# CVEs published 2018-03-30

71 CVEs were published on March 30, 2018: 0 critical, 0 high. Days are UTC.

- [CVE-2017-11087](https://cve.now/CVE-2017-11087.md): libOmxVenc in Android for MSM, Firefox OS for MSM, and QRD Android copies the output buffer to an application with the "filled length", whic (no CVSS, Qualcomm Android for MSM, Firefox OS for MSM, QRD Android)
- [CVE-2017-14875](https://cve.now/CVE-2017-14875.md): In the handler for the ioctl command VIDIOC\_MSM\_ISP\_DUAL\_HW\_LPM\_MODE in Android for MSM, Firefox OS for MSM, and QRD Android before 2017-05- (no CVSS, Qualcomm Android for MSM, Firefox OS for MSM, QRD Android)
- [CVE-2017-14876](https://cve.now/CVE-2017-14876.md): In msm\_ispif\_config\_stereo() in Android for MSM, Firefox OS for MSM, and QRD Android before 2017-06-21, the parameter params-\>entries\[i\].vfe (no CVSS, Qualcomm Android for MSM, Firefox OS for MSM, QRD Android)
- [CVE-2017-14877](https://cve.now/CVE-2017-14877.md): While the IPA driver in Android for MSM, Firefox OS for MSM, and QRD Android before 2017-08-31 is processing IOCTL commands there is no mute (no CVSS, Qualcomm Android for MSM, Firefox OS for MSM, QRD Android)
- [CVE-2017-14881](https://cve.now/CVE-2017-14881.md): While calling the IPA IOCTL handler for IPA\_IOC\_ADD\_HDR\_PROC\_CTX in Android for MSM, Firefox OS for MSM, and QRD Android before 2017-10-13, (no CVSS, Qualcomm Android for MSM, Firefox OS for MSM, QRD Android)
- [CVE-2017-14883](https://cve.now/CVE-2017-14883.md): In the function wma\_unified\_power\_debug\_stats\_event\_handler() in Android for MSM, Firefox OS for MSM, and QRD Android before 2017-10-18, if (no CVSS, Qualcomm Android for MSM, Firefox OS for MSM, QRD Android)
- [CVE-2017-14891](https://cve.now/CVE-2017-14891.md): In the KGSL driver function \_gpuobj\_map\_useraddr() in Android for MSM, Firefox OS for MSM, and QRD Android before 2017-10-12, the contents o (no CVSS, Qualcomm Android for MSM, Firefox OS for MSM, QRD Android)
- [CVE-2017-14892](https://cve.now/CVE-2017-14892.md): In the function msm\_pcm\_hw\_params() in Android for MSM, Firefox OS for MSM, and QRD Android before 2017-09-19, the return value of q6asm\_ope (no CVSS, Qualcomm Android for MSM, Firefox OS for MSM, QRD Android)
- [CVE-2017-15823](https://cve.now/CVE-2017-15823.md): In spectral\_create\_samp\_msg() in Android for MSM, Firefox OS for MSM, and QRD Android before 2017-10-11, some values from firmware are not p (no CVSS, Qualcomm Android for MSM, Firefox OS for MSM, QRD Android)
- [CVE-2017-15826](https://cve.now/CVE-2017-15826.md): Due to a race condition in MDSS rotator in Android for MSM, Firefox OS for MSM, and QRD Android before 2017-10-20, a double free vulnerabili (no CVSS, Qualcomm Android for MSM, Firefox OS for MSM, QRD Android)
- [CVE-2017-15846](https://cve.now/CVE-2017-15846.md): In the video\_ioctl2() function in the camera driver in Android for MSM, Firefox OS for MSM, and QRD Android before 2017-09-16, an untrusted (no CVSS, Qualcomm Android for MSM, Firefox OS for MSM, QRD Android)
- [CVE-2017-15852](https://cve.now/CVE-2017-15852.md): Information leak of the ISPIF base address in Android for MSM, Firefox OS for MSM, and QRD Android can occur in the camera driver. (no CVSS, Qualcomm Android for MSM, Firefox OS for MSM, QRD Android)
- [CVE-2017-15859](https://cve.now/CVE-2017-15859.md): While processing the QCA\_NL80211\_VENDOR\_SUBCMD\_SET\_TXPOWER\_SCALE\_DECR\_DB vendor command, in which attribute QCA\_WLAN\_VENDOR\_ATTR\_TXPOWER\_SCA (no CVSS, Qualcomm Android for MSM, Firefox OS for MSM, QRD Android)
