CVEs published March 30, 2018
71 CVEs were published on March 30, 2018: 0 critical, 0 high.
- Published
- 71
- Critical
- 0
- High
- 0
- Medium
- 7
- Low
- 1
- Unrated
- 63
- Now in CISA KEV
- 0
- Fix available
- 3
Most affected products
- Qualcomm Android for MSM, Firefox OS for MSM, QRD Android
- 22
- IBM Business Process Manager
- 5
- Elastic Kibana
- 4
- Qualcomm Snapdragon IoT, Snapdragon Mobile
- 4
- Dell EMC RSA Authentication Agent for Web for IIS, RSA Auth…
- 2
- Dell EMC RSA Authentication Agent for Web for IIS
- 1
- Elastic Logstash
- 1
- Elastic X-Pack Security
- 1
- hapi hoek node module · hoek
- 1
- IBM Financial Transaction Manager
- 1
Medium, low and unrated 71
- CVE-2017-11087libOmxVenc in Android for MSM, Firefox OS for MSM, and QRD Android copies the output buffer to an application with the "filled length", whicQualcomm Android for MSM, Firefox OS for MSM, QRD Android
- CVE-2017-14875In the handler for the ioctl command VIDIOC_MSM_ISP_DUAL_HW_LPM_MODE in Android for MSM, Firefox OS for MSM, and QRD Android before 2017-05-Qualcomm Android for MSM, Firefox OS for MSM, QRD Android
- CVE-2017-14876In msm_ispif_config_stereo() in Android for MSM, Firefox OS for MSM, and QRD Android before 2017-06-21, the parameter params->entries[i].vfeQualcomm Android for MSM, Firefox OS for MSM, QRD Android
- CVE-2017-14877While the IPA driver in Android for MSM, Firefox OS for MSM, and QRD Android before 2017-08-31 is processing IOCTL commands there is no muteQualcomm Android for MSM, Firefox OS for MSM, QRD Android
- CVE-2017-14881While calling the IPA IOCTL handler for IPA_IOC_ADD_HDR_PROC_CTX in Android for MSM, Firefox OS for MSM, and QRD Android before 2017-10-13, Qualcomm Android for MSM, Firefox OS for MSM, QRD Android
- CVE-2017-14883In the function wma_unified_power_debug_stats_event_handler() in Android for MSM, Firefox OS for MSM, and QRD Android before 2017-10-18, if Qualcomm Android for MSM, Firefox OS for MSM, QRD Android
- CVE-2017-14891In the KGSL driver function _gpuobj_map_useraddr() in Android for MSM, Firefox OS for MSM, and QRD Android before 2017-10-12, the contents oQualcomm Android for MSM, Firefox OS for MSM, QRD Android
- CVE-2017-14892In the function msm_pcm_hw_params() in Android for MSM, Firefox OS for MSM, and QRD Android before 2017-09-19, the return value of q6asm_opeQualcomm Android for MSM, Firefox OS for MSM, QRD Android
- CVE-2017-15823In spectral_create_samp_msg() in Android for MSM, Firefox OS for MSM, and QRD Android before 2017-10-11, some values from firmware are not pQualcomm Android for MSM, Firefox OS for MSM, QRD Android
- CVE-2017-15826Due to a race condition in MDSS rotator in Android for MSM, Firefox OS for MSM, and QRD Android before 2017-10-20, a double free vulnerabiliQualcomm Android for MSM, Firefox OS for MSM, QRD Android
- CVE-2017-15846In the video_ioctl2() function in the camera driver in Android for MSM, Firefox OS for MSM, and QRD Android before 2017-09-16, an untrusted Qualcomm Android for MSM, Firefox OS for MSM, QRD Android
- CVE-2017-15852Information leak of the ISPIF base address in Android for MSM, Firefox OS for MSM, and QRD Android can occur in the camera driver.Qualcomm Android for MSM, Firefox OS for MSM, QRD Android
