# CVEs published 2018-03-26 51 CVEs were published on March 26, 2018: 0 critical, 0 high. Days are UTC. - [CVE-2017-12410](https://cve.now/CVE-2017-12410.md): It is possible to exploit a Time of Check & Time of Use (TOCTOU) vulnerability by winning a race condition when Kaseya Virtual System Admini (no CVSS) - [CVE-2017-12815](https://cve.now/CVE-2017-12815.md): Analysis of the Bomgar Remote Support Portal JavaStart.jar Applet 52790 and earlier revealed that it is vulnerable to a path traversal vulne (no CVSS) - [CVE-2018-7658](https://cve.now/CVE-2018-7658.md): NTSServerSvc.exe in the server in Softros Network Time System 2.3.4 allows remote attackers to cause a denial of service (daemon crash) by s (no CVSS) - [CVE-2018-8802](https://cve.now/CVE-2018-8802.md): SQL injection vulnerability in the management interface in ePortal Manager allows remote attackers to execute arbitrary SQL commands via u (no CVSS) - [CVE-2017-18249](https://cve.now/CVE-2017-18249.md): The add\_free\_nid function in fs/f2fs/node.c in the Linux kernel before 4.12 does not properly track an allocated nid, which allows local use (no CVSS) - [CVE-2018-1348](https://cve.now/CVE-2018-1348.md): NetIQ Identity Manager SSL Renegotiation (CVSS 5.3, NetIQ Identity Manager) - [CVE-2018-1349](https://cve.now/CVE-2018-1349.md): NetIQ Identity Manager Driver Component Log File Information Leakage (CVSS 2.3, NetIQ Identity Manager) - [CVE-2018-1350](https://cve.now/CVE-2018-1350.md): NetIQ Identity Manager Driver Component Information Leakage (CVSS 2.3, NetIQ Identity Manager) - [CVE-2018-7673](https://cve.now/CVE-2018-7673.md): NetIQ Identity Manager DoS Attack (CVSS 5.1, NetIQ Identity Manager) - [CVE-2014-2048](https://cve.now/CVE-2014-2048.md): The user\_openid app in ownCloud Server before 5.0.15 allows remote attackers to obtain access by leveraging an insecure OpenID implementatio (no CVSS) - [CVE-2014-2293](https://cve.now/CVE-2014-2293.md): Zikula Application Framework before 1.3.7 build 11 allows remote attackers to conduct PHP object injection attacks and delete arbitrary file (no CVSS) - [CVE-2014-2312](https://cve.now/CVE-2014-2312.md): The main function in android\_main.cpp in thermald allows local users to write to arbitrary files via a symlink attack on /tmp/thermald.pid. (no CVSS) - [CVE-2015-5039](https://cve.now/CVE-2015-5039.md): The Remote Client and change management integrations in IBM Rational ClearCase 7.1.x, 8.0.0.x before 8.0.0.18, and 8.0.1.x before 8.0.1.11 d (no CVSS) - [CVE-2015-5045](https://cve.now/CVE-2015-5045.md): The Administration and Reporting tool in IBM Rational License Key Server (RLKS) before 8.1.4.9 iFix 04 allows local users to obtain sensitiv (no CVSS) - [CVE-2015-7401](https://cve.now/CVE-2015-7401.md): IBM Curam Social Program Management 6.1.x before 6.1.1.1 allows remote authenticated users to bypass intended access restrictions and obtain (no CVSS) - [CVE-2015-7423](https://cve.now/CVE-2015-7423.md): Multiple cross-site scripting (XSS) vulnerabilities in IBM InfoSphere Master Data Management (MDM) - Collaborative Edition 9.1, 10.1, 11.0, (no CVSS) - [CVE-2015-7424](https://cve.now/CVE-2015-7424.md): IBM InfoSphere Master Data Management (MDM) - Collaborative Edition 9.1, 10.1, 11.0, 11.3, 11.4, and 11.5 allow remote authenticated users t (no CVSS) - [CVE-2015-7432](https://cve.now/CVE-2015-7432.md): IBM Capacity Management Analytics 2.1.0.0 allows local users to decrypt usernames and passwords by leveraging access to setenv.sh and parame (no CVSS) - [CVE-2015-7433](https://cve.now/CVE-2015-7433.md): IBM Capacity Management Analytics 2.1.0.0 allows local users to discover cleartext usernames and passwords by leveraging