# CVEs published 2018-03-22

67 CVEs were published on March 22, 2018: 1 critical, 3 high. Days are UTC.

- [CVE-2017-18242](https://cve.now/CVE-2017-18242.md): The apply\_dependent\_coupling function in libavcodec/aacdec.c in Libav 12.2 allows remote attackers to cause a denial of service (out-of-boun (no CVSS)
- [CVE-2017-18243](https://cve.now/CVE-2017-18243.md): The unpack\_parse\_unit function in libavcodec/dirac\_parser.c in Libav 12.2 allows remote attackers to cause a denial of service (segmentation (no CVSS)
- [CVE-2017-18244](https://cve.now/CVE-2017-18244.md): The stereo\_processing function in libavcodec/aacps.c in Libav 12.2 allows remote attackers to cause a denial of service (out-of-bounds read) (no CVSS)
- [CVE-2018-8903](https://cve.now/CVE-2018-8903.md): Open-AudIT Professional 2.1 allows XSS via the Name or Description field on the Credentials screen. (no CVSS)
- [CVE-2018-8942](https://cve.now/CVE-2018-8942.md): Xiuno BBS 4.0.0 has XSS in the adminpage sitename parameter. (no CVSS)
- [CVE-2018-8943](https://cve.now/CVE-2018-8943.md): There is a SQL injection in the PHPSHE 1.6 userbank parameter. (no CVSS)
- [CVE-2018-8944](https://cve.now/CVE-2018-8944.md): PHPOK 4.8.338 has an arbitrary file upload vulnerability. (no CVSS)
- [CVE-2018-8945](https://cve.now/CVE-2018-8945.md): The bfd\_section\_from\_shdr function in elf.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.30, a (no CVSS)
- [CVE-2018-5502](https://cve.now/CVE-2018-5502.md): On F5 BIG-IP versions 13.0.0 - 13.1.0.3, attackers may be able to disrupt services on the BIG-IP system with maliciously crafted client cert (no CVSS, F5 Networks BIG-IP)
- [CVE-2018-5503](https://cve.now/CVE-2018-5503.md): On F5 BIG-IP versions 13.0.0 - 13.1.0.3 or 12.0.0 - 12.1.3.1, TMM may restart when processing a specifically crafted page through a virtual (no CVSS, F5 Networks BIG-IP)
- [CVE-2018-5504](https://cve.now/CVE-2018-5504.md): In some circumstances, the Traffic Management Microkernel (TMM) does not properly handle certain malformed Websockets requests/responses, wh (no CVSS, F5 Networks BIG-IP)
- [CVE-2018-5505](https://cve.now/CVE-2018-5505.md): On F5 BIG-IP versions 13.1.0 - 13.1.0.3, when ASM and AVR are both provisioned, TMM may restart while processing DNS requests when the virtu (no CVSS, F5 Networks BIG-IP)
- [CVE-2018-5509](https://cve.now/CVE-2018-5509.md): On F5 BIG-IP versions 13.0.0 or 12.1.0 - 12.1.3.1, when a specifically configured virtual server receives traffic of an undisclosed nature, (no CVSS, F5 Networks BIG-IP)
- [CVE-2018-7512](https://cve.now/CVE-2018-7512.md): A cross-site scripting vulnerability has been identified in Geutebruck G-Cam/EFD-2250 Version 1.12.0.4 and Topline TopFD-2125 Version 3.15.1 (no CVSS, Geutebrück G-Cam/EFD-2250 (part n° 5.…)
- [CVE-2018-7516](https://cve.now/CVE-2018-7516.md): A server-side request forgery vulnerability has been identified in Geutebruck G-Cam/EFD-2250 Version 1.12.0.4 and Topline TopFD-2125 Version (no CVSS, Geutebrück G-Cam/EFD-2250 (part n° 5.…)
- [CVE-2018-7520](https://cve.now/CVE-2018-7520.md): An improper access control vulnerability has been identified in Geutebruck G-Cam/EFD-2250 Version 1.12.0.4 and Topline TopFD-2125 Version 3. (no CVSS, Geutebrück G-Cam/EFD-2250 (part n° 5.…)
- [CVE-2018-7524](https://cve.now/CVE-2018-7524.md): A cross-site request forgery vulnerability has been identified in Geutebruck G-Cam/EFD-2250 Version 1.12.0.4 and Topline TopFD-2125 Version (no CVSS, Geutebrück G-Cam/EFD-2250 (part n° 5.…)
