# CVEs published 2018-03-14

144 CVEs were published on March 14, 2018: 0 critical, 4 high. Days are UTC.

- [CVE-2017-12194](https://cve.now/CVE-2017-12194.md): A flaw was found in the way spice-client processed certain messages sent from the server. (no CVSS, freedesktop.org spice-gtk)
- [CVE-2018-7701](https://cve.now/CVE-2018-7701.md): Multiple cross-site request forgery (CSRF) vulnerabilities in SecurEnvoy SecurMail before 9.2.501 allow remote attackers to hijack the authe (no CVSS)
- [CVE-2018-7702](https://cve.now/CVE-2018-7702.md): SecurEnvoy SecurMail before 9.2.501 allows remote attackers to spoof transmission of arbitrary e-mail messages, resend e-mail messages to ar (no CVSS)
- [CVE-2018-7703](https://cve.now/CVE-2018-7703.md): Cross-site scripting (XSS) vulnerability in SecurEnvoy SecurMail before 9.2.501 allows remote attackers to inject arbitrary web script or HT (no CVSS)
- [CVE-2018-7704](https://cve.now/CVE-2018-7704.md): SecurEnvoy SecurMail before 9.2.501 allows remote authenticated users to read arbitrary e-mail messages via the option1 parameter in a reply (no CVSS)
- [CVE-2018-7705](https://cve.now/CVE-2018-7705.md): Directory traversal vulnerability in SecurEnvoy SecurMail before 9.2.501 allows remote authenticated users to read e-mail messages to arbitr (no CVSS)
- [CVE-2018-7706](https://cve.now/CVE-2018-7706.md): Directory traversal vulnerability in SecurEnvoy SecurMail before 9.2.501 allows remote authenticated users to read arbitrary e-mail messages (no CVSS)
- [CVE-2018-7707](https://cve.now/CVE-2018-7707.md): Cross-site scripting (XSS) vulnerability in SecurEnvoy SecurMail before 9.2.501 allows remote attackers to inject arbitrary web script or HT (no CVSS)
- [CVE-2018-7756](https://cve.now/CVE-2018-7756.md): RunExeFile.exe in the installer for DEWESoft X3 SP1 (64-bit) devices does not require authentication for sessions on TCP port 1999, which al (no CVSS)
- [CVE-2018-8045](https://cve.now/CVE-2018-8045.md): In Joomla! 3.5.0 through 3.8.5, the lack of type casting of a variable in a SQL statement leads to a SQL injection vulnerability in the User (no CVSS)
- [CVE-2018-8715](https://cve.now/CVE-2018-8715.md): The Embedthis HTTP library, and Appweb versions before 7.0.3, have a logic flaw related to the authCondition function in http/httpLib.c. (no CVSS)
- [CVE-2018-8717](https://cve.now/CVE-2018-8717.md): joyplus-cms 1.6.0 has CSRF, as demonstrated by adding an administrator account via a manager/admin\_ajax.php?action=save&tab={pre}manager req (no CVSS)
- [CVE-2018-2366](https://cve.now/CVE-2018-2366.md): SAP Business Process Automation (BPA) By Redwood, 9.0, 9.1, allows an attacker to exploit insufficient validation of path information provid (CVSS 4.3, SAP SE SAP Business Process Automation (BPA) By Redwood)
- [CVE-2018-2397](https://cve.now/CVE-2018-2397.md): In SAP Business Objects Business Intelligence Platform, 4.00, 4.10, 4.20, 4.30, the Central Management Console (CMC) does not sufficiently e (CVSS 5.4, SAP SE SAP Business Objects Business Intelligence Platform)
- [CVE-2018-2398](https://cve.now/CVE-2018-2398.md): Under certain conditions SAP Business Client 6.5 allows an attacker to access information which would otherwise be restricted. (CVSS 6.7, SAP SE SAP Business Client)
- [CVE-2018-2399](https://cve.now/CVE-2018-2399.md): Cross-Site Scripting in Process Monitoring Infrastructure, from 7.10 to 7.11, 7.20, 7.30, 7.31, 7.40, 7.50, due to inefficient encoding of u (CVSS 6.1, SAP SE SAP Process Monitoring Infrastructure)
- [CVE-2018-2400](https://cve.now/CVE-2018-2400.md): Under certain conditions SAP Business Process Automation (BPA) By Redwood, 9.00, 9.10, allows an attacker to access information which would (no CVSS)
- [CVE-2018-2401](https://cve.now/CVE-2018-2401.md): SAP Business Process Automation (BPA) By Redwood does not sufficiently validate an XML document accepted from an untrusted source resulting (CVSS 5.4, SAP SE SAP Business Process Automation (BPA) By Redwood)