- [CVE-2017-16614](https://cve.now/CVE-2017-16614.md): SSRF (Server Side Request Forgery) in tpshop 2.0.5 and 2.0.6 allows remote attackers to obtain sensitive information, attack intranet hosts, (no CVSS)
- [CVE-2017-17766](https://cve.now/CVE-2017-17766.md): In wma\_peer\_info\_event\_handler() in Android for MSM, Firefox OS for MSM, and QRD Android before 2017-10-03, the value of num\_peers received (no CVSS, Qualcomm Android for MSM, Firefox OS for MSM, QRD Android)
- [CVE-2017-17769](https://cve.now/CVE-2017-17769.md): Information leakage in Android for MSM, Firefox OS for MSM, and QRD Android can occur in the audio driver. (no CVSS, Qualcomm Android for MSM, Firefox OS for MSM, QRD Android)
- [CVE-2017-17771](https://cve.now/CVE-2017-17771.md): In msm\_isp\_prepare\_v4l2\_buf in Android for MSM, Firefox OS for MSM, and QRD Android before 2017-02-12, an array out of bounds can occur. (no CVSS, Qualcomm Android for MSM, Firefox OS for MSM, QRD Android)
- [CVE-2017-9691](https://cve.now/CVE-2017-9691.md): There is a race condition in Android for MSM, Firefox OS for MSM, and QRD Android that allows to access to already free'd memory in the debu (no CVSS, Qualcomm Android for MSM, Firefox OS for MSM, QRD Android)
- [CVE-2017-9692](https://cve.now/CVE-2017-9692.md): When an atomic commit is issued on a writeback panel with a NULL output\_layer parameter in Android for MSM, Firefox OS for MSM, and QRD Andr (no CVSS, Qualcomm Android for MSM, Firefox OS for MSM, QRD Android)
- [CVE-2017-9693](https://cve.now/CVE-2017-9693.md): The length of attribute value for STA\_EXT\_CAPABILITY in \_\_wlan\_hdd\_change\_station in Android for MSM, Firefox OS for MSM, and QRD Android be (no CVSS, Qualcomm Android for MSM, Firefox OS for MSM, QRD Android)
- [CVE-2017-9694](https://cve.now/CVE-2017-9694.md): While parsing Netlink attributes in QCA\_WLAN\_VENDOR\_ATTR\_EXTSCAN\_BSSID\_HOTLIST\_PARAMS\_LOST\_AP\_SAMPLE\_SIZE in qcacld 2.0 before 2017-05-16, a (no CVSS, Qualcomm Android for MSM, Firefox OS for MSM, QRD Android)
- [CVE-2017-9723](https://cve.now/CVE-2017-9723.md): The touchscreen driver synaptics\_dsx in Android for MSM, Firefox OS for MSM, and QRD Android before 2017-06-05, the size of a stack-allocate (no CVSS, Qualcomm Android for MSM, Firefox OS for MSM, QRD Android)
- [CVE-2018-1232](https://cve.now/CVE-2018-1232.md): RSA Authentication Agent version 8.0.1 and earlier for Web for both IIS and Apache Web Server are impacted by a stack-based buffer overflow (no CVSS, Dell EMC RSA Authentication Agent for Web for IIS, RSA Auth…)
- [CVE-2018-1233](https://cve.now/CVE-2018-1233.md): RSA Authentication Agent version 8.0.1 and earlier for Web for both IIS and Apache Web Server are affected by a cross-site scripting vulnera (no CVSS, Dell EMC RSA Authentication Agent for Web for IIS, RSA Auth…)
- [CVE-2018-1234](https://cve.now/CVE-2018-1234.md): RSA Authentication Agent version 8.0.1 and earlier for Web for IIS is affected by a problem where access control list (ACL) permissions on a (no CVSS, Dell EMC RSA Authentication Agent for Web for IIS)
- [CVE-2018-5708](https://cve.now/CVE-2018-5708.md): An issue was discovered on D-Link DIR-601 B1 2.02NA devices. (no CVSS)
- [CVE-2018-7171](https://cve.now/CVE-2018-7171.md): Directory traversal vulnerability in Twonky Server 7.0.11 through 8.5 allows remote attackers to share the contents of arbitrary directories (no CVSS)
- [CVE-2018-7203](https://cve.now/CVE-2018-7203.md): Cross-site scripting (XSS) vulnerability in Twonky Server 7.0.11 through 8.5 allows remote attackers to inject arbitrary web script or HTML (no CVSS)
