# CVEs published 2018-03-01

53 CVEs were published on March 1, 2018: 1 critical, 7 high. 1 is now in CISA KEV. Days are UTC.

- [CVE-2017-6926](https://cve.now/CVE-2017-6926.md): In Drupal versions 8.4.x versions before 8.4.5 users with permission to post comments are able to view content and comments they do not have (no CVSS, Drupal.org Drupal Core · drupal/core +1)
- [CVE-2017-6927](https://cve.now/CVE-2017-6927.md): Drupal 8.4.x versions before 8.4.5 and Drupal 7.x versions before 7.57 has a Drupal.checkPlain() JavaScript function which is used to escape (no CVSS, Drupal.org Drupal Core · drupal/core +1)
- [CVE-2017-6928](https://cve.now/CVE-2017-6928.md): Drupal core 7.x versions before 7.57 when using Drupal's private file system, Drupal will check to make sure a user has access to a file bef (no CVSS, Drupal.org Drupal Core · drupal/core +1)
- [CVE-2017-6929](https://cve.now/CVE-2017-6929.md): A jQuery cross site scripting vulnerability is present when making Ajax requests to untrusted domains. (no CVSS, Drupal.org Drupal Core · drupal/core +1)
- [CVE-2017-6930](https://cve.now/CVE-2017-6930.md): In Drupal versions 8.4.x versions before 8.4.5 when using node access controls with a multilingual site, Drupal marks the untranslated versi (no CVSS, Drupal.org Drupal Core · drupal/core +1)
- [CVE-2017-6931](https://cve.now/CVE-2017-6931.md): In Drupal versions 8.4.x versions before 8.4.5 the Settings Tray module has a vulnerability that allows users to update certain data that th (no CVSS, Drupal.org Drupal Core · drupal/core +1)
- [CVE-2017-6932](https://cve.now/CVE-2017-6932.md): Drupal core 7.x versions before 7.57 has an external link injection vulnerability when the language switcher block is used. (no CVSS, Drupal.org Drupal Core · drupal/core +1)
- [CVE-2018-7634](https://cve.now/CVE-2018-7634.md): An issue was discovered in Enalean Tuleap 9.17. (no CVSS)
- [CVE-2017-15134](https://cve.now/CVE-2017-15134.md): A stack buffer overflow flaw was found in the way 389-ds-base 1.3.6.x before 1.3.6.13, 1.3.7.x before 1.3.7.9, 1.4.x before 1.4.0.5 handled (no CVSS, Red Hat 389-ds-base)
- [CVE-2017-18212](https://cve.now/CVE-2017-18212.md): An issue was discovered in JerryScript 1.0. (no CVSS)
- [CVE-2018-7586](https://cve.now/CVE-2018-7586.md): In the nextgen-gallery plugin before 2.2.50 for WordPress, gallery paths are not secured. (no CVSS)
- [CVE-2018-7587](https://cve.now/CVE-2018-7587.md): An issue was discovered in CImg v.220. (no CVSS)
- [CVE-2018-7588](https://cve.now/CVE-2018-7588.md): An issue was discovered in CImg v.220. (no CVSS)
- [CVE-2018-7589](https://cve.now/CVE-2018-7589.md): An issue was discovered in CImg v.220. (no CVSS)
- [CVE-2018-7590](https://cve.now/CVE-2018-7590.md): CSRF exists in Hoosk 1.7.0 via /admin/users/new/add, resulting in account creation. (no CVSS)
- [CVE-2017-18209](https://cve.now/CVE-2017-18209.md): In the GetOpenCLCachedFilesDirectory function in magick/opencl.c in ImageMagick 7.0.7, a NULL pointer dereference vulnerability occurs becau (no CVSS)
- [CVE-2017-18210](https://cve.now/CVE-2017-18210.md): In ImageMagick 7.0.7, a NULL pointer dereference vulnerability was found in the function BenchmarkOpenCLDevices in MagickCore/opencl.c becau (no CVSS)