- [CVE-2018-2402](https://cve.now/CVE-2018-2402.md): In systems using the optional capture & replay functionality of SAP HANA, 1.00 and 2.00, (see SAP Note 2362820 for more information about ca (CVSS 7.6, SAP SE SAP HANA)
- [CVE-2018-6328](https://cve.now/CVE-2018-6328.md): It was discovered that the Unitrends Backup (UB) before 10.1.0 user interface was exposed to an authentication bypass, which then could allo (no CVSS)
- [CVE-2018-6329](https://cve.now/CVE-2018-6329.md): It was discovered that the Unitrends Backup (UB) before 10.1.0 libbpext.so authentication could be bypassed with a SQL injection, allowing a (no CVSS)
- [CVE-2018-8710](https://cve.now/CVE-2018-8710.md): A remote code execution issue was discovered in the WooCommerce Products Filter (aka WOOF) plugin before 2.2.0 for WordPress, as demonstrate (no CVSS)
- [CVE-2018-8711](https://cve.now/CVE-2018-8711.md): A local file inclusion issue was discovered in the WooCommerce Products Filter (aka WOOF) plugin before 2.2.0 for WordPress, as demonstrated (no CVSS)
- [CVE-2018-8712](https://cve.now/CVE-2018-8712.md): An issue was discovered in Webmin 1.840 and 1.880 when the default Yes setting of "Can view any file as a log file" is enabled. (no CVSS)
- [CVE-2018-1000120](https://cve.now/CVE-2018-1000120.md): A buffer overflow exists in curl 7.12.3 to and including curl 7.58.0 in the FTP URL handling that allows an attacker to cause a denial of se (no CVSS, curl)
- [CVE-2018-1000121](https://cve.now/CVE-2018-1000121.md): A NULL pointer dereference exists in curl 7.21.0 to and including curl 7.58.0 in the LDAP code that allows an attacker to cause a denial of (no CVSS)
- [CVE-2018-1000122](https://cve.now/CVE-2018-1000122.md): A buffer over-read exists in curl 7.20.0 to and including curl 7.58.0 in the RTSP+RTP handling code that allows an attacker to cause a denia (no CVSS)
- [CVE-2018-1077](https://cve.now/CVE-2018-1077.md): Spacewalk 2.6 contains an API which has an XXE flaw allowing for the disclosure of potentially sensitive information from the server. (no CVSS, spacewalk)
- [CVE-2018-7496](https://cve.now/CVE-2018-7496.md): An Information Exposure issue was discovered in OSIsoft PI Vision versions 2017 and prior. (no CVSS, OSIsoft PI Vision)
- [CVE-2018-7500](https://cve.now/CVE-2018-7500.md): A Permissions, Privileges, and Access Controls issue was discovered in OSIsoft PI Web API versions 2017 R2 and prior. (no CVSS, OSIsoft PI Web API)
- [CVE-2018-7504](https://cve.now/CVE-2018-7504.md): A Protection Mechanism Failure issue was discovered in OSIsoft PI Vision versions 2017 and prior. (no CVSS, OSIsoft PI Vision)
- [CVE-2018-7508](https://cve.now/CVE-2018-7508.md): A Cross-site Scripting issue was discovered in OSIsoft PI Web API versions 2017 R2 and prior. (no CVSS, OSIsoft PI Web API)
- [CVE-2018-7529](https://cve.now/CVE-2018-7529.md): A Deserialization of Untrusted Data issue was discovered in OSIsoft PI Data Archive versions 2017 and prior. (no CVSS, OSIsoft PI Data Archive)
- [CVE-2018-7531](https://cve.now/CVE-2018-7531.md): An Improper Input Validation issue was discovered in OSIsoft PI Data Archive versions 2017 and prior. (no CVSS, OSIsoft PI Data Archive)
- [CVE-2018-7533](https://cve.now/CVE-2018-7533.md): An Incorrect Default Permissions issue was discovered in OSIsoft PI Data Archive versions 2017 and prior. (no CVSS, OSIsoft PI Data Archive)
- [CVE-2018-0787](https://cve.now/CVE-2018-0787.md): ASP.NET Core 1.0. (no CVSS, Microsoft ASP.NET Core · Microsoft.AspNetCore.HttpOverri… +1)
- [CVE-2018-0808](https://cve.now/CVE-2018-0808.md): ASP.NET Core 1.0. (no CVSS, Microsoft ASP.NET Core)
- [CVE-2018-0811](https://cve.now/CVE-2018-0811.md): The Windows kernel in Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1 and RT 8.1, Windows Server 2012 and R2, Windo (no CVSS, Microsoft Windows kernel)