- [CVE-2018-7528](https://cve.now/CVE-2018-7528.md): An SQL injection vulnerability has been identified in Geutebruck G-Cam/EFD-2250 Version 1.12.0.4 and Topline TopFD-2125 Version 3.15.1 IP ca (no CVSS, Geutebrück G-Cam/EFD-2250 (part n° 5.…)
- [CVE-2018-7532](https://cve.now/CVE-2018-7532.md): Unauthentication vulnerabilities have been identified in Geutebruck G-Cam/EFD-2250 Version 1.12.0.4 and Topline TopFD-2125 Version 3.15.1 IP (no CVSS, Geutebrück G-Cam/EFD-2250 (part n° 5.…)
- [CVE-2018-5349](https://cve.now/CVE-2018-5349.md): A vulnerability has been found in Heimdal PRO v2.2.190, but it is most likely also present in Heimdal FREE and Heimdal CORP. (no CVSS)
- [CVE-2018-5731](https://cve.now/CVE-2018-5731.md): An issue was discovered in Heimdal PRO 2.2.190. (no CVSS)
- [CVE-2017-0920](https://cve.now/CVE-2017-0920.md): GitLab Community and Enterprise Editions before 10.1.6, 10.2.6, and 10.3.4 are vulnerable to an authorization bypass issue in the Projects:: (no CVSS, GitLab Community and Enterprise Editions)
- [CVE-2017-16242](https://cve.now/CVE-2017-16242.md): An issue was discovered on MECO USB Memory Stick with Fingerprint MECOZiolsamDE601 devices. (no CVSS)
- [CVE-2017-0932](https://cve.now/CVE-2017-0932.md): Ubiquiti Networks EdgeOS version 1.9.1.1 and prior suffer from an Improper Privilege Management vulnerability due to the lack of validation (no CVSS, Ubiquiti Networks EdgeRouter X)
- [CVE-2017-0933](https://cve.now/CVE-2017-0933.md): Ubiquiti Networks EdgeOS version 1.9.1 and prior suffer from a Cross-Site Request Forgery (CSRF) vulnerability. (no CVSS, Ubiquiti Networks EdgeRouter X)
- [CVE-2017-0934](https://cve.now/CVE-2017-0934.md): Ubiquiti Networks EdgeOS version 1.9.1 and prior suffer from an Improper Privilege Management vulnerability due to the lack of protection of (no CVSS, Ubiquiti Networks EdgeRouter X)
- [CVE-2017-0935](https://cve.now/CVE-2017-0935.md): Ubiquiti Networks EdgeOS version 1.9.1.1 and prior suffer from an Improper Privilege Management vulnerability due to the lack of protection (no CVSS, Ubiquiti Networks EdgeRouter X)
- [CVE-2017-16771](https://cve.now/CVE-2017-16771.md): Cross-site scripting (XSS) vulnerability in Log Viewer in Synology Photo Station before 6.8.3-3463 and before 6.3-2971 allows remote attacke (no CVSS, Synology Photo Station)
- [CVE-2017-16772](https://cve.now/CVE-2017-16772.md): Improper input validation vulnerability in SYNOPHOTO\_Flickr\_MultiUpload in Synology Photo Station before 6.8.3-3463 and before 6.3-2971 allo (no CVSS, Synology Photo Station)
- [CVE-2018-8930](https://cve.now/CVE-2018-8930.md): The AMD EPYC Server, Ryzen, Ryzen Pro, and Ryzen Mobile processor chips have insufficient enforcement of Hardware Validated Boot, aka MASTER (no CVSS)
- [CVE-2018-8931](https://cve.now/CVE-2018-8931.md): The AMD Ryzen, Ryzen Pro, and Ryzen Mobile processor chips have insufficient access control for the Secure Processor, aka RYZENFALL-1. (no CVSS)
- [CVE-2018-8932](https://cve.now/CVE-2018-8932.md): The AMD Ryzen and Ryzen Pro processor chips have insufficient access control for the Secure Processor, aka RYZENFALL-2, RYZENFALL-3, and RYZ (no CVSS)
- [CVE-2018-8933](https://cve.now/CVE-2018-8933.md): The AMD EPYC Server processor chips have insufficient access control for protected memory regions, aka FALLOUT-1, FALLOUT-2, and FALLOUT-3. (no CVSS)
- [CVE-2018-8934](https://cve.now/CVE-2018-8934.md): The Promontory chipset, as used in AMD Ryzen and Ryzen Pro platforms, has a backdoor in firmware, aka CHIMERA-FW. (no CVSS)
- [CVE-2018-8935](https://cve.now/CVE-2018-8935.md): The Promontory chipset, as used in AMD Ryzen and Ryzen Pro platforms, has a backdoor in the ASIC, aka CHIMERA-HW. (no CVSS)
