# CVEs published 2018-03-13

72 CVEs were published on March 13, 2018: 0 critical, 2 high. Days are UTC.

- [CVE-2018-1000123](https://cve.now/CVE-2018-1000123.md): Ionic Team Cordova plugin iOS Keychain version before commit 18233ca25dfa92cca018b9c0935f43f78fd77fbf contains an Information Exposure Throu (no CVSS)
- [CVE-2018-1000124](https://cve.now/CVE-2018-1000124.md): I Librarian I-librarian version 4.8 and earlier contains a XML External Entity (XXE) vulnerability in line 154 of importmetadata.php(simplex (no CVSS)
- [CVE-2018-1000125](https://cve.now/CVE-2018-1000125.md): inversoft prime-jwt version prior to version 1.3.0 or prior to commit 0d94dcef0133d699f21d217e922564adbb83a227 contains an input validation (no CVSS)
- [CVE-2018-1000126](https://cve.now/CVE-2018-1000126.md): Ajenti version 2 contains an Information Disclosure vulnerability in Line 176 of the code source that can result in user and system enumerat (no CVSS, ajenti-panel)
- [CVE-2018-1000127](https://cve.now/CVE-2018-1000127.md): memcached version prior to 1.4.37 contains an Integer Overflow vulnerability in items.c:item\_free() that can result in data corruption and d (no CVSS)
- [CVE-2018-1227](https://cve.now/CVE-2018-1227.md): Pivotal Concourse after 2018-03-05 might allow remote attackers to have an unspecified impact, if a customer obtained the Concourse software (no CVSS, Concourse CI: As of 2018-03-13, Pivotal does not believe th…)
- [CVE-2017-16250](https://cve.now/CVE-2017-16250.md): A vulnerability in Mitel ST 14.2, release GA28 and earlier, could allow an attacker to use the API function to enumerate through user-ids wh (no CVSS)
- [CVE-2017-16251](https://cve.now/CVE-2017-16251.md): A vulnerability in the conferencing component of Mitel ST 14.2, release GA28 and earlier, could allow an authenticated user to upload a mali (no CVSS)
- [CVE-2018-7405](https://cve.now/CVE-2018-7405.md): Cross-site scripting (XSS) in Zoho ManageEngine EventLog Analyzer before 11.12 Build 11120 allows remote attackers to inject arbitrary web s (no CVSS)
- [CVE-2017-17442](https://cve.now/CVE-2017-17442.md): In BlackBerry UEM Management Console version 12.7.1 and earlier, a reflected cross-site scripting vulnerability that could allow an attacker (no CVSS, BlackBerry UEM Management Console)
- [CVE-2018-7750](https://cve.now/CVE-2018-7750.md): transport.py in the SSH server implementation of Paramiko before 1.17.6, 1.18.x before 1.18.5, 2.0.x before 2.0.8, 2.1.x before 2.1.5, 2.2.x (no CVSS, paramiko)
- [CVE-2017-1002101](https://cve.now/CVE-2017-1002101.md): In Kubernetes versions 1.3.x, 1.4.x, 1.5.x, 1.6.x and prior to versions 1.7.14, 1.8.9 and 1.9.4 containers using subpath volume mounts with (CVSS 8.8, Kubernetes)
- [CVE-2017-1002102](https://cve.now/CVE-2017-1002102.md): In Kubernetes versions 1.3.x, 1.4.x, 1.5.x, 1.6.x and prior to versions 1.7.14, 1.8.9 and 1.9.4 containers using a secret, configMap, projec (CVSS 7.1, Kubernetes · k8s.io/kubernetes)
- [CVE-2018-6294](https://cve.now/CVE-2018-6294.md): Unsecured way of firmware update in Hanwha Techwin Smartcams (no CVSS, Hanwha Techwin Smartcams)
- [CVE-2018-6295](https://cve.now/CVE-2018-6295.md): Unencrypted way of remote control and communications in Hanwha Techwin Smartcams (no CVSS, Hanwha Techwin Smartcams)
- [CVE-2018-6296](https://cve.now/CVE-2018-6296.md): An undocumented (hidden) capability for switching the web interface in Hanwha Techwin Smartcams (no CVSS, Hanwha Techwin Smartcams)
- [CVE-2018-6297](https://cve.now/CVE-2018-6297.md): Buffer overflow in Hanwha Techwin Smartcams (no CVSS, Hanwha Techwin Smartcams)
- [CVE-2018-6298](https://cve.now/CVE-2018-6298.md): Remote code execution in Hanwha Techwin Smartcams (no CVSS, Hanwha Techwin Smartcams)
- [CVE-2018-6299](https://cve.now/CVE-2018-6299.md): Authentication bypass in Hanwha Techwin Smartcams (no CVSS, Hanwha Techwin Smartcams)
