# CVEs published 2018-03-28

56 CVEs were published on March 28, 2018: 1 critical, 11 high. 15 are now in CISA KEV. Days are UTC.

- [CVE-2018-0150](https://cve.now/CVE-2018-0150.md): A vulnerability in Cisco IOS XE Software could allow an unauthenticated, remote attacker to log in to a device running an affected release o (no CVSS, Cisco IOS XE)
- [CVE-2018-0151](https://cve.now/CVE-2018-0151.md): A vulnerability in the quality of service (QoS) subsystem of Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, re (CVSS 9.8, KEV, Cisco IOS and IOS XE)
- [CVE-2018-0152](https://cve.now/CVE-2018-0152.md): A vulnerability in the web-based user interface (web UI) of Cisco IOS XE Software could allow an authenticated, remote attacker to gain elev (no CVSS, Cisco IOS XE Software)
- [CVE-2018-0154](https://cve.now/CVE-2018-0154.md): A vulnerability in the crypto engine of the Cisco Integrated Services Module for VPN (ISM-VPN) running Cisco IOS Software could allow an una (CVSS 7.5, KEV, Cisco IOS)
- [CVE-2018-0155](https://cve.now/CVE-2018-0155.md): A vulnerability in the Bidirectional Forwarding Detection (BFD) offload implementation of Cisco Catalyst 4500 Series Switches and Cisco Cata (CVSS 8.6, KEV, Cisco IOS and IOS XE)
- [CVE-2018-0156](https://cve.now/CVE-2018-0156.md): A vulnerability in the Smart Install feature of Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, remote attacker (CVSS 7.5, KEV, Cisco IOS and IOS XE)
- [CVE-2018-0157](https://cve.now/CVE-2018-0157.md): A vulnerability in the Zone-Based Firewall code of Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause a device t (no CVSS, Cisco IOS XE)
- [CVE-2018-0158](https://cve.now/CVE-2018-0158.md): A vulnerability in the Internet Key Exchange Version 2 (IKEv2) module of Cisco IOS Software and Cisco IOS XE Software could allow an unauthe (CVSS 8.6, KEV, Cisco IOS and IOS XE)
- [CVE-2018-0159](https://cve.now/CVE-2018-0159.md): A vulnerability in the implementation of Internet Key Exchange Version 1 (IKEv1) functionality in Cisco IOS Software and Cisco IOS XE Softwa (CVSS 7.5, KEV, Cisco IOS and IOS XE)
- [CVE-2018-0160](https://cve.now/CVE-2018-0160.md): A vulnerability in Simple Network Management Protocol (SNMP) subsystem of Cisco IOS XE Software could allow an authenticated, remote attacke (no CVSS, Cisco IOS XE)
- [CVE-2018-0161](https://cve.now/CVE-2018-0161.md): A vulnerability in the Simple Network Management Protocol (SNMP) subsystem of Cisco IOS Software running on certain models of Cisco Catalyst (CVSS 6.3, KEV, Cisco IOS)
- [CVE-2018-0163](https://cve.now/CVE-2018-0163.md): A vulnerability in the 802.1x multiple-authentication (multi-auth) feature of Cisco IOS Software could allow an unauthenticated, adjacent at (no CVSS, Cisco IOS)
- [CVE-2018-0164](https://cve.now/CVE-2018-0164.md): A vulnerability in the Switch Integrated Security Features of Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause (no CVSS, Cisco IOS XE)
- [CVE-2018-0165](https://cve.now/CVE-2018-0165.md): A vulnerability in the Internet Group Management Protocol (IGMP) packet-processing functionality of Cisco IOS XE Software could allow an una (no CVSS, Cisco IOS XE)
- [CVE-2018-0167](https://cve.now/CVE-2018-0167.md): Multiple Buffer Overflow vulnerabilities in the Link Layer Discovery Protocol (LLDP) subsystem of Cisco IOS Software, Cisco IOS XE Software, (CVSS 8.8, KEV, Cisco IOS, IOS XE, and IOS XR)
- [CVE-2018-0169](https://cve.now/CVE-2018-0169.md): Multiple vulnerabilities in the CLI parser of Cisco IOS XE Software could allow an authenticated, local attacker to gain access to the under (no CVSS, Cisco IOS XE)
- [CVE-2018-0170](https://cve.now/CVE-2018-0170.md): A vulnerability in the Cisco Umbrella Integration feature of Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause (no CVSS, Cisco IOS XE)
- [CVE-2018-0171](https://cve.now/CVE-2018-0171.md): A vulnerability in the Smart Install feature of Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, remote attacker (CVSS 7.5, KEV, Cisco IOS and IOS XE)