- [CVE-2018-8936](https://cve.now/CVE-2018-8936.md): The AMD EPYC Server, Ryzen, Ryzen Pro, and Ryzen Mobile processor chips allow Platform Security Processor (PSP) privilege escalation. (no CVSS)
- [CVE-2017-18094](https://cve.now/CVE-2017-18094.md): Various resources in Atlassian Fisheye and Crucible before version 4.4.3 (the fixed version for 4.4.x) and 4.5.0 allow remote attackers with (no CVSS, Atlassian Fisheye and Crucible)
- [CVE-2018-0534](https://cve.now/CVE-2018-0534.md): Cross-site scripting vulnerability in ArsenoL Version 0.5 allows an attacker to inject arbitrary web script or HTML via unspecified vectors. (no CVSS, FlaFla... ArsenoL)
- [CVE-2018-0535](https://cve.now/CVE-2018-0535.md): Cross-site scripting vulnerability in PHP 2chBBS version bbs18c allows an attacker to inject arbitrary web script or HTML via unspecified ve (no CVSS, Kagaminokuni PHP 2chBBS)
- [CVE-2018-0536](https://cve.now/CVE-2018-0536.md): Cross-site scripting vulnerability in QQQ SYSTEMS ver2.24 allows an attacker to inject arbitrary web script or HTML via quiz.cgi. (no CVSS, Gundam Cult QQQ QQQ SYSTEMS)
- [CVE-2018-0537](https://cve.now/CVE-2018-0537.md): Cross-site scripting vulnerability in QQQ SYSTEMS ver2.24 allows an attacker to inject arbitrary web script or HTML via quiz\_op.cgi. (no CVSS, Gundam Cult QQQ QQQ SYSTEMS)
- [CVE-2018-0538](https://cve.now/CVE-2018-0538.md): Cross-site scripting vulnerability in QQQ SYSTEMS ver2.24 allows an attacker to inject arbitrary web script or HTML via unspecified vectors. (no CVSS, Gundam Cult QQQ QQQ SYSTEMS)
- [CVE-2018-0539](https://cve.now/CVE-2018-0539.md): QQQ SYSTEMS version 2.24 allows an attacker to execute arbitrary commands via unspecified vectors. (no CVSS, Gundam Cult QQQ QQQ SYSTEMS)
- [CVE-2018-0540](https://cve.now/CVE-2018-0540.md): Untrusted search path vulnerability in ViX version 2.21.148.0 allows an attacker to gain privileges via a Trojan horse DLL in an unspecified (no CVSS, K\_OKADA ViX)
- [CVE-2018-0541](https://cve.now/CVE-2018-0541.md): Buffer overflow in Tiny FTP Daemon Ver0.52d allows an attacker to cause a denial-of-service (DoS) condition or execute arbitrary code via un (no CVSS, Hisayuki Nomura Tiny FTP Daemon)
- [CVE-2018-0542](https://cve.now/CVE-2018-0542.md): Directory traversal vulnerability in WebProxy version 1.7.8 allows an attacker to read arbitrary files via unspecified vectors. (no CVSS, LunarNight Laboratory WebProxy)
- [CVE-2018-0552](https://cve.now/CVE-2018-0552.md): Untrusted search path vulnerability in The installer of PhishWall Client Firefox and Chrome edition for Windows Ver. (no CVSS, SecureBrain The installer of PhishWall Client Firefox and C…)
- [CVE-2018-5225](https://cve.now/CVE-2018-5225.md): In browser editing in Atlassian Bitbucket Server from version 4.13.0 before 5.4.8 (the fixed version for 4.13.0 through 5.4.7), 5.5.0 before (no CVSS, Atlassian Bitbucket Server)
- [CVE-2016-9711](https://cve.now/CVE-2016-9711.md): IBM Predictive Solutions Foundation (IBM Cognos Analytics 11.0) reveals sensitive information in detailed error messages that could aid an a (CVSS 5.3, IBM Cognos Analytics)
- [CVE-2017-1571](https://cve.now/CVE-2017-1571.md): IBM DB2 for Linux, UNIX and Windows (includes DB2 Connect Server) 9.7, 10.1, 10.5, and 11.1 uses weaker than expected cryptographic algorith (CVSS 5.1, IBM DB2 for Linux, UNIX and Windows)
- [CVE-2017-1677](https://cve.now/CVE-2017-1677.md): IBM Data Server Driver for JDBC and SQLJ (IBM DB2 for Linux, UNIX and Windows 9.7, 10.1, 10.5, and 11.1) deserializes the contents of /tmp/c (CVSS 7.4, IBM DB2 for Linux, UNIX and Windows)