- [CVE-2018-6300](https://cve.now/CVE-2018-6300.md): Remote password change in Hanwha Techwin Smartcams (no CVSS, Hanwha Techwin Smartcams)
- [CVE-2018-6301](https://cve.now/CVE-2018-6301.md): Arbitrary camera access and monitoring via cloud in Hanwha Techwin Smartcams (no CVSS, Hanwha Techwin Smartcams)
- [CVE-2018-6302](https://cve.now/CVE-2018-6302.md): Denial of service by blocking of new camera registration on the cloud server in Hanwha Techwin Smartcams (no CVSS, Hanwha Techwin Smartcams)
- [CVE-2018-6303](https://cve.now/CVE-2018-6303.md): Denial of service by uploading malformed firmware in Hanwha Techwin Smartcams (no CVSS, Hanwha Techwin Smartcams)
- [CVE-2018-6304](https://cve.now/CVE-2018-6304.md): Stack overflow in custom XML-parser in Gemalto's Sentinel LDK RTE version before 7.65 leads to remote denial of service (no CVSS, Gemalto's Sentinel LDK RTE)
- [CVE-2018-6305](https://cve.now/CVE-2018-6305.md): Denial of service in Gemalto's Sentinel LDK RTE version before 7.65 (no CVSS, Gemalto's Sentinel LDK RTE)
- [CVE-2018-1050](https://cve.now/CVE-2018-1050.md): All versions of Samba from 4.0.0 onwards are vulnerable to a denial of service attack when the RPC spoolss service is configured to be run a (no CVSS, Samba)
- [CVE-2018-1057](https://cve.now/CVE-2018-1057.md): On a Samba 4 AD DC the LDAP server in all versions of Samba from 4.0.0 onwards incorrectly validates permissions to modify passwords over LD (no CVSS, Samba)
- [CVE-2018-1000069](https://cve.now/CVE-2018-1000069.md): FreePlane version 1.5.9 and earlier contains a XML External Entity (XXE) vulnerability in XML Parser in mindmap loader that can result in st (no CVSS)
- [CVE-2018-1000070](https://cve.now/CVE-2018-1000070.md): Bitmessage PyBitmessage version v0.6.2 (and introduced in or after commit 8ce72d8d2d25973b7064b1cf76a6b0b3d62f0ba0) contains a Eval injectio (no CVSS)
- [CVE-2018-1000071](https://cve.now/CVE-2018-1000071.md): roundcube version 1.3.4 and earlier contains an Insecure Permissions vulnerability in enigma plugin that can result in exfiltration of gpg p (no CVSS)
- [CVE-2018-1000072](https://cve.now/CVE-2018-1000072.md): iRedMail version prior to commit f04b8ef contains a Insecure Permissions vulnerability in Roundcube Webmail that can result in Exfiltrate a (no CVSS)
- [CVE-2018-1000073](https://cve.now/CVE-2018-1000073.md): RubyGems version Ruby 2.2 series: 2.2.9 and earlier, Ruby 2.3 series: 2.3.6 and earlier, Ruby 2.4 series: 2.4.3 and earlier, Ruby 2.5 series (no CVSS, rubygems-update · org.jruby:jruby-stdlib)
- [CVE-2018-1000074](https://cve.now/CVE-2018-1000074.md): RubyGems version Ruby 2.2 series: 2.2.9 and earlier, Ruby 2.3 series: 2.3.6 and earlier, Ruby 2.4 series: 2.4.3 and earlier, Ruby 2.5 series (no CVSS, rubygems-update · org.jruby:jruby-stdlib)
- [CVE-2018-1000075](https://cve.now/CVE-2018-1000075.md): RubyGems version Ruby 2.2 series: 2.2.9 and earlier, Ruby 2.3 series: 2.3.6 and earlier, Ruby 2.4 series: 2.4.3 and earlier, Ruby 2.5 series (no CVSS, rubygems-update · org.jruby:jruby-stdlib)
- [CVE-2018-1000076](https://cve.now/CVE-2018-1000076.md): RubyGems version Ruby 2.2 series: 2.2.9 and earlier, Ruby 2.3 series: 2.3.6 and earlier, Ruby 2.4 series: 2.4.3 and earlier, Ruby 2.5 series (no CVSS, rubygems-update · org.jruby:jruby-stdlib)
- [CVE-2018-1000077](https://cve.now/CVE-2018-1000077.md): RubyGems version Ruby 2.2 series: 2.2.9 and earlier, Ruby 2.3 series: 2.3.6 and earlier, Ruby 2.4 series: 2.4.3 and earlier, Ruby 2.5 series (no CVSS, rubygems-update · org.jruby:jruby-stdlib)
- [CVE-2018-1000078](https://cve.now/CVE-2018-1000078.md): RubyGems version Ruby 2.2 series: 2.2.9 and earlier, Ruby 2.3 series: 2.3.6 and earlier, Ruby 2.4 series: 2.4.3 and earlier, Ruby 2.5 series (no CVSS, rubygems-update · org.jruby:jruby-stdlib)
- [CVE-2018-1000079](https://cve.now/CVE-2018-1000079.md): RubyGems version Ruby 2.2 series: 2.2.9 and earlier, Ruby 2.3 series: 2.3.6 and earlier, Ruby 2.4 series: 2.4.3 and earlier, Ruby 2.5 series (no CVSS, rubygems-update · org.jruby:jruby-stdlib)
