# CVEs published 2018-03-04

12 CVEs were published on March 4, 2018: 0 critical, 0 high. Days are UTC.

- [CVE-2018-7662](https://cve.now/CVE-2018-7662.md): Couch through 2.0 allows remote attackers to discover the full path via a direct request to includes/mysql2i/mysql2i.func.php or addons/phpm (no CVSS)
- [CVE-2018-7661](https://cve.now/CVE-2018-7661.md): Papenmeier WiFi Baby Monitor Free & Lite before 2.02.2 allows remote attackers to obtain audio data via certain requests to TCP ports 8258 a (no CVSS)
- [CVE-2017-18214](https://cve.now/CVE-2017-18214.md): The moment module before 2.19.3 for Node.js is prone to a regular expression denial of service via a crafted date string, a different vulner (no CVSS, moment)
- [CVE-2018-7560](https://cve.now/CVE-2018-7560.md): index.js in the Anton Myshenin aws-lambda-multipart-parser NPM package before 0.1.2 has a Regular Expression Denial of Service (ReDoS) issue (no CVSS, aws-lambda-multipart-parser)
- [CVE-2018-7567](https://cve.now/CVE-2018-7567.md): In the Admin Package Manager in Open Ticket Request System (OTRS) 5.0.0 through 5.0.24 and 6.0.0 through 6.0.1, authenticated admins are abl (no CVSS)
- [CVE-2018-7653](https://cve.now/CVE-2018-7653.md): In YzmCMS 3.6, index.php has XSS via the a, c, or m parameter. (no CVSS)
- [CVE-2017-18213](https://cve.now/CVE-2017-18213.md): In Exponent CMS before 2.4.1 Patch #6, certain admin users can elevate their privileges. (no CVSS)
- [CVE-2018-7449](https://cve.now/CVE-2018-7449.md): SEGGER FTP Server for Windows before 3.22a allows remote attackers to cause a denial of service (daemon crash) via an invalid LIST, STOR, or (no CVSS)
- [CVE-2018-7583](https://cve.now/CVE-2018-7583.md): Proxy.exe in DualDesk 20 allows Remote Denial Of Service (daemon crash) via a long string to TCP port 5500. (no CVSS)
- [CVE-2018-7651](https://cve.now/CVE-2018-7651.md): index.js in the ssri module before 5.2.2 for Node.js is prone to a regular expression denial of service vulnerability in strict mode functio (no CVSS, ssri)
- [CVE-2018-7652](https://cve.now/CVE-2018-7652.md): lib/Zonemaster/GUI/Dancer/Export.pm in Zonemaster Web GUI before 1.0.11 has XSS. (no CVSS)
- [CVE-2018-7654](https://cve.now/CVE-2018-7654.md): On 3CX 15.5.6354.2 devices, the parameter "file" in the request "/api/RecordingList/download?file=" allows full access to files on the serve (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2018-03-04
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.