access to the CMA i (no CVSS) - [CVE-2015-7434](https://cve.now/CVE-2015-7434.md): IBM Capacity Management Analytics 2.1.0.0 allows local users to discover encrypted usernames and passwords by leveraging access to the CMA i (no CVSS) - [CVE-2018-1186](https://cve.now/CVE-2018-1186.md): Dell EMC Isilon versions between 8.1.0.0 - 8.1.0.1, 8.0.1.0 - 8.0.1.2, and 8.0.0.0 - 8.0.0.6, versions 7.2.1.x, and version 7.1.1.11 is affe (no CVSS, Dell EMC Isilon OneFS) - [CVE-2018-1187](https://cve.now/CVE-2018-1187.md): Dell EMC Isilon versions between 8.1.0.0 - 8.1.0.1, 8.0.1.0 - 8.0.1.2, and 8.0.0.0 - 8.0.0.6 is affected by a cross-site scripting vulnerabi (no CVSS, Dell EMC Isilon OneFS) - [CVE-2018-1188](https://cve.now/CVE-2018-1188.md): Dell EMC Isilon versions between 8.1.0.0 - 8.1.0.1, 8.0.1.0 - 8.0.1.2, and 8.0.0.0 - 8.0.0.6, and versions 7.2.1.x is affected by a cross-si (no CVSS, Dell EMC Isilon OneFS) - [CVE-2018-1189](https://cve.now/CVE-2018-1189.md): Dell EMC Isilon versions between 8.1.0.0 - 8.1.0.1, 8.0.1.0 - 8.0.1.2, and 8.0.0.0 - 8.0.0.6, versions 7.2.1.x, and version 7.1.1.11 is affe (no CVSS, Dell EMC Isilon OneFS) - [CVE-2018-1201](https://cve.now/CVE-2018-1201.md): Dell EMC Isilon versions between 8.1.0.0 - 8.1.0.1, 8.0.1.0 - 8.0.1.2, and 8.0.0.0 - 8.0.0.6, versions 7.2.1.x, and version 7.1.1.11 is affe (no CVSS, Dell EMC Isilon OneFS) - [CVE-2018-1202](https://cve.now/CVE-2018-1202.md): Dell EMC Isilon versions between 8.1.0.0 - 8.1.0.1, 8.0.1.0 - 8.0.1.2, and 8.0.0.0 - 8.0.0.6, and version 7.1.1.11 is affected by a cross-si (no CVSS, Dell EMC Isilon OneFS) - [CVE-2018-1203](https://cve.now/CVE-2018-1203.md): In Dell EMC Isilon OneFS, the compadmin is able to run tcpdump binary with root privileges. (no CVSS, Dell EMC Isilon OneFS) - [CVE-2018-1204](https://cve.now/CVE-2018-1204.md): Dell EMC Isilon OneFS versions between 8.1.0.0 - 8.1.0.1, 8.0.1.0 - 8.0.1.2, and 8.0.0.0 - 8.0.0.6, versions 7.2.1.x, and version 7.1.1.11 i (no CVSS, Dell EMC Isilon OneFS) - [CVE-2018-1213](https://cve.now/CVE-2018-1213.md): Dell EMC Isilon OneFS versions between 8.1.0.0 - 8.1.0.1, 8.0.1.0 - 8.0.1.2, and 8.0.0.0 - 8.0.0.6, versions 7.2.1.x, and version 7.1.1.11 a (no CVSS, Dell EMC Isilon OneFS) - [CVE-2018-7543](https://cve.now/CVE-2018-7543.md): Cross-site scripting (XSS) vulnerability in installer/build/view.step4.php of the SnapCreek Duplicator plugin 1.2.32 for WordPress allows re (no CVSS) - [CVE-2017-18248](https://cve.now/CVE-2017-18248.md): The add\_job function in scheduler/ipp.c in CUPS before 2.2.6, when D-Bus support is enabled, can be crashed by remote attackers by sending p (no CVSS) - [CVE-2018-8937](https://cve.now/CVE-2018-8937.md): An issue was discovered in Open-AudIT Professional 2.1. (no CVSS) - [CVE-2017-15534](https://cve.now/CVE-2017-15534.md): The Norton App Lock prior to version 1.3.0.13 can be susceptible to an authentication bypass exploit. (no CVSS, Symantec Norton App Lock) - [CVE-2017-6278](https://cve.now/CVE-2017-6278.md): NVIDIA Tegra kernel contains a vulnerability in the CORE DVFS Thermal driver where there is the potential to read or write a buffer using an (no CVSS, NVIDIA Tegra) - [CVE-2017-15710](https://cve.now/CVE-2017-15710.md): In Apache httpd 2.0.23 to 2.0.65, 2.2.0 to 2.2.34, and 2.4.0 to 2.4.29, mod\_authnz\_ldap, if configured with AuthLDAPCharsetConfig, uses the (no CVSS, Apache Software Foundation Apache HTTP Server) - [CVE-2017-15715](https://cve.now/CVE-2017-15715.md): In Apache httpd 2.4.0 to 2.4.29, the expression specified in \ could match '$' to a newline character in a malicious filename, ra (no CVSS, Apache Software Foundation Apache HTTP Server) - [CVE-2018-1283](https://cve.now/CVE-2018-1283.md): In