CVEs published March 20, 2018
61 CVEs were published on March 20, 2018: 0 critical, 1 high.
- Published
- 61
- Critical
- 0
- High
- 1
- Medium
- 1
- Low
- 0
- Unrated
- 59
- Now in CISA KEV
- 0
- Fix available
- 5
Most affected products
- Apache Software Foundation Apache Syncope · org.apache.sync…
- 2
- Huawei Technologies Co. VNS-L21
- 2
- Apache Software Foundation Apache Commons Email · org.apach…
- 1
- Eaton ELCSoft
- 1
- Fortinet FortiWeb
- 1
- GE Healthcare GE Centricity PACS RA1000
- 1
- GE Healthcare GE GEMNet License server aka.
- 1
- GE Healthcare GE Infinia
- 1
- GE Healthcare GE Xeleris
- 1
- Huawei Technologies Co. FusionSphere OpenStack
- 1
High 1
Medium, low and unrated 60
- CVE-2018-8881Netwide Assembler (NASM) 2.13.02rc2 has a heap-based buffer over-read in the function tokenize in asm/preproc.c, related to an unterminated
- CVE-2018-8882Netwide Assembler (NASM) 2.13.02rc2 has a stack-based buffer under-read in the function ieee_shr in asm/float.c via a large shift value.
- CVE-2018-8883Netwide Assembler (NASM) 2.13.02rc2 has a buffer over-read in the parse_line function in asm/parser.c via uncontrolled access to nasm_reg_fl
- CVE-2018-8873In 2345 Security Guard 3.6, the driver file (2345NetFirewall.sys) allows local users to cause a denial of service (BSOD) or possibly have un
- CVE-2018-8874In 2345 Security Guard 3.6, the driver file (2345Wrath.sys) allows local users to cause a denial of service (BSOD) or possibly have unspecif
- CVE-2018-8875In 2345 Security Guard 3.6, the driver file (2345Wrath.sys) allows local users to cause a denial of service (BSOD) or possibly have unspecif
- CVE-2018-8876In 2345 Security Guard 3.6, the driver file (2345Wrath.sys) allows local users to cause a denial of service (BSOD) or possibly have unspecif
- CVE-2014-1215Multiple buffer overflows in Core FTP Server before 1.2 build 508 allow local users to gain privileges via vectors related to reading data f
- CVE-2014-1457Open Web Analytics (OWA) before 1.5.6 improperly generates random nonce values, which makes it easier for remote attackers to bypass a CSRF
- CVE-2014-1665Cross-site scripting (XSS) vulnerability in ownCloud before 6.0.1 allows remote authenticated users to inject arbitrary web script or HTML v
- CVE-2014-2031Deadwood before 2.3.09, 3.x before 3.2.05, and as used in MaraDNS before 1.4.14 and 2.x before 2.0.09, allow remote attackers to cause a den
- CVE-2014-2032Deadwood before 2.3.09, 3.x before 3.2.05, and as used in MaraDNS before 1.4.14 and 2.x before 2.0.09, allow remote attackers to cause a den
- CVE-2014-3990The Cart::getProducts method in system/library/cart.php in OpenCart 1.5.6.4 and earlier allows remote attackers to conduct server-side reque
- CVE-2014-4928SQL injection vulnerability in Invision Power Board (aka IPB or IP.Board) before 3.4.6 allows remote attackers to execute arbitrary SQL comm
- CVE-2015-7449IBM Rational Collaborative Lifecycle Management (CLM) 4.0.x before 4.0.7 iFix10, 5.0.x before 5.0.2 iFix15, 6.0.x before 6.0.1 iFix5, and 6.