- CVE-2017-15859While processing the QCA_NL80211_VENDOR_SUBCMD_SET_TXPOWER_SCALE_DECR_DB vendor command, in which attribute QCA_WLAN_VENDOR_ATTR_TXPOWER_SCAQualcomm Android for MSM, Firefox OS for MSM, QRD Android
- CVE-2017-16614SSRF (Server Side Request Forgery) in tpshop 2.0.5 and 2.0.6 allows remote attackers to obtain sensitive information, attack intranet hosts,
- CVE-2017-17766In wma_peer_info_event_handler() in Android for MSM, Firefox OS for MSM, and QRD Android before 2017-10-03, the value of num_peers received Qualcomm Android for MSM, Firefox OS for MSM, QRD Android
- CVE-2017-17769Information leakage in Android for MSM, Firefox OS for MSM, and QRD Android can occur in the audio driver.Qualcomm Android for MSM, Firefox OS for MSM, QRD Android
- CVE-2017-17771In msm_isp_prepare_v4l2_buf in Android for MSM, Firefox OS for MSM, and QRD Android before 2017-02-12, an array out of bounds can occur.Qualcomm Android for MSM, Firefox OS for MSM, QRD Android
- CVE-2017-9691There is a race condition in Android for MSM, Firefox OS for MSM, and QRD Android that allows to access to already free'd memory in the debuQualcomm Android for MSM, Firefox OS for MSM, QRD Android
- CVE-2017-9692When an atomic commit is issued on a writeback panel with a NULL output_layer parameter in Android for MSM, Firefox OS for MSM, and QRD AndrQualcomm Android for MSM, Firefox OS for MSM, QRD Android
- CVE-2017-9693The length of attribute value for STA_EXT_CAPABILITY in __wlan_hdd_change_station in Android for MSM, Firefox OS for MSM, and QRD Android beQualcomm Android for MSM, Firefox OS for MSM, QRD Android
- CVE-2017-9694While parsing Netlink attributes in QCA_WLAN_VENDOR_ATTR_EXTSCAN_BSSID_HOTLIST_PARAMS_LOST_AP_SAMPLE_SIZE in qcacld 2.0 before 2017-05-16, aQualcomm Android for MSM, Firefox OS for MSM, QRD Android
- CVE-2017-9723The touchscreen driver synaptics_dsx in Android for MSM, Firefox OS for MSM, and QRD Android before 2017-06-05, the size of a stack-allocateQualcomm Android for MSM, Firefox OS for MSM, QRD Android
- CVE-2018-1232RSA Authentication Agent version 8.0.1 and earlier for Web for both IIS and Apache Web Server are impacted by a stack-based buffer overflow Dell EMC RSA Authentication Agent for Web for IIS, RSA Auth…
- CVE-2018-1233RSA Authentication Agent version 8.0.1 and earlier for Web for both IIS and Apache Web Server are affected by a cross-site scripting vulneraDell EMC RSA Authentication Agent for Web for IIS, RSA Auth…
- CVE-2018-1234RSA Authentication Agent version 8.0.1 and earlier for Web for IIS is affected by a problem where access control list (ACL) permissions on aDell EMC RSA Authentication Agent for Web for IIS
- CVE-2018-5708An issue was discovered on D-Link DIR-601 B1 2.02NA devices.
- CVE-2018-7171Directory traversal vulnerability in Twonky Server 7.0.11 through 8.5 allows remote attackers to share the contents of arbitrary directories
- CVE-2018-7203Cross-site scripting (XSS) vulnerability in Twonky Server 7.0.11 through 8.5 allows remote attackers to inject arbitrary web script or HTML
- CVE-2018-7566The Linux kernel 4.15 has a Buffer Overflow via an SNDRV_SEQ_IOCTL_SET_CLIENT_POOL ioctl write operation to /dev/snd/seq by a local user.