- [CVE-2018-0813](https://cve.now/CVE-2018-0813.md): The Windows kernel in Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1 and RT 8.1, Windows Server 2012 and R2, Windo (no CVSS, Microsoft Windows kernel)
- [CVE-2018-0814](https://cve.now/CVE-2018-0814.md): The Windows kernel in Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1 and RT 8.1, Windows Server 2012 and R2, Windo (no CVSS, Microsoft Windows kernel)
- [CVE-2018-0815](https://cve.now/CVE-2018-0815.md): The Windows Graphics Device Interface (GDI) in Microsoft Windows Server 2008 SP2 and R2 SP1 and Windows 7 SP1 allows an elevation of privile (no CVSS, Microsoft Windows)
- [CVE-2018-0816](https://cve.now/CVE-2018-0816.md): The Windows Graphics Device Interface (GDI) in Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1 and RT 8.1, Windows (no CVSS, Microsoft Windows)
- [CVE-2018-0817](https://cve.now/CVE-2018-0817.md): The Windows Graphics Device Interface (GDI) in Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1 and RT 8.1, Windows (no CVSS, Microsoft Windows)
- [CVE-2018-0868](https://cve.now/CVE-2018-0868.md): Windows Installer in Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1 and RT 8.1, Windows Server 2012 and R2, Window (no CVSS, Microsoft Windows Installer)
- [CVE-2018-0872](https://cve.now/CVE-2018-0872.md): ChakraCore and Microsoft Edge in Microsoft Windows 10 Gold, 1511, 1607, 1703, 1709, and Windows Server 2016 allows remote code execution, du (no CVSS, ChakraCore, Microsoft Edge · Microsoft.ChakraCore)
- [CVE-2018-0873](https://cve.now/CVE-2018-0873.md): ChakraCore and Microsoft Edge in Microsoft Windows 10 1511, 1607, 1703, 1709, and Windows Server 2016 allows remote code execution, due to h (no CVSS, ChakraCore, Microsoft Edge · Microsoft.ChakraCore)
- [CVE-2018-0874](https://cve.now/CVE-2018-0874.md): ChakraCore and Microsoft Edge in Microsoft Windows 10 Gold, 1511, 1607, 1703, 1709, and Windows Server 2016 allows remote code execution, du (no CVSS, ChakraCore, Microsoft Edge · Microsoft.ChakraCore)
- [CVE-2018-0875](https://cve.now/CVE-2018-0875.md): .NET Core 1.0, .NET Core 1.1, NET Core 2.0 and PowerShell Core 6.0.0 allow a denial of Service vulnerability due to how specially crafted re (no CVSS, Microsoft .NET Core · Microsoft.NETCore.Jit)
- [CVE-2018-0876](https://cve.now/CVE-2018-0876.md): Microsoft Edge in Windows 10 Gold, 1511, 1607, 1703, 1709, and Windows Server 2016 allows remote code execution, due to how the scripting en (no CVSS, Microsoft Edge)
- [CVE-2018-0877](https://cve.now/CVE-2018-0877.md): The Desktop Bridge Virtual File System (VFS) in Windows 10 1607, 1703, and 1709, Windows Server 2016 and Windows Server, version 1709 allows (no CVSS, Microsoft Windows Desktop Bridge Virtual File System)
- [CVE-2018-0878](https://cve.now/CVE-2018-0878.md): Windows Remote Assistance in Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1 and RT 8.1, Windows Server 2012 and R2 (CVSS 3.1, Microsoft Windows Remote Assistance)
- [CVE-2018-0879](https://cve.now/CVE-2018-0879.md): Microsoft Edge in Windows 10 1709 allows information disclosure, due to how Edge handles objects in memory, aka "Microsoft Edge Information (no CVSS, Microsoft Edge)
- [CVE-2018-0880](https://cve.now/CVE-2018-0880.md): The Desktop Bridge in Windows 10 1607, 1703, and 1709, Windows Server 2016 and Windows Server, version 1709 allows an elevation of privilege (no CVSS, Microsoft Windows Desktop Bridge)
- [CVE-2018-0881](https://cve.now/CVE-2018-0881.md): The Microsoft Video Control in Microsoft Windows Server 2008 R2 SP1, Windows 7 SP1, Windows 8.1 and RT 8.1, Windows Server 2012 and R2, Wind (no CVSS, Microsoft Windows)
- [CVE-2018-0882](https://cve.now/CVE-2018-0882.md): The Desktop Bridge in Windows 10 1607, 1703, and 1709, Windows Server 2016 and Windows Server, version 1709 allows an elevation of privilege (no CVSS, Microsoft Windows Deskop Bridge)