- [CVE-2018-7566](https://cve.now/CVE-2018-7566.md): The Linux kernel 4.15 has a Buffer Overflow via an SNDRV\_SEQ\_IOCTL\_SET\_CLIENT\_POOL ioctl write operation to /dev/snd/seq by a local user. (no CVSS)
- [CVE-2018-3817](https://cve.now/CVE-2018-3817.md): When logging warnings regarding deprecated settings, Logstash before 5.6.6 and 6.x before 6.1.2 could inadvertently log sensitive informatio (no CVSS, Elastic Logstash)
- [CVE-2018-3818](https://cve.now/CVE-2018-3818.md): Kibana versions 5.1.1 to 6.1.2 and 5.6.6 had a cross-site scripting (XSS) vulnerability via the colored fields formatter that could allow an (no CVSS, Elastic Kibana)
- [CVE-2018-3819](https://cve.now/CVE-2018-3819.md): The fix in Kibana for ESA-2017-23 was incomplete. (no CVSS, Elastic Kibana)
- [CVE-2018-3820](https://cve.now/CVE-2018-3820.md): Kibana versions after 6.1.0 and before 6.1.3 had a cross-site scripting (XSS) vulnerability in labs visualizations that could allow an attac (no CVSS, Elastic Kibana)
- [CVE-2018-3821](https://cve.now/CVE-2018-3821.md): Kibana versions after 5.1.1 and before 5.6.7 and 6.1.3 had a cross-site scripting (XSS) vulnerability in the tag cloud visualization that co (no CVSS, Elastic Kibana)
- [CVE-2018-3822](https://cve.now/CVE-2018-3822.md): X-Pack Security versions 6.2.0, 6.2.1, and 6.2.2 are vulnerable to a user impersonation attack via incorrect XML canonicalization and DOM tr (no CVSS, Elastic X-Pack Security)
- [CVE-2018-3728](https://cve.now/CVE-2018-3728.md): hoek node module before 4.2.0 and 5.0.x before 5.0.3 suffers from a Modification of Assumed-Immutable Data (MAID) vulnerability via 'merge' (no CVSS, hapi hoek node module · hoek)
- [CVE-2018-3740](https://cve.now/CVE-2018-3740.md): A specially crafted HTML fragment can cause Sanitize gem for Ruby to allow non-whitelisted attributes to be used on a whitelisted HTML eleme (no CVSS, Ryan Grove sanitize · sanitize)
- [CVE-2018-3741](https://cve.now/CVE-2018-3741.md): There is a possible XSS vulnerability in all rails-html-sanitizer gem versions below 1.0.4 for Ruby. (no CVSS, rails-html-sanitizer)
- [CVE-2018-9148](https://cve.now/CVE-2018-9148.md): Western Digital WD My Cloud v04.05.00-320 devices embed the session token (aka PHPSESSID) in filenames, which makes it easier for attackers (no CVSS)
- [CVE-2018-9151](https://cve.now/CVE-2018-9151.md): A NULL pointer dereference bug in the function ObReferenceObjectByHandle in the Kingsoft Internet Security 9+ kernel driver KWatch3.sys allo (no CVSS)
- [CVE-2017-1705](https://cve.now/CVE-2017-1705.md): IBM Security Privileged Identity Manager 2.1.0 contains left-over, sensitive information in page comments. (CVSS 4.3, IBM Security Privileged Identity Manager)
- [CVE-2017-1747](https://cve.now/CVE-2017-1747.md): A specially crafted message could cause a denial of service in IBM WebSphere MQ 9.0, 9.0.0.1, 9.0.0.2, 9.0.1, 9.0.2, 9.0.3, and 9.0.4 applic (CVSS 5.3, IBM MQ)
- [CVE-2017-1756](https://cve.now/CVE-2017-1756.md): IBM Business Process Manager 8.6 allows web pages to be stored locally which can be read by another user on the system. (CVSS 4.0, IBM Business Process Manager)
- [CVE-2017-1765](https://cve.now/CVE-2017-1765.md): IBM Business Process Manager 8.6 could allow an authenticated user with special privileges to reveal sensitive information about the applica (CVSS 3.1, IBM Business Process Manager)
