# CVEs published 2018-03-27

66 CVEs were published on March 27, 2018: 0 critical, 0 high. 2 are now in CISA KEV. Days are UTC.

- [CVE-2018-9105](https://cve.now/CVE-2018-9105.md): NordVPN 3.3.10 for macOS suffers from a root privilege escalation vulnerability. (no CVSS)
- [CVE-2018-9092](https://cve.now/CVE-2018-9092.md): There is a CSRF vulnerability in mc-admin/conf.php in MiniCMS 1.10 that can change the administrator account password. (no CVSS)
- [CVE-2014-5130](https://cve.now/CVE-2014-5130.md): Avolve Software ProjectDox 8.1 allows remote authenticated users to obtain sensitive information from other users via vectors involving a di (no CVSS)
- [CVE-2014-5131](https://cve.now/CVE-2014-5131.md): Avolve Software ProjectDox 8.1 makes it easier for remote authenticated users to obtain sensitive information by leveraging ciphertext reuse (no CVSS)
- [CVE-2014-5132](https://cve.now/CVE-2014-5132.md): Avolve Software ProjectDox 8.1 allows remote attackers to enumerate users via vectors related to email addresses. (no CVSS)
- [CVE-2017-7630](https://cve.now/CVE-2017-7630.md): QNAP QTS 4.2.6 build 20171026, QTS 4.3.3 build 20170727 and earlier allows remote attackers to obtain potentially sensitive information (fir (no CVSS)
- [CVE-2017-7631](https://cve.now/CVE-2017-7631.md): Cross-site scripting (XSS) vulnerability in the share link function of File Station of QNAP 4.2.6 build 20171026, QTS 4.3.3 build 20170727 a (no CVSS)
- [CVE-2017-7632](https://cve.now/CVE-2017-7632.md): Cross-site scripting (XSS) vulnerability in File Station of QNAP QTS 4.2.6 build 20171026, QTS 4.3.3 build 20170727 and earlier allows remot (no CVSS)
- [CVE-2018-0733](https://cve.now/CVE-2018-0733.md): Incorrect CRYPTO\_memcmp on HP-UX PA-RISC (no CVSS, OpenSSL)
- [CVE-2018-0739](https://cve.now/CVE-2018-0739.md): Constructed ASN.1 types with a recursive definition could exceed the stack (no CVSS, OpenSSL)
- [CVE-2018-1091](https://cve.now/CVE-2018-1091.md): In the flush\_tmregs\_to\_thread function in arch/powerpc/kernel/ptrace.c in the Linux kernel before 4.13.5, a guest kernel crash can be trigge (no CVSS, Linux kernel v4.13 and newer)
- [CVE-2018-1205](https://cve.now/CVE-2018-1205.md): Dell EMC ScaleIO, versions prior to 2.5, do not properly handle some packet data in the MDM service. (no CVSS, Dell EMC ScaleIO)
- [CVE-2018-1237](https://cve.now/CVE-2018-1237.md): Dell EMC ScaleIO versions prior to 2.5, contain improper restriction of excessive authentication attempts on the Light installation Agent (L (no CVSS, Dell EMC ScaleIO)
- [CVE-2018-1238](https://cve.now/CVE-2018-1238.md): Dell EMC ScaleIO versions prior to 2.5, contain a command injection vulnerability in the Light Installation Agent (LIA). (no CVSS, Dell EMC ScaleIO)
- [CVE-2018-1327](https://cve.now/CVE-2018-1327.md): The Apache Struts REST Plugin is using XStream library which is vulnerable and allow perform a DoS attack when using a malicious request wit (no CVSS, Apache Software Foundation Apache Struts · org.apache.strut…)
- [CVE-2018-9058](https://cve.now/CVE-2018-9058.md): In Long Range Zip (aka lrzip) 0.631, there is an infinite loop in the runzip\_fd function of runzip.c. (no CVSS)