- CVE-2015-7458Cross-site scripting (XSS) vulnerability in IBM Connections 3.0.1.1 and earlier, 4.0, 4.5, and 5.0 before CR4 allows remote attackers to inj
- CVE-2015-7459Cross-site scripting (XSS) vulnerability in IBM Connections 3.0.1.1 and earlier, 4.0, 4.5, and 5.0 before CR4 allows remote attackers to inj
- CVE-2015-7460Cross-site scripting (XSS) vulnerability in IBM Connections 3.0.1.1 and earlier, 4.0, 4.5, and 5.0 before CR4 allows remote attackers to inj
- CVE-2015-7461XML external entity (XXE) vulnerability in IBM Connections 3.0.1.1 and earlier, 4.0, 4.5, and 5.0 before CR4 allows remote authenticated use
- CVE-2018-8832enhavo 0.4.0 has XSS via a user-group that contains executable JavaScript code in the user-group name.
- CVE-2017-5736An elevation of privilege in Intel Software Guard Extensions Platform Software Component before 1.9.105.42329 allows a local attacker to exeIntel Software Guard Extensions Platform Software Component
- CVE-2018-3626Edger8r tool in the Intel SGX SDK before version 2.1.2 (Linux) and 1.9.6 (Windows) may generate code that is susceptible to a side channel pIntel SGX SDK
- CVE-2018-8828A Buffer Overflow issue was discovered in Kamailio before 4.4.7, 5.0.x before 5.0.6, and 5.1.x before 5.1.2.
- CVE-2018-5768A remote, unauthenticated attacker can gain remote code execution on the the Tenda AC15 router with a specially crafted password parameter f
- CVE-2018-1141When installing Nessus to a directory outside of the default location, Nessus versions prior to 7.0.3 did not enforce secure permissions forTenable Nessus
- CVE-2018-1294If a user of Apache Commons Email (typically an application programmer) passes unvalidated input as the so-called "Bounce Address", and thatApache Software Foundation Apache Commons Email · org.apach…
- CVE-2018-1321An administrator with report and template entitlements in Apache Syncope 1.2.x before 1.2.11, 2.0.x before 2.0.8, and unsupported releases 1Apache Software Foundation Apache Syncope · org.apache.sync…
- CVE-2018-1322An administrator with user search entitlements in Apache Syncope 1.2.x before 1.2.11, 2.0.x before 2.0.8, and unsupported releases 1.0.x andApache Software Foundation Apache Syncope · org.apache.sync…
- CVE-2018-5438Philips ISCV application prior to version 2.3.0 has an insufficient session expiration vulnerability where an attacker could reuse the sessi
- CVE-2017-14002GE Infinia/Infinia with Hawkeye 4 medical imaging systems all current versions are affected these devices use default or hard-coded credentiGE Healthcare GE Infinia
- CVE-2017-14004GE GEMNet License server (EchoServer) all current versions are affected these devices use default or hard-coded credentials.GE Healthcare GE GEMNet License server aka.
- CVE-2017-14006GE Xeleris versions 1.0,1.1,2.1,3.0,3.1, medical imaging systems, all current versions are affected, these devices use default or hard-codedGE Healthcare GE Xeleris
- CVE-2017-14008GE Centricity PACS RA1000, diagnostic image analysis, all current versions are affected these devices use default or hard-coded credentials.GE Healthcare GE Centricity PACS RA1000
- CVE-2018-7511In Eaton ELCSoft versions 2.04.02 and prior, there are multiple cases where specially crafted files could cause a buffer overflow which, in Eaton ELCSoft
- CVE-2017-17215Huawei HG532 with some customized versions has a remote code execution vulnerability.Huawei Technologies Co. HG532
- CVE-2017-17306Some Huawei Smartphones with software of VNS-L21AUTC555B141, VNS-L21C10B160, VNS-L21C66B160, VNS-L21C703B140 have an array out-of-bounds reaHuawei Technologies Co. VNS-L21
- CVE-2017-17307Some Huawei Smartphones with software of VNS-L21AUTC555B141 have an out-of-bounds read vulnerability.Huawei Technologies Co. VNS-L21
- CVE-2017-17319Huawei P9 smartphones with the versions before EVA-AL10C00B399SP02 have an information disclosure vulnerability.Huawei Technologies Co. P9
- CVE-2017-17320Huawei Mate 9 Pro smartphones with software of LON-AL00BC00B139D, LON-AL00BC00B229, LON-L29DC721B188 have a memory double free vulnerabilityHuawei Technologies Co. Mate 9 Pro
- CVE-2017-8176Huawei IPTV STB with earlier than IPTV STB V100R003C01LMYTa6SPC001 versions has an authentication bypass vulnerability.Huawei Technologies Co. IPTV STB
- CVE-2017-8187Huawei FusionSphere OpenStack V100R006C00SPC102(NFV) has a privilege escalation vulnerability.Huawei Technologies Co. FusionSphere OpenStack
- CVE-2018-5770An issue was discovered on Tenda AC15 devices.
