CVEs published March 13, 2018
72 CVEs were published on March 13, 2018: 0 critical, 2 high.
- Published
- 72
- Critical
- 0
- High
- 2
- Medium
- 0
- Low
- 0
- Unrated
- 70
- Now in CISA KEV
- 0
- Fix available
- 25
Most affected products
- Hanwha Techwin Smartcams
- 10
- rubygems-update · org.jruby:jruby-stdlib
- 7
- ajenti-panel
- 5
- com.sonyericsson.hudson.plugins.gerrit:gerrit-trigger
- 2
- Gemalto's Sentinel LDK RTE
- 2
- Samba
- 2
- BlackBerry UEM Management Console
- 1
- com.synopsys.jenkinsci:ownership
- 1
- Concourse CI: As of 2018-03-13, Pivotal does not believe th…
- 1
- django-anymail
- 1
High 2
- CVE-2017-1002101In Kubernetes versions 1.3.x, 1.4.x, 1.5.x, 1.6.x and prior to versions 1.7.14, 1.8.9 and 1.9.4 containers using subpath volume mounts with Kubernetes
- CVE-2017-1002102In Kubernetes versions 1.3.x, 1.4.x, 1.5.x, 1.6.x and prior to versions 1.7.14, 1.8.9 and 1.9.4 containers using a secret, configMap, projecKubernetes · k8s.io/kubernetes
Medium, low and unrated 70
- CVE-2018-1000123Ionic Team Cordova plugin iOS Keychain version before commit 18233ca25dfa92cca018b9c0935f43f78fd77fbf contains an Information Exposure Throu
- CVE-2018-1000124I Librarian I-librarian version 4.8 and earlier contains a XML External Entity (XXE) vulnerability in line 154 of importmetadata.php(simplex
- CVE-2018-1000125inversoft prime-jwt version prior to version 1.3.0 or prior to commit 0d94dcef0133d699f21d217e922564adbb83a227 contains an input validation
- CVE-2018-1000126Ajenti version 2 contains an Information Disclosure vulnerability in Line 176 of the code source that can result in user and system enumeratajenti-panel
- CVE-2018-1000127memcached version prior to 1.4.37 contains an Integer Overflow vulnerability in items.c:item_free() that can result in data corruption and d
- CVE-2018-1227Pivotal Concourse after 2018-03-05 might allow remote attackers to have an unspecified impact, if a customer obtained the Concourse softwareConcourse CI: As of 2018-03-13, Pivotal does not believe th…
- CVE-2017-16250A vulnerability in Mitel ST 14.2, release GA28 and earlier, could allow an attacker to use the API function to enumerate through user-ids wh
- CVE-2017-16251A vulnerability in the conferencing component of Mitel ST 14.2, release GA28 and earlier, could allow an authenticated user to upload a mali
- CVE-2018-7405Cross-site scripting (XSS) in Zoho ManageEngine EventLog Analyzer before 11.12 Build 11120 allows remote attackers to inject arbitrary web s
- CVE-2017-17442In BlackBerry UEM Management Console version 12.7.1 and earlier, a reflected cross-site scripting vulnerability that could allow an attackerBlackBerry UEM Management Console
- CVE-2018-7750transport.py in the SSH server implementation of Paramiko before 1.17.6, 1.18.x before 1.18.5, 2.0.x before 2.0.8, 2.1.x before 2.1.5, 2.2.xparamiko
- CVE-2018-6294Unsecured way of firmware update in Hanwha Techwin SmartcamsHanwha Techwin Smartcams
- CVE-2018-6295Unencrypted way of remote control and communications in Hanwha Techwin SmartcamsHanwha Techwin Smartcams
- CVE-2018-6296An undocumented (hidden) capability for switching the web interface in Hanwha Techwin SmartcamsHanwha Techwin Smartcams
- CVE-2018-6297Buffer overflow in Hanwha Techwin SmartcamsHanwha Techwin Smartcams
- CVE-2018-6298Remote code execution in Hanwha Techwin SmartcamsHanwha Techwin Smartcams
- CVE-2018-6299Authentication bypass in Hanwha Techwin SmartcamsHanwha Techwin Smartcams
- CVE-2018-6300Remote password change in Hanwha Techwin SmartcamsHanwha Techwin Smartcams
- CVE-2018-6301Arbitrary camera access and monitoring via cloud in Hanwha Techwin SmartcamsHanwha Techwin Smartcams
- CVE-2018-6302Denial of service by blocking of new camera registration on the cloud server in Hanwha Techwin SmartcamsHanwha Techwin Smartcams
- CVE-2018-6303Denial of service by uploading malformed firmware in Hanwha Techwin SmartcamsHanwha Techwin Smartcams
- CVE-2018-6304Stack overflow in custom XML-parser in Gemalto's Sentinel LDK RTE version before 7.65 leads to remote denial of serviceGemalto's Sentinel LDK RTE
