# CVEs published 2018-03-20

61 CVEs were published on March 20, 2018: 0 critical, 1 high. Days are UTC.

- [CVE-2018-8881](https://cve.now/CVE-2018-8881.md): Netwide Assembler (NASM) 2.13.02rc2 has a heap-based buffer over-read in the function tokenize in asm/preproc.c, related to an unterminated (no CVSS)
- [CVE-2018-8882](https://cve.now/CVE-2018-8882.md): Netwide Assembler (NASM) 2.13.02rc2 has a stack-based buffer under-read in the function ieee\_shr in asm/float.c via a large shift value. (no CVSS)
- [CVE-2018-8883](https://cve.now/CVE-2018-8883.md): Netwide Assembler (NASM) 2.13.02rc2 has a buffer over-read in the parse\_line function in asm/parser.c via uncontrolled access to nasm\_reg\_fl (no CVSS)
- [CVE-2018-8873](https://cve.now/CVE-2018-8873.md): In 2345 Security Guard 3.6, the driver file (2345NetFirewall.sys) allows local users to cause a denial of service (BSOD) or possibly have un (no CVSS)
- [CVE-2018-8874](https://cve.now/CVE-2018-8874.md): In 2345 Security Guard 3.6, the driver file (2345Wrath.sys) allows local users to cause a denial of service (BSOD) or possibly have unspecif (no CVSS)
- [CVE-2018-8875](https://cve.now/CVE-2018-8875.md): In 2345 Security Guard 3.6, the driver file (2345Wrath.sys) allows local users to cause a denial of service (BSOD) or possibly have unspecif (no CVSS)
- [CVE-2018-8876](https://cve.now/CVE-2018-8876.md): In 2345 Security Guard 3.6, the driver file (2345Wrath.sys) allows local users to cause a denial of service (BSOD) or possibly have unspecif (no CVSS)
- [CVE-2014-1215](https://cve.now/CVE-2014-1215.md): Multiple buffer overflows in Core FTP Server before 1.2 build 508 allow local users to gain privileges via vectors related to reading data f (no CVSS)
- [CVE-2014-1457](https://cve.now/CVE-2014-1457.md): Open Web Analytics (OWA) before 1.5.6 improperly generates random nonce values, which makes it easier for remote attackers to bypass a CSRF (no CVSS)
- [CVE-2014-1665](https://cve.now/CVE-2014-1665.md): Cross-site scripting (XSS) vulnerability in ownCloud before 6.0.1 allows remote authenticated users to inject arbitrary web script or HTML v (no CVSS)
- [CVE-2014-2031](https://cve.now/CVE-2014-2031.md): Deadwood before 2.3.09, 3.x before 3.2.05, and as used in MaraDNS before 1.4.14 and 2.x before 2.0.09, allow remote attackers to cause a den (no CVSS)
- [CVE-2014-2032](https://cve.now/CVE-2014-2032.md): Deadwood before 2.3.09, 3.x before 3.2.05, and as used in MaraDNS before 1.4.14 and 2.x before 2.0.09, allow remote attackers to cause a den (no CVSS)
- [CVE-2014-3990](https://cve.now/CVE-2014-3990.md): The Cart::getProducts method in system/library/cart.php in OpenCart 1.5.6.4 and earlier allows remote attackers to conduct server-side reque (no CVSS)
- [CVE-2014-4928](https://cve.now/CVE-2014-4928.md): SQL injection vulnerability in Invision Power Board (aka IPB or IP.Board) before 3.4.6 allows remote attackers to execute arbitrary SQL comm (no CVSS)
- [CVE-2015-7449](https://cve.now/CVE-2015-7449.md): IBM Rational Collaborative Lifecycle Management (CLM) 4.0.x before 4.0.7 iFix10, 5.0.x before 5.0.2 iFix15, 6.0.x before 6.0.1 iFix5, and 6. (no CVSS)
- [CVE-2015-7458](https://cve.now/CVE-2015-7458.md): Cross-site scripting (XSS) vulnerability in IBM Connections 3.0.1.1 and earlier, 4.0, 4.5, and 5.0 before CR4 allows remote attackers to inj (no CVSS)
