CVEs published March 27, 2018
66 CVEs were published on March 27, 2018: 0 critical, 0 high. 2 are now in CISA KEV.
- Published
- 66
- Critical
- 0
- High
- 0
- Medium
- 2
- Low
- 0
- Unrated
- 64
- Now in CISA KEV
- 2
- Fix available
- 4
Most affected products
- Dell EMC ScaleIO
- 3
- OpenSSL
- 2
- Apache Software Foundation Apache Struts · org.apache.strut…
- 1
- Cisco IOS XE
- 1
- Cisco Spark Hybrid Calendar Service
- 1
- Cisco Unified Communications Manager
- 1
- ClamAV
- 1
- github.com/hashicorp/terraform-provider-aws
- 1
- Linux kernel v4.13 and newer
- 1
- loofah · nokogiri
- 1
Medium, low and unrated 66
- CVE-2018-9105NordVPN 3.3.10 for macOS suffers from a root privilege escalation vulnerability.
- CVE-2018-9092There is a CSRF vulnerability in mc-admin/conf.php in MiniCMS 1.10 that can change the administrator account password.
- CVE-2014-5130Avolve Software ProjectDox 8.1 allows remote authenticated users to obtain sensitive information from other users via vectors involving a di
- CVE-2014-5131Avolve Software ProjectDox 8.1 makes it easier for remote authenticated users to obtain sensitive information by leveraging ciphertext reuse
- CVE-2014-5132Avolve Software ProjectDox 8.1 allows remote attackers to enumerate users via vectors related to email addresses.
- CVE-2017-7630QNAP QTS 4.2.6 build 20171026, QTS 4.3.3 build 20170727 and earlier allows remote attackers to obtain potentially sensitive information (fir
- CVE-2017-7631Cross-site scripting (XSS) vulnerability in the share link function of File Station of QNAP 4.2.6 build 20171026, QTS 4.3.3 build 20170727 a
- CVE-2017-7632Cross-site scripting (XSS) vulnerability in File Station of QNAP QTS 4.2.6 build 20171026, QTS 4.3.3 build 20170727 and earlier allows remot
- CVE-2018-0733Incorrect CRYPTO_memcmp on HP-UX PA-RISCOpenSSL
- CVE-2018-0739Constructed ASN.1 types with a recursive definition could exceed the stackOpenSSL
- CVE-2018-1091In the flush_tmregs_to_thread function in arch/powerpc/kernel/ptrace.c in the Linux kernel before 4.13.5, a guest kernel crash can be triggeLinux kernel v4.13 and newer
- CVE-2018-1205Dell EMC ScaleIO, versions prior to 2.5, do not properly handle some packet data in the MDM service.Dell EMC ScaleIO
- CVE-2018-1237Dell EMC ScaleIO versions prior to 2.5, contain improper restriction of excessive authentication attempts on the Light installation Agent (LDell EMC ScaleIO
- CVE-2018-1238Dell EMC ScaleIO versions prior to 2.5, contain a command injection vulnerability in the Light Installation Agent (LIA).Dell EMC ScaleIO
- CVE-2018-1327The Apache Struts REST Plugin is using XStream library which is vulnerable and allow perform a DoS attack when using a malicious request witApache Software Foundation Apache Struts · org.apache.strut…
- CVE-2018-9058In Long Range Zip (aka lrzip) 0.631, there is an infinite loop in the runzip_fd function of runzip.c.
