CVEs published March 22, 2018
67 CVEs were published on March 22, 2018: 1 critical, 3 high.
- Published
- 67
- Critical
- 1
- High
- 3
- Medium
- 5
- Low
- 0
- Unrated
- 58
- Now in CISA KEV
- 0
- Fix available
- 1
Most affected products
- Geutebrück G-Cam/EFD-2250 (part n° 5.…
- 6
- IBM DB2 for Linux, UNIX and Windows
- 6
- F5 Networks BIG-IP
- 5
- Gundam Cult QQQ QQQ SYSTEMS
- 4
- Ubiquiti Networks EdgeRouter X
- 4
- Synology Photo Station
- 2
- Atlassian Bitbucket Server
- 1
- Atlassian Fisheye and Crucible
- 1
- FlaFla... ArsenoL
- 1
- GitLab Community and Enterprise Editions
- 1
Critical 1
High 3
- CVE-2017-1677IBM Data Server Driver for JDBC and SQLJ (IBM DB2 for Linux, UNIX and Windows 9.7, 10.1, 10.5, and 11.1) deserializes the contents of /tmp/cIBM DB2 for Linux, UNIX and Windows
- CVE-2018-1426IBM GSKit (IBM DB2 for Linux, UNIX and Windows 9.7, 10.1, 10.5, and 11.1) duplicates the PRNG state across fork() system calls when multipleIBM DB2 for Linux, UNIX and Windows
- CVE-2018-1448IBM DB2 for Linux, UNIX and Windows 9.7, 10.1, 10.5, and 11.1 (includes DB2 Connect Server) contains a vulnerability that could allow a locaIBM DB2 for Linux, UNIX and Windows
Medium, low and unrated 63
- CVE-2017-18242The apply_dependent_coupling function in libavcodec/aacdec.c in Libav 12.2 allows remote attackers to cause a denial of service (out-of-boun
- CVE-2017-18243The unpack_parse_unit function in libavcodec/dirac_parser.c in Libav 12.2 allows remote attackers to cause a denial of service (segmentation
- CVE-2017-18244The stereo_processing function in libavcodec/aacps.c in Libav 12.2 allows remote attackers to cause a denial of service (out-of-bounds read)
- CVE-2018-8903Open-AudIT Professional 2.1 allows XSS via the Name or Description field on the Credentials screen.
- CVE-2018-8942Xiuno BBS 4.0.0 has XSS in the adminpage sitename parameter.
- CVE-2018-8943There is a SQL injection in the PHPSHE 1.6 userbank parameter.
- CVE-2018-8944PHPOK 4.8.338 has an arbitrary file upload vulnerability.
- CVE-2018-8945The bfd_section_from_shdr function in elf.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.30, a
- CVE-2018-5502On F5 BIG-IP versions 13.0.0 - 13.1.0.3, attackers may be able to disrupt services on the BIG-IP system with maliciously crafted client certF5 Networks BIG-IP
- CVE-2018-5503On F5 BIG-IP versions 13.0.0 - 13.1.0.3 or 12.0.0 - 12.1.3.1, TMM may restart when processing a specifically crafted page through a virtual F5 Networks BIG-IP
- CVE-2018-5504In some circumstances, the Traffic Management Microkernel (TMM) does not properly handle certain malformed Websockets requests/responses, whF5 Networks BIG-IP
- CVE-2018-5505On F5 BIG-IP versions 13.1.0 - 13.1.0.3, when ASM and AVR are both provisioned, TMM may restart while processing DNS requests when the virtuF5 Networks BIG-IP
- CVE-2018-5509On F5 BIG-IP versions 13.0.0 or 12.1.0 - 12.1.3.1, when a specifically configured virtual server receives traffic of an undisclosed nature, F5 Networks BIG-IP
- CVE-2018-7512A cross-site scripting vulnerability has been identified in Geutebruck G-Cam/EFD-2250 Version 1.12.0.4 and Topline TopFD-2125 Version 3.15.1Geutebrück G-Cam/EFD-2250 (part n° 5.…
- CVE-2018-7516A server-side request forgery vulnerability has been identified in Geutebruck G-Cam/EFD-2250 Version 1.12.0.4 and Topline TopFD-2125 VersionGeutebrück G-Cam/EFD-2250 (part n° 5.…
- CVE-2018-7520An improper access control vulnerability has been identified in Geutebruck G-Cam/EFD-2250 Version 1.12.0.4 and Topline TopFD-2125 Version 3.Geutebrück G-Cam/EFD-2250 (part n° 5.…
- CVE-2018-7524A cross-site request forgery vulnerability has been identified in Geutebruck G-Cam/EFD-2250 Version 1.12.0.4 and Topline TopFD-2125 Version Geutebrück G-Cam/EFD-2250 (part n° 5.…
- CVE-2018-7528An SQL injection vulnerability has been identified in Geutebruck G-Cam/EFD-2250 Version 1.12.0.4 and Topline TopFD-2125 Version 3.15.1 IP caGeutebrück G-Cam/EFD-2250 (part n° 5.…
- CVE-2018-7532Unauthentication vulnerabilities have been identified in Geutebruck G-Cam/EFD-2250 Version 1.12.0.4 and Topline TopFD-2125 Version 3.15.1 IPGeutebrück G-Cam/EFD-2250 (part n° 5.…
- CVE-2018-5349A vulnerability has been found in Heimdal PRO v2.2.190, but it is most likely also present in Heimdal FREE and Heimdal CORP.