- [CVE-2015-7459](https://cve.now/CVE-2015-7459.md): Cross-site scripting (XSS) vulnerability in IBM Connections 3.0.1.1 and earlier, 4.0, 4.5, and 5.0 before CR4 allows remote attackers to inj (no CVSS)
- [CVE-2015-7460](https://cve.now/CVE-2015-7460.md): Cross-site scripting (XSS) vulnerability in IBM Connections 3.0.1.1 and earlier, 4.0, 4.5, and 5.0 before CR4 allows remote attackers to inj (no CVSS)
- [CVE-2015-7461](https://cve.now/CVE-2015-7461.md): XML external entity (XXE) vulnerability in IBM Connections 3.0.1.1 and earlier, 4.0, 4.5, and 5.0 before CR4 allows remote authenticated use (no CVSS)
- [CVE-2018-8832](https://cve.now/CVE-2018-8832.md): enhavo 0.4.0 has XSS via a user-group that contains executable JavaScript code in the user-group name. (no CVSS)
- [CVE-2017-5736](https://cve.now/CVE-2017-5736.md): An elevation of privilege in Intel Software Guard Extensions Platform Software Component before 1.9.105.42329 allows a local attacker to exe (no CVSS, Intel Software Guard Extensions Platform Software Component)
- [CVE-2018-3626](https://cve.now/CVE-2018-3626.md): Edger8r tool in the Intel SGX SDK before version 2.1.2 (Linux) and 1.9.6 (Windows) may generate code that is susceptible to a side channel p (no CVSS, Intel SGX SDK)
- [CVE-2018-8828](https://cve.now/CVE-2018-8828.md): A Buffer Overflow issue was discovered in Kamailio before 4.4.7, 5.0.x before 5.0.6, and 5.1.x before 5.1.2. (no CVSS)
- [CVE-2018-5768](https://cve.now/CVE-2018-5768.md): A remote, unauthenticated attacker can gain remote code execution on the the Tenda AC15 router with a specially crafted password parameter f (no CVSS)
- [CVE-2011-3178](https://cve.now/CVE-2011-3178.md): openbuildservice webui code injection (CVSS 8.1, opensuse openbuildservice)
- [CVE-2018-1141](https://cve.now/CVE-2018-1141.md): When installing Nessus to a directory outside of the default location, Nessus versions prior to 7.0.3 did not enforce secure permissions for (no CVSS, Tenable Nessus)
- [CVE-2018-1294](https://cve.now/CVE-2018-1294.md): If a user of Apache Commons Email (typically an application programmer) passes unvalidated input as the so-called "Bounce Address", and that (no CVSS, Apache Software Foundation Apache Commons Email · org.apach…)
- [CVE-2018-1321](https://cve.now/CVE-2018-1321.md): An administrator with report and template entitlements in Apache Syncope 1.2.x before 1.2.11, 2.0.x before 2.0.8, and unsupported releases 1 (no CVSS, Apache Software Foundation Apache Syncope · org.apache.sync…)
- [CVE-2018-1322](https://cve.now/CVE-2018-1322.md): An administrator with user search entitlements in Apache Syncope 1.2.x before 1.2.11, 2.0.x before 2.0.8, and unsupported releases 1.0.x and (no CVSS, Apache Software Foundation Apache Syncope · org.apache.sync…)
- [CVE-2018-5438](https://cve.now/CVE-2018-5438.md): Philips ISCV application prior to version 2.3.0 has an insufficient session expiration vulnerability where an attacker could reuse the sessi (no CVSS)
- [CVE-2017-14002](https://cve.now/CVE-2017-14002.md): GE Infinia/Infinia with Hawkeye 4 medical imaging systems all current versions are affected these devices use default or hard-coded credenti (no CVSS, GE Healthcare GE Infinia)
- [CVE-2017-14004](https://cve.now/CVE-2017-14004.md): GE GEMNet License server (EchoServer) all current versions are affected these devices use default or hard-coded credentials. (no CVSS, GE Healthcare GE GEMNet License server aka.)
