CVEs published March 29, 2018
33 CVEs were published on March 29, 2018: 1 critical, 0 high. 1 is now in CISA KEV.
- Published
- 33
- Critical
- 1
- High
- 0
- Medium
- 0
- Low
- 0
- Unrated
- 32
- Now in CISA KEV
- 1
- Fix available
- 6
Most affected products
- CA Technologies CA API Developer Portal
- 3
- Atlassian Bamboo
- 1
- Atlassian Fisheye and Crucible
- 1
- Cloud Foundry Garden-runC
- 1
- Drupal before 7.58, 8.x before 8.3.9, 8.4.x before 8.4.6… +1
- 1
- Siemens AG TIM 1531 IRC
- 1
Critical 1
Medium, low and unrated 32
- CVE-2016-0898MySQL for PCF tiles 1.7.x before 1.7.10 were discovered to log the AWS access key in plaintext.
- CVE-2016-6658Applications in cf-release before 245 can be configured and pushed with a user-provided custom buildpack using a URL pointing to the buildpa
- CVE-2017-16512The vagrant update process in Hashicorp vagrant-vmware-fusion 5.0.2 through 5.0.4 allows local users to steal root privileges via a crafted
- CVE-2017-16839Hashicorp vagrant-vmware-fusion 5.0.4 allows local users to steal root privileges if VMware Fusion is not installed.
- CVE-2017-16873It is possible to exploit an unsanitized PATH in the suid binary that ships with vagrant-vmware-fusion 4.0.25 through 5.0.4 in order to esca
- CVE-2018-1191Cloud Foundry Garden-runC, versions prior to 1.11.0, contains an information exposure vulnerability.Cloud Foundry Garden-runC
- CVE-2014-5028The Original File and Patched File resources in Review Board 1.7.x before 1.7.27 and 2.0.x before 2.0.4 allow remote authenticated users to
- CVE-2014-5170The Storage API module 7.x before 7.x-1.6 for Drupal might allow remote attackers to execute arbitrary code by leveraging failure to update
- CVE-2014-6604Cross-site scripting (XSS) vulnerability in class-s2-list-table.php in the Subscribe2 plugin before 10.16 for WordPress allows remote attack
- CVE-2015-2000The Jumio SDK before 1.5.0 for Android might allow attackers to execute arbitrary code by leveraging a finalize method in a Serializable cla
- CVE-2015-2001The MetaIO SDK before 6.0.2.1 for Android might allow attackers to execute arbitrary code by leveraging a finalize method in a Serializable
- CVE-2015-2002The ESRI ArcGis Runtime SDK before 10.2.6-2 for Android might allow attackers to execute arbitrary code by leveraging a finalize method in a
- CVE-2015-2003The PJSIP PJSUA2 SDK before SVN Changeset 51322 for Android might allow attackers to execute arbitrary code by leveraging a finalize method
- CVE-2015-2004The GraceNote GNSDK SDK before SVN Changeset 1.1.7 for Android might allow attackers to execute arbitrary code by leveraging a finalize meth
- CVE-2015-2009Cross-site request forgery (CSRF) vulnerability in the xmlrpc.cgi service in IBM QRadar SIEM 7.1 before MR2 Patch 11 Interim Fix 02 and 7.2.
- CVE-2015-2020The MyScript SDK before 1.3 for Android might allow attackers to execute arbitrary code by leveraging a finalize method in a Serializable cl
- CVE-2015-4952The on-demand plugin in IBM Endpoint Manager for Remote Control 9.0.1 and 9.1.0 allows user-assisted remote attackers to execute arbitrary c
- CVE-2015-4953IBM BigFix Remote Control before Interim Fix pack 9.1.2-TIV-IBRC912-IF0001 makes it easier for man-in-the-middle attackers to decrypt traffi
- CVE-2017-5947An issue was discovered in OnePlus One, X, 2, 3, 3T, and 5 devices with OxygenOS 5.0 and earlier.
- CVE-2018-9031The login interface on TNLSoftSolutions Sentry Vision 3.x devices provides password disclosure by reading an "if(pwd ==" line in the HTML so
- CVE-2018-4841A vulnerability has been identified in TIM 1531 IRC (All versions < V1.1).Siemens AG TIM 1531 IRC
- CVE-2018-5223Fisheye and Crucible did not correctly check if a configured Mercurial repository URI contained values that the Windows operating system mayAtlassian Fisheye and Crucible
- CVE-2018-5224Bamboo did not correctly check if a configured Mercurial repository URI contained values that the Windows operating system may consider arguAtlassian Bamboo
- CVE-2018-6586CA API Developer Portal 3.5 up to and including 3.5 CR6 has a stored cross-site scripting vulnerability related to profile picture processinCA Technologies CA API Developer Portal
- CVE-2018-6587CA API Developer Portal 3.5 up to and including 3.5 CR6 has a reflected cross-site scripting vulnerability related to the widgetID variable.CA Technologies CA API Developer Portal
- CVE-2018-6588CA API Developer Portal 3.5 up to and including 3.5 CR5 has a reflected cross-site scripting vulnerability related to the apiExplorer.CA Technologies CA API Developer Portal
- CVE-2018-9116An XXE vulnerability within WireMock before 2.16.0 allows a remote unauthenticated attacker to access local files and internal resources and
- CVE-2018-9117WireMock before 2.16.0 contains a vulnerability that allows a remote unauthenticated attacker to access local files beyond the application d
- CVE-2018-9120In Crea8social 2018.2, there is Stored Cross-Site Scripting via a post.
- CVE-2018-9121In Crea8social 2018.2, there is Stored Cross-Site Scripting via a post comment.
- CVE-2018-9122In Crea8social 2018.2, there is Reflected Cross-Site Scripting via the term parameter to the /search URI.
- CVE-2018-9123In Crea8social 2018.2, there is Stored Cross-Site Scripting via a User Profile.