- [CVE-2018-7700](https://cve.now/CVE-2018-7700.md): DedeCMS 5.7 has CSRF with an impact of arbitrary code execution, because the partcode parameter in a tag\_test\_action.php request can specify (no CVSS)
- [CVE-2018-9057](https://cve.now/CVE-2018-9057.md): aws/resource\_aws\_iam\_user\_login\_profile.go in the HashiCorp Terraform Amazon Web Services (AWS) provider through v1.12.0 has an inappropriat (no CVSS, github.com/hashicorp/terraform-provider-aws)
- [CVE-2015-4954](https://cve.now/CVE-2015-4954.md): IBM BigFix Remote Control before Interim Fix pack 9.1.2-TIV-IBRC912-IF0001 improperly allows self-signed certificates, which might allow rem (no CVSS)
- [CVE-2015-4987](https://cve.now/CVE-2015-4987.md): The search and replay servers in IBM Tealeaf Customer Experience 8.0 through 9.0.2 allow remote attackers to bypass authentication via unspe (no CVSS)
- [CVE-2015-5016](https://cve.now/CVE-2015-5016.md): IBM Maximo Asset Management 7.1, 7.5, and 7.6; Maximo Asset Management Essentials 7.1 and 7.5; Control Desk 7.5 and 7.6; Tivoli Asset Manage (no CVSS)
- [CVE-2018-6765](https://cve.now/CVE-2018-6765.md): Swisscom MySwisscomAssistant 2.17.1.1065 contains a vulnerability that could allow an unauthenticated, remote attacker to execute arbitrary (no CVSS)
- [CVE-2018-6766](https://cve.now/CVE-2018-6766.md): Swisscom TVMediaHelper 1.1.0.50 contains a vulnerability that could allow an unauthenticated, remote attacker to execute arbitrary code on t (no CVSS)
- [CVE-2018-7192](https://cve.now/CVE-2018-7192.md): Cross-site scripting (XSS) vulnerability in /ajax.php/form/help-topic in Enhancesoft osTicket before 1.10.2 allows remote attackers to injec (no CVSS)
- [CVE-2018-7193](https://cve.now/CVE-2018-7193.md): Cross-site scripting (XSS) vulnerability in /scp/directory.php in Enhancesoft osTicket before 1.10.2 allows remote attackers to inject arbit (no CVSS)
- [CVE-2018-7194](https://cve.now/CVE-2018-7194.md): Integer format vulnerability in the ticket number generator in Enhancesoft osTicket before 1.10.2 allows remote attackers to cause a denial- (no CVSS)
- [CVE-2018-7195](https://cve.now/CVE-2018-7195.md): Enhancesoft osTicket before 1.10.2 allows remote attackers to reset arbitrary passwords (when an associated e-mail address is known) by leve (no CVSS)
- [CVE-2018-7196](https://cve.now/CVE-2018-7196.md): Cross-site scripting (XSS) vulnerability in /scp/index.php in Enhancesoft osTicket before 1.10.2 allows remote attackers to inject arbitrary (no CVSS)
- [CVE-2018-8048](https://cve.now/CVE-2018-8048.md): In the Loofah gem through 2.2.0 for Ruby, non-whitelisted HTML attributes may occur in sanitized output by republishing a crafted HTML fragm (no CVSS, loofah · nokogiri)
- [CVE-2018-9056](https://cve.now/CVE-2018-9056.md): Systems with microprocessors utilizing speculative execution may allow unauthorized disclosure of information to an attacker with local user (no CVSS)
- [CVE-2014-0486](https://cve.now/CVE-2014-0486.md): Knot DNS before 1.5.2 allows remote attackers to cause a denial of service (application crash) via a crafted DNS message. (no CVSS)
- [CVE-2014-4959](https://cve.now/CVE-2014-4959.md): \*\*DISPUTED\*\* SQL injection vulnerability in SQLiteDatabase.java in the SQLi Api in Android allows remote attackers to execute arbitrary SQL (no CVSS)