- [CVE-2018-1000080](https://cve.now/CVE-2018-1000080.md): Ajenti version version 2 contains a Insecure Permissions vulnerability in Plugins download that can result in The download of any plugins as (no CVSS, ajenti-panel)
- [CVE-2018-1000081](https://cve.now/CVE-2018-1000081.md): Ajenti version version 2 contains a Input Validation vulnerability in ID string on Get-values POST request that can result in Server Crashin (no CVSS, ajenti-panel)
- [CVE-2018-1000082](https://cve.now/CVE-2018-1000082.md): Ajenti version version 2 contains a Cross ite Request Forgery (CSRF) vulnerability in the command execution panel of the tool used to manage (no CVSS, ajenti-panel)
- [CVE-2018-1000083](https://cve.now/CVE-2018-1000083.md): Ajenti version version 2 contains a Improper Error Handling vulnerability in Login JSON request that can result in The requisition leaks a p (no CVSS, ajenti-panel)
- [CVE-2018-1000084](https://cve.now/CVE-2018-1000084.md): WOlfCMS WolfCMS version version 0.8.3.1 contains a Stored Cross-Site Scripting vulnerability in Layout Name (from Layout tab) that can resul (no CVSS)
- [CVE-2018-1000085](https://cve.now/CVE-2018-1000085.md): ClamAV version version 0.99.3 contains a Out of bounds heap memory read vulnerability in XAR parser, function xar\_hash\_check() that can resu (no CVSS)
- [CVE-2018-1000086](https://cve.now/CVE-2018-1000086.md): NPR Visuals Team Pym.js version versions 0.4.2 up to 1.3.1 contains a Cross ite Request Forgery (CSRF) vulnerability in Pym.js \_onNavigateTo (no CVSS, pym.js)
- [CVE-2018-1000087](https://cve.now/CVE-2018-1000087.md): WolfCMS version version 0.8.3.1 contains a Reflected Cross Site Scripting vulnerability in "Create New File" and "Create New Directory" inpu (no CVSS)
- [CVE-2018-1000088](https://cve.now/CVE-2018-1000088.md): Doorkeeper version 2.1.0 through 4.2.5 contains a Cross Site Scripting (XSS) vulnerability in web view's OAuth app form, user authorization (no CVSS, doorkeeper)
- [CVE-2018-1000089](https://cve.now/CVE-2018-1000089.md): Anymail django-anymail version version 0.2 through 1.3 contains a CWE-532, CWE-209 vulnerability in WEBHOOK\_AUTHORIZATION setting value that (no CVSS, django-anymail)
- [CVE-2018-1000090](https://cve.now/CVE-2018-1000090.md): textpattern version version 4.6.2 contains a XML Injection vulnerability in Import XML feature that can result in Denial of service in conte (no CVSS)
- [CVE-2018-1000091](https://cve.now/CVE-2018-1000091.md): KadNode version version 2.2.0 contains a Buffer Overflow vulnerability in Arguments when starting up the binary that can result in Control o (no CVSS)
- [CVE-2018-1000092](https://cve.now/CVE-2018-1000092.md): CMS Made Simple version versions 2.2.5 contains a Cross ite Request Forgery (CSRF) vulnerability in Admin profile page that can result in De (no CVSS)
- [CVE-2018-1000093](https://cve.now/CVE-2018-1000093.md): CryptoNote version version 0.8.9 and possibly later contain a local RPC server which does not require authentication, as a result the wallet (no CVSS)
- [CVE-2016-9575](https://cve.now/CVE-2016-9575.md): Ipa versions 4.2.x, 4.3.x before 4.3.3 and 4.4.x before 4.4.3 did not properly check the user's permissions while modifying certificate prof (no CVSS, FreeIPA ipa)
- [CVE-2018-1000104](https://cve.now/CVE-2018-1000104.md): A plaintext storage of a password vulnerability exists in Jenkins Coverity Plugin 1.10.0 and earlier in CIMInstance.java that allows an atta (no CVSS, org.jenkins-ci.plugins:coverity)
- [CVE-2018-1000105](https://cve.now/CVE-2018-1000105.md): An improper authorization vulnerability exists in Jenkins Gerrit Trigger Plugin 2.27.4 and earlier in GerritManagement.java, GerritServer.ja (no CVSS, com.sonyericsson.hudson.plugins.gerrit:gerrit-trigger)