- [CVE-2018-0883](https://cve.now/CVE-2018-0883.md): Windows Shell in Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1 and RT 8.1, Windows Server 2012 and R2, Windows 10 (no CVSS, Microsoft Windows Shell)
- [CVE-2018-0884](https://cve.now/CVE-2018-0884.md): Windows Scripting Host (WSH) in Windows 10 Gold, 1511, 1607, 1703 and 1709, Windows Server 2016 and Windows Server, version 1709 allows a se (no CVSS, Microsoft Windows Scripting Host)
- [CVE-2018-0885](https://cve.now/CVE-2018-0885.md): The Microsoft Hyper-V Network Switch in 64-bit versions of Microsoft Windows Server 2008 SP2 and R2 SP1, Windows Server 2012 and R2, Windows (no CVSS, Microsoft Hyper-V Network Switch)
- [CVE-2018-0886](https://cve.now/CVE-2018-0886.md): The Credential Security Support Provider protocol (CredSSP) in Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1 and (no CVSS, Microsoft Windows)
- [CVE-2018-0888](https://cve.now/CVE-2018-0888.md): The Microsoft Hyper-V Network Switch in 64-bit versions of Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows (no CVSS, Microsoft Hyper-V Network SwitchHyper-V Network Switch)
- [CVE-2018-0889](https://cve.now/CVE-2018-0889.md): Microsoft Edge in Windows 10 Gold, 1511, 1607, 1703, 1709, and Windows Server 2016 allows remote code execution, due to how the scripting en (no CVSS, Microsoft Edge)
- [CVE-2018-0891](https://cve.now/CVE-2018-0891.md): ChakraCore, and Internet Explorer in Microsoft Windows 7 SP1, Windows Server 2008 and R2 SP1, Windows 8.1 and Windows RT 8.1, Windows Server (no CVSS, ChakraCore, Microsoft Edge, Internet Explorer)
- [CVE-2018-0893](https://cve.now/CVE-2018-0893.md): Microsoft Edge in Windows 10 Gold, 1511, 1607, 1703, 1709, and Windows Server 2016 allows remote code execution, due to how the scripting en (no CVSS, Microsoft Edge)
- [CVE-2018-0894](https://cve.now/CVE-2018-0894.md): The Windows kernel in Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1 and RT 8.1, Windows Server 2012 and R2, Windo (no CVSS, Microsoft Windows kernel)
- [CVE-2018-0895](https://cve.now/CVE-2018-0895.md): The Windows kernel in Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1 and RT 8.1, Windows Server 2012 and R2, Windo (no CVSS, Microsoft Windows kernel)
- [CVE-2018-0896](https://cve.now/CVE-2018-0896.md): The Windows kernel in Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1 and RT 8.1, Windows Server 2012 and R2, Windo (no CVSS, Microsoft Windows kernel)
- [CVE-2018-0897](https://cve.now/CVE-2018-0897.md): The Windows kernel in Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1 and RT 8.1, Windows Server 2012 and R2, Windo (no CVSS, Microsoft Windows kernel)
- [CVE-2018-0898](https://cve.now/CVE-2018-0898.md): The Windows kernel in Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1 and RT 8.1, Windows Server 2012 and R2, Windo (no CVSS, Microsoft Windows kernel)
- [CVE-2018-0899](https://cve.now/CVE-2018-0899.md): The Windows kernel in Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1 and RT 8.1, Windows Server 2012 and R2, Windo (no CVSS, Microsoft Windows kernel)
- [CVE-2018-0900](https://cve.now/CVE-2018-0900.md): The Windows kernel in Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1 and RT 8.1, Windows Server 2012 and R2, Windo (no CVSS, Microsoft Windows kernel)
- [CVE-2018-0901](https://cve.now/CVE-2018-0901.md): The Windows kernel in Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1 and RT 8.1, Windows Server 2012 and R2, Windo (no CVSS, Microsoft Windows kernel)
- [CVE-2018-0902](https://cve.now/CVE-2018-0902.md): The Cryptography Next Generation (CNG) kernel-mode driver (cng.sys) in Windows 10 Gold, 1511, 1607, 1703, and 1709. (no CVSS, Microsoft Cryptography Next Generation (CNG) kernel-mode dr…)
