# CVEs published 2018-03-12

47 CVEs were published on March 12, 2018: 0 critical, 1 high. Days are UTC.

- [CVE-2017-18228](https://cve.now/CVE-2017-18228.md): Remedy Mid Tier in BMC Remedy AR System 9.1 allows XSS via the ATTKey parameter in an arsys/servlet/AttachServlet request. (no CVSS)
- [CVE-2016-0235](https://cve.now/CVE-2016-0235.md): IBM Security Guardium Database Activity Monitor 10 allows local users to have unspecified impact by leveraging administrator access to a har (no CVSS)
- [CVE-2016-0237](https://cve.now/CVE-2016-0237.md): IBM Security Guardium Database Activity Monitor 10 allows local users to obtain sensitive information by reading cached browser data. (no CVSS)
- [CVE-2016-0250](https://cve.now/CVE-2016-0250.md): XML external entity (XXE) vulnerability in IBM InfoSphere Information Governance Catalog 11.3 before 11.3.1.2 and 11.5 before 11.5.0.1 allow (no CVSS)
- [CVE-2016-0261](https://cve.now/CVE-2016-0261.md): Cross-site scripting (XSS) vulnerability in IBM Curam Social Program Management 6.0.0 before SP2 EP29, 6.0.4 before 6.0.4.6 iFix3, 6.0.5 bef (no CVSS)
- [CVE-2016-9952](https://cve.now/CVE-2016-9952.md): The verify\_certificate function in lib/vtls/schannel.c in libcurl 7.30.0 through 7.51.0, when built for Windows CE using the schannel TLS ba (CVSS 8.1)
- [CVE-2016-9953](https://cve.now/CVE-2016-9953.md): The verify\_certificate function in lib/vtls/schannel.c in libcurl 7.30.0 through 7.51.0, when built for Windows CE using the schannel TLS ba (no CVSS)
- [CVE-2018-5758](https://cve.now/CVE-2018-5758.md): The Upload File functionality in upload.jspa in Aurea Jive Jive-n 9.0.2.1 On-Premises allows for an XML External Entity attack through a cra (no CVSS)
- [CVE-2018-6016](https://cve.now/CVE-2018-6016.md): Unquoted Windows search path vulnerability in the srvInventoryWebServer service in 10-Strike Network Monitor 5.4 allows local users to gain (no CVSS)
- [CVE-2018-6183](https://cve.now/CVE-2018-6183.md): BitDefender Total Security 2018 allows local users to gain privileges or cause a denial of service by impersonating all the pipes through a (no CVSS)
- [CVE-2018-6321](https://cve.now/CVE-2018-6321.md): Unquoted Windows search path vulnerability in the panda\_url\_filtering service in Panda Global Protection 17.0.1 allows local users to gain p (no CVSS)
- [CVE-2018-6322](https://cve.now/CVE-2018-6322.md): Panda Global Protection 17.0.1 allows local users to gain privileges or cause a denial of service by impersonating all the pipes through a u (no CVSS)
- [CVE-2018-6400](https://cve.now/CVE-2018-6400.md): Kingsoft WPS Office Free 10.2.0.5978 allows local users to gain privileges or cause a denial of service by impersonating all the pipes throu (no CVSS)
- [CVE-2018-6623](https://cve.now/CVE-2018-6623.md): An issue was discovered in Hola 1.79.859. (no CVSS)
- [CVE-2018-7538](https://cve.now/CVE-2018-7538.md): A SQL injection vulnerability in the tracker functionality of Enalean Tuleap software engineering platform before 9.18 allows attackers to e (no CVSS)
- [CVE-2018-7562](https://cve.now/CVE-2018-7562.md): A remote code execution issue was discovered in GLPI through 9.2.1. (no CVSS)
- [CVE-2018-7563](https://cve.now/CVE-2018-7563.md): An issue was discovered in GLPI through 9.2.1. (no CVSS)
- [CVE-2018-7858](https://cve.now/CVE-2018-7858.md): Quick Emulator (aka QEMU), when built with the Cirrus CLGD 54xx VGA Emulator support, allows local guest OS privileged users to cause a deni (no CVSS)
- [CVE-2018-7749](https://cve.now/CVE-2018-7749.md): The SSH server implementation of AsyncSSH before 1.12.1 does not properly check whether authentication is completed before processing other (no CVSS, asyncssh)
- [CVE-2018-1206](https://cve.now/CVE-2018-1206.md): Dell EMC Data Protection Advisor versions prior to 6.3 Patch 159 and Dell EMC Data Protection Advisor versions prior to 6.4 Patch 110 contai (no CVSS, Dell EMC Data Protection Advisor versions prior to 6.3 Patc…)
- [CVE-2018-1323](https://cve.now/CVE-2018-1323.md): The IIS/ISAPI specific code in the Apache Tomcat JK ISAPI Connector 1.2.0 to 1.2.42 that normalised the requested path before matching it to (no CVSS, Apache Software Foundation Apache Tomcat Connectors)
- [CVE-2016-8629](https://cve.now/CVE-2016-8629.md): Red Hat Keycloak before version 2.4.0 did not correctly check permissions when handling service account user deletion requests sent to the r (no CVSS, Red Hat Keycloak · org.keycloak:keycloak-core)
- [CVE-2016-9589](https://cve.now/CVE-2016-9589.md): Undertow in Red Hat wildfly before version 11.0.0.Beta1 is vulnerable to a resource exhaustion resulting in a denial of service. (no CVSS, Red Hat wildfly · org.wildfly:wildfly-undertow)
- [CVE-2016-9600](https://cve.now/CVE-2016-9600.md): JasPer before version 2.0.10 is vulnerable to a null pointer dereference was found in the decoded creation of JPEG 2000 image files. (no CVSS, jasper)