- [CVE-2018-1000106](https://cve.now/CVE-2018-1000106.md): An improper authorization vulnerability exists in Jenkins Gerrit Trigger Plugin 2.27.4 and earlier in GerritManagement.java, GerritServer.ja (no CVSS, com.sonyericsson.hudson.plugins.gerrit:gerrit-trigger)
- [CVE-2018-1000107](https://cve.now/CVE-2018-1000107.md): An improper authorization vulnerability exists in Jenkins Job and Node Ownership Plugin 0.11.0 and earlier in OwnershipDescription.java, Job (no CVSS, com.synopsys.jenkinsci:ownership)
- [CVE-2018-1000108](https://cve.now/CVE-2018-1000108.md): A cross-site scripting vulnerability exists in Jenkins CppNCSS Plugin 1.1 and earlier in AbstractProjectAction/index.jelly that allow an att (no CVSS, org.jenkins-ci.plugins:cppncss)
- [CVE-2018-1000109](https://cve.now/CVE-2018-1000109.md): An improper authorization vulnerability exists in Jenkins Google Play Android Publisher Plugin version 1.6 and earlier in GooglePlayBuildSte (no CVSS, org.jenkins-ci.plugins:google-play-android-publisher)
- [CVE-2018-1000110](https://cve.now/CVE-2018-1000110.md): An improper authorization vulnerability exists in Jenkins Git Plugin version 3.7.0 and earlier in GitStatus.java that allows an attacker wit (no CVSS, org.jenkins-ci.plugins:git)
- [CVE-2018-1000111](https://cve.now/CVE-2018-1000111.md): An improper authorization vulnerability exists in Jenkins Subversion Plugin version 2.10.2 and earlier in SubversionStatus.java and Subversi (no CVSS, org.jenkins-ci.plugins:subversion)
- [CVE-2018-1000112](https://cve.now/CVE-2018-1000112.md): An improper authorization vulnerability exists in Jenkins Mercurial Plugin version 2.2 and earlier in MercurialStatus.java that allows an at (no CVSS, org.jenkins-ci.plugins:mercurial)
- [CVE-2018-1000113](https://cve.now/CVE-2018-1000113.md): A cross-site scripting vulnerability exists in Jenkins TestLink Plugin 2.12 and earlier in TestLinkBuildAction/summary.jelly and others that (no CVSS, org.jenkins-ci.plugins:testlink)
- [CVE-2018-1000114](https://cve.now/CVE-2018-1000114.md): An improper authorization vulnerability exists in Jenkins Promoted Builds Plugin 2.31.1 and earlier in Status.java and ManualCondition.java (no CVSS, org.jenkins-ci.plugins:promoted-builds)
- [CVE-2018-8078](https://cve.now/CVE-2018-8078.md): YzmCMS 3.7 has Stored XSS via the title parameter to advertisement/adver/edit.html. (no CVSS)
- [CVE-2018-8087](https://cve.now/CVE-2018-8087.md): Memory leak in the hwsim\_new\_radio\_nl function in drivers/net/wireless/mac80211\_hwsim.c in the Linux kernel through 4.15.9 allows local user (no CVSS)
- [CVE-2018-1000094](https://cve.now/CVE-2018-1000094.md): CMS Made Simple version 2.2.5 contains a Remote Code Execution vulnerability in File Manager that can result in Allows an authenticated admi (no CVSS)
- [CVE-2018-1000095](https://cve.now/CVE-2018-1000095.md): oVirt version 4.2.0 to 4.2.2 contains a Cross Site Scripting (XSS) vulnerability in the name/description of VMs portion of the web admin app (no CVSS)
- [CVE-2018-1000096](https://cve.now/CVE-2018-1000096.md): brianleroux tiny-json-http version all versions since commit 9b8e74a232bba4701844e07bcba794173b0238a8 (Oct 29 2016) contains a Missing SSL c (no CVSS, tiny-json-http)
- [CVE-2018-1000097](https://cve.now/CVE-2018-1000097.md): Sharutils sharutils (unshar command) version 4.15.2 contains a Buffer Overflow vulnerability in Affected component on the file unshar.c at l (no CVSS)
- [CVE-2018-1000098](https://cve.now/CVE-2018-1000098.md): Teluu PJSIP version 2.7.1 and earlier contains a Integer Overflow vulnerability in pjmedia SDP parsing that can result in Crash. (no CVSS)
- [CVE-2018-1000099](https://cve.now/CVE-2018-1000099.md): Teluu PJSIP version 2.7.1 and earlier contains a Access of Null/Uninitialized Pointer vulnerability in pjmedia SDP parsing that can result i (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2018-03-13
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.