- [CVE-2018-0903](https://cve.now/CVE-2018-0903.md): Microsoft Access 2010 SP2, Microsoft Access 2013 SP1, Microsoft Access 2016, and Microsoft Office 2016 Click-to-Run allow a remote code exec (no CVSS, Microsoft Access)
- [CVE-2018-0904](https://cve.now/CVE-2018-0904.md): The Windows kernel in Microsoft Windows Server 2008 R2 SP1, Windows 7 SP1, Windows 8.1 and RT 8.1, Windows Server 2012 and R2, Windows 10 Go (no CVSS, Microsoft Windows kernel)
- [CVE-2018-0907](https://cve.now/CVE-2018-0907.md): Microsoft Excel 2007 SP3, Microsoft Excel 2010 SP2, Microsoft Excel 2013 SP1, Microsoft Excel 2016, Microsoft Office 2016 Click-to-Run and M (no CVSS, Microsoft Excel)
- [CVE-2018-0909](https://cve.now/CVE-2018-0909.md): Microsoft Project Server 2013 SP1 and Microsoft SharePoint Enterprise Server 2016 allow an elevation of privilege vulnerability to due how s (no CVSS, Microsoft SharePoint)
- [CVE-2018-0910](https://cve.now/CVE-2018-0910.md): Microsoft Project Server 2013 SP1 and Microsoft SharePoint Enterprise Server 2016 allow an elevation of privilege vulnerability to due how s (no CVSS, Microsoft SharePoint)
- [CVE-2018-0911](https://cve.now/CVE-2018-0911.md): Microsoft Project Server 2013 SP1 and Microsoft SharePoint Enterprise Server 2016 allow an elevation of privilege vulnerability to due how s (no CVSS, Microsoft SharePoint)
- [CVE-2018-0912](https://cve.now/CVE-2018-0912.md): Microsoft Project Server 2013 SP1 and Microsoft SharePoint Enterprise Server 2016 allow an elevation of privilege vulnerability to due how s (no CVSS, Microsoft SharePoint)
- [CVE-2018-0913](https://cve.now/CVE-2018-0913.md): Microsoft Project Server 2013 SP1 and Microsoft SharePoint Enterprise Server 2016 allow an elevation of privilege vulnerability to due how s (no CVSS, Microsoft SharePoint)
- [CVE-2018-0914](https://cve.now/CVE-2018-0914.md): Microsoft Project Server 2013 SP1 and Microsoft SharePoint Enterprise Server 2016 allow an elevation of privilege vulnerability to due how s (no CVSS, Microsoft SharePoint)
- [CVE-2018-0915](https://cve.now/CVE-2018-0915.md): Microsoft Project Server 2013 SP1 and Microsoft SharePoint Enterprise Server 2016 allow an elevation of privilege vulnerability to due how s (no CVSS, Microsoft SharePoint)
- [CVE-2018-0916](https://cve.now/CVE-2018-0916.md): Microsoft Project Server 2013 SP1 and Microsoft SharePoint Enterprise Server 2016 allow an elevation of privilege vulnerability to due how s (no CVSS, Microsoft SharePoint)
- [CVE-2018-0917](https://cve.now/CVE-2018-0917.md): Microsoft SharePoint Enterprise Server 2016 allows an elevation of privilege vulnerability to due how specially crafted web requests are san (no CVSS, Microsoft SharePoint)
- [CVE-2018-0919](https://cve.now/CVE-2018-0919.md): Microsoft Office 2010 SP2, 2013 SP1, and 2016, Microsoft Office 2016 Click-to-Run Microsoft Office 2016 for Mac, Microsoft Office Web Apps 2 (no CVSS, Microsoft Office)
- [CVE-2018-0921](https://cve.now/CVE-2018-0921.md): Microsoft SharePoint Enterprise Server 2016 allows an elevation of privilege vulnerability to due how specially crafted web requests are san (no CVSS, Microsoft SharePoint)
- [CVE-2018-0922](https://cve.now/CVE-2018-0922.md): Microsoft Office 2010 SP2, 2013 SP1, and 2016, Microsoft Office 2016 Click-to-Run Microsoft Office 2016 for Mac, Microsoft Office Compatibil (no CVSS, Microsoft Office)
- [CVE-2018-0923](https://cve.now/CVE-2018-0923.md): Microsoft SharePoint Enterprise Server 2016 allows an elevation of privilege vulnerability to due how specially crafted web requests are san (no CVSS, Microsoft SharePoint)
- [CVE-2018-0924](https://cve.now/CVE-2018-0924.md): Microsoft Exchange Server 2010 Service Pack 3 Update Rollup 20, Microsoft Exchange Server 2013 Cumulative Update 18, Microsoft Exchange Serv (no CVSS, Microsoft Exchange Server)
