CVEs published March 23, 2018
29 CVEs were published on March 23, 2018: 0 critical, 0 high.
- Published
- 29
- Critical
- 0
- High
- 0
- Medium
- 6
- Low
- 0
- Unrated
- 23
- Now in CISA KEV
- 0
- Fix available
- 1
Most affected products
- IBM Rational Collaborative Lifecycle Management
- 5
- Dell EMC iDRAC7/iDRAC8
- 1
- electron
- 1
- Huawei Technologies Co. DBS3900 TDD LTE
- 1
- Huawei Technologies Co. Prague
- 1
- IBM MQ Appliance
- 1
- ICS-CERT Beckhoff TwinCAT PLC products
- 1
Medium, low and unrated 29
- CVE-2018-1000137I, Librarian version 4.8 and earlier contains a Cross site Request Forgery (CSRF) vulnerability in users.php that can result in the password
- CVE-2018-1000138I, Librarian version 4.8 and earlier contains a SSRF vulnerability in "url" parameter of getFromWeb in functions.php that can result in the
- CVE-2018-1000139I, Librarian version 4.8 and earlier contains a Cross Site Scripting (XSS) vulnerability in "id" parameter in stable.php that can result in
- CVE-2018-1000141I, Librarian version 4.9 and earlier contains an Incorrect Access Control vulnerability in ajaxdiscussion.php that can result in any users g
- CVE-2018-8957CoverCMS v1.1.6 has XSS via the fourth input box to index.php, related to admina/mconfigs.inc.php.
- CVE-2018-8960The ReadTIFFImage function in coders/tiff.c in ImageMagick 7.0.7-26 Q16 does not properly restrict memory allocation, leading to a heap-base
- CVE-2018-8961In libming 0.4.8, the decompilePUSHPARAM function of decompile.c has a use-after-free.
- CVE-2018-8962In libming 0.4.8, the decompileSingleArgBuiltInFunctionCall function of decompile.c has a use-after-free.
- CVE-2018-8963In libming 0.4.8, the decompileGETVARIABLE function of decompile.c has a use-after-free.
- CVE-2018-8964In libming 0.4.8, the decompileDELETE function of decompile.c has a use-after-free.
- CVE-2017-1524IBM Jazz Foundation (IBM Rational Collaborative Lifecycle Management 5.0 and 6.0) could allow an authenticated user to obtain sensitive infoIBM Rational Collaborative Lifecycle Management
- CVE-2017-1602IBM RSA DM (IBM Rational Collaborative Lifecycle Management 5.0 and 6.0) could allow an authenticated user to access settings that they shouIBM Rational Collaborative Lifecycle Management
- CVE-2017-1629IBM Jazz Foundation (IBM Rational Collaborative Lifecycle Management 5.0 and 6.0) is vulnerable to cross-site scripting.IBM Rational Collaborative Lifecycle Management
- CVE-2017-1655IBM Jazz Foundation (IBM Rational Collaborative Lifecycle Management 5.0 and 6.0) is vulnerable to cross-site scripting.IBM Rational Collaborative Lifecycle Management
- CVE-2017-1762IBM Jazz Foundation (IBM Rational Collaborative Lifecycle Management 5.0 and 6.0) is vulnerable to cross-site scripting.IBM Rational Collaborative Lifecycle Management
- CVE-2017-18245The mpc8_probe function in libavformat/mpc8.c in Libav 12.2 allows remote attackers to cause a denial of service (heap-based buffer over-rea
- CVE-2017-18246The pcm_encode_frame function in libavcodec/pcm.c in Libav 12.2 allows remote attackers to cause a denial of service (heap-based buffer over
- CVE-2017-18247The av_audio_fifo_size function in libavutil/audio_fifo.c in Libav 12.2 allows remote attackers to cause a denial of service (NULL pointer d
- CVE-2018-1000136Electron version 1.7 up to 1.7.12; 1.8 up to 1.8.3 and 2.0.0 up to 2.0.0-beta.3 contains an improper handling of values vulnerability in Webelectron
- CVE-2018-1429IBM MQ Appliance 9.0.1, 9.0.2, 9.0.3, amd 9.0.4 is vulnerable to cross-site scripting.IBM MQ Appliance
- CVE-2018-7502Kernel drivers in Beckhoff TwinCAT 3.1 Build 4022.4, TwinCAT 2.11 R3 2259, and TwinCAT 3.1 lack proper validation of user-supplied pointer vICS-CERT Beckhoff TwinCAT PLC products
- CVE-2018-8948In MISP before 2.4.89, app/View/Events/resolved_attributes.ctp has multiple XSS issues via a malicious MISP module.
- CVE-2018-8949An issue was discovered in app/Model/Attribute.php in MISP before 2.4.89.
- CVE-2017-15325The Bdat driver of Prague smart phones with software versions earlier than Prague-AL00AC00B211, versions earlier than Prague-AL00BC00B211, vHuawei Technologies Co. Prague
- CVE-2017-15326DBS3900 TDD LTE V100R003C00, V100R004C10 have a weak encryption algorithm security vulnerability.Huawei Technologies Co. DBS3900 TDD LTE
- CVE-2017-17736Kentico 9.0 before 9.0.51 and 10.0 before 10.0.48 allows remote attackers to obtain Global Administrator access by visiting CMSInstall/insta
- CVE-2018-1207Dell EMC iDRAC7/iDRAC8, versions prior to 2.52.52.52, contain CGI injection vulnerability which could be used to execute remote code.
- CVE-2018-1211Dell EMC iDRAC7/iDRAC8, versions prior to 2.52.52.52, contain a path traversal vulnerability in its Web server's URI parser which could be uDell EMC iDRAC7/iDRAC8
- CVE-2018-1000140rsyslog librelp version 1.2.14 and earlier contains a Buffer Overflow vulnerability in the checking of x509 certificates from a peer that ca