- [CVE-2018-1231](https://cve.now/CVE-2018-1231.md): Cloud Foundry BOSH CLI, versions prior to v3.0.1, contains an improper access control vulnerability. (no CVSS)
- [CVE-2018-1266](https://cve.now/CVE-2018-1266.md): Cloud Foundry Cloud Controller, versions prior to 1.52.0, contains information disclosure and path traversal vulnerabilities. (no CVSS)
- [CVE-2018-1267](https://cve.now/CVE-2018-1267.md): Cloud Foundry Silk CNI plugin, versions prior to 0.2.0, contains an improper access control vulnerability. (no CVSS)
- [CVE-2018-6882](https://cve.now/CVE-2018-6882.md): Cross-site scripting (XSS) vulnerability in the ZmMailMsgView.getAttachmentLinkHtml function in Zimbra Collaboration Suite (ZCS) before 8.7 (CVSS 6.1, KEV)
- [CVE-2018-8718](https://cve.now/CVE-2018-8718.md): Cross-site request forgery (CSRF) vulnerability in the Mailer Plugin 1.20 for Jenkins 2.111 allows remote authenticated users to send unauth (no CVSS, org.jenkins-ci.plugins:mailer)
- [CVE-2018-8763](https://cve.now/CVE-2018-8763.md): Roland Gruber Softwareentwicklung LDAP Account Manager before 6.3 has XSS via the dn parameter to the templates/3rdParty/pla/htdocs/cmd.php (no CVSS)
- [CVE-2018-8764](https://cve.now/CVE-2018-8764.md): Roland Gruber Softwareentwicklung LDAP Account Manager before 6.3 places a CSRF token in the sec\_token parameter of a URI, which makes it ea (no CVSS)
- [CVE-2017-12310](https://cve.now/CVE-2017-12310.md): A vulnerability in the auto discovery phase of Cisco Spark Hybrid Calendar Service could allow an unauthenticated, remote attacker to view s (no CVSS, Cisco Spark Hybrid Calendar Service)
- [CVE-2017-12319](https://cve.now/CVE-2017-12319.md): A vulnerability in the Border Gateway Protocol (BGP) over an Ethernet Virtual Private Network (EVPN) for Cisco IOS XE Software could allow a (CVSS 5.9, KEV, Cisco IOS XE)
- [CVE-2018-0198](https://cve.now/CVE-2018-0198.md): A vulnerability in the web framework of Cisco Unified Communications Manager could allow an unauthenticated, remote attacker to view sensiti (no CVSS, Cisco Unified Communications Manager)
- [CVE-2018-0202](https://cve.now/CVE-2018-0202.md): clamscan in ClamAV before 0.99.4 contains a vulnerability that could allow an unauthenticated, remote attacker to cause a denial of service (no CVSS, ClamAV)
- [CVE-2018-9055](https://cve.now/CVE-2018-9055.md): JasPer 2.0.14 allows denial of service via a reachable assertion in the function jpc\_firstone in libjasper/jpc/jpc\_math.c. (no CVSS)
- [CVE-2017-18250](https://cve.now/CVE-2017-18250.md): An issue was discovered in ImageMagick 7.0.7. (no CVSS)
- [CVE-2017-18251](https://cve.now/CVE-2017-18251.md): An issue was discovered in ImageMagick 7.0.7. (no CVSS)
- [CVE-2017-18252](https://cve.now/CVE-2017-18252.md): An issue was discovered in ImageMagick 7.0.7. (no CVSS)
- [CVE-2017-18253](https://cve.now/CVE-2017-18253.md): An issue was discovered in ImageMagick 7.0.7. (no CVSS)
- [CVE-2017-18254](https://cve.now/CVE-2017-18254.md): An issue was discovered in ImageMagick 7.0.7. (no CVSS)
- [CVE-2018-9032](https://cve.now/CVE-2018-9032.md): An authentication bypass vulnerability on D-Link DIR-850L Wireless AC1200 Dual Band Gigabit Cloud Router (Hardware Version : A1, B1; Firmwar (no CVSS)