- [CVE-2017-1766](https://cve.now/CVE-2017-1766.md): Due to incorrect authorization in IBM Business Process Manager 8.6 an attacker can claim and work on ad hoc tasks he is not assigned to. (CVSS 4.3, IBM Business Process Manager)
- [CVE-2017-1767](https://cve.now/CVE-2017-1767.md): IBM Business Process Manager 8.6 is vulnerable to cross-site scripting. (CVSS 5.4, IBM Business Process Manager)
- [CVE-2018-1384](https://cve.now/CVE-2018-1384.md): IBM Business Process Manager 8.6 is vulnerable to cross-site scripting. (CVSS 5.4, IBM Business Process Manager)
- [CVE-2018-1390](https://cve.now/CVE-2018-1390.md): IBM Financial Transaction Manager for Check Services for Multi-Platform 3.0, 3.0.2, and 3.0.2.1 is vulnerable to cross-site scripting. (CVSS 5.4, IBM Financial Transaction Manager)
- [CVE-2018-9134](https://cve.now/CVE-2018-9134.md): file\_manage\_control.php in DedeCMS 5.7 has CSRF in an fmdo=rename action, as demonstrated by renaming an arbitrary file under uploads/userup (no CVSS)
- [CVE-2018-9147](https://cve.now/CVE-2018-9147.md): Cross-site scripting (XSS) vulnerabilities in version 7.5.7 of Gespage software allow remote attackers to inject arbitrary web script or HTM (no CVSS)
- [CVE-2017-11010](https://cve.now/CVE-2017-11010.md): In Android before 2018-01-05 on Qualcomm Snapdragon IoT, Snapdragon Mobile MDM9206, MDM9650, SD 210/SD 212/SD 205, SD 625, SD 650/52, SD 835 (no CVSS, Qualcomm Snapdragon IoT, Snapdragon Mobile)
- [CVE-2017-14906](https://cve.now/CVE-2017-14906.md): In Android before 2018-01-05 on Qualcomm Snapdragon IoT, Snapdragon Mobile MDM9206, MDM9607, MSM8909W, SD 210/SD 212/SD 205, SD 410/12, PKCS (no CVSS, Qualcomm Snapdragon IoT, Snapdragon Mobile)
- [CVE-2017-14911](https://cve.now/CVE-2017-14911.md): In Android before 2018-01-05 on Qualcomm Snapdragon IoT, Snapdragon Mobile, Snapdragon Automobile APQ8096AU, MDM9206, MDM9650, MSM8996AU, SD (no CVSS, Qualcomm Snapdragon IoT, Snapdragon Mobile, Snapdragon Auto…)
- [CVE-2017-14912](https://cve.now/CVE-2017-14912.md): In Android before 2018-01-05 on Qualcomm Snapdragon IoT, Snapdragon Mobile \[VERSION\]: MDM9206, MDM9607, MDM9650, MSM8909W, SD 200, SD 210/SD (no CVSS, Qualcomm Snapdragon IoT, Snapdragon Mobile)
- [CVE-2017-14913](https://cve.now/CVE-2017-14913.md): In Android before 2018-01-05 on Qualcomm Snapdragon IoT, Snapdragon Mobile MDM9206, SD 625, SD 650/52, SD 835, SD 845, DDR address input val (no CVSS, Qualcomm Snapdragon IoT, Snapdragon Mobile)
- [CVE-2017-14915](https://cve.now/CVE-2017-14915.md): In Android before 2018-01-05 on Qualcomm Snapdragon Mobile SD 625, SD 650/52, SD 835, accessing SPCOM functions with a compromised client st (no CVSS, Qualcomm Snapdragon Mobile)
- [CVE-2017-9681](https://cve.now/CVE-2017-9681.md): In Android before 2017-08-05 on Qualcomm MSM, Firefox OS for MSM, QRD Android, and all Android releases from CAF using the Linux kernel, if (no CVSS, Qualcomm Android for MSM, Firefox OS for MSM, QRD Android)
- [CVE-2018-5799](https://cve.now/CVE-2018-5799.md): In Zoho ManageEngine ServiceDesk Plus before 9403, an XSS issue allows an attacker to run arbitrary JavaScript via a /api/request/?OPERATION (no CVSS)
- [CVE-2018-9130](https://cve.now/CVE-2018-9130.md): IBOS 4.4.3 has XSS via a company full name. (no CVSS)
- [CVE-2018-9132](https://cve.now/CVE-2018-9132.md): libming 0.4.8 has a NULL pointer dereference in the getInt function of the decompile.c file. (no CVSS)
- [CVE-2018-9133](https://cve.now/CVE-2018-9133.md): ImageMagick 7.0.7-26 Q16 has excessive iteration in the DecodeLabImage and EncodeLabImage functions (coders/tiff.c), which results in a hