CVEs published March 19, 2018
30 CVEs were published on March 19, 2018: 2 critical, 0 high. 1 is now in CISA KEV.
- Published
- 30
- Critical
- 2
- High
- 0
- Medium
- 0
- Low
- 1
- Unrated
- 27
- Now in CISA KEV
- 1
- Fix available
- 2
Most affected products
- DocuTrac DTISQLInstaller.exe
- 2
- Dell EMC Cloud Controller
- 1
- Dell EMC Garden Nstar
- 1
- Dell EMC Grails by Pivotal
- 1
- Dell EMC NetWorker
- 1
- Dell EMC Spring Boot · org.springframework.boot:spring-boot
- 1
- Dell EMC The Cloud Foundry Gorouter
- 1
- Dell EMC Windows Stemcells
- 1
- getgrav/grav
- 1
- Joyent SmartOS
- 1
Critical 2
Medium, low and unrated 28
- CVE-2014-2274Cross-site request forgery (CSRF) vulnerability in the Subscribe To Comments Reloaded plugin before 140219 for WordPress allows remote attac
- CVE-2014-2297Multiple cross-site scripting (XSS) vulnerabilities in the VideoWhisper Live Streaming Integration plugin 4.29.6 for WordPress allow remote
- CVE-2014-2550Cross-site request forgery (CSRF) vulnerability in the Disable Comments plugin before 1.0.4 for WordPress allows remote attackers to hijack
- CVE-2014-2652SQL injection vulnerability in OpenScape Deployment Service (DLS) before 6.x and 7.x before R1.11.3 allows remote attackers to execute arbit
- CVE-2014-2674Directory traversal vulnerability in the Ajax Pagination (twitter Style) plugin 1.1 for WordPress allows remote attackers to read arbitrary
- CVE-2014-2675Cross-site request forgery (CSRF) vulnerability in inc/AdminPage.php in the WP HTML Sitemap plugin 1.2 for WordPress allows remote attackers
- CVE-2014-2884The ProcessVolumeDeviceControlIrp function in Ntdriver.c in TrueCrypt 7.1a allows local users to bypass access restrictions and obtain sensi
- CVE-2014-2885Multiple integer overflows in TrueCrypt 7.1a allow local users to (1) obtain sensitive information via vectors involving a crafted item->Ori
- CVE-2014-4024SSL virtual servers in F5 BIG-IP systems 10.x before 10.2.4 HF9, 11.x before 11.2.1 HF12, 11.3.0 before HF10, 11.4.0 before HF8, 11.4.1 befo
- CVE-2014-5443Seafile Server before 3.1.2 and Server Professional Edition before 3.1.0 allow local users to gain privileges via vectors related to ccnet h
- CVE-2014-5450Zarafa Collaboration Platform 4.1 uses world-readable permissions for /etc/zarafa/license, which allows local users to obtain sensitive info
- CVE-2018-5233Cross-site scripting (XSS) vulnerability in system/src/Grav/Common/Twig/Twig.php in Grav CMS before 1.3.0 allows remote attackers to inject getgrav/grav
- CVE-2018-7262In Ceph before 12.2.3 and 13.x through 13.0.1, the rgw_civetweb.cc RGWCivetWeb::init_env function in radosgw doesn't handle malformed HTTP h
- CVE-2018-8732Cross-site scripting (XSS) vulnerability in WampServer 3.1.1 allows remote attackers to inject arbitrary web script or HTML via the virtual_
- CVE-2018-1171This vulnerability allows local attackers to escalate privileges on vulnerable installations of Joyent SmartOS release-20170803-20170803T064Joyent SmartOS
- CVE-2018-1195In Cloud Controller versions prior to 1.46.0, cf-deployment versions prior to 1.3.0, and cf-release versions prior to 283, Cloud Controller Dell EMC Cloud Controller
- CVE-2018-1196Spring Boot supports an embedded launch script that can be used to easily run the application as a systemd or init.d linux service.Dell EMC Spring Boot · org.springframework.boot:spring-boot
- CVE-2018-1197In Windows Stemcells versions prior to 1200.14, apps running inside containers in Windows on Google Cloud Platform are able to access the meDell EMC Windows Stemcells
- CVE-2018-1218In Dell EMC NetWorker versions prior to 9.2.1.1, versions prior to 9.1.1.6, 9.0.x, and versions prior to 8.2.4.11, the 'nsrd' daemon causes Dell EMC NetWorker
- CVE-2018-1221In cf-deployment before 1.14.0 and routing-release before 0.172.0, the Cloud Foundry Gorouter mishandles WebSocket requests for AWS ApplicatDell EMC The Cloud Foundry Gorouter
- CVE-2018-5552DocuTrac DTISQLInstaller.exe Hard-Coded SaltDocuTrac DTISQLInstaller.exe
- CVE-2018-6842Kentico 10 before 10.0.50 and 11 before 11.0.3 has XSS in which a crafted URL results in improper construction of a system page.
- CVE-2018-6843Kentico 10 before 10.0.50 and 11 before 11.0.3 has SQL injection in the administration interface.
- CVE-2018-7422A Local File Inclusion vulnerability in the Site Editor plugin through 1.1.1 for WordPress allows remote attackers to retrieve arbitrary fil
- CVE-2018-8761protected\apps\member\controller\shopcarController.php in Yxcms building system (compatible cell phone) v1.4.7 has a logic flaw allowing att
- CVE-2014-3626The Grails Resource Plugin often has to exchange URIs for resources with other internal components.Dell EMC Grails by Pivotal
- CVE-2015-5350In Garden versions 0.22.0-0.329.0, a vulnerability has been discovered in the garden-linux nstar executable that allows access to files on tDell EMC Garden Nstar
- CVE-2017-18240The Gentoo app-admin/collectd package before 5.7.2-r1 sets the ownership of PID file directory to the collectd account, which might allow lo