# CVEs published 2018-03-29 33 CVEs were published on March 29, 2018: 1 critical, 0 high. 1 is now in CISA KEV. Days are UTC. - [CVE-2016-0898](https://cve.now/CVE-2016-0898.md): MySQL for PCF tiles 1.7.x before 1.7.10 were discovered to log the AWS access key in plaintext. (no CVSS) - [CVE-2016-6658](https://cve.now/CVE-2016-6658.md): Applications in cf-release before 245 can be configured and pushed with a user-provided custom buildpack using a URL pointing to the buildpa (no CVSS) - [CVE-2017-16512](https://cve.now/CVE-2017-16512.md): The vagrant update process in Hashicorp vagrant-vmware-fusion 5.0.2 through 5.0.4 allows local users to steal root privileges via a crafted (no CVSS) - [CVE-2017-16839](https://cve.now/CVE-2017-16839.md): Hashicorp vagrant-vmware-fusion 5.0.4 allows local users to steal root privileges if VMware Fusion is not installed. (no CVSS) - [CVE-2017-16873](https://cve.now/CVE-2017-16873.md): It is possible to exploit an unsanitized PATH in the suid binary that ships with vagrant-vmware-fusion 4.0.25 through 5.0.4 in order to esca (no CVSS) - [CVE-2018-1191](https://cve.now/CVE-2018-1191.md): Cloud Foundry Garden-runC, versions prior to 1.11.0, contains an information exposure vulnerability. (no CVSS, Cloud Foundry Garden-runC) - [CVE-2014-5028](https://cve.now/CVE-2014-5028.md): The Original File and Patched File resources in Review Board 1.7.x before 1.7.27 and 2.0.x before 2.0.4 allow remote authenticated users to (no CVSS) - [CVE-2014-5170](https://cve.now/CVE-2014-5170.md): The Storage API module 7.x before 7.x-1.6 for Drupal might allow remote attackers to execute arbitrary code by leveraging failure to update (no CVSS) - [CVE-2014-6604](https://cve.now/CVE-2014-6604.md): Cross-site scripting (XSS) vulnerability in class-s2-list-table.php in the Subscribe2 plugin before 10.16 for WordPress allows remote attack (no CVSS) - [CVE-2015-2000](https://cve.now/CVE-2015-2000.md): The Jumio SDK before 1.5.0 for Android might allow attackers to execute arbitrary code by leveraging a finalize method in a Serializable cla (no CVSS) - [CVE-2015-2001](https://cve.now/CVE-2015-2001.md): The MetaIO SDK before 6.0.2.1 for Android might allow attackers to execute arbitrary code by leveraging a finalize method in a Serializable (no CVSS) - [CVE-2015-2002](https://cve.now/CVE-2015-2002.md): The ESRI ArcGis Runtime SDK before 10.2.6-2 for Android might allow attackers to execute arbitrary code by leveraging a finalize method in a (no CVSS) - [CVE-2015-2003](https://cve.now/CVE-2015-2003.md): The PJSIP PJSUA2 SDK before SVN Changeset 51322 for Android might allow attackers to execute arbitrary code by leveraging a finalize method (no CVSS) - [CVE-2015-2004](https://cve.now/CVE-2015-2004.md): The GraceNote GNSDK SDK before SVN Changeset 1.1.7 for Android might allow attackers to execute arbitrary code by leveraging a finalize meth (no CVSS) - [CVE-2015-2009](https://cve.now/CVE-2015-2009.md): Cross-site request forgery (CSRF) vulnerability in the xmlrpc.cgi service in IBM QRadar SIEM 7.1 before MR2 Patch 11 Interim Fix 02 and 7.2. (no CVSS) - [CVE-2015-2020](https://cve.now/CVE-2015-2020.md): The MyScript SDK before 1.3 for Android might allow attackers to execute arbitrary code by leveraging a finalize method in a Serializable cl (no CVSS) - [CVE-2015-4952](https://cve.now/CVE-2015-4952.md): The on-demand plugin in IBM Endpoint Manager for Remote Control 9.0.1 and 9.1.0 