# CVEs published 2018-03-24

13 CVEs were published on March 24, 2018: 0 critical, 0 high. Days are UTC.

- [CVE-2018-8972](https://cve.now/CVE-2018-8972.md): Creditwest Bank CMS Project (aka CWCMS) through 2017-07-28 has CSRF in the functionality for updating the site configuration, which allows r (no CVSS)
- [CVE-2018-8973](https://cve.now/CVE-2018-8973.md): OTCMS 3.20 allows XSS by adding a keyword or link to an article, as demonstrated by an admin/keyWord\_deal.php?mudi=add request. (no CVSS)
- [CVE-2018-8970](https://cve.now/CVE-2018-8970.md): The int\_x509\_param\_set\_hosts function in lib/libcrypto/x509/x509\_vpm.c in LibreSSL 2.7.0 before 2.7.1 does not support a certain special cas (no CVSS)
- [CVE-2018-8971](https://cve.now/CVE-2018-8971.md): The Auth0 integration in GitLab before 10.3.9, 10.4.x before 10.4.6, and 10.5.x before 10.5.6 has an incorrect omniauth-auth0 configuration, (no CVSS)
- [CVE-2015-9257](https://cve.now/CVE-2015-9257.md): BMC Remedy Action Request (AR) System 9.0 before 9.0.00 Service Pack 2 hot fix 1 has persistent XSS. (no CVSS)
- [CVE-2017-17749](https://cve.now/CVE-2017-17749.md): Bose SoundTouch devices allow XSS via crafted song data from a music service, as demonstrated by Pandora. (no CVSS)
- [CVE-2017-17750](https://cve.now/CVE-2017-17750.md): Bose SoundTouch devices allow XSS via a crafted public playlist from Spotify. (no CVSS)
- [CVE-2017-17751](https://cve.now/CVE-2017-17751.md): Bose SoundTouch devices allows remote attackers to achieve remote control via a crafted web site that uses the WebSocket Protocol. (no CVSS)
- [CVE-2018-8965](https://cve.now/CVE-2018-8965.md): An issue was discovered in zzcms 8.2. (no CVSS)
- [CVE-2018-8966](https://cve.now/CVE-2018-8966.md): An issue was discovered in zzcms 8.2. (no CVSS)
- [CVE-2018-8967](https://cve.now/CVE-2018-8967.md): An issue was discovered in zzcms 8.2. (no CVSS)
- [CVE-2018-8968](https://cve.now/CVE-2018-8968.md): An issue was discovered in zzcms 8.2. (no CVSS)
- [CVE-2018-8969](https://cve.now/CVE-2018-8969.md): An issue was discovered in zzcms 8.2. (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2018-03-24
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.