- CVE-2018-5731An issue was discovered in Heimdal PRO 2.2.190.
- CVE-2017-0920GitLab Community and Enterprise Editions before 10.1.6, 10.2.6, and 10.3.4 are vulnerable to an authorization bypass issue in the Projects::GitLab Community and Enterprise Editions
- CVE-2017-16242An issue was discovered on MECO USB Memory Stick with Fingerprint MECOZiolsamDE601 devices.
- CVE-2017-0932Ubiquiti Networks EdgeOS version 1.9.1.1 and prior suffer from an Improper Privilege Management vulnerability due to the lack of validation Ubiquiti Networks EdgeRouter X
- CVE-2017-0933Ubiquiti Networks EdgeOS version 1.9.1 and prior suffer from a Cross-Site Request Forgery (CSRF) vulnerability.Ubiquiti Networks EdgeRouter X
- CVE-2017-0934Ubiquiti Networks EdgeOS version 1.9.1 and prior suffer from an Improper Privilege Management vulnerability due to the lack of protection ofUbiquiti Networks EdgeRouter X
- CVE-2017-0935Ubiquiti Networks EdgeOS version 1.9.1.1 and prior suffer from an Improper Privilege Management vulnerability due to the lack of protection Ubiquiti Networks EdgeRouter X
- CVE-2017-16771Cross-site scripting (XSS) vulnerability in Log Viewer in Synology Photo Station before 6.8.3-3463 and before 6.3-2971 allows remote attackeSynology Photo Station
- CVE-2017-16772Improper input validation vulnerability in SYNOPHOTO_Flickr_MultiUpload in Synology Photo Station before 6.8.3-3463 and before 6.3-2971 alloSynology Photo Station
- CVE-2018-8930The AMD EPYC Server, Ryzen, Ryzen Pro, and Ryzen Mobile processor chips have insufficient enforcement of Hardware Validated Boot, aka MASTER
- CVE-2018-8931The AMD Ryzen, Ryzen Pro, and Ryzen Mobile processor chips have insufficient access control for the Secure Processor, aka RYZENFALL-1.
- CVE-2018-8932The AMD Ryzen and Ryzen Pro processor chips have insufficient access control for the Secure Processor, aka RYZENFALL-2, RYZENFALL-3, and RYZ
- CVE-2018-8933The AMD EPYC Server processor chips have insufficient access control for protected memory regions, aka FALLOUT-1, FALLOUT-2, and FALLOUT-3.
- CVE-2018-8934The Promontory chipset, as used in AMD Ryzen and Ryzen Pro platforms, has a backdoor in firmware, aka CHIMERA-FW.
- CVE-2018-8935The Promontory chipset, as used in AMD Ryzen and Ryzen Pro platforms, has a backdoor in the ASIC, aka CHIMERA-HW.
- CVE-2018-8936The AMD EPYC Server, Ryzen, Ryzen Pro, and Ryzen Mobile processor chips allow Platform Security Processor (PSP) privilege escalation.
