CVEs published March 6, 2018
58 CVEs were published on March 6, 2018: 1 critical, 0 high. 1 is now in CISA KEV.
- Published
- 58
- Critical
- 1
- High
- 0
- Medium
- 0
- Low
- 0
- Unrated
- 57
- Now in CISA KEV
- 1
- Fix available
- 1
Most affected products
- Hirschmann Automation and Control GmbH Classic Platform Swi…
- 5
- Nvidia SHIELD TV
- 5
- auth0-js
- 1
- Micro Focus NetIQ Privileged Account Manager (PAM) 3.1 and
- 1
- NetApp SnapCenter
- 1
- Nvidia Android
- 1
- oVirt
- 1
Critical 1
Medium, low and unrated 57
- CVE-2016-5179Chrome OS before 53.0.2785.144 allows remote attackers to execute arbitrary commands at boot.
- CVE-2016-7443Exponent CMS 2.3.0 through 2.3.9 allows remote attackers to have unspecified impact via vectors related to "uploading files to wrong locatio
- CVE-2017-11649Cross-site request forgery (CSRF) vulnerability in DrayTek Vigor AP910C devices with firmware 1.2.0_RC3 build r6594 allows remote attackers
- CVE-2017-11650Cross-site scripting (XSS) vulnerability in DrayTek Vigor AP910C devices with firmware 1.2.0_RC3 build r6594 allows remote attackers to inje
- CVE-2018-7738In util-linux before 2.32-rc1, bash-completion/umount allows local users to gain privileges by embedding shell commands in a mountpoint name
- CVE-2018-7739antsle antman before 0.9.1a allows remote attackers to bypass authentication via invalid characters in the username and password parameters,
- CVE-2018-5461An Inadequate Encryption Strength issue was discovered in Belden Hirschmann RS, RSR, RSB, MACH100, MACH1000, MACH4000, MS, and OCTOPUS ClassHirschmann Automation and Control GmbH Classic Platform Swi…
- CVE-2018-5465A Session Fixation issue was discovered in Belden Hirschmann RS, RSR, RSB, MACH100, MACH1000, MACH4000, MS, and OCTOPUS Classic Platform SwiHirschmann Automation and Control GmbH Classic Platform Swi…
- CVE-2018-5467An Information Exposure Through Query Strings in GET Request issue was discovered in Belden Hirschmann RS, RSR, RSB, MACH100, MACH1000, MACHHirschmann Automation and Control GmbH Classic Platform Swi…
- CVE-2018-5469An Improper Restriction of Excessive Authentication Attempts issue was discovered in Belden Hirschmann RS, RSR, RSB, MACH100, MACH1000, MACHHirschmann Automation and Control GmbH Classic Platform Swi…
- CVE-2018-5471A Cleartext Transmission of Sensitive Information issue was discovered in Belden Hirschmann RS, RSR, RSB, MACH100, MACH1000, MACH4000, MS, aHirschmann Automation and Control GmbH Classic Platform Swi…
- CVE-2018-7736In Z-BlogPHP 1.5.1.1740, cmd.php has XSS via the ZC_BLOG_SUBNAME parameter or ZC_UPLOAD_FILETYPE parameter.
- CVE-2018-7737In Z-BlogPHP 1.5.1.1740, there is Web Site physical path leakage, as demonstrated by admin_footer.php or admin_footer.php.
- CVE-2015-5377Elasticsearch before 1.6.1 allows remote attackers to execute arbitrary code via unspecified vectors involving the transport protocol.
- CVE-2017-15519Versions of SnapCenter 2.0 through 3.0.1 allow unauthenticated remote attackers to view and modify backup related data via the Plug-in for NNetApp SnapCenter
- CVE-2018-1343PAM exposure enabling unauthenticated access to remote hostMicro Focus NetIQ Privileged Account Manager (PAM) 3.1 and
- CVE-2018-5729MIT krb5 1.6 or later allows an authenticated kadmin with permission to add principals to an LDAP Kerberos database to cause a denial of ser
- CVE-2018-5730MIT krb5 1.6 or later allows an authenticated kadmin with permission to add principals to an LDAP Kerberos database to circumvent a DN conta
- CVE-2018-6019Samsung Display Solutions App before 3.02 for Android allows man-in-the-middle attackers to spoof B2B content by leveraging failure to use e
- CVE-2018-6527XSS vulnerability in htdocs/webinc/js/adv_parent_ctrl_map.php in D-Link DIR-868L DIR868LA1_FW112b04 and previous versions, DIR-865L DIR-865L
- CVE-2018-6528XSS vulnerability in htdocs/webinc/body/bsc_sms_send.php in D-Link DIR-868L DIR868LA1_FW112b04 and previous versions, DIR-865L DIR-865L_REVA
- CVE-2018-6529XSS vulnerability in htdocs/webinc/js/bsc_sms_inbox.php in D-Link DIR-868L DIR868LA1_FW112b04 and previous versions, DIR-865L DIR-865L_REVA_
- CVE-2018-6808NetScaler ADC 10.5, 11.0, 11.1, and 12.0, and NetScaler Gateway 10.5, 11.0, 11.1, and 12.0 allow remote attackers to download arbitrary file
- CVE-2018-6809NetScaler ADC 10.5, 11.0, 11.1, and 12.0, and NetScaler Gateway 10.5, 11.0, 11.1, and 12.0 allow remote attackers to gain privilege on a tar
