CVEs published March 4, 2018
12 CVEs were published on March 4, 2018: 0 critical, 0 high.
- Published
- 12
- Critical
- 0
- High
- 0
- Medium
- 0
- Low
- 0
- Unrated
- 12
- Now in CISA KEV
- 0
- Fix available
- 3
Most affected products
- aws-lambda-multipart-parser
- 1
- moment
- 1
- ssri
- 1
Medium, low and unrated 12
- CVE-2018-7662Couch through 2.0 allows remote attackers to discover the full path via a direct request to includes/mysql2i/mysql2i.func.php or addons/phpm
- CVE-2018-7661Papenmeier WiFi Baby Monitor Free & Lite before 2.02.2 allows remote attackers to obtain audio data via certain requests to TCP ports 8258 a
- CVE-2017-18214The moment module before 2.19.3 for Node.js is prone to a regular expression denial of service via a crafted date string, a different vulnermoment
- CVE-2018-7560index.js in the Anton Myshenin aws-lambda-multipart-parser NPM package before 0.1.2 has a Regular Expression Denial of Service (ReDoS) issueaws-lambda-multipart-parser
- CVE-2018-7567In the Admin Package Manager in Open Ticket Request System (OTRS) 5.0.0 through 5.0.24 and 6.0.0 through 6.0.1, authenticated admins are abl
- CVE-2018-7653In YzmCMS 3.6, index.php has XSS via the a, c, or m parameter.
- CVE-2017-18213In Exponent CMS before 2.4.1 Patch #6, certain admin users can elevate their privileges.
- CVE-2018-7449SEGGER FTP Server for Windows before 3.22a allows remote attackers to cause a denial of service (daemon crash) via an invalid LIST, STOR, or
- CVE-2018-7583Proxy.exe in DualDesk 20 allows Remote Denial Of Service (daemon crash) via a long string to TCP port 5500.
- CVE-2018-7651index.js in the ssri module before 5.2.2 for Node.js is prone to a regular expression denial of service vulnerability in strict mode functiossri
- CVE-2018-7652lib/Zonemaster/GUI/Dancer/Export.pm in Zonemaster Web GUI before 1.0.11 has XSS.
- CVE-2018-7654On 3CX 15.5.6354.2 devices, the parameter "file" in the request "/api/RecordingList/download?file=" allows full access to files on the serve