- [CVE-2017-14006](https://cve.now/CVE-2017-14006.md): GE Xeleris versions 1.0,1.1,2.1,3.0,3.1, medical imaging systems, all current versions are affected, these devices use default or hard-coded (no CVSS, GE Healthcare GE Xeleris)
- [CVE-2017-14008](https://cve.now/CVE-2017-14008.md): GE Centricity PACS RA1000, diagnostic image analysis, all current versions are affected these devices use default or hard-coded credentials. (no CVSS, GE Healthcare GE Centricity PACS RA1000)
- [CVE-2018-7511](https://cve.now/CVE-2018-7511.md): In Eaton ELCSoft versions 2.04.02 and prior, there are multiple cases where specially crafted files could cause a buffer overflow which, in (no CVSS, Eaton ELCSoft)
- [CVE-2017-17215](https://cve.now/CVE-2017-17215.md): Huawei HG532 with some customized versions has a remote code execution vulnerability. (no CVSS, Huawei Technologies Co. HG532)
- [CVE-2017-17306](https://cve.now/CVE-2017-17306.md): Some Huawei Smartphones with software of VNS-L21AUTC555B141, VNS-L21C10B160, VNS-L21C66B160, VNS-L21C703B140 have an array out-of-bounds rea (no CVSS, Huawei Technologies Co. VNS-L21)
- [CVE-2017-17307](https://cve.now/CVE-2017-17307.md): Some Huawei Smartphones with software of VNS-L21AUTC555B141 have an out-of-bounds read vulnerability. (no CVSS, Huawei Technologies Co. VNS-L21)
- [CVE-2017-17319](https://cve.now/CVE-2017-17319.md): Huawei P9 smartphones with the versions before EVA-AL10C00B399SP02 have an information disclosure vulnerability. (no CVSS, Huawei Technologies Co. P9)
- [CVE-2017-17320](https://cve.now/CVE-2017-17320.md): Huawei Mate 9 Pro smartphones with software of LON-AL00BC00B139D, LON-AL00BC00B229, LON-L29DC721B188 have a memory double free vulnerability (no CVSS, Huawei Technologies Co. Mate 9 Pro)
- [CVE-2017-8176](https://cve.now/CVE-2017-8176.md): Huawei IPTV STB with earlier than IPTV STB V100R003C01LMYTa6SPC001 versions has an authentication bypass vulnerability. (no CVSS, Huawei Technologies Co. IPTV STB)
- [CVE-2017-8187](https://cve.now/CVE-2017-8187.md): Huawei FusionSphere OpenStack V100R006C00SPC102(NFV) has a privilege escalation vulnerability. (no CVSS, Huawei Technologies Co. FusionSphere OpenStack)
- [CVE-2018-5770](https://cve.now/CVE-2018-5770.md): An issue was discovered on Tenda AC15 devices. (no CVSS)
- [CVE-2017-17668](https://cve.now/CVE-2017-17668.md): Memory write mechanism in NCR S1 Dispenser controller before firmware version 0x0156 allows an unauthenticated user to upgrade or downgrade (no CVSS)
- [CVE-2018-4843](https://cve.now/CVE-2018-4843.md): A vulnerability has been identified in SIMATIC S7-400 CPU 414-3 PN/DP V7 (All versions \< V7.0.3), SIMATIC S7-400 CPU 414F-3 PN/DP V7 (All (CVSS 6.5, Siemens SIMATIC S7-400 CPU 414-3 PN/DP · Siemens SIMATI… +38)
- [CVE-2018-4844](https://cve.now/CVE-2018-4844.md): A vulnerability has been identified in SIMATIC WinCC OA UI for Android (All versions \< V3.15.10), SIMATIC WinCC OA UI for iOS (All versions (no CVSS, Siemens AG SIMATIC WinCC OA UI for Android, SIMATIC WinCC O…)