- CVE-2018-6810Directory traversal vulnerability in NetScaler ADC 10.5, 11.0, 11.1, and 12.0, and NetScaler Gateway 10.5, 11.0, 11.1, and 12.0 allows remot
- CVE-2018-6811Multiple cross-site scripting (XSS) vulnerabilities in Citrix NetScaler ADC 10.5, 11.0, 11.1, and 12.0, and NetScaler Gateway 10.5, 11.0, 11
- CVE-2018-7170ntpd in ntp 4.2.x before 4.2.8p7 and 4.3.x before 4.3.92 allows authenticated users that know the private symmetric key to create arbitraril
- CVE-2018-7182The ctl_getitem method in ntpd in ntp-4.2.8p6 before 4.2.8p11 allows remote attackers to cause a denial of service (out-of-bounds read) via
- CVE-2018-7184ntpd in ntp 4.2.8p4 before 4.2.8p11 drops bad packets before updating the "received" timestamp, which allows remote attackers to cause a den
- CVE-2018-7185The protocol engine in ntp 4.2.6 before 4.2.8p11 allows a remote attackers to cause a denial of service (disruption) by continually sending
- CVE-2018-7734Afian FileRun (before 2018.02.13) suffers from a remote SQL injection vulnerability, when logged in as superuser, via the search parameter i
- CVE-2018-7735Afian FileRun (before 2018.02.13) suffers from a remote SQL injection vulnerability, when logged in as superuser, via the search parameter i
- CVE-2018-7728An issue was discovered in Exempi through 2.4.4.
- CVE-2018-7729An issue was discovered in Exempi through 2.4.4.
- CVE-2018-7730An issue was discovered in Exempi through 2.4.4.
- CVE-2018-7731An issue was discovered in Exempi through 2.4.4.
- CVE-2018-7732An issue was discovered in YxtCMF 3.1.
- CVE-2018-7733An issue was discovered in YxtCMF 3.1.
- CVE-2018-1000100GPAC MP4Box version 0.7.1 and earlier contains a Buffer Overflow vulnerability in src/isomedia/avc_ext.c lines 2417 to 2420 that can result
- CVE-2018-1000101Mingw-w64 version 5.0.3 and earlier, 5.0.4, 6.0.0 and 7.0.0 contains an Improper Null Termination (CWE-170) vulnerability in mingw-w64-crt (
- CVE-2018-7722The management panel in Piwigo 2.9.3 has stored XSS via the name parameter in a /ws.php?format=json request.
- CVE-2018-7723The management panel in Piwigo 2.9.3 has stored XSS via the virtual_name parameter in a /admin.php?page=cat_list request, a different issue
- CVE-2018-7724The management panel in Piwigo 2.9.3 has stored XSS via the name parameter in a /admin.php?page=photo-${photo_number} request.
- CVE-2018-7725An issue was discovered in ZZIPlib 0.13.68.
- CVE-2018-7726An issue was discovered in ZZIPlib 0.13.68.
- CVE-2018-7727An issue was discovered in ZZIPlib 0.13.68.
- CVE-2017-6280NVIDIA driver contains a possible out-of-bounds read vulnerability due to a leak which may lead to information disclosure.Nvidia Android
- CVE-2017-6282NVIDIA Tegra kernel driver contains a vulnerability in NVMAP where an attacker has the ability to write an arbitrary value to an arbitrary lNvidia SHIELD TV
- CVE-2017-6283NVIDIA Security Engine contains a vulnerability in the RSA function where the keyslot read/write lock permissions are cleared on a chip reseNvidia SHIELD TV
- CVE-2017-6284NVIDIA Security Engine contains a vulnerability in the Deterministic Random Bit Generator (DRBG) where the DRBG does not properly initializeNvidia SHIELD TV
- CVE-2017-6295NVIDIA TrustZone Software contains a vulnerability in the Keymaster implementation where the software reads data past the end, or before theNvidia SHIELD TV
- CVE-2017-6296NVIDIA TrustZone Software contains a TOCTOU issue in the DRM application which may lead to the denial of service or possible escalation of pNvidia SHIELD TV
- CVE-2017-9783Cross-site scripting (XSS) vulnerability in ProjectSend (formerly cFTP) before commit 6c3710430be26feb5371cb0377e5355d6f9a27ca allows remote
- CVE-2017-9786Cross-site scripting (XSS) vulnerability in ProjectSend (formerly cFTP) before commit 6c3710430be26feb5371cb0377e5355d6f9a27ca allows remote
- CVE-2018-1062A vulnerability was discovered in oVirt 4.1.x before 4.1.9, where the combination of Enable Discard and Wipe After Delete flags for VM disksoVirt
- CVE-2018-7307The Auth0 Auth0.js library before 9.3 has CSRF because it mishandles the case where the authorization response lacks the state parameter.auth0-js
- CVE-2018-7650PHP Scripts Mall Hot Scripts Clone:Script Classified Version 3.1 Application is vulnerable to stored XSS within the "Add New" function for a