# CVEs published 2018-03-08

59 CVEs were published on March 8, 2018: 1 critical, 0 high. 1 is now in CISA KEV. Days are UTC.

- [CVE-2018-7890](https://cve.now/CVE-2018-7890.md): A remote code execution issue was discovered in Zoho ManageEngine Applications Manager before 13.6 (build 13640). (no CVSS)
- [CVE-2018-7889](https://cve.now/CVE-2018-7889.md): gui2/viewer/bookmarkmanager.py in Calibre 3.18 calls cPickle.load on imported bookmark data, which allows remote attackers to execute arbitr (no CVSS)
- [CVE-2014-7271](https://cve.now/CVE-2014-7271.md): Simple Desktop Display Manager (SDDM) before 0.10.0 allows local users to log in as user "sddm" without authentication. (no CVSS)
- [CVE-2014-7272](https://cve.now/CVE-2014-7272.md): Simple Desktop Display Manager (SDDM) before 0.10.0 allows local users to gain root privileges because code running as root performs write o (no CVSS)
- [CVE-2018-5313](https://cve.now/CVE-2018-5313.md): A vulnerability allows local attackers to escalate privilege on Rapid Scada 5.5.0 because of weak C:\\SCADA permissions. (no CVSS)
- [CVE-2018-7183](https://cve.now/CVE-2018-7183.md): Buffer overflow in the decodearr function in ntpq in ntp 4.2.8p6 through 4.2.8p10 allows remote attackers to execute arbitrary code by lever (no CVSS)
- [CVE-2018-7866](https://cve.now/CVE-2018-7866.md): A NULL pointer dereference was discovered in newVar3 in util/decompile.c in libming 0.4.8. (no CVSS)
- [CVE-2018-7867](https://cve.now/CVE-2018-7867.md): There is a heap-based buffer overflow in the getString function of util/decompile.c in libming 0.4.8 during a RegisterNumber sprintf. (no CVSS)
- [CVE-2018-7868](https://cve.now/CVE-2018-7868.md): There is a heap-based buffer over-read in the getName function of util/decompile.c in libming 0.4.8 for CONSTANT8 data. (no CVSS)
- [CVE-2018-7869](https://cve.now/CVE-2018-7869.md): There is a memory leak triggered in the function dcinit of util/decompile.c in libming 0.4.8, which will lead to a denial of service attack. (no CVSS)
- [CVE-2018-7870](https://cve.now/CVE-2018-7870.md): An invalid memory address dereference was discovered in getString in util/decompile.c in libming 0.4.8 for CONSTANT16 data. (no CVSS)
- [CVE-2018-7871](https://cve.now/CVE-2018-7871.md): There is a heap-based buffer over-read in the getName function of util/decompile.c in libming 0.4.8 for CONSTANT16 data. (no CVSS)
- [CVE-2018-7872](https://cve.now/CVE-2018-7872.md): An invalid memory address dereference was discovered in the function getName in libming 0.4.8 for CONSTANT16 data. (no CVSS)
- [CVE-2018-7873](https://cve.now/CVE-2018-7873.md): There is a heap-based buffer overflow in the getString function of util/decompile.c in libming 0.4.8 for INTEGER data. (no CVSS)
- [CVE-2018-7874](https://cve.now/CVE-2018-7874.md): An invalid memory address dereference was discovered in strlenext in util/decompile.c in libming 0.4.8. (no CVSS)
- [CVE-2018-7875](https://cve.now/CVE-2018-7875.md): There is a heap-based buffer over-read in the getString function of util/decompile.c in libming 0.4.8 for CONSTANT8 data. (no CVSS)
- [CVE-2018-7876](https://cve.now/CVE-2018-7876.md): In libming 0.4.8, a memory exhaustion vulnerability was found in the function parseSWF\_ACTIONRECORD in util/parser.c, which allows remote at (no CVSS)
- [CVE-2018-7877](https://cve.now/CVE-2018-7877.md): There is a heap-based buffer overflow in the getString function of util/decompile.c in libming 0.4.8 for DOUBLE data. (no CVSS)
- [CVE-2018-4838](https://cve.now/CVE-2018-4838.md): A vulnerability has been identified in EN100 Ethernet module IEC 61850 variant (All versions \< V4.30), EN100 Ethernet module DNP3 variant (A (no CVSS, Siemens AG EN100 Ethernet module IEC 61850 variant · Sie… +3)
- [CVE-2018-4839](https://cve.now/CVE-2018-4839.md): A vulnerability has been identified in DIGSI 4 (All versions \< V4.92), EN100 Ethernet module DNP3 variant (All versions \< V1.05.00), EN100 E (no CVSS, Siemens DIGSI · Siemens EN100 Ethernet module DNP3 vari… +13)
- [CVE-2018-4840](https://cve.now/CVE-2018-4840.md): A vulnerability has been identified in DIGSI 4 (All versions \< V4.92), EN100 Ethernet module DNP3 variant (All versions \< V1.05.00), EN100 E (no CVSS, Siemens DIGSI · Siemens EN100 Ethernet module DNP3 varia… +4)
- [CVE-2017-1625](https://cve.now/CVE-2017-1625.md): IBM Pulse for QRadar 1.0.0 - 1.0.3 discloses sensitive information to unauthorized users. (CVSS 5.3, IBM Pulse for QRadar)
