# CVEs published 2018-03-23 29 CVEs were published on March 23, 2018: 0 critical, 0 high. Days are UTC. - [CVE-2018-1000137](https://cve.now/CVE-2018-1000137.md): I, Librarian version 4.8 and earlier contains a Cross site Request Forgery (CSRF) vulnerability in users.php that can result in the password (no CVSS) - [CVE-2018-1000138](https://cve.now/CVE-2018-1000138.md): I, Librarian version 4.8 and earlier contains a SSRF vulnerability in "url" parameter of getFromWeb in functions.php that can result in the (no CVSS) - [CVE-2018-1000139](https://cve.now/CVE-2018-1000139.md): I, Librarian version 4.8 and earlier contains a Cross Site Scripting (XSS) vulnerability in "id" parameter in stable.php that can result in (no CVSS) - [CVE-2018-1000141](https://cve.now/CVE-2018-1000141.md): I, Librarian version 4.9 and earlier contains an Incorrect Access Control vulnerability in ajaxdiscussion.php that can result in any users g (no CVSS) - [CVE-2018-8957](https://cve.now/CVE-2018-8957.md): CoverCMS v1.1.6 has XSS via the fourth input box to index.php, related to admina/mconfigs.inc.php. (no CVSS) - [CVE-2018-8960](https://cve.now/CVE-2018-8960.md): The ReadTIFFImage function in coders/tiff.c in ImageMagick 7.0.7-26 Q16 does not properly restrict memory allocation, leading to a heap-base (no CVSS) - [CVE-2018-8961](https://cve.now/CVE-2018-8961.md): In libming 0.4.8, the decompilePUSHPARAM function of decompile.c has a use-after-free. (no CVSS) - [CVE-2018-8962](https://cve.now/CVE-2018-8962.md): In libming 0.4.8, the decompileSingleArgBuiltInFunctionCall function of decompile.c has a use-after-free. (no CVSS) - [CVE-2018-8963](https://cve.now/CVE-2018-8963.md): In libming 0.4.8, the decompileGETVARIABLE function of decompile.c has a use-after-free. (no CVSS) - [CVE-2018-8964](https://cve.now/CVE-2018-8964.md): In libming 0.4.8, the decompileDELETE function of decompile.c has a use-after-free. (no CVSS) - [CVE-2017-1524](https://cve.now/CVE-2017-1524.md): IBM Jazz Foundation (IBM Rational Collaborative Lifecycle Management 5.0 and 6.0) could allow an authenticated user to obtain sensitive info (CVSS 4.3, IBM Rational Collaborative Lifecycle Management) - [CVE-2017-1602](https://cve.now/CVE-2017-1602.md): IBM RSA DM (IBM Rational Collaborative Lifecycle Management 5.0 and 6.0) could allow an authenticated user to access settings that they shou (CVSS 4.3, IBM Rational Collaborative Lifecycle Management) - [CVE-2017-1629](https://cve.now/CVE-2017-1629.md): IBM Jazz Foundation (IBM Rational Collaborative Lifecycle Management 5.0 and 6.0) is vulnerable to cross-site scripting. (CVSS 5.4, IBM Rational Collaborative Lifecycle Management) - [CVE-2017-1655](https://cve.now/CVE-2017-1655.md): IBM Jazz Foundation (IBM Rational Collaborative Lifecycle Management 5.0 and 6.0) is vulnerable to cross-site scripting. (CVSS 5.4, IBM Rational Collaborative Lifecycle Management) - [CVE-2017-1762](https://cve.now/CVE-2017-1762.md): IBM Jazz Foundation (IBM Rational Collaborative Lifecycle Management 5.0 and 6.0) is vulnerable to cross-site scripting. (CVSS 5.4, IBM Rational Collaborative Lifecycle Management) - [CVE-2017-18245](https://cve.now/CVE-2017-18245.md): The mpc8\_probe function in libavformat/mpc8.c in Libav 12.2 allows remote attackers to cause a denial of service (heap-based buffer over-rea (no CVSS) - [CVE-2017-18246](https://cve.now/CVE-2017-18246.md): The pcm\_encode\_frame function in libavcodec/pcm.c in Libav 12.2 allows remote attackers to cause a denial of service (heap-based buffer over (no CVSS) - [CVE-2017-18247](https://cve.now/CVE-2017-18247.md): The av\_audio\_fifo\_size function in libavutil/audio\_fifo.c in Libav 12.2 allows remote attackers to cause a denial of service (NULL pointer d (no CVSS) - [CVE-2018-1000136](https://cve.now/CVE-2018-1000136.md): Electron version 1.7 up to 1.7.12; 1.8 up to 1.8.3 and 2.0.0 up to 2.0.0-beta.3 contains an improper handling of values vulnerability in Web (no CVSS, electron) - [CVE-2018-1429](https://cve.now/CVE-2018-1429.md): IBM MQ Appliance 9.0.1, 9.0.2, 9.0.3, amd 9.0.4 is vulnerable to cross-site scripting. (CVSS 5.4, IBM MQ Appliance) - [CVE-2018-7502](https://cve.now/CVE-2018-7502.md): Kernel drivers in Beckhoff TwinCAT 3.1 Build 4022.4, TwinCAT 2.11 R3 2259, and TwinCAT 3.1 lack proper validation of user-supplied pointer v (no CVSS, ICS-CERT Beckhoff TwinCAT PLC products) - [CVE-2018-8948](https://cve.now/CVE-2018-8948.md): In MISP before 2.4.89, app/View/Events/resolved\_attributes.ctp has multiple XSS issues via a malicious MISP module. (no CVSS) - [CVE-2018-8949](https://cve.now/CVE-2018-8949.md): An issue was discovered in app/Model/Attribute.php in MISP before 2.4.89. (no CVSS) - [CVE-2017-15325](https://cve.now/CVE-2017-15325.md): The Bdat driver of Prague smart phones with software versions earlier than Prague-AL00AC00B211, versions earlier than Prague-AL00BC00B211, v (no CVSS, Huawei Technologies Co. Prague) - [CVE-2017-15326](https://cve.now/CVE-2017-15326.md): DBS3900 TDD LTE V100R003C00, V100R004C10 have a weak encryption algorithm security vulnerability. (no CVSS, Huawei Technologies Co. DBS3900 TDD LTE) - [CVE-2017-17736](https://cve.now/CVE-2017-17736.md): Kentico 9.0 before 9.0.51 and 10.0 before 10.0.48 allows remote attackers to obtain Global Administrator access by visiting CMSInstall/insta (no CVSS) - [CVE-2018-1207](https://cve.now/CVE-2018-1207.md): Dell EMC iDRAC7/iDRAC8, versions prior to 2.52.52.52, contain CGI injection vulnerability which could be used to execute remote code. (no CVSS) - [CVE-2018-1211](https://cve.now/CVE-2018-1211.md): Dell EMC iDRAC7/iDRAC8, versions prior to 2.52.52.52, contain a path traversal vulnerability in its Web server's URI parser which could be u (no CVSS, Dell EMC iDRAC7/iDRAC8) - [CVE-2018-1000140](https://cve.now/CVE-2018-1000140.md): rsyslog librelp version 1.2.14 and earlier contains a Buffer Overflow vulnerability in the checking of x509 certificates from a peer that ca (no CVSS) --- Source: cve.now, built and run by Sazabi (AI-native observability and security) Page: https://cve.now/daily/2018-03-23 Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.