CVEs published March 12, 2018
47 CVEs were published on March 12, 2018: 0 critical, 1 high.
- Published
- 47
- Critical
- 0
- High
- 1
- Medium
- 0
- Low
- 0
- Unrated
- 46
- Now in CISA KEV
- 0
- Fix available
- 6
Most affected products
- Nvidia Android
- 5
- Apache Software Foundation Apache Tomcat Connectors
- 1
- Apache Software Foundation Wicket jQuery UI · com.googlecod…
- 1
- asyncssh
- 1
- ClusterLabs pcs
- 1
- Dell EMC Data Protection Advisor versions prior to 6.3 Patc…
- 1
- Foreman Hammer CLI · hammer_cli_foreman
- 1
- jasper
- 1
- Red Hat curl
- 1
- Red Hat keycloak · org.keycloak:keycloak-core
- 1
High 1
Medium, low and unrated 46
- CVE-2017-18228Remedy Mid Tier in BMC Remedy AR System 9.1 allows XSS via the ATTKey parameter in an arsys/servlet/AttachServlet request.
- CVE-2016-0235IBM Security Guardium Database Activity Monitor 10 allows local users to have unspecified impact by leveraging administrator access to a har
- CVE-2016-0237IBM Security Guardium Database Activity Monitor 10 allows local users to obtain sensitive information by reading cached browser data.
- CVE-2016-0250XML external entity (XXE) vulnerability in IBM InfoSphere Information Governance Catalog 11.3 before 11.3.1.2 and 11.5 before 11.5.0.1 allow
- CVE-2016-0261Cross-site scripting (XSS) vulnerability in IBM Curam Social Program Management 6.0.0 before SP2 EP29, 6.0.4 before 6.0.4.6 iFix3, 6.0.5 bef
- CVE-2016-9953The verify_certificate function in lib/vtls/schannel.c in libcurl 7.30.0 through 7.51.0, when built for Windows CE using the schannel TLS ba
- CVE-2018-5758The Upload File functionality in upload.jspa in Aurea Jive Jive-n 9.0.2.1 On-Premises allows for an XML External Entity attack through a cra
- CVE-2018-6016Unquoted Windows search path vulnerability in the srvInventoryWebServer service in 10-Strike Network Monitor 5.4 allows local users to gain
- CVE-2018-6183BitDefender Total Security 2018 allows local users to gain privileges or cause a denial of service by impersonating all the pipes through a
- CVE-2018-6321Unquoted Windows search path vulnerability in the panda_url_filtering service in Panda Global Protection 17.0.1 allows local users to gain p
- CVE-2018-6322Panda Global Protection 17.0.1 allows local users to gain privileges or cause a denial of service by impersonating all the pipes through a u
- CVE-2018-6400Kingsoft WPS Office Free 10.2.0.5978 allows local users to gain privileges or cause a denial of service by impersonating all the pipes throu
- CVE-2018-6623An issue was discovered in Hola 1.79.859.
- CVE-2018-7538A SQL injection vulnerability in the tracker functionality of Enalean Tuleap software engineering platform before 9.18 allows attackers to e
- CVE-2018-7562A remote code execution issue was discovered in GLPI through 9.2.1.
- CVE-2018-7563An issue was discovered in GLPI through 9.2.1.