- [CVE-2017-18211](https://cve.now/CVE-2017-18211.md): In ImageMagick 7.0.7, a NULL pointer dereference vulnerability was found in the function saveBinaryCLProgram in magick/opencl.c because a pr (no CVSS)
- [CVE-2018-7047](https://cve.now/CVE-2018-7047.md): An issue was discovered in the MBeans Server in Wowza Streaming Engine before 4.7.1. (no CVSS)
- [CVE-2018-7048](https://cve.now/CVE-2018-7048.md): An issue was discovered in Wowza Streaming Engine before 4.7.1. (no CVSS)
- [CVE-2018-7049](https://cve.now/CVE-2018-7049.md): An issue was discovered in Wowza Streaming Engine before 4.7.1. (no CVSS)
- [CVE-2017-14798](https://cve.now/CVE-2017-14798.md): local privilege escalation in SUSE postgresql init script (CVSS 7.3, suse postgresql-init)
- [CVE-2017-14799](https://cve.now/CVE-2017-14799.md): XSS Vulnerability with ESP URL (CVSS 4.6, NetIQ Access Manager)
- [CVE-2017-14800](https://cve.now/CVE-2017-14800.md): Reflected xss on Access Manager iManager UI (CVSS 5.4, NetIQ Access Manager)
- [CVE-2017-14804](https://cve.now/CVE-2017-14804.md): package builds could use directory traversal to write outside of target area (CVSS 9.9, SUSE build)
- [CVE-2017-5188](https://cve.now/CVE-2017-5188.md): OBS worker VM escape via relative symbolic links (CVSS 5.0, openSUSE open build service)
- [CVE-2017-7426](https://cve.now/CVE-2017-7426.md): iManager - XML External Entity vulnerabilities (CVSS 5.4, NetIQ Identity Manager Plug-ins)
- [CVE-2017-7435](https://cve.now/CVE-2017-7435.md): libzypp accepts unsigned 3rd party repo without warning (CVSS 8.1, SUSE libzypp)
- [CVE-2017-7436](https://cve.now/CVE-2017-7436.md): libzypp accepts unsigned packages even when configured to check signatures (CVSS 8.1, SUSE libzypp)
- [CVE-2017-9268](https://cve.now/CVE-2017-9268.md): open-build-service retrigger / wipebinaries hitting the wrong project bypassing access permissions (CVSS 4.4, SUSE open build service)
- [CVE-2017-9269](https://cve.now/CVE-2017-9269.md): lack of keypinning in libzypp could lead to repository switching (CVSS 7.7, SUSE libzypp)
- [CVE-2017-9270](https://cve.now/CVE-2017-9270.md): post-auth arbitrary file write on cryptctl server (CVSS 8.7, SUSE cryptctl)
- [CVE-2017-9271](https://cve.now/CVE-2017-9271.md): proxy credentials written to log files by zypper (CVSS 4.0, SUSE zypper)
- [CVE-2017-9274](https://cve.now/CVE-2017-9274.md): osc executes spec code during "osc commit" (CVSS 7.8, SUSE obs-service-source\_validator)
- [CVE-2017-9286](https://cve.now/CVE-2017-9286.md): nextcloud package security issues with /srv/www/htdocs (CVSS 7.8, SUSE nextcloud)
- [CVE-2018-7579](https://cve.now/CVE-2018-7579.md): \\application\\admin\\controller\\update\_urls.class.php in YzmCMS 3.6 has SQL Injection via the catids array parameter to admin/update\_urls/upda (no CVSS)
- [CVE-2018-7584](https://cve.now/CVE-2018-7584.md): In PHP through 5.6.33, 7.0.x before 7.0.28, 7.1.x through 7.1.14, and 7.2.x through 7.2.2, there is a stack-based buffer under-read while pa (no CVSS)
- [CVE-2018-2365](https://cve.now/CVE-2018-2365.md): SAP NetWeaver Portal, WebDynpro Java, 7.30, 7.31, 7.40, 7.50, does not sufficiently encode user controlled inputs, resulting in Cross-Site S (no CVSS, SAP SE SAP NetWeaver Portal WebDynpro RunTime)
- [CVE-2018-2367](https://cve.now/CVE-2018-2367.md): ABAP File Interface in, SAP BASIS, from 7.00 to 7.02, from 7.10 to 7.11, 7.30, 7.31, 7.40, from 7.50 to 7.52, allows an attacker to exploit (no CVSS, SAP SE SAP BASIS)