- [CVE-2017-1788](https://cve.now/CVE-2017-1788.md): IBM WebSphere Application Server 9 installations using Form Login could allow a remote attacker to conduct spoofing attacks. (CVSS 5.3, IBM WebSphere Application Server)
- [CVE-2017-1789](https://cve.now/CVE-2017-1789.md): IBM Tivoli Monitoring V6 6.2.3 and 6.3.0 could allow an unauthenticated user to remotely execute code through unspecified methods. (CVSS 9.8, IBM Tivoli Monitoring)
- [CVE-2018-1426](https://cve.now/CVE-2018-1426.md): IBM GSKit (IBM DB2 for Linux, UNIX and Windows 9.7, 10.1, 10.5, and 11.1) duplicates the PRNG state across fork() system calls when multiple (CVSS 7.4, IBM DB2 for Linux, UNIX and Windows)
- [CVE-2018-1427](https://cve.now/CVE-2018-1427.md): IBM GSKit (IBM DB2 for Linux, UNIX and Windows 9.7, 10.1, 10.5, and 11.1) contains several environment variables that a local attacker could (CVSS 6.2, IBM DB2 for Linux, UNIX and Windows)
- [CVE-2018-1428](https://cve.now/CVE-2018-1428.md): IBM GSKit (IBM DB2 for Linux, UNIX and Windows 9.7, 10.1, 10.5, and 11.1) uses weaker than expected cryptographic algorithms that could allo (CVSS 6.2, IBM DB2 for Linux, UNIX and Windows)
- [CVE-2018-1448](https://cve.now/CVE-2018-1448.md): IBM DB2 for Linux, UNIX and Windows 9.7, 10.1, 10.5, and 11.1 (includes DB2 Connect Server) contains a vulnerability that could allow a loca (CVSS 7.7, IBM DB2 for Linux, UNIX and Windows)
- [CVE-2018-8909](https://cve.now/CVE-2018-8909.md): The Wire application before 2018-03-07 for Android allows attackers to write to pathnames outside of the downloads directory via a ../ in a (no CVSS)
- [CVE-2017-17743](https://cve.now/CVE-2017-17743.md): Improper input sanitization within the restricted administration shell on UCOPIA Wireless Appliance devices before 4.4.20, 5.0.x before 5.0. (no CVSS)
- [CVE-2018-8899](https://cve.now/CVE-2018-8899.md): IdentityServer IdentityServer4 1.x before 1.5.3 and 2.x before 2.1.3 does not encode the redirect URI on the authorization response page, wh (no CVSS)
- [CVE-2014-4912](https://cve.now/CVE-2014-4912.md): An Arbitrary File Upload issue was discovered in Frog CMS 0.9.5 due to lack of extension validation. (no CVSS)
- [CVE-2018-8894](https://cve.now/CVE-2018-8894.md): In 2345 Security Guard 3.6, the driver file (2345BdPcSafe.sys) allows local users to cause a denial of service (BSOD) or possibly have unspe (no CVSS)
- [CVE-2018-8895](https://cve.now/CVE-2018-8895.md): In 2345 Security Guard 3.6, the driver file (2345DumpBlock.sys) allows local users to cause a denial of service (BSOD) or possibly have unsp (no CVSS)
- [CVE-2018-8896](https://cve.now/CVE-2018-8896.md): In 2345 Security Guard 3.6, the driver file (2345DumpBlock.sys) allows local users to cause a denial of service (BSOD) or possibly have unsp (no CVSS)
- [CVE-2018-8904](https://cve.now/CVE-2018-8904.md): In Windows Master (aka Windows Optimization Master) 7.99.13.604, the driver file (WoptiHWDetect.SYS) allows local users to cause a denial of (no CVSS)
- [CVE-2018-8905](https://cve.now/CVE-2018-8905.md): In LibTIFF 4.0.9, a heap-based buffer overflow occurs in the function LZWDecodeCompat in tif\_lzw.c via a crafted TIFF file, as demonstrated (no CVSS)
- [CVE-2018-8906](https://cve.now/CVE-2018-8906.md): dsmall v20180320 has XSS via a crafted street address to public/index.php/home/memberaddress/index.html, which is mishandled at public/index (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2018-03-22
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.