- [CVE-2017-2585](https://cve.now/CVE-2017-2585.md): Red Hat Keycloak before version 2.5.1 has an implementation of HMAC verification for JWS tokens that uses a method that runs in non-constant (no CVSS, Red Hat keycloak · org.keycloak:keycloak-core)
- [CVE-2017-2619](https://cve.now/CVE-2017-2619.md): Samba before versions 4.6.1, 4.5.7 and 4.4.11 are vulnerable to a malicious client using a symlink race to allow access to areas of the serv (no CVSS, samba)
- [CVE-2017-2628](https://cve.now/CVE-2017-2628.md): curl, as shipped in Red Hat Enterprise Linux 6 before version 7.19.7-53, did not correctly backport the fix for CVE-2015-3148 because it did (no CVSS, Red Hat curl)
- [CVE-2017-2661](https://cve.now/CVE-2017-2661.md): ClusterLabs pcs before version 0.9.157 is vulnerable to a cross-site scripting vulnerability due to improper validation of Node name field w (no CVSS, ClusterLabs pcs)
- [CVE-2017-2667](https://cve.now/CVE-2017-2667.md): Hammer CLI, a CLI utility for Foreman, before version 0.10.0, did not explicitly set the verify\_ssl flag for apipie-bindings that disable it (no CVSS, Foreman Hammer CLI · hammer\_cli\_foreman)
- [CVE-2017-15719](https://cve.now/CVE-2017-15719.md): In Wicket jQuery UI 6.28.0 and earlier, 7.9.1 and earlier, and 8.0.0-M8 and earlier, a security issue has been discovered in the WYSIWYG edi (no CVSS, Apache Software Foundation Wicket jQuery UI · com.googlecod…)
- [CVE-2017-6281](https://cve.now/CVE-2017-6281.md): NVIDIA libnvomx contains a possible out of bounds write due to a improper input validation which could lead to local escalation of privilege (no CVSS, Nvidia Android)
- [CVE-2017-6285](https://cve.now/CVE-2017-6285.md): NVIDIA libnvrm contains a possible out of bounds read due to a missing bounds check which could lead to local information disclosure. (no CVSS, Nvidia Android)
- [CVE-2017-6286](https://cve.now/CVE-2017-6286.md): NVIDIA libnvomx contains a possible out of bounds write due to a missing bounds check which could lead to local escalation of privilege. (no CVSS, Nvidia Android)
- [CVE-2017-6287](https://cve.now/CVE-2017-6287.md): NVIDIA libnvrm contains a possible out of bounds read due to a missing bounds check which could lead to local information disclosure. (no CVSS, Nvidia Android)
- [CVE-2017-6288](https://cve.now/CVE-2017-6288.md): NVIDIA libnvrm contains a possible out of bounds read due to a missing bounds check which could lead to local information disclosure. (no CVSS, Nvidia Android)
- [CVE-2018-8069](https://cve.now/CVE-2018-8069.md): QCMS version 3.0 has XSS via the webname parameter to the /backend/system.html URI. (no CVSS)
- [CVE-2018-8070](https://cve.now/CVE-2018-8070.md): QCMS version 3.0 has XSS via the title parameter to the /guest/index.html URI. (no CVSS)
- [CVE-2017-18225](https://cve.now/CVE-2017-18225.md): The Gentoo net-im/jabberd2 package through 2.6.1 installs jabberd, jabberd2-c2s, jabberd2-router, jabberd2-s2s, and jabberd2-sm in /usr/bin (no CVSS)
- [CVE-2017-18226](https://cve.now/CVE-2017-18226.md): The Gentoo net-im/jabberd2 package through 2.6.1 sets the ownership of /var/run/jabber to the jabber account, which might allow local users (no CVSS)
- [CVE-2017-18227](https://cve.now/CVE-2017-18227.md): TitanHQ WebTitan Gateway has incorrect certificate validation for the TLS interception feature. (no CVSS)
- [CVE-2017-18224](https://cve.now/CVE-2017-18224.md): In the Linux kernel before 4.15, fs/ocfs2/aops.c omits use of a semaphore and consequently has a race condition for access to the extent tre (no CVSS)
- [CVE-2018-7893](https://cve.now/CVE-2018-7893.md): CMS Made Simple (CMSMS) 2.2.6 has stored XSS in admin/moduleinterface.php via the metadata parameter. (no CVSS)
- [CVE-2018-8058](https://cve.now/CVE-2018-8058.md): CMS Made Simple (CMSMS) 2.2.6 has XSS in admin/moduleinterface.php via the pagedata parameter. (no CVSS)
- [CVE-2014-8129](https://cve.now/CVE-2014-8129.md): LibTIFF 4.0.3 allows remote attackers to cause a denial of service (out-of-bounds write) or possibly have unspecified other impact via a cra (no CVSS)
- [CVE-2014-8130](https://cve.now/CVE-2014-8130.md): The \_TIFFmalloc function in tif\_unix.c in LibTIFF 4.0.3 does not reject a zero size, which allows remote attackers to cause a denial of serv (no CVSS)
- [CVE-2016-5314](https://cve.now/CVE-2016-5314.md): Buffer overflow in the PixarLogDecode function in tif\_pixarlog.c in LibTIFF 4.0.6 and earlier allows remote attackers to cause a denial of s (no CVSS)
- [CVE-2018-8065](https://cve.now/CVE-2018-8065.md): An issue was discovered in the web server in Flexense SyncBreeze Enterprise 10.6.24. (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2018-03-12
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.