- CVE-2018-6305Denial of service in Gemalto's Sentinel LDK RTE version before 7.65Gemalto's Sentinel LDK RTE
- CVE-2018-1050All versions of Samba from 4.0.0 onwards are vulnerable to a denial of service attack when the RPC spoolss service is configured to be run aSamba
- CVE-2018-1057On a Samba 4 AD DC the LDAP server in all versions of Samba from 4.0.0 onwards incorrectly validates permissions to modify passwords over LDSamba
- CVE-2018-1000069FreePlane version 1.5.9 and earlier contains a XML External Entity (XXE) vulnerability in XML Parser in mindmap loader that can result in st
- CVE-2018-1000070Bitmessage PyBitmessage version v0.6.2 (and introduced in or after commit 8ce72d8d2d25973b7064b1cf76a6b0b3d62f0ba0) contains a Eval injectio
- CVE-2018-1000071roundcube version 1.3.4 and earlier contains an Insecure Permissions vulnerability in enigma plugin that can result in exfiltration of gpg p
- CVE-2018-1000072iRedMail version prior to commit f04b8ef contains a Insecure Permissions vulnerability in Roundcube Webmail that can result in Exfiltrate a
- CVE-2018-1000073RubyGems version Ruby 2.2 series: 2.2.9 and earlier, Ruby 2.3 series: 2.3.6 and earlier, Ruby 2.4 series: 2.4.3 and earlier, Ruby 2.5 seriesrubygems-update · org.jruby:jruby-stdlib
- CVE-2018-1000074RubyGems version Ruby 2.2 series: 2.2.9 and earlier, Ruby 2.3 series: 2.3.6 and earlier, Ruby 2.4 series: 2.4.3 and earlier, Ruby 2.5 seriesrubygems-update · org.jruby:jruby-stdlib
- CVE-2018-1000075RubyGems version Ruby 2.2 series: 2.2.9 and earlier, Ruby 2.3 series: 2.3.6 and earlier, Ruby 2.4 series: 2.4.3 and earlier, Ruby 2.5 seriesrubygems-update · org.jruby:jruby-stdlib
- CVE-2018-1000076RubyGems version Ruby 2.2 series: 2.2.9 and earlier, Ruby 2.3 series: 2.3.6 and earlier, Ruby 2.4 series: 2.4.3 and earlier, Ruby 2.5 seriesrubygems-update · org.jruby:jruby-stdlib
- CVE-2018-1000077RubyGems version Ruby 2.2 series: 2.2.9 and earlier, Ruby 2.3 series: 2.3.6 and earlier, Ruby 2.4 series: 2.4.3 and earlier, Ruby 2.5 seriesrubygems-update · org.jruby:jruby-stdlib
- CVE-2018-1000078RubyGems version Ruby 2.2 series: 2.2.9 and earlier, Ruby 2.3 series: 2.3.6 and earlier, Ruby 2.4 series: 2.4.3 and earlier, Ruby 2.5 seriesrubygems-update · org.jruby:jruby-stdlib
- CVE-2018-1000079RubyGems version Ruby 2.2 series: 2.2.9 and earlier, Ruby 2.3 series: 2.3.6 and earlier, Ruby 2.4 series: 2.4.3 and earlier, Ruby 2.5 seriesrubygems-update · org.jruby:jruby-stdlib
- CVE-2018-1000080Ajenti version version 2 contains a Insecure Permissions vulnerability in Plugins download that can result in The download of any plugins asajenti-panel
- CVE-2018-1000081Ajenti version version 2 contains a Input Validation vulnerability in ID string on Get-values POST request that can result in Server Crashinajenti-panel
- CVE-2018-1000082Ajenti version version 2 contains a Cross ite Request Forgery (CSRF) vulnerability in the command execution panel of the tool used to manageajenti-panel
- CVE-2018-1000083Ajenti version version 2 contains a Improper Error Handling vulnerability in Login JSON request that can result in The requisition leaks a pajenti-panel
- CVE-2018-1000084WOlfCMS WolfCMS version version 0.8.3.1 contains a Stored Cross-Site Scripting vulnerability in Layout Name (from Layout tab) that can resul
- CVE-2018-1000085ClamAV version version 0.99.3 contains a Out of bounds heap memory read vulnerability in XAR parser, function xar_hash_check() that can resu
- CVE-2018-1000086NPR Visuals Team Pym.js version versions 0.4.2 up to 1.3.1 contains a Cross ite Request Forgery (CSRF) vulnerability in Pym.js _onNavigateTopym.js
- CVE-2018-1000087WolfCMS version version 0.8.3.1 contains a Reflected Cross Site Scripting vulnerability in "Create New File" and "Create New Directory" inpu
- CVE-2018-1000088Doorkeeper version 2.1.0 through 4.2.5 contains a Cross Site Scripting (XSS) vulnerability in web view's OAuth app form, user authorization doorkeeper
- CVE-2018-1000089Anymail django-anymail version version 0.2 through 1.3 contains a CWE-532, CWE-209 vulnerability in WEBHOOK_AUTHORIZATION setting value thatdjango-anymail