allows user-assisted remote attackers to execute arbitrary c (no CVSS) - [CVE-2015-4953](https://cve.now/CVE-2015-4953.md): IBM BigFix Remote Control before Interim Fix pack 9.1.2-TIV-IBRC912-IF0001 makes it easier for man-in-the-middle attackers to decrypt traffi (no CVSS) - [CVE-2017-5947](https://cve.now/CVE-2017-5947.md): An issue was discovered in OnePlus One, X, 2, 3, 3T, and 5 devices with OxygenOS 5.0 and earlier. (no CVSS) - [CVE-2018-9031](https://cve.now/CVE-2018-9031.md): The login interface on TNLSoftSolutions Sentry Vision 3.x devices provides password disclosure by reading an "if(pwd ==" line in the HTML so (no CVSS) - [CVE-2018-4841](https://cve.now/CVE-2018-4841.md): A vulnerability has been identified in TIM 1531 IRC (All versions \< V1.1). (no CVSS, Siemens AG TIM 1531 IRC) - [CVE-2018-5223](https://cve.now/CVE-2018-5223.md): Fisheye and Crucible did not correctly check if a configured Mercurial repository URI contained values that the Windows operating system may (no CVSS, Atlassian Fisheye and Crucible) - [CVE-2018-5224](https://cve.now/CVE-2018-5224.md): Bamboo did not correctly check if a configured Mercurial repository URI contained values that the Windows operating system may consider argu (no CVSS, Atlassian Bamboo) - [CVE-2018-6586](https://cve.now/CVE-2018-6586.md): CA API Developer Portal 3.5 up to and including 3.5 CR6 has a stored cross-site scripting vulnerability related to profile picture processin (no CVSS, CA Technologies CA API Developer Portal) - [CVE-2018-6587](https://cve.now/CVE-2018-6587.md): CA API Developer Portal 3.5 up to and including 3.5 CR6 has a reflected cross-site scripting vulnerability related to the widgetID variable. (no CVSS, CA Technologies CA API Developer Portal) - [CVE-2018-6588](https://cve.now/CVE-2018-6588.md): CA API Developer Portal 3.5 up to and including 3.5 CR5 has a reflected cross-site scripting vulnerability related to the apiExplorer. (no CVSS, CA Technologies CA API Developer Portal) - [CVE-2018-7600](https://cve.now/CVE-2018-7600.md): Drupal before 7.58, 8.x before 8.3.9, 8.4.x before 8.4.6, and 8.5.x before 8.5.1 allows remote attackers to execute arbitrary code because o (CVSS 9.8, KEV, Drupal before 7.58, 8.x before 8.3.9, 8.4.x before 8.4.6… +1) - [CVE-2018-9116](https://cve.now/CVE-2018-9116.md): An XXE vulnerability within WireMock before 2.16.0 allows a remote unauthenticated attacker to access local files and internal resources and (no CVSS) - [CVE-2018-9117](https://cve.now/CVE-2018-9117.md): WireMock before 2.16.0 contains a vulnerability that allows a remote unauthenticated attacker to access local files beyond the application d (no CVSS) - [CVE-2018-9120](https://cve.now/CVE-2018-9120.md): In Crea8social 2018.2, there is Stored Cross-Site Scripting via a post. (no CVSS) - [CVE-2018-9121](https://cve.now/CVE-2018-9121.md): In Crea8social 2018.2, there is Stored Cross-Site Scripting via a post comment. (no CVSS) - [CVE-2018-9122](https://cve.now/CVE-2018-9122.md): In Crea8social 2018.2, there is Reflected Cross-Site Scripting via the term parameter to the /search URI. (no CVSS) - [CVE-2018-9123](https://cve.now/CVE-2018-9123.md): In Crea8social 2018.2, there is Stored Cross-Site Scripting via a User Profile. (no CVSS) --- Source: cve.now, built and run by Sazabi (AI-native observability and security) Page: https://cve.now/daily/2018-03-29 Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.