- [CVE-2018-9039](https://cve.now/CVE-2018-9039.md): In Octopus Deploy 2.0 and later before 2018.3.7, an authenticated user, with variable edit permissions, can scope some variables to targets (no CVSS)
- [CVE-2018-9040](https://cve.now/CVE-2018-9040.md): In Advanced SystemCare Ultimate 11.0.1.58, the driver file (Monitor\_win10\_x64.sys) allows local users to cause a denial of service (BSOD) or (no CVSS)
- [CVE-2018-9041](https://cve.now/CVE-2018-9041.md): In Advanced SystemCare Ultimate 11.0.1.58, the driver file (Monitor\_win10\_x64.sys) allows local users to cause a denial of service (BSOD) or (no CVSS)
- [CVE-2018-9042](https://cve.now/CVE-2018-9042.md): In Advanced SystemCare Ultimate 11.0.1.58, the driver file (Monitor\_win10\_x64.sys) allows local users to cause a denial of service (BSOD) or (no CVSS)
- [CVE-2018-9043](https://cve.now/CVE-2018-9043.md): In Advanced SystemCare Ultimate 11.0.1.58, the driver file (Monitor\_win10\_x64.sys) allows local users to cause a denial of service (BSOD) or (no CVSS)
- [CVE-2018-9044](https://cve.now/CVE-2018-9044.md): In Advanced SystemCare Ultimate 11.0.1.58, the driver file (Monitor\_win10\_x64.sys) allows local users to cause a denial of service (BSOD) or (no CVSS)
- [CVE-2018-9045](https://cve.now/CVE-2018-9045.md): In Windows Master (aka Windows Optimization Master) 7.99.13.604, the driver file (WoptiHWDetect.SYS) allows local users to cause a denial of (no CVSS)
- [CVE-2018-9046](https://cve.now/CVE-2018-9046.md): In Windows Master (aka Windows Optimization Master) 7.99.13.604, the driver file (WoptiHWDetect.SYS) allows local users to cause a denial of (no CVSS)
- [CVE-2018-9047](https://cve.now/CVE-2018-9047.md): In Windows Master (aka Windows Optimization Master) 7.99.13.604, the driver file (WoptiHWDetect.SYS) allows local users to cause a denial of (no CVSS)
- [CVE-2018-9048](https://cve.now/CVE-2018-9048.md): In Windows Master (aka Windows Optimization Master) 7.99.13.604, the driver file (WoptiHWDetect.SYS) allows local users to cause a denial of (no CVSS)
- [CVE-2018-9049](https://cve.now/CVE-2018-9049.md): In Windows Master (aka Windows Optimization Master) 7.99.13.604, the driver file (WoptiHWDetect.SYS) allows local users to cause a denial of (no CVSS)
- [CVE-2018-9050](https://cve.now/CVE-2018-9050.md): In Windows Master (aka Windows Optimization Master) 7.99.13.604, the driver file (WoptiHWDetect.SYS) allows local users to cause a denial of (no CVSS)
- [CVE-2018-9051](https://cve.now/CVE-2018-9051.md): In Windows Master (aka Windows Optimization Master) 7.99.13.604, the driver file (WoptiHWDetect.SYS) allows local users to cause a denial of (no CVSS)
- [CVE-2018-9052](https://cve.now/CVE-2018-9052.md): In Windows Master (aka Windows Optimization Master) 7.99.13.604, the driver file (WoptiHWDetect.SYS) allows local users to cause a denial of (no CVSS)
- [CVE-2018-9053](https://cve.now/CVE-2018-9053.md): In Windows Master (aka Windows Optimization Master) 7.99.13.604, the driver file (WoptiHWDetect.SYS) allows local users to cause a denial of (no CVSS)
- [CVE-2018-9054](https://cve.now/CVE-2018-9054.md): In Windows Master (aka Windows Optimization Master) 7.99.13.604, the driver file (WoptiHWDetect.SYS) allows local users to cause a denial of (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2018-03-27
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.