- CVE-2018-1000090textpattern version version 4.6.2 contains a XML Injection vulnerability in Import XML feature that can result in Denial of service in conte
- CVE-2018-1000091KadNode version version 2.2.0 contains a Buffer Overflow vulnerability in Arguments when starting up the binary that can result in Control o
- CVE-2018-1000092CMS Made Simple version versions 2.2.5 contains a Cross ite Request Forgery (CSRF) vulnerability in Admin profile page that can result in De
- CVE-2018-1000093CryptoNote version version 0.8.9 and possibly later contain a local RPC server which does not require authentication, as a result the wallet
- CVE-2016-9575Ipa versions 4.2.x, 4.3.x before 4.3.3 and 4.4.x before 4.4.3 did not properly check the user's permissions while modifying certificate profFreeIPA ipa
- CVE-2018-1000104A plaintext storage of a password vulnerability exists in Jenkins Coverity Plugin 1.10.0 and earlier in CIMInstance.java that allows an attaorg.jenkins-ci.plugins:coverity
- CVE-2018-1000105An improper authorization vulnerability exists in Jenkins Gerrit Trigger Plugin 2.27.4 and earlier in GerritManagement.java, GerritServer.jacom.sonyericsson.hudson.plugins.gerrit:gerrit-trigger
- CVE-2018-1000106An improper authorization vulnerability exists in Jenkins Gerrit Trigger Plugin 2.27.4 and earlier in GerritManagement.java, GerritServer.jacom.sonyericsson.hudson.plugins.gerrit:gerrit-trigger
- CVE-2018-1000107An improper authorization vulnerability exists in Jenkins Job and Node Ownership Plugin 0.11.0 and earlier in OwnershipDescription.java, Jobcom.synopsys.jenkinsci:ownership
- CVE-2018-1000108A cross-site scripting vulnerability exists in Jenkins CppNCSS Plugin 1.1 and earlier in AbstractProjectAction/index.jelly that allow an attorg.jenkins-ci.plugins:cppncss
- CVE-2018-1000109An improper authorization vulnerability exists in Jenkins Google Play Android Publisher Plugin version 1.6 and earlier in GooglePlayBuildSteorg.jenkins-ci.plugins:google-play-android-publisher
- CVE-2018-1000110An improper authorization vulnerability exists in Jenkins Git Plugin version 3.7.0 and earlier in GitStatus.java that allows an attacker witorg.jenkins-ci.plugins:git
- CVE-2018-1000111An improper authorization vulnerability exists in Jenkins Subversion Plugin version 2.10.2 and earlier in SubversionStatus.java and Subversiorg.jenkins-ci.plugins:subversion
- CVE-2018-1000112An improper authorization vulnerability exists in Jenkins Mercurial Plugin version 2.2 and earlier in MercurialStatus.java that allows an atorg.jenkins-ci.plugins:mercurial
- CVE-2018-1000113A cross-site scripting vulnerability exists in Jenkins TestLink Plugin 2.12 and earlier in TestLinkBuildAction/summary.jelly and others thatorg.jenkins-ci.plugins:testlink
- CVE-2018-1000114An improper authorization vulnerability exists in Jenkins Promoted Builds Plugin 2.31.1 and earlier in Status.java and ManualCondition.java org.jenkins-ci.plugins:promoted-builds
- CVE-2018-8078YzmCMS 3.7 has Stored XSS via the title parameter to advertisement/adver/edit.html.
- CVE-2018-8087Memory leak in the hwsim_new_radio_nl function in drivers/net/wireless/mac80211_hwsim.c in the Linux kernel through 4.15.9 allows local user
- CVE-2018-1000094CMS Made Simple version 2.2.5 contains a Remote Code Execution vulnerability in File Manager that can result in Allows an authenticated admi
- CVE-2018-1000095oVirt version 4.2.0 to 4.2.2 contains a Cross Site Scripting (XSS) vulnerability in the name/description of VMs portion of the web admin app
- CVE-2018-1000096brianleroux tiny-json-http version all versions since commit 9b8e74a232bba4701844e07bcba794173b0238a8 (Oct 29 2016) contains a Missing SSL ctiny-json-http
- CVE-2018-1000097Sharutils sharutils (unshar command) version 4.15.2 contains a Buffer Overflow vulnerability in Affected component on the file unshar.c at l
- CVE-2018-1000098Teluu PJSIP version 2.7.1 and earlier contains a Integer Overflow vulnerability in pjmedia SDP parsing that can result in Crash.
- CVE-2018-1000099Teluu PJSIP version 2.7.1 and earlier contains a Access of Null/Uninitialized Pointer vulnerability in pjmedia SDP parsing that can result i