- CVE-2018-7858Quick Emulator (aka QEMU), when built with the Cirrus CLGD 54xx VGA Emulator support, allows local guest OS privileged users to cause a deni
- CVE-2018-7749The SSH server implementation of AsyncSSH before 1.12.1 does not properly check whether authentication is completed before processing other asyncssh
- CVE-2018-1206Dell EMC Data Protection Advisor versions prior to 6.3 Patch 159 and Dell EMC Data Protection Advisor versions prior to 6.4 Patch 110 contaiDell EMC Data Protection Advisor versions prior to 6.3 Patc…
- CVE-2018-1323The IIS/ISAPI specific code in the Apache Tomcat JK ISAPI Connector 1.2.0 to 1.2.42 that normalised the requested path before matching it toApache Software Foundation Apache Tomcat Connectors
- CVE-2016-8629Red Hat Keycloak before version 2.4.0 did not correctly check permissions when handling service account user deletion requests sent to the rRed Hat Keycloak · org.keycloak:keycloak-core
- CVE-2016-9589Undertow in Red Hat wildfly before version 11.0.0.Beta1 is vulnerable to a resource exhaustion resulting in a denial of service.Red Hat wildfly · org.wildfly:wildfly-undertow
- CVE-2016-9600JasPer before version 2.0.10 is vulnerable to a null pointer dereference was found in the decoded creation of JPEG 2000 image files.jasper
- CVE-2017-2585Red Hat Keycloak before version 2.5.1 has an implementation of HMAC verification for JWS tokens that uses a method that runs in non-constantRed Hat keycloak · org.keycloak:keycloak-core
- CVE-2017-2619Samba before versions 4.6.1, 4.5.7 and 4.4.11 are vulnerable to a malicious client using a symlink race to allow access to areas of the servsamba
- CVE-2017-2628curl, as shipped in Red Hat Enterprise Linux 6 before version 7.19.7-53, did not correctly backport the fix for CVE-2015-3148 because it didRed Hat curl
- CVE-2017-2661ClusterLabs pcs before version 0.9.157 is vulnerable to a cross-site scripting vulnerability due to improper validation of Node name field wClusterLabs pcs
- CVE-2017-2667Hammer CLI, a CLI utility for Foreman, before version 0.10.0, did not explicitly set the verify_ssl flag for apipie-bindings that disable itForeman Hammer CLI · hammer_cli_foreman
- CVE-2017-15719In Wicket jQuery UI 6.28.0 and earlier, 7.9.1 and earlier, and 8.0.0-M8 and earlier, a security issue has been discovered in the WYSIWYG ediApache Software Foundation Wicket jQuery UI · com.googlecod…
- CVE-2017-6281NVIDIA libnvomx contains a possible out of bounds write due to a improper input validation which could lead to local escalation of privilegeNvidia Android
- CVE-2017-6285NVIDIA libnvrm contains a possible out of bounds read due to a missing bounds check which could lead to local information disclosure.Nvidia Android
- CVE-2017-6286NVIDIA libnvomx contains a possible out of bounds write due to a missing bounds check which could lead to local escalation of privilege.Nvidia Android
- CVE-2017-6287NVIDIA libnvrm contains a possible out of bounds read due to a missing bounds check which could lead to local information disclosure.Nvidia Android
- CVE-2017-6288NVIDIA libnvrm contains a possible out of bounds read due to a missing bounds check which could lead to local information disclosure.Nvidia Android
- CVE-2018-8069QCMS version 3.0 has XSS via the webname parameter to the /backend/system.html URI.
- CVE-2018-8070QCMS version 3.0 has XSS via the title parameter to the /guest/index.html URI.
- CVE-2017-18225The Gentoo net-im/jabberd2 package through 2.6.1 installs jabberd, jabberd2-c2s, jabberd2-router, jabberd2-s2s, and jabberd2-sm in /usr/bin
- CVE-2017-18226The Gentoo net-im/jabberd2 package through 2.6.1 sets the ownership of /var/run/jabber to the jabber account, which might allow local users
- CVE-2017-18227TitanHQ WebTitan Gateway has incorrect certificate validation for the TLS interception feature.
- CVE-2017-18224In the Linux kernel before 4.15, fs/ocfs2/aops.c omits use of a semaphore and consequently has a race condition for access to the extent tre
- CVE-2018-7893CMS Made Simple (CMSMS) 2.2.6 has stored XSS in admin/moduleinterface.php via the metadata parameter.
- CVE-2018-8058CMS Made Simple (CMSMS) 2.2.6 has XSS in admin/moduleinterface.php via the pagedata parameter.
- CVE-2014-8129LibTIFF 4.0.3 allows remote attackers to cause a denial of service (out-of-bounds write) or possibly have unspecified other impact via a cra
- CVE-2014-8130The _TIFFmalloc function in tif_unix.c in LibTIFF 4.0.3 does not reject a zero size, which allows remote attackers to cause a denial of serv
- CVE-2016-5314Buffer overflow in the PixarLogDecode function in tif_pixarlog.c in LibTIFF 4.0.6 and earlier allows remote attackers to cause a denial of s
- CVE-2018-8065An issue was discovered in the web server in Flexense SyncBreeze Enterprise 10.6.24.