- CVE-2018-3817When logging warnings regarding deprecated settings, Logstash before 5.6.6 and 6.x before 6.1.2 could inadvertently log sensitive informatioElastic Logstash
- CVE-2018-3818Kibana versions 5.1.1 to 6.1.2 and 5.6.6 had a cross-site scripting (XSS) vulnerability via the colored fields formatter that could allow anElastic Kibana
- CVE-2018-3819The fix in Kibana for ESA-2017-23 was incomplete.Elastic Kibana
- CVE-2018-3820Kibana versions after 6.1.0 and before 6.1.3 had a cross-site scripting (XSS) vulnerability in labs visualizations that could allow an attacElastic Kibana
- CVE-2018-3821Kibana versions after 5.1.1 and before 5.6.7 and 6.1.3 had a cross-site scripting (XSS) vulnerability in the tag cloud visualization that coElastic Kibana
- CVE-2018-3822X-Pack Security versions 6.2.0, 6.2.1, and 6.2.2 are vulnerable to a user impersonation attack via incorrect XML canonicalization and DOM trElastic X-Pack Security
- CVE-2018-3728hoek node module before 4.2.0 and 5.0.x before 5.0.3 suffers from a Modification of Assumed-Immutable Data (MAID) vulnerability via 'merge' hapi hoek node module · hoek
- CVE-2018-3740A specially crafted HTML fragment can cause Sanitize gem for Ruby to allow non-whitelisted attributes to be used on a whitelisted HTML elemeRyan Grove sanitize · sanitize
- CVE-2018-3741There is a possible XSS vulnerability in all rails-html-sanitizer gem versions below 1.0.4 for Ruby.rails-html-sanitizer
- CVE-2018-9148Western Digital WD My Cloud v04.05.00-320 devices embed the session token (aka PHPSESSID) in filenames, which makes it easier for attackers
- CVE-2018-9151A NULL pointer dereference bug in the function ObReferenceObjectByHandle in the Kingsoft Internet Security 9+ kernel driver KWatch3.sys allo
- CVE-2017-1705IBM Security Privileged Identity Manager 2.1.0 contains left-over, sensitive information in page comments.IBM Security Privileged Identity Manager
- CVE-2017-1747A specially crafted message could cause a denial of service in IBM WebSphere MQ 9.0, 9.0.0.1, 9.0.0.2, 9.0.1, 9.0.2, 9.0.3, and 9.0.4 applicIBM MQ
- CVE-2017-1756IBM Business Process Manager 8.6 allows web pages to be stored locally which can be read by another user on the system.IBM Business Process Manager
- CVE-2017-1765IBM Business Process Manager 8.6 could allow an authenticated user with special privileges to reveal sensitive information about the applicaIBM Business Process Manager
- CVE-2017-1766Due to incorrect authorization in IBM Business Process Manager 8.6 an attacker can claim and work on ad hoc tasks he is not assigned to.IBM Business Process Manager
- CVE-2017-1767IBM Business Process Manager 8.6 is vulnerable to cross-site scripting.IBM Business Process Manager
- CVE-2018-1384IBM Business Process Manager 8.6 is vulnerable to cross-site scripting.IBM Business Process Manager
- CVE-2018-1390IBM Financial Transaction Manager for Check Services for Multi-Platform 3.0, 3.0.2, and 3.0.2.1 is vulnerable to cross-site scripting.IBM Financial Transaction Manager
- CVE-2018-9134file_manage_control.php in DedeCMS 5.7 has CSRF in an fmdo=rename action, as demonstrated by renaming an arbitrary file under uploads/userup
- CVE-2018-9147Cross-site scripting (XSS) vulnerabilities in version 7.5.7 of Gespage software allow remote attackers to inject arbitrary web script or HTM