- CVE-2018-7700DedeCMS 5.7 has CSRF with an impact of arbitrary code execution, because the partcode parameter in a tag_test_action.php request can specify
- CVE-2018-9057aws/resource_aws_iam_user_login_profile.go in the HashiCorp Terraform Amazon Web Services (AWS) provider through v1.12.0 has an inappropriatgithub.com/hashicorp/terraform-provider-aws
- CVE-2015-4954IBM BigFix Remote Control before Interim Fix pack 9.1.2-TIV-IBRC912-IF0001 improperly allows self-signed certificates, which might allow rem
- CVE-2015-4987The search and replay servers in IBM Tealeaf Customer Experience 8.0 through 9.0.2 allow remote attackers to bypass authentication via unspe
- CVE-2015-5016IBM Maximo Asset Management 7.1, 7.5, and 7.6; Maximo Asset Management Essentials 7.1 and 7.5; Control Desk 7.5 and 7.6; Tivoli Asset Manage
- CVE-2018-6765Swisscom MySwisscomAssistant 2.17.1.1065 contains a vulnerability that could allow an unauthenticated, remote attacker to execute arbitrary
- CVE-2018-6766Swisscom TVMediaHelper 1.1.0.50 contains a vulnerability that could allow an unauthenticated, remote attacker to execute arbitrary code on t
- CVE-2018-7192Cross-site scripting (XSS) vulnerability in /ajax.php/form/help-topic in Enhancesoft osTicket before 1.10.2 allows remote attackers to injec
- CVE-2018-7193Cross-site scripting (XSS) vulnerability in /scp/directory.php in Enhancesoft osTicket before 1.10.2 allows remote attackers to inject arbit
- CVE-2018-7194Integer format vulnerability in the ticket number generator in Enhancesoft osTicket before 1.10.2 allows remote attackers to cause a denial-
- CVE-2018-7195Enhancesoft osTicket before 1.10.2 allows remote attackers to reset arbitrary passwords (when an associated e-mail address is known) by leve
- CVE-2018-7196Cross-site scripting (XSS) vulnerability in /scp/index.php in Enhancesoft osTicket before 1.10.2 allows remote attackers to inject arbitrary
- CVE-2018-8048In the Loofah gem through 2.2.0 for Ruby, non-whitelisted HTML attributes may occur in sanitized output by republishing a crafted HTML fragmloofah · nokogiri
- CVE-2018-9056Systems with microprocessors utilizing speculative execution may allow unauthorized disclosure of information to an attacker with local user
- CVE-2014-0486Knot DNS before 1.5.2 allows remote attackers to cause a denial of service (application crash) via a crafted DNS message.
- CVE-2014-4959**DISPUTED** SQL injection vulnerability in SQLiteDatabase.java in the SQLi Api in Android allows remote attackers to execute arbitrary SQL
- CVE-2018-1231Cloud Foundry BOSH CLI, versions prior to v3.0.1, contains an improper access control vulnerability.
- CVE-2018-1266Cloud Foundry Cloud Controller, versions prior to 1.52.0, contains information disclosure and path traversal vulnerabilities.
- CVE-2018-1267Cloud Foundry Silk CNI plugin, versions prior to 0.2.0, contains an improper access control vulnerability.
- CVE-2018-6882Cross-site scripting (XSS) vulnerability in the ZmMailMsgView.getAttachmentLinkHtml function in Zimbra Collaboration Suite (ZCS) before 8.7
- CVE-2018-8718Cross-site request forgery (CSRF) vulnerability in the Mailer Plugin 1.20 for Jenkins 2.111 allows remote authenticated users to send unauthorg.jenkins-ci.plugins:mailer
- CVE-2018-8763Roland Gruber Softwareentwicklung LDAP Account Manager before 6.3 has XSS via the dn parameter to the templates/3rdParty/pla/htdocs/cmd.php
- CVE-2018-8764Roland Gruber Softwareentwicklung LDAP Account Manager before 6.3 places a CSRF token in the sec_token parameter of a URI, which makes it ea
- CVE-2017-12310A vulnerability in the auto discovery phase of Cisco Spark Hybrid Calendar Service could allow an unauthenticated, remote attacker to view sCisco Spark Hybrid Calendar Service
- CVE-2017-12319A vulnerability in the Border Gateway Protocol (BGP) over an Ethernet Virtual Private Network (EVPN) for Cisco IOS XE Software could allow aCisco IOS XE
- CVE-2018-0198A vulnerability in the web framework of Cisco Unified Communications Manager could allow an unauthenticated, remote attacker to view sensitiCisco Unified Communications Manager
- CVE-2018-0202clamscan in ClamAV before 0.99.4 contains a vulnerability that could allow an unauthenticated, remote attacker to cause a denial of service ClamAV
- CVE-2018-9055JasPer 2.0.14 allows denial of service via a reachable assertion in the function jpc_firstone in libjasper/jpc/jpc_math.c.