- [CVE-2018-0172](https://cve.now/CVE-2018-0172.md): A vulnerability in the DHCP option 82 encapsulation functionality of Cisco IOS Software and Cisco IOS XE Software could allow an unauthentic (CVSS 8.6, KEV, Cisco IOS and IOS XE)
- [CVE-2018-0173](https://cve.now/CVE-2018-0173.md): A vulnerability in the Cisco IOS Software and Cisco IOS XE Software function that restores encapsulated option 82 information in DHCP Versio (CVSS 8.6, KEV, Cisco IOS and IOS XE)
- [CVE-2018-0174](https://cve.now/CVE-2018-0174.md): A vulnerability in the DHCP option 82 encapsulation functionality of Cisco IOS Software and Cisco IOS XE Software could allow an unauthentic (CVSS 8.6, KEV, Cisco IOS and IOS XE)
- [CVE-2018-0175](https://cve.now/CVE-2018-0175.md): Format String vulnerability in the Link Layer Discovery Protocol (LLDP) subsystem of Cisco IOS Software, Cisco IOS XE Software, and Cisco IO (CVSS 8.0, KEV, Cisco IOS, IOS XE, and IOS XR)
- [CVE-2018-0176](https://cve.now/CVE-2018-0176.md): Multiple vulnerabilities in the CLI parser of Cisco IOS XE Software could allow an authenticated, local attacker to gain access to the under (no CVSS, Cisco IOS XE)
- [CVE-2018-0177](https://cve.now/CVE-2018-0177.md): A vulnerability in the IP Version 4 (IPv4) processing code of Cisco IOS XE Software running on Cisco Catalyst 3850 and Cisco Catalyst 3650 S (no CVSS, Cisco IOS XE)
- [CVE-2018-0179](https://cve.now/CVE-2018-0179.md): Multiple vulnerabilities in the Login Enhancements (Login Block) feature of Cisco IOS Software could allow an unauthenticated, remote attack (CVSS 6.8, KEV, Cisco IOS)
- [CVE-2018-0180](https://cve.now/CVE-2018-0180.md): Multiple vulnerabilities in the Login Enhancements (Login Block) feature of Cisco IOS Software could allow an unauthenticated, remote attack (CVSS 6.8, KEV, Cisco IOS)
- [CVE-2018-0182](https://cve.now/CVE-2018-0182.md): Multiple vulnerabilities in the CLI parser of Cisco IOS XE Software could allow an authenticated, local attacker to inject arbitrary command (no CVSS, Cisco IOS XE)
- [CVE-2018-0183](https://cve.now/CVE-2018-0183.md): A vulnerability in the CLI parser of Cisco IOS XE Software could allow an authenticated, local attacker to gain access to the underlying Lin (no CVSS, Cisco IOS XE)
- [CVE-2018-0184](https://cve.now/CVE-2018-0184.md): A vulnerability in the CLI parser of Cisco IOS XE Software could allow an authenticated, local attacker to gain access to the underlying Lin (no CVSS, Cisco IOS XE)
- [CVE-2018-0185](https://cve.now/CVE-2018-0185.md): Multiple vulnerabilities in the CLI parser of Cisco IOS XE Software could allow an authenticated, local attacker to inject arbitrary command (no CVSS, Cisco IOS XE)
- [CVE-2018-0186](https://cve.now/CVE-2018-0186.md): Multiple vulnerabilities in the web-based user interface (web UI) of Cisco IOS XE Software could allow an unauthenticated, remote attacker t (no CVSS, Cisco IOS XE)
- [CVE-2018-0188](https://cve.now/CVE-2018-0188.md): Multiple vulnerabilities in the web-based user interface (web UI) of Cisco IOS XE Software could allow an unauthenticated, remote attacker t (no CVSS, Cisco IOS XE)
- [CVE-2018-0189](https://cve.now/CVE-2018-0189.md): A vulnerability in the Forwarding Information Base (FIB) code of Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated (no CVSS, Cisco IOS and IOS XE)
- [CVE-2018-0190](https://cve.now/CVE-2018-0190.md): Multiple vulnerabilities in the web-based user interface (web UI) of Cisco IOS XE Software could allow an unauthenticated, remote attacker t (no CVSS, Cisco IOS XE)
- [CVE-2018-0193](https://cve.now/CVE-2018-0193.md): Multiple vulnerabilities in the CLI parser of Cisco IOS XE Software could allow an authenticated, local attacker to inject arbitrary command (no CVSS, Cisco IOS XE)
- [CVE-2018-0195](https://cve.now/CVE-2018-0195.md): A vulnerability in the Cisco IOS XE Software REST API could allow an authenticated, remote attacker to bypass API authorization checks and u (no CVSS, Cisco IOS XE)