- [CVE-2018-0925](https://cve.now/CVE-2018-0925.md): ChakraCore allows remote code execution, due to how the ChakraCore scripting engine handles objects in memory, aka "Scripting Engine Memory (no CVSS, Microsoft ChakraCore · Microsoft.ChakraCore)
- [CVE-2018-0926](https://cve.now/CVE-2018-0926.md): The Windows kernel in Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1 and RT 8.1, Windows Server 2012 and R2, Windo (no CVSS, Microsoft Windows kernel)
- [CVE-2018-0927](https://cve.now/CVE-2018-0927.md): Internet Explorer in Microsoft Windows 7 SP1, Windows Server 2008 R2 SP1, Windows 8.1 and Windows RT 8.1, Windows Server 2012 and R2, and Mi (no CVSS, Internet Explorer, Microsoft Edge)
- [CVE-2018-0929](https://cve.now/CVE-2018-0929.md): Internet Explorer in Microsoft Windows 7 SP1, Windows Server 2008 SP2 and R2 SP1, Windows 8.1 and Windows RT 8.1, Windows Server 2012 and R2 (no CVSS, Microsoft Internet Explorer)
- [CVE-2018-0930](https://cve.now/CVE-2018-0930.md): ChakraCore and Microsoft Edge in Microsoft Windows 10 1709 allows remote code execution, due to how the Chakra scripting engine handles obje (no CVSS, ChakraCore, Microsoft Edge · Microsoft.ChakraCore)
- [CVE-2018-0931](https://cve.now/CVE-2018-0931.md): ChakraCore and Microsoft Windows 10 Gold, 1511, 1607, 1703, 1709, and Windows Server 2016 allows remote code execution, due to how the Chakr (no CVSS, ChakraCore, Microsoft Edge · Microsoft.ChakraCore)
- [CVE-2018-0932](https://cve.now/CVE-2018-0932.md): Internet Explorer in Microsoft Windows 7 SP1, Windows Server 2008 R2 SP1, Windows 8.1 and Windows RT 8.1, Windows Server 2012 and R2, and Mi (no CVSS, Internet Explorer, Microsoft Edge)
- [CVE-2018-0933](https://cve.now/CVE-2018-0933.md): ChakraCore and Microsoft Windows 10 Gold, 1511, 1607, 1703, 1709, and Windows Server 2016 allows remote code execution, due to how the Chakr (no CVSS, ChakraCore, Microsoft Edge · Microsoft.ChakraCore)
- [CVE-2018-0934](https://cve.now/CVE-2018-0934.md): ChakraCore and Microsoft Windows 10 Gold, 1511, 1607, 1703, 1709, and Windows Server 2016 allows remote code execution, due to how the Chakr (no CVSS, ChakraCore, Microsoft Edge · Microsoft.ChakraCore)
- [CVE-2018-0935](https://cve.now/CVE-2018-0935.md): Internet Explorer in Microsoft Windows 7 SP1, Windows Server 2008 and R2 SP1, Windows 8.1 and Windows RT 8.1, Windows Server 2012 and R2, Wi (no CVSS, Microsoft Internet Explorer)
- [CVE-2018-0936](https://cve.now/CVE-2018-0936.md): ChakraCore and Microsoft Windows 10 1709 allow remote code execution, due to how the Chakra scripting engine handles objects in memory, aka (no CVSS, ChakraCore, Microsoft Edge · Microsoft.ChakraCore)
- [CVE-2018-0937](https://cve.now/CVE-2018-0937.md): ChakraCore and Microsoft Windows 10 1703 and 1709 allow remote code execution, due to how the Chakra scripting engine handles objects in mem (no CVSS, ChakraCore, Microsoft Edge · Microsoft.ChakraCore)
- [CVE-2018-0939](https://cve.now/CVE-2018-0939.md): ChakraCore and Microsoft Edge in Windows 10 1703 and 1709 allow information disclosure, due to how the scripting engine handles objects in m (no CVSS, ChakraCore, Microsoft Edge · Microsoft.ChakraCore)
- [CVE-2018-0940](https://cve.now/CVE-2018-0940.md): Microsoft Exchange Outlook Web Access (OWA) in Microsoft Exchange Server 2010 Service Pack 3 Update Rollup 20, Microsoft Exchange Server 201 (no CVSS, Microsoft Exchange Outlook Web Access)
- [CVE-2018-0941](https://cve.now/CVE-2018-0941.md): Microsoft Exchange Server 2016 Cumulative Update 7 and Microsoft Exchange Server 2016 Cumulative Update 8 allow an information disclosure vu (no CVSS, Microsoft Exchange Server)
- [CVE-2018-0942](https://cve.now/CVE-2018-0942.md): Internet Explorer in Microsoft Windows 7 SP1, Windows Server 2008 SP2 and R2 SP1, Windows 8.1 and Windows RT 8.1, Windows Server 2012 and R2 (no CVSS, Microsoft Internet Explorer)
