read while pa
- CVE-2018-2365SAP NetWeaver Portal, WebDynpro Java, 7.30, 7.31, 7.40, 7.50, does not sufficiently encode user controlled inputs, resulting in Cross-Site SSAP SE SAP NetWeaver Portal WebDynpro RunTime
- CVE-2018-2367ABAP File Interface in, SAP BASIS, from 7.00 to 7.02, from 7.10 to 7.11, 7.30, 7.31, 7.40, from 7.50 to 7.52, allows an attacker to exploit SAP SE SAP BASIS
- CVE-2018-2368SAP NetWeaver System Landscape Directory, LM-CORE 7.10, 7.20, 7.30, 7.31, 7.40, does not perform any authentication checks for functionalitiSAP SE SAP NetWeaver System Landscape Directory, LM-Core
- CVE-2018-2380SAP CRM, 7.01, 7.02,7.30, 7.31, 7.33, 7.54, allows an attacker to exploit insufficient validation of path information provided by users, thuSAP SE SAP CRM
- CVE-2018-5314Command injection vulnerability in Citrix NetScaler ADC and NetScaler Gateway 11.0 before build 70.16, 11.1 before build 55.13, and 12.0 bef
- CVE-2018-7573An issue was discovered in FTPShell Client 6.7.
- CVE-2017-6150Under certain conditions for F5 BIG-IP systems 13.0.0 or 12.1.0 - 12.1.3.1, using FastL4 profiles, when the Reassemble IP Fragments option iF5 Networks BIG-IP LTM, AAM, AFM, Analytics, APM, ASM, DNS,…
- CVE-2017-6154On F5 BIG-IP systems running 13.0.0, 12.1.0 - 12.1.3.1, or 11.6.1 - 11.6.2, the BIG-IP ASM bd daemon may core dump memory under some circumsF5 Networks BIG-IP ASM
- CVE-2018-5500On F5 BIG-IP systems running 13.0.0, 12.1.0 - 12.1.3.1, or 11.6.1 - 11.6.2, every Multipath TCP (MCTCP) connection established leaks a smallF5 Networks BIG-IP LTM, AAM, AFM, Analytics, APM, ASM, DNS,…
- CVE-2018-5501In some circumstances, on F5 BIG-IP systems running 13.0.0, 12.1.0 - 12.1.3.1, any 11.6.x or 11.5.x release, or 11.2.1, TCP DNS profile alloF5 Networks BIG-IP LTM, AAM, AFM, Analytics, APM, ASM, DNS,…
- CVE-2018-7561Stack-based Buffer Overflow in httpd on Tenda AC9 devices V15.03.05.14_EN allows remote attackers to cause a denial of service or possibly h
- CVE-2017-12627In Apache Xerces-C XML Parser library before 3.2.1, processing of external DTD paths can result in a null pointer dereference under certain Apache Software Foundation Apache Xerces C++
- CVE-2017-18207The Wave_read._read_fmt_chunk function in Lib/wave.py in Python through 3.6.4 does not ensure a nonzero channel value, which allows attacker
- CVE-2017-18208The madvise_willneed function in mm/madvise.c in the Linux kernel before 4.14.4 allows local users to cause a denial of service (infinite lo
- CVE-2018-6653comforte SWAP 1049 through 1069 and 20.0.0 through 21.5.3 (as used in SSLOBJ on HPE NonStop SSL T0910, and in the comforte SecurCS, SecurFTP
- CVE-2018-7550The load_multiboot function in hw/i386/multiboot.c in Quick Emulator (aka QEMU) allows local guest OS users to execute arbitrary code on the