- [CVE-2018-5717](https://cve.now/CVE-2018-5717.md): Memory write mechanism in NCR S2 Dispenser controller before firmware version 0x0108 allows an unauthenticated user to upgrade or downgrade (no CVSS)
- [CVE-2017-14191](https://cve.now/CVE-2017-14191.md): An Improper Access Control vulnerability in Fortinet FortiWeb 5.6.0 up to but not including 6.1.0 under "Signed Security Mode", allows attac (no CVSS, Fortinet FortiWeb)
- [CVE-2018-1000135](https://cve.now/CVE-2018-1000135.md): GNOME NetworkManager version 1.10.2 and earlier contains a Information Exposure (CWE-200) vulnerability in DNS resolver that can result in P (no CVSS)
- [CVE-2018-8811](https://cve.now/CVE-2018-8811.md): Cross-site request forgery (CSRF) vulnerability in system/workplace/admin/accounts/user\_role.jsp in OpenCMS 10.5.3 allows remote attackers t (no CVSS)
- [CVE-2018-8815](https://cve.now/CVE-2018-8815.md): Cross-site scripting (XSS) vulnerability in the gallery function in Alkacon OpenCMS 10.5.3 allows remote attackers to inject arbitrary web s (no CVSS)
- [CVE-2018-8821](https://cve.now/CVE-2018-8821.md): windrvr1260.sys in Jungo DriverWizard WinDriver 12.6.0 allows attackers to cause a denial of service (BSOD) via a crafted .exe file. (no CVSS)
- [CVE-2018-8804](https://cve.now/CVE-2018-8804.md): WriteEPTImage in coders/ept.c in ImageMagick 7.0.7-25 Q16 allows remote attackers to cause a denial of service (MagickCore/memory.c double f (no CVSS)
- [CVE-2018-8805](https://cve.now/CVE-2018-8805.md): Yxcms building system (compatible cell phone) v1.4.7 has XSS via the content parameter to protected\\apps\\default\\view\\default\\extend\_guestbo (no CVSS)
- [CVE-2018-8806](https://cve.now/CVE-2018-8806.md): In libming 0.4.8, there is a use-after-free in the decompileArithmeticOp function of decompile.c. (no CVSS)
- [CVE-2018-8807](https://cve.now/CVE-2018-8807.md): In libming 0.4.8, these is a use-after-free in the function decompileCALLFUNCTION of decompile.c. (no CVSS)
- [CVE-2018-8808](https://cve.now/CVE-2018-8808.md): In radare2 2.4.0, there is a heap-based buffer over-read in the r\_asm\_disassemble function of asm.c. (no CVSS)
- [CVE-2018-8809](https://cve.now/CVE-2018-8809.md): In radare2 2.4.0, there is a heap-based buffer over-read in the dalvik\_op function of anal\_dalvik.c. (no CVSS)
- [CVE-2018-8810](https://cve.now/CVE-2018-8810.md): In radare2 2.4.0, there is a heap-based buffer over-read in the get\_ivar\_list\_t function of mach0\_classes.c. (no CVSS)
- [CVE-2018-8088](https://cve.now/CVE-2018-8088.md): org.slf4j.ext.EventData in the slf4j-ext module in QOS.CH SLF4J before 1.8.0-beta2 allows remote attackers to bypass intended access restric (no CVSS, org.slf4j:slf4j-ext)
- [CVE-2018-8822](https://cve.now/CVE-2018-8822.md): Incorrect buffer length handling in the ncp\_read\_kernel function in fs/ncpfs/ncplib\_kernel.c in the Linux kernel through 4.15.11, and in dri (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2018-03-20
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.