- CVE-2017-17668Memory write mechanism in NCR S1 Dispenser controller before firmware version 0x0156 allows an unauthenticated user to upgrade or downgrade
- CVE-2018-4843A vulnerability has been identified in SIMATIC S7-400 CPU 414-3 PN/DP V7 (All versions < V7.0.3), SIMATIC S7-400 CPU 414F-3 PN/DP V7 (All Siemens SIMATIC S7-400 CPU 414-3 PN/DP · Siemens SIMATI… +38
- CVE-2018-4844A vulnerability has been identified in SIMATIC WinCC OA UI for Android (All versions < V3.15.10), SIMATIC WinCC OA UI for iOS (All versions Siemens AG SIMATIC WinCC OA UI for Android, SIMATIC WinCC O…
- CVE-2018-5717Memory write mechanism in NCR S2 Dispenser controller before firmware version 0x0108 allows an unauthenticated user to upgrade or downgrade
- CVE-2017-14191An Improper Access Control vulnerability in Fortinet FortiWeb 5.6.0 up to but not including 6.1.0 under "Signed Security Mode", allows attacFortinet FortiWeb
- CVE-2018-1000135GNOME NetworkManager version 1.10.2 and earlier contains a Information Exposure (CWE-200) vulnerability in DNS resolver that can result in P
- CVE-2018-8811Cross-site request forgery (CSRF) vulnerability in system/workplace/admin/accounts/user_role.jsp in OpenCMS 10.5.3 allows remote attackers t
- CVE-2018-8815Cross-site scripting (XSS) vulnerability in the gallery function in Alkacon OpenCMS 10.5.3 allows remote attackers to inject arbitrary web s
- CVE-2018-8821windrvr1260.sys in Jungo DriverWizard WinDriver 12.6.0 allows attackers to cause a denial of service (BSOD) via a crafted .exe file.
- CVE-2018-8804WriteEPTImage in coders/ept.c in ImageMagick 7.0.7-25 Q16 allows remote attackers to cause a denial of service (MagickCore/memory.c double f
- CVE-2018-8805Yxcms building system (compatible cell phone) v1.4.7 has XSS via the content parameter to protected\apps\default\view\default\extend_guestbo
- CVE-2018-8806In libming 0.4.8, there is a use-after-free in the decompileArithmeticOp function of decompile.c.
- CVE-2018-8807In libming 0.4.8, these is a use-after-free in the function decompileCALLFUNCTION of decompile.c.
- CVE-2018-8808In radare2 2.4.0, there is a heap-based buffer over-read in the r_asm_disassemble function of asm.c.
- CVE-2018-8809In radare2 2.4.0, there is a heap-based buffer over-read in the dalvik_op function of anal_dalvik.c.
- CVE-2018-8810In radare2 2.4.0, there is a heap-based buffer over-read in the get_ivar_list_t function of mach0_classes.c.
- CVE-2018-8088org.slf4j.ext.EventData in the slf4j-ext module in QOS.CH SLF4J before 1.8.0-beta2 allows remote attackers to bypass intended access restricorg.slf4j:slf4j-ext
- CVE-2018-8822Incorrect buffer length handling in the ncp_read_kernel function in fs/ncpfs/ncplib_kernel.c in the Linux kernel through 4.15.11, and in dri