- [CVE-2018-0944](https://cve.now/CVE-2018-0944.md): Microsoft Project Server 2013 SP1 and Microsoft SharePoint Enterprise Server 2016 allows an elevation of privilege vulnerability to due how (no CVSS, Microsoft SharePoint)
- [CVE-2018-0947](https://cve.now/CVE-2018-0947.md): Microsoft SharePoint Foundation 2013 SP1 and Microsoft SharePoint Enterprise Server 2016 allow an elevation of privilege vulnerability to du (no CVSS, Microsoft SharePoint)
- [CVE-2018-0977](https://cve.now/CVE-2018-0977.md): The Windows kernel mode driver in Windows 10 Gold, 1511, 1607, 1703, and 1709, Windows Server 2016 and Windows Server, version 1709 allows a (no CVSS, Microsoft Windows)
- [CVE-2018-0983](https://cve.now/CVE-2018-0983.md): Windows Storage Services in Windows 10 versions 1511, 1607, 1703 and 1709, Windows Server 2016 and Windows Server, version 1709 allows an el (no CVSS, Microsoft Windows Storage Services)
- [CVE-2018-5779](https://cve.now/CVE-2018-5779.md): A vulnerability in the conferencing component of Mitel Connect ONSITE, versions R1711-PREM and earlier, and Mitel ST 14.2, release GA28 and (no CVSS)
- [CVE-2018-5780](https://cve.now/CVE-2018-5780.md): A vulnerability in the conferencing component of Mitel Connect ONSITE, versions R1711-PREM and earlier, and Mitel ST 14.2, release GA28 and (no CVSS)
- [CVE-2018-5781](https://cve.now/CVE-2018-5781.md): A vulnerability in the conferencing component of Mitel Connect ONSITE, versions R1711-PREM and earlier, and Mitel ST 14.2, release GA28 and (no CVSS)
- [CVE-2018-5782](https://cve.now/CVE-2018-5782.md): A vulnerability in the conferencing component of Mitel Connect ONSITE, versions R1711-PREM and earlier, and Mitel ST 14.2, release GA28 and (no CVSS)
- [CVE-2018-7677](https://cve.now/CVE-2018-7677.md): CSRF in NetIQ Access Manager (NAM) Identity Server component (CVSS 3.5, NetIQ Access Manager (NAM) Admin Console)
- [CVE-2018-7678](https://cve.now/CVE-2018-7678.md): XSS vulnerability in NetIQ Access Manager (NAM) Admin Console component (CVSS 3.5, NetIQ Access Manager (NAM) Admin Console)
- [CVE-2018-7474](https://cve.now/CVE-2018-7474.md): An issue was discovered in Textpattern CMS 4.6.2 and earlier. (no CVSS)
- [CVE-2018-1000129](https://cve.now/CVE-2018-1000129.md): An XSS vulnerability exists in the Jolokia agent version 1.3.7 in the HTTP servlet that allows an attacker to execute malicious javascript i (no CVSS, org.jolokia:jolokia-core)
- [CVE-2018-1000130](https://cve.now/CVE-2018-1000130.md): A JNDI Injection vulnerability exists in Jolokia agent version 1.3.7 in the proxy mode that allows a remote attacker to run arbitrary Java c (no CVSS, org.jolokia:jolokia-core)
- [CVE-2018-1000131](https://cve.now/CVE-2018-1000131.md): Pradeep Makone wordpress Support Plus Responsive Ticket System version 9.0.2 and earlier contains a SQL Injection vulnerability in the funct (no CVSS)
- [CVE-2018-1000132](https://cve.now/CVE-2018-1000132.md): Mercurial version 4.5 and earlier contains a Incorrect Access Control (CWE-285) vulnerability in Protocol server that can result in Unauthor (no CVSS, mercurial)
- [CVE-2018-6875](https://cve.now/CVE-2018-6875.md): Format String vulnerability in KeepKey version 4.0.0 allows attackers to trigger information display (of information that should not be acce (no CVSS)
- [CVE-2018-7279](https://cve.now/CVE-2018-7279.md): A remote code execution issue was discovered in AlienVault USM and OSSIM before 5.5.1. (no CVSS)
- [CVE-2018-8097](https://cve.now/CVE-2018-8097.md): io/mongo/parser.py in Eve (aka pyeve) before 0.7.5 allows remote attackers to execute arbitrary code via Code Injection in the where paramet (no CVSS, eve)
- [CVE-2018-8108](https://cve.now/CVE-2018-8108.md): The select component in bui through 2018-03-13 has XSS because it performs an escape operation on already-escaped text, as demonstrated by w (no CVSS)