- [CVE-2018-0196](https://cve.now/CVE-2018-0196.md): A vulnerability in the web-based user interface (web UI) of Cisco IOS XE Software could allow an authenticated, remote attacker to write arb (no CVSS, Cisco IOS XE)
- [CVE-2018-6608](https://cve.now/CVE-2018-6608.md): In the WebRTC component in Opera 51.0.2830.55, after visiting a web site that attempts to gather complete client information (such as https: (no CVSS)
- [CVE-2017-0936](https://cve.now/CVE-2017-0936.md): Nextcloud Server before 11.0.7 and 12.0.5 suffers from an Authorization Bypass Through User-Controlled Key vulnerability. (no CVSS, Nextcloud Server)
- [CVE-2018-8820](https://cve.now/CVE-2018-8820.md): An issue was discovered in Square 9 GlobalForms 6.2.x. (no CVSS)
- [CVE-2018-8885](https://cve.now/CVE-2018-8885.md): screenresolution-mechanism in screen-resolution-extra 0.17.2 does not properly use the PolicyKit D-Bus API, which allows local users to bypa (no CVSS)
- [CVE-2018-1064](https://cve.now/CVE-2018-1064.md): libvirt version before 4.2.0-rc1 is vulnerable to a resource exhaustion as a result of an incomplete fix for CVE-2018-5748 that affects QEMU (no CVSS, libvirt)
- [CVE-2017-11509](https://cve.now/CVE-2017-11509.md): An authenticated remote attacker can execute arbitrary code in Firebird SQL Server versions 2.5.7 and 3.0.2 by executing a malformed SQL sta (no CVSS, Firebird Foundation Firebird SQL Server)
- [CVE-2017-11510](https://cve.now/CVE-2017-11510.md): An information leak exists in Wanscam's HW0021 network camera that allows an unauthenticated remote attacker to recover the administrator us (no CVSS, Wanscam HW0021)
- [CVE-2018-5451](https://cve.now/CVE-2018-5451.md): In Philips Alice 6 System version R8.0.2 or prior, when an actor claims to have a given identity, the software does not prove or insufficien (no CVSS, Philips Alice 6 System)
- [CVE-2018-7498](https://cve.now/CVE-2018-7498.md): In Philips Alice 6 System version R8.0.2 or prior, the lack of proper data encryption passes up the guarantees of confidentiality, integrity (no CVSS, Philips Alice 6 System)
- [CVE-2018-7674](https://cve.now/CVE-2018-7674.md): IDM URL Redirection attack (CVSS 2.1, NetIQ Identity Manager)
- [CVE-2018-7676](https://cve.now/CVE-2018-7676.md): IDM Information Leakage (CVSS 3.9, NetIQ Identity Manager)
- [CVE-2018-9110](https://cve.now/CVE-2018-9110.md): Studio 42 elFinder before 2.1.37 has a directory traversal vulnerability in elFinder.class.php with the zipdl() function that can allow a re (no CVSS, studio-42/elfinder)
- [CVE-2018-1083](https://cve.now/CVE-2018-1083.md): Zsh before version 5.4.2-test-1 is vulnerable to a buffer overflow in the shell autocomplete functionality. (no CVSS, zsh)
- [CVE-2018-1142](https://cve.now/CVE-2018-1142.md): Tenable Appliance versions 4.6.1 and earlier have been found to contain a single XSS vulnerability. (no CVSS, Tenable Appliance)
- [CVE-2018-9109](https://cve.now/CVE-2018-9109.md): Studio 42 elFinder before 2.1.36 has a directory traversal vulnerability in elFinder.class.php with the zipdl() function that can allow a re (no CVSS, studio-42/elfinder)
- [CVE-2018-9106](https://cve.now/CVE-2018-9106.md): CSV Injection (aka Excel Macro Injection or Formula Injection) exists in the export feature in the Acyba AcySMS extension before 3.5.1 for J (no CVSS)
- [CVE-2018-9107](https://cve.now/CVE-2018-9107.md): CSV Injection (aka Excel Macro Injection or Formula Injection) exists in the export feature in the Acyba AcyMailing extension before 5.9.6 f (no CVSS)
- [CVE-2018-9108](https://cve.now/CVE-2018-9108.md): CSRF in /admin/user/manage/add in QuickAppsCMS 2.0.0-beta2 allows an unauthorized remote attacker to create an account with admin privileges (no CVSS, quickapps/cms)
- [CVE-2018-8823](https://cve.now/CVE-2018-8823.md): modules/bamegamenu/ajax\_phpcode.php in the Responsive Mega Menu (Horizontal+Vertical+Dropdown) Pro module 1.0.32 for PrestaShop 1.5.5.0 thro (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2018-03-28
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.