- CVE-2017-11010In Android before 2018-01-05 on Qualcomm Snapdragon IoT, Snapdragon Mobile MDM9206, MDM9650, SD 210/SD 212/SD 205, SD 625, SD 650/52, SD 835Qualcomm Snapdragon IoT, Snapdragon Mobile
- CVE-2017-14906In Android before 2018-01-05 on Qualcomm Snapdragon IoT, Snapdragon Mobile MDM9206, MDM9607, MSM8909W, SD 210/SD 212/SD 205, SD 410/12, PKCSQualcomm Snapdragon IoT, Snapdragon Mobile
- CVE-2017-14911In Android before 2018-01-05 on Qualcomm Snapdragon IoT, Snapdragon Mobile, Snapdragon Automobile APQ8096AU, MDM9206, MDM9650, MSM8996AU, SDQualcomm Snapdragon IoT, Snapdragon Mobile, Snapdragon Auto…
- CVE-2017-14912In Android before 2018-01-05 on Qualcomm Snapdragon IoT, Snapdragon Mobile [VERSION]: MDM9206, MDM9607, MDM9650, MSM8909W, SD 200, SD 210/SDQualcomm Snapdragon IoT, Snapdragon Mobile
- CVE-2017-14913In Android before 2018-01-05 on Qualcomm Snapdragon IoT, Snapdragon Mobile MDM9206, SD 625, SD 650/52, SD 835, SD 845, DDR address input valQualcomm Snapdragon IoT, Snapdragon Mobile
- CVE-2017-14915In Android before 2018-01-05 on Qualcomm Snapdragon Mobile SD 625, SD 650/52, SD 835, accessing SPCOM functions with a compromised client stQualcomm Snapdragon Mobile
- CVE-2017-9681In Android before 2017-08-05 on Qualcomm MSM, Firefox OS for MSM, QRD Android, and all Android releases from CAF using the Linux kernel, if Qualcomm Android for MSM, Firefox OS for MSM, QRD Android
- CVE-2018-5799In Zoho ManageEngine ServiceDesk Plus before 9403, an XSS issue allows an attacker to run arbitrary JavaScript via a /api/request/?OPERATION
- CVE-2018-9130IBOS 4.4.3 has XSS via a company full name.
- CVE-2018-9132libming 0.4.8 has a NULL pointer dereference in the getInt function of the decompile.c file.
- CVE-2018-9133ImageMagick 7.0.7-26 Q16 has excessive iteration in the DecodeLabImage and EncodeLabImage functions (coders/tiff.c), which results in a hang
- CVE-2018-9135In ImageMagick 7.0.7-24 Q16, there is a heap-based buffer over-read in IsWEBPImageLossless in coders/webp.c.
- CVE-2018-9136windrvr1260.sys in Jungo DriverWizard WinDriver 12.6.0 allows attackers to cause a denial of service (BSOD) via a crafted .exe file, a diffe
- CVE-2018-9138An issue was discovered in cplus-dem.c in GNU libiberty, as distributed in GNU Binutils 2.29 and 2.30.
- CVE-2018-9139On Samsung mobile devices with N(7.x) software, a buffer overflow in the vision service allows code execution in a privileged process via a
- CVE-2018-9140On Samsung mobile devices with M(6.0) software, the Email application allows XSS via an event attribute and arbitrary file loading via a src
- CVE-2018-9141On Samsung mobile devices with L(5.x), M(6.0), and N(7.x) software, Gallery allows remote attackers to execute arbitrary code via a BMP file
- CVE-2018-9142On Samsung mobile devices with N(7.x) software, attackers can install an arbitrary APK in the Secure Folder SD Card area because of faulty v
- CVE-2018-9143On Samsung mobile devices with M(6.0) and N(7.x) software, a heap overflow in the sensorhub binder service leads to code execution in a priv
- CVE-2018-9144In Exiv2 0.26, there is an out-of-bounds read in Exiv2::Internal::binaryToString in image.cpp.
- CVE-2018-9145In the DataBuf class in include/exiv2/types.hpp in Exiv2 0.26, an issue exists in the constructor with an initial buffer size.