- [CVE-2018-8100](https://cve.now/CVE-2018-8100.md): The JPXStream::readTilePart function in JPXStream.cc in xpdf 4.00 allows attackers to launch denial of service (heap-based buffer overflow a (no CVSS)
- [CVE-2018-8101](https://cve.now/CVE-2018-8101.md): The JPXStream::inverseTransformLevel function in JPXStream.cc in xpdf 4.00 allows attackers to launch denial of service (heap-based buffer o (no CVSS)
- [CVE-2018-8102](https://cve.now/CVE-2018-8102.md): The JBIG2MMRDecoder::getBlackCode function in JBIG2Stream.cc in xpdf 4.00 allows attackers to launch denial of service (buffer over-read and (no CVSS)
- [CVE-2018-8103](https://cve.now/CVE-2018-8103.md): The JBIG2Stream::readGenericBitmap function in JBIG2Stream.cc in xpdf 4.00 allows attackers to launch denial of service (heap-based buffer o (no CVSS)
- [CVE-2018-8104](https://cve.now/CVE-2018-8104.md): The BufStream::lookChar function in Stream.cc in xpdf 4.00 allows attackers to launch denial of service (heap-based buffer over-read and app (no CVSS)
- [CVE-2018-8105](https://cve.now/CVE-2018-8105.md): The JPXStream::fillReadBuf function in JPXStream.cc in xpdf 4.00 allows attackers to launch denial of service (heap-based buffer over-read a (no CVSS)
- [CVE-2018-8106](https://cve.now/CVE-2018-8106.md): The JPXStream::readTilePartData function in JPXStream.cc in xpdf 4.00 allows attackers to launch denial of service (heap-based buffer over-r (no CVSS)
- [CVE-2018-8107](https://cve.now/CVE-2018-8107.md): The JPXStream::close function in JPXStream.cc in xpdf 4.00 allows attackers to launch denial of service (heap-based buffer over-read and app (no CVSS)
- [CVE-2017-18229](https://cve.now/CVE-2017-18229.md): An issue was discovered in GraphicsMagick 1.3.26. (no CVSS)
- [CVE-2017-18230](https://cve.now/CVE-2017-18230.md): An issue was discovered in GraphicsMagick 1.3.26. (no CVSS)
- [CVE-2017-18231](https://cve.now/CVE-2017-18231.md): An issue was discovered in GraphicsMagick 1.3.26. (no CVSS)
- [CVE-2017-1741](https://cve.now/CVE-2017-1741.md): IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 could allow a remote attacker to obtain sensitive information caused by improper han (CVSS 4.3, IBM WebSphere Application Server)
- [CVE-2018-1386](https://cve.now/CVE-2018-1386.md): IBM Tivoli Workload Automation for AIX (IBM Workload Scheduler 8.6, 9.1, 9.2, 9.3, and 9.4) contains directories with improper permissions t (CVSS 7.4, IBM Workload Scheduler)
- [CVE-2018-1435](https://cve.now/CVE-2018-1435.md): IBM Notes 8.5 and 9.0 is vulnerable to a DLL hijacking attack. (CVSS 7.8, IBM Notes)
- [CVE-2018-1437](https://cve.now/CVE-2018-1437.md): IBM Notes 8.5 and 9.0 could allow an attacker to execute arbitrary code on the system, caused by an error related to multiple untrusted sear (CVSS 7.8, IBM Notes)
- [CVE-2018-1441](https://cve.now/CVE-2018-1441.md): IBM Application Performance Management - Response Time Monitoring Agent (IBM Monitoring 8.1.3 and 8.1.4) is vulnerable to cross-site scripti (CVSS 6.1, IBM Monitoring)
- [CVE-2018-1444](https://cve.now/CVE-2018-1444.md): IBM WebSphere Portal 8.5 and 9.0 is vulnerable to cross-site scripting. (CVSS 5.4, IBM WebSphere Portal)
- [CVE-2018-8096](https://cve.now/CVE-2018-8096.md): Datalust Seq before 4.2.605 is vulnerable to Authentication Bypass (with the attacker obtaining admin access) via '"Name":"isauthenticatione (no CVSS)
- [CVE-2018-8098](https://cve.now/CVE-2018-8098.md): Integer overflow in the index.c:read\_entry() function while decompressing a compressed prefix length in libgit2 before v0.26.2 allows an att (no CVSS)
- [CVE-2018-8099](https://cve.now/CVE-2018-8099.md): Incorrect returning of an error code in the index.c:read\_entry() function leads to a double free in libgit2 before v0.26.2, which allows an (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2018-03-14
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.