- CVE-2017-18094Various resources in Atlassian Fisheye and Crucible before version 4.4.3 (the fixed version for 4.4.x) and 4.5.0 allow remote attackers withAtlassian Fisheye and Crucible
- CVE-2018-0534Cross-site scripting vulnerability in ArsenoL Version 0.5 allows an attacker to inject arbitrary web script or HTML via unspecified vectors.FlaFla... ArsenoL
- CVE-2018-0535Cross-site scripting vulnerability in PHP 2chBBS version bbs18c allows an attacker to inject arbitrary web script or HTML via unspecified veKagaminokuni PHP 2chBBS
- CVE-2018-0536Cross-site scripting vulnerability in QQQ SYSTEMS ver2.24 allows an attacker to inject arbitrary web script or HTML via quiz.cgi.Gundam Cult QQQ QQQ SYSTEMS
- CVE-2018-0537Cross-site scripting vulnerability in QQQ SYSTEMS ver2.24 allows an attacker to inject arbitrary web script or HTML via quiz_op.cgi.Gundam Cult QQQ QQQ SYSTEMS
- CVE-2018-0538Cross-site scripting vulnerability in QQQ SYSTEMS ver2.24 allows an attacker to inject arbitrary web script or HTML via unspecified vectors.Gundam Cult QQQ QQQ SYSTEMS
- CVE-2018-0539QQQ SYSTEMS version 2.24 allows an attacker to execute arbitrary commands via unspecified vectors.Gundam Cult QQQ QQQ SYSTEMS
- CVE-2018-0540Untrusted search path vulnerability in ViX version 2.21.148.0 allows an attacker to gain privileges via a Trojan horse DLL in an unspecifiedK_OKADA ViX
- CVE-2018-0541Buffer overflow in Tiny FTP Daemon Ver0.52d allows an attacker to cause a denial-of-service (DoS) condition or execute arbitrary code via unHisayuki Nomura Tiny FTP Daemon
- CVE-2018-0542Directory traversal vulnerability in WebProxy version 1.7.8 allows an attacker to read arbitrary files via unspecified vectors.LunarNight Laboratory WebProxy
- CVE-2018-0552Untrusted search path vulnerability in The installer of PhishWall Client Firefox and Chrome edition for Windows Ver.SecureBrain The installer of PhishWall Client Firefox and C…
- CVE-2018-5225In browser editing in Atlassian Bitbucket Server from version 4.13.0 before 5.4.8 (the fixed version for 4.13.0 through 5.4.7), 5.5.0 beforeAtlassian Bitbucket Server
- CVE-2016-9711IBM Predictive Solutions Foundation (IBM Cognos Analytics 11.0) reveals sensitive information in detailed error messages that could aid an aIBM Cognos Analytics
- CVE-2017-1571IBM DB2 for Linux, UNIX and Windows (includes DB2 Connect Server) 9.7, 10.1, 10.5, and 11.1 uses weaker than expected cryptographic algorithIBM DB2 for Linux, UNIX and Windows
- CVE-2017-1788IBM WebSphere Application Server 9 installations using Form Login could allow a remote attacker to conduct spoofing attacks.IBM WebSphere Application Server
- CVE-2018-1427IBM GSKit (IBM DB2 for Linux, UNIX and Windows 9.7, 10.1, 10.5, and 11.1) contains several environment variables that a local attacker couldIBM DB2 for Linux, UNIX and Windows
- CVE-2018-1428IBM GSKit (IBM DB2 for Linux, UNIX and Windows 9.7, 10.1, 10.5, and 11.1) uses weaker than expected cryptographic algorithms that could alloIBM DB2 for Linux, UNIX and Windows
- CVE-2018-8909The Wire application before 2018-03-07 for Android allows attackers to write to pathnames outside of the downloads directory via a ../ in a
- CVE-2017-17743Improper input sanitization within the restricted administration shell on UCOPIA Wireless Appliance devices before 4.4.20, 5.0.x before 5.0.
- CVE-2018-8899IdentityServer IdentityServer4 1.x before 1.5.3 and 2.x before 2.1.3 does not encode the redirect URI on the authorization response page, wh
- CVE-2014-4912An Arbitrary File Upload issue was discovered in Frog CMS 0.9.5 due to lack of extension validation.
- CVE-2018-8894In 2345 Security Guard 3.6, the driver file (2345BdPcSafe.sys) allows local users to cause a denial of service (BSOD) or possibly have unspe
- CVE-2018-8895In 2345 Security Guard 3.6, the driver file (2345DumpBlock.sys) allows local users to cause a denial of service (BSOD) or possibly have unsp
- CVE-2018-8896In 2345 Security Guard 3.6, the driver file (2345DumpBlock.sys) allows local users to cause a denial of service (BSOD) or possibly have unsp
- CVE-2018-8904In Windows Master (aka Windows Optimization Master) 7.99.13.604, the driver file (WoptiHWDetect.SYS) allows local users to cause a denial of
- CVE-2018-8905In LibTIFF 4.0.9, a heap-based buffer overflow occurs in the function LZWDecodeCompat in tif_lzw.c via a crafted TIFF file, as demonstrated
- CVE-2018-8906dsmall v20180320 has XSS via a crafted street address to public/index.php/home/memberaddress/index.html, which is mishandled at public/index