- CVE-2017-18250An issue was discovered in ImageMagick 7.0.7.
- CVE-2017-18251An issue was discovered in ImageMagick 7.0.7.
- CVE-2017-18252An issue was discovered in ImageMagick 7.0.7.
- CVE-2017-18253An issue was discovered in ImageMagick 7.0.7.
- CVE-2017-18254An issue was discovered in ImageMagick 7.0.7.
- CVE-2018-9032An authentication bypass vulnerability on D-Link DIR-850L Wireless AC1200 Dual Band Gigabit Cloud Router (Hardware Version : A1, B1; Firmwar
- CVE-2018-9039In Octopus Deploy 2.0 and later before 2018.3.7, an authenticated user, with variable edit permissions, can scope some variables to targets
- CVE-2018-9040In Advanced SystemCare Ultimate 11.0.1.58, the driver file (Monitor_win10_x64.sys) allows local users to cause a denial of service (BSOD) or
- CVE-2018-9041In Advanced SystemCare Ultimate 11.0.1.58, the driver file (Monitor_win10_x64.sys) allows local users to cause a denial of service (BSOD) or
- CVE-2018-9042In Advanced SystemCare Ultimate 11.0.1.58, the driver file (Monitor_win10_x64.sys) allows local users to cause a denial of service (BSOD) or
- CVE-2018-9043In Advanced SystemCare Ultimate 11.0.1.58, the driver file (Monitor_win10_x64.sys) allows local users to cause a denial of service (BSOD) or
- CVE-2018-9044In Advanced SystemCare Ultimate 11.0.1.58, the driver file (Monitor_win10_x64.sys) allows local users to cause a denial of service (BSOD) or
- CVE-2018-9045In Windows Master (aka Windows Optimization Master) 7.99.13.604, the driver file (WoptiHWDetect.SYS) allows local users to cause a denial of
- CVE-2018-9046In Windows Master (aka Windows Optimization Master) 7.99.13.604, the driver file (WoptiHWDetect.SYS) allows local users to cause a denial of
- CVE-2018-9047In Windows Master (aka Windows Optimization Master) 7.99.13.604, the driver file (WoptiHWDetect.SYS) allows local users to cause a denial of
- CVE-2018-9048In Windows Master (aka Windows Optimization Master) 7.99.13.604, the driver file (WoptiHWDetect.SYS) allows local users to cause a denial of
- CVE-2018-9049In Windows Master (aka Windows Optimization Master) 7.99.13.604, the driver file (WoptiHWDetect.SYS) allows local users to cause a denial of
- CVE-2018-9050In Windows Master (aka Windows Optimization Master) 7.99.13.604, the driver file (WoptiHWDetect.SYS) allows local users to cause a denial of
- CVE-2018-9051In Windows Master (aka Windows Optimization Master) 7.99.13.604, the driver file (WoptiHWDetect.SYS) allows local users to cause a denial of
- CVE-2018-9052In Windows Master (aka Windows Optimization Master) 7.99.13.604, the driver file (WoptiHWDetect.SYS) allows local users to cause a denial of
- CVE-2018-9053In Windows Master (aka Windows Optimization Master) 7.99.13.604, the driver file (WoptiHWDetect.SYS) allows local users to cause a denial of
- CVE-2018-9054In Windows Master (aka Windows Optimization Master) 7.99.13.604, the driver file (WoptiHWDetect.SYS) allows local users to cause a denial of