# CVEs published 2018-03-19

30 CVEs were published on March 19, 2018: 2 critical, 0 high. 1 is now in CISA KEV. Days are UTC.

- [CVE-2014-2274](https://cve.now/CVE-2014-2274.md): Cross-site request forgery (CSRF) vulnerability in the Subscribe To Comments Reloaded plugin before 140219 for WordPress allows remote attac (no CVSS)
- [CVE-2014-2297](https://cve.now/CVE-2014-2297.md): Multiple cross-site scripting (XSS) vulnerabilities in the VideoWhisper Live Streaming Integration plugin 4.29.6 for WordPress allow remote (no CVSS)
- [CVE-2014-2550](https://cve.now/CVE-2014-2550.md): Cross-site request forgery (CSRF) vulnerability in the Disable Comments plugin before 1.0.4 for WordPress allows remote attackers to hijack (no CVSS)
- [CVE-2014-2652](https://cve.now/CVE-2014-2652.md): SQL injection vulnerability in OpenScape Deployment Service (DLS) before 6.x and 7.x before R1.11.3 allows remote attackers to execute arbit (no CVSS)
- [CVE-2014-2674](https://cve.now/CVE-2014-2674.md): Directory traversal vulnerability in the Ajax Pagination (twitter Style) plugin 1.1 for WordPress allows remote attackers to read arbitrary (no CVSS)
- [CVE-2014-2675](https://cve.now/CVE-2014-2675.md): Cross-site request forgery (CSRF) vulnerability in inc/AdminPage.php in the WP HTML Sitemap plugin 1.2 for WordPress allows remote attackers (no CVSS)
- [CVE-2014-2884](https://cve.now/CVE-2014-2884.md): The ProcessVolumeDeviceControlIrp function in Ntdriver.c in TrueCrypt 7.1a allows local users to bypass access restrictions and obtain sensi (no CVSS)
- [CVE-2014-2885](https://cve.now/CVE-2014-2885.md): Multiple integer overflows in TrueCrypt 7.1a allow local users to (1) obtain sensitive information via vectors involving a crafted item-\>Ori (no CVSS)
- [CVE-2014-4024](https://cve.now/CVE-2014-4024.md): SSL virtual servers in F5 BIG-IP systems 10.x before 10.2.4 HF9, 11.x before 11.2.1 HF12, 11.3.0 before HF10, 11.4.0 before HF8, 11.4.1 befo (no CVSS)
- [CVE-2014-5443](https://cve.now/CVE-2014-5443.md): Seafile Server before 3.1.2 and Server Professional Edition before 3.1.0 allow local users to gain privileges via vectors related to ccnet h (no CVSS)
- [CVE-2014-5450](https://cve.now/CVE-2014-5450.md): Zarafa Collaboration Platform 4.1 uses world-readable permissions for /etc/zarafa/license, which allows local users to obtain sensitive info (no CVSS)
- [CVE-2018-5233](https://cve.now/CVE-2018-5233.md): Cross-site scripting (XSS) vulnerability in system/src/Grav/Common/Twig/Twig.php in Grav CMS before 1.3.0 allows remote attackers to inject (no CVSS, getgrav/grav)
- [CVE-2018-7262](https://cve.now/CVE-2018-7262.md): In Ceph before 12.2.3 and 13.x through 13.0.1, the rgw\_civetweb.cc RGWCivetWeb::init\_env function in radosgw doesn't handle malformed HTTP h (no CVSS)
- [CVE-2018-7445](https://cve.now/CVE-2018-7445.md): A buffer overflow was found in the MikroTik RouterOS SMB service when processing NetBIOS session request messages. (CVSS 9.8, KEV)
- [CVE-2018-8732](https://cve.now/CVE-2018-8732.md): Cross-site scripting (XSS) vulnerability in WampServer 3.1.1 allows remote attackers to inject arbitrary web script or HTML via the virtual\_ (no CVSS)
- [CVE-2018-1171](https://cve.now/CVE-2018-1171.md): This vulnerability allows local attackers to escalate privileges on vulnerable installations of Joyent SmartOS release-20170803-20170803T064 (no CVSS, Joyent SmartOS)
- [CVE-2018-1195](https://cve.now/CVE-2018-1195.md): In Cloud Controller versions prior to 1.46.0, cf-deployment versions prior to 1.3.0, and cf-release versions prior to 283, Cloud Controller (no CVSS, Dell EMC Cloud Controller)
- [CVE-2018-1196](https://cve.now/CVE-2018-1196.md): Spring Boot supports an embedded launch script that can be used to easily run the application as a systemd or init.d linux service. (no CVSS, Dell EMC Spring Boot · org.springframework.boot:spring-boot)
- [CVE-2018-1197](https://cve.now/CVE-2018-1197.md): In Windows Stemcells versions prior to 1200.14, apps running inside containers in Windows on Google Cloud Platform are able to access the me (no CVSS, Dell EMC Windows Stemcells)
- [CVE-2018-1218](https://cve.now/CVE-2018-1218.md): In Dell EMC NetWorker versions prior to 9.2.1.1, versions prior to 9.1.1.6, 9.0.x, and versions prior to 8.2.4.11, the 'nsrd' daemon causes (no CVSS, Dell EMC NetWorker)
- [CVE-2018-1221](https://cve.now/CVE-2018-1221.md): In cf-deployment before 1.14.0 and routing-release before 0.172.0, the Cloud Foundry Gorouter mishandles WebSocket requests for AWS Applicat (no CVSS, Dell EMC The Cloud Foundry Gorouter)
- [CVE-2018-5551](https://cve.now/CVE-2018-5551.md): DocuTrac DTISQLInstaller.exe Hard-Coded Credentials (CVSS 9.0, DocuTrac DTISQLInstaller.exe)
- [CVE-2018-5552](https://cve.now/CVE-2018-5552.md): DocuTrac DTISQLInstaller.exe Hard-Coded Salt (CVSS 2.9, DocuTrac DTISQLInstaller.exe)
- [CVE-2018-6842](https://cve.now/CVE-2018-6842.md): Kentico 10 before 10.0.50 and 11 before 11.0.3 has XSS in which a crafted URL results in improper construction of a system page. (no CVSS)
- [CVE-2018-6843](https://cve.now/CVE-2018-6843.md): Kentico 10 before 10.0.50 and 11 before 11.0.3 has SQL injection in the administration interface. (no CVSS)
- [CVE-2018-7422](https://cve.now/CVE-2018-7422.md): A Local File Inclusion vulnerability in the Site Editor plugin through 1.1.1 for WordPress allows remote attackers to retrieve arbitrary fil (no CVSS)
- [CVE-2018-8761](https://cve.now/CVE-2018-8761.md): protected\\apps\\member\\controller\\shopcarController.php in Yxcms building system (compatible cell phone) v1.4.7 has a logic flaw allowing att (no CVSS)
- [CVE-2014-3626](https://cve.now/CVE-2014-3626.md): The Grails Resource Plugin often has to exchange URIs for resources with other internal components. (no CVSS, Dell EMC Grails by Pivotal)
- [CVE-2015-5350](https://cve.now/CVE-2015-5350.md): In Garden versions 0.22.0-0.329.0, a vulnerability has been discovered in the garden-linux nstar executable that allows access to files on t (no CVSS, Dell EMC Garden Nstar)
- [CVE-2017-18240](https://cve.now/CVE-2017-18240.md): The Gentoo app-admin/collectd package before 5.7.2-r1 sets the ownership of PID file directory to the collectd account, which might allow lo (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2018-03-19
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.