- [CVE-2018-2368](https://cve.now/CVE-2018-2368.md): SAP NetWeaver System Landscape Directory, LM-CORE 7.10, 7.20, 7.30, 7.31, 7.40, does not perform any authentication checks for functionaliti (no CVSS, SAP SE SAP NetWeaver System Landscape Directory, LM-Core)
- [CVE-2018-2380](https://cve.now/CVE-2018-2380.md): SAP CRM, 7.01, 7.02,7.30, 7.31, 7.33, 7.54, allows an attacker to exploit insufficient validation of path information provided by users, thu (CVSS 6.6, KEV, SAP SE SAP CRM)
- [CVE-2018-5314](https://cve.now/CVE-2018-5314.md): Command injection vulnerability in Citrix NetScaler ADC and NetScaler Gateway 11.0 before build 70.16, 11.1 before build 55.13, and 12.0 bef (no CVSS)
- [CVE-2018-7573](https://cve.now/CVE-2018-7573.md): An issue was discovered in FTPShell Client 6.7. (no CVSS)
- [CVE-2017-6150](https://cve.now/CVE-2017-6150.md): Under certain conditions for F5 BIG-IP systems 13.0.0 or 12.1.0 - 12.1.3.1, using FastL4 profiles, when the Reassemble IP Fragments option i (no CVSS, F5 Networks BIG-IP LTM, AAM, AFM, Analytics, APM, ASM, DNS,…)
- [CVE-2017-6154](https://cve.now/CVE-2017-6154.md): On F5 BIG-IP systems running 13.0.0, 12.1.0 - 12.1.3.1, or 11.6.1 - 11.6.2, the BIG-IP ASM bd daemon may core dump memory under some circums (no CVSS, F5 Networks BIG-IP ASM)
- [CVE-2018-5500](https://cve.now/CVE-2018-5500.md): On F5 BIG-IP systems running 13.0.0, 12.1.0 - 12.1.3.1, or 11.6.1 - 11.6.2, every Multipath TCP (MCTCP) connection established leaks a small (no CVSS, F5 Networks BIG-IP LTM, AAM, AFM, Analytics, APM, ASM, DNS,…)
- [CVE-2018-5501](https://cve.now/CVE-2018-5501.md): In some circumstances, on F5 BIG-IP systems running 13.0.0, 12.1.0 - 12.1.3.1, any 11.6.x or 11.5.x release, or 11.2.1, TCP DNS profile allo (no CVSS, F5 Networks BIG-IP LTM, AAM, AFM, Analytics, APM, ASM, DNS,…)
- [CVE-2018-7561](https://cve.now/CVE-2018-7561.md): Stack-based Buffer Overflow in httpd on Tenda AC9 devices V15.03.05.14\_EN allows remote attackers to cause a denial of service or possibly h (no CVSS)
- [CVE-2017-12627](https://cve.now/CVE-2017-12627.md): In Apache Xerces-C XML Parser library before 3.2.1, processing of external DTD paths can result in a null pointer dereference under certain (no CVSS, Apache Software Foundation Apache Xerces C++)
- [CVE-2017-18207](https://cve.now/CVE-2017-18207.md): The Wave\_read.\_read\_fmt\_chunk function in Lib/wave.py in Python through 3.6.4 does not ensure a nonzero channel value, which allows attacker (no CVSS)
- [CVE-2017-18208](https://cve.now/CVE-2017-18208.md): The madvise\_willneed function in mm/madvise.c in the Linux kernel before 4.14.4 allows local users to cause a denial of service (infinite lo (no CVSS)
- [CVE-2018-6653](https://cve.now/CVE-2018-6653.md): comforte SWAP 1049 through 1069 and 20.0.0 through 21.5.3 (as used in SSLOBJ on HPE NonStop SSL T0910, and in the comforte SecurCS, SecurFTP (no CVSS)
- [CVE-2018-7550](https://cve.now/CVE-2018-7550.md): The load\_multiboot function in hw/i386/multiboot.c in Quick Emulator (aka QEMU) allows local guest OS users to execute arbitrary code on the (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2018-03-01
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.