- [CVE-2018-1387](https://cve.now/CVE-2018-1387.md): IBM Application Performance Management for Monitoring & Diagnostics (IBM Monitoring 8.1.3 and 8.1.4) may release sensitive personal data to (CVSS 5.3, IBM Monitoring)
- [CVE-2018-1442](https://cve.now/CVE-2018-1442.md): IBM Application Performance Management - Response Time Monitoring Agent (IBM Monitoring 8.1.4) is vulnerable to cross-site request forgery w (CVSS 4.3, IBM Monitoring)
- [CVE-2018-1443](https://cve.now/CVE-2018-1443.md): An XML parsing vulnerability affects IBM SAML-based single sign-on (SSO) systems (IBM Security Access Manager 9.0.0 - 9.0.4 and IBM Tivoli F (CVSS 5.9, IBM Security Access Manager · IBM Tivoli Federated Identity…)
- [CVE-2018-1182](https://cve.now/CVE-2018-1182.md): An issue was discovered in EMC RSA Identity Governance and Lifecycle versions 7.0.1, 7.0.2, all patch levels (hardware appliance and softwar (no CVSS, EMC RSA Identity Governance and Lifecycle versions 7.0.1, 7…)
- [CVE-2018-1215](https://cve.now/CVE-2018-1215.md): An arbitrary file upload vulnerability was discovered in vApp Manager which is embedded in Dell EMC Unisphere for VMAX, Dell EMC Solutions E (no CVSS, vApp Manager which is embedded in Dell EMC Unisphere for VM…)
- [CVE-2018-1216](https://cve.now/CVE-2018-1216.md): A hard-coded password vulnerability was discovered in vApp Manager which is embedded in Dell EMC Unisphere for VMAX, Dell EMC Solutions Enab (no CVSS, vApp Manager which is embedded in Dell EMC Unisphere for VM…)
- [CVE-2018-1219](https://cve.now/CVE-2018-1219.md): EMC RSA Archer, versions prior to 6.2.0.8, contains an improper access control vulnerability on an API which is used to enumerate user infor (no CVSS, EMC RSA Archer GRC Platform RSA Archer versions prior to)
- [CVE-2018-1220](https://cve.now/CVE-2018-1220.md): EMC RSA Archer, versions prior to 6.2.0.8, contains a redirect vulnerability in the QuickLinks feature. (no CVSS, EMC RSA Archer GRC Platform RSA Archer versions prior to)
- [CVE-2017-18222](https://cve.now/CVE-2017-18222.md): In the Linux kernel before 4.12, Hisilicon Network Subsystem (HNS) does not consider the ETH\_SS\_PRIV\_FLAGS case when retrieving sset\_count d (no CVSS)
- [CVE-2017-6152](https://cve.now/CVE-2017-6152.md): A local user on F5 BIG-IQ Centralized Management 5.1.0-5.2.0 with the Access Manager role has privileges to change the passwords of other us (no CVSS, F5 Networks BIG-IQ Centralized Management)
- [CVE-2017-7634](https://cve.now/CVE-2017-7634.md): Cross-site scripting (XSS) vulnerability in QNAP NAS application Media Streaming add-on version 421.1.0.2, 430.1.2.0, and earlier allows rem (no CVSS, QNAP Media Streaming Add-On)
- [CVE-2017-7638](https://cve.now/CVE-2017-7638.md): QNAP NAS application Media Streaming add-on version 421.1.0.2, 430.1.2.0, and earlier does not authenticate requests properly. (no CVSS, QNAP Media Streaming Add-On)
- [CVE-2017-7640](https://cve.now/CVE-2017-7640.md): QNAP NAS application Media Streaming add-on version 421.1.0.2, 430.1.2.0, and earlier allows remote attackers to run arbitrary OS commands a (no CVSS, QNAP Media Streaming Add-On)
- [CVE-2017-7641](https://cve.now/CVE-2017-7641.md): QNAP NAS application Media Streaming add-on version 421.1.0.2, 430.1.2.0, and earlier does not utilize CSRF protections. (no CVSS, QNAP Media Streaming Add-On)
- [CVE-2018-7757](https://cve.now/CVE-2018-7757.md): Memory leak in the sas\_smp\_get\_phy\_events function in drivers/scsi/libsas/sas\_expander.c in the Linux kernel through 4.15.7 allows local use (no CVSS)
- [CVE-2018-0087](https://cve.now/CVE-2018-0087.md): A vulnerability in the FTP server of the Cisco Web Security Appliance (WSA) could allow an unauthenticated, remote attacker to log in to the (no CVSS, Cisco Web Security Appliance)
- [CVE-2018-0141](https://cve.now/CVE-2018-0141.md): A vulnerability in Cisco Prime Collaboration Provisioning (PCP) Software 11.6 could allow an unauthenticated, local attacker to log in to th (no CVSS, Cisco Prime Collaboration Provisioning)
- [CVE-2018-0144](https://cve.now/CVE-2018-0144.md): A vulnerability in the web-based management interface of Cisco Prime Data Center Network Manager could allow an unauthenticated, remote atta (no CVSS, Cisco Prime Data Center Network Manager)