Apache httpd 2.4.0 to 2.4.29, when mod\_session is configured to forward its session data to CGI applications (SessionEnv on, not the defa (no CVSS, Apache Software Foundation Apache HTTP Server) - [CVE-2018-1301](https://cve.now/CVE-2018-1301.md): A specially crafted request could have crashed the Apache HTTP Server prior to version 2.4.30, due to an out of bound access after a size li (no CVSS, Apache Software Foundation Apache HTTP Server) - [CVE-2018-1302](https://cve.now/CVE-2018-1302.md): When an HTTP/2 stream was destroyed after being handled, the Apache HTTP Server prior to version 2.4.30 could have written a NULL pointer po (no CVSS, Apache Software Foundation Apache HTTP Server) - [CVE-2018-1303](https://cve.now/CVE-2018-1303.md): A specially crafted HTTP request header could have crashed the Apache HTTP Server prior to version 2.4.30 due to an out of bound read while (no CVSS, Apache Software Foundation Apache HTTP Server) - [CVE-2018-1312](https://cve.now/CVE-2018-1312.md): In Apache httpd 2.2.0 to 2.4.29, when generating an HTTP Digest authentication challenge, the nonce sent to prevent reply attacks was not co (no CVSS, Apache Software Foundation Apache HTTP Server) - [CVE-2018-5454](https://cve.now/CVE-2018-5454.md): Philips IntelliSpace Portal all versions of 8.0.x, and 7.0.x have a vulnerability where code debugging methods are enabled, which could allo (no CVSS, Philips IntelliSpace Portal) - [CVE-2018-5458](https://cve.now/CVE-2018-5458.md): Philips IntelliSpace Portal all versions of 8.0.x, and 7.0.x have a vulnerability using SSL legacy encryption that could allow an attacker t (no CVSS, Philips IntelliSpace Portal) - [CVE-2018-5462](https://cve.now/CVE-2018-5462.md): Philips IntelliSpace Portal all versions of 8.0.x, and 7.0.x have an SSL incorrect hostname certificate vulnerability this could allow an at (no CVSS, Philips IntelliSpace Portal) - [CVE-2018-5464](https://cve.now/CVE-2018-5464.md): Philips IntelliSpace Portal all versions of 8.0.x, and 7.0.x have an untrusted SSL certificate vulnerability this could allow an attacker to (no CVSS, Philips IntelliSpace Portal) - [CVE-2018-5466](https://cve.now/CVE-2018-5466.md): Philips IntelliSpace Portal all versions of 8.0.x, and 7.0.x have a self-signed SSL certificate vulnerability this could allow an attacker t (no CVSS, Philips IntelliSpace Portal) - [CVE-2018-5468](https://cve.now/CVE-2018-5468.md): Philips Intellispace Portal all versions 7.0.x and 8.0.x have a remote desktop access vulnerability that could allow an attacker to gain una (no CVSS, Philips IntelliSpace Portal) - [CVE-2018-5470](https://cve.now/CVE-2018-5470.md): Philips IntelliSpace Portal all versions of 8.0.x, and 7.0.x have an unquoted search path or element vulnerability that has been identified, (no CVSS, Philips IntelliSpace Portal) - [CVE-2018-5472](https://cve.now/CVE-2018-5472.md): Philips Intellispace Portal all versions 7.0.x and 8.0.x have an insecure windows permissions vulnerability that could allow an attacker to (no CVSS, Philips IntelliSpace Portal) - [CVE-2018-5474](https://cve.now/CVE-2018-5474.md): Philips Intellispace Portal all versions 7.0.x and 8.0.x have an input validation vulnerability that could allow a remote attacker to execut (no CVSS, Philips IntelliSpace Portal) - [CVE-2018-9020](https://cve.now/CVE-2018-9020.md): The Events Manager plugin before 5.8.1.2 for WordPress allows XSS via the events-manager.js mapTitle parameter in the Google Maps miniature. (no CVSS) --- Source: cve.now, built and run by Sazabi (AI-native observability and security) Page: https://cve.now/daily/2018-03-26 Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.