- [CVE-2018-0147](https://cve.now/CVE-2018-0147.md): A vulnerability in Java deserialization used by Cisco Secure Access Control System (ACS) prior to release 5.8 patch 9 could allow an unauthe (CVSS 9.8, KEV, Cisco Secure Access Control System)
- [CVE-2018-0207](https://cve.now/CVE-2018-0207.md): A vulnerability in the web-based user interface of the Cisco Secure Access Control Server prior to 5.8 patch 9 could allow an unauthenticate (no CVSS, Cisco Secure Access Control Server)
- [CVE-2018-0208](https://cve.now/CVE-2018-0208.md): A vulnerability in the web-based management interface of the (cloud based) Cisco Registered Envelope Service could allow an authenticated, r (no CVSS, Cisco Registered Envelope Service)
- [CVE-2018-0209](https://cve.now/CVE-2018-0209.md): A vulnerability in the Simple Network Management Protocol (SNMP) subsystem communication channel through the Cisco 550X Series Stackable Man (no CVSS, Cisco 550X Series Stackable Managed Switches)
- [CVE-2018-0210](https://cve.now/CVE-2018-0210.md): A vulnerability in the web-based management interface of Cisco Data Center Network Manager could allow an unauthenticated, remote attacker t (no CVSS, Cisco Data Center Network Manager)
- [CVE-2018-0211](https://cve.now/CVE-2018-0211.md): A vulnerability in specific CLI commands for the Cisco Identity Services Engine could allow an authenticated, local attacker to cause a deni (no CVSS, Cisco Identity Services Engine)
- [CVE-2018-0212](https://cve.now/CVE-2018-0212.md): A vulnerability in the web-based management interface of Cisco Identity Services Engine (ISE) could allow an unauthenticated, remote attacke (no CVSS, Cisco Identity Services Engine)
- [CVE-2018-0213](https://cve.now/CVE-2018-0213.md): A vulnerability in the credential reset functionality for Cisco Identity Services Engine (ISE) could allow an authenticated, remote attacker (no CVSS, Cisco Identity Services Engine)
- [CVE-2018-0214](https://cve.now/CVE-2018-0214.md): A vulnerability in certain CLI commands of Cisco Identity Services Engine (ISE) could allow an authenticated, local attacker to execute arbi (no CVSS, Cisco Identity Services Engine)
- [CVE-2018-0215](https://cve.now/CVE-2018-0215.md): A vulnerability in the web-based management interface of Cisco Identity Services Engine (ISE) could allow an unauthenticated, remote attacke (no CVSS, Cisco Identity Services Engine)
- [CVE-2018-0216](https://cve.now/CVE-2018-0216.md): A vulnerability in the web-based management interface of Cisco Identity Services Engine (ISE) could allow an unauthenticated, remote attacke (no CVSS, Cisco Identity Services Engine)
- [CVE-2018-0217](https://cve.now/CVE-2018-0217.md): A vulnerability in the CLI of the Cisco StarOS operating system for Cisco ASR 5000 Series Aggregation Services Routers could allow an authen (no CVSS, Cisco StarOS)
- [CVE-2018-0218](https://cve.now/CVE-2018-0218.md): A vulnerability in the web-based user interface of the Cisco Secure Access Control Server prior to 5.8 patch 9 could allow an unauthenticate (no CVSS, Cisco Secure Access Control Server)
- [CVE-2018-0219](https://cve.now/CVE-2018-0219.md): A vulnerability in the web-based management interface of Cisco Unified Computing System (UCS) Director could allow an unauthenticated, remot (no CVSS, Cisco UCS Director)
- [CVE-2018-0220](https://cve.now/CVE-2018-0220.md): A vulnerability in the web-based management interface of Cisco Videoscape AnyRes Live could allow an authenticated, remote attacker to condu (no CVSS, Cisco Videoscape AnyRes Live)
- [CVE-2018-0221](https://cve.now/CVE-2018-0221.md): A vulnerability in specific CLI commands for the Cisco Identity Services Engine (ISE) could allow an authenticated, local attacker to perfor (no CVSS, Cisco Identity Services Engine)
- [CVE-2018-0223](https://cve.now/CVE-2018-0223.md): A vulnerability in DesktopServlet in the web-based management interface of Cisco Security Manager could allow an unauthenticated, remote att (no CVSS, Cisco Security Manager)
- [CVE-2018-0224](https://cve.now/CVE-2018-0224.md): A vulnerability in the CLI of the Cisco StarOS operating system for Cisco ASR 5000 Series Aggregation Services Routers could allow an authen (no CVSS, Cisco StarOS)
- [CVE-2018-7755](https://cve.now/CVE-2018-7755.md): An issue was discovered in the fd\_locked\_ioctl function in drivers/block/floppy.c in the Linux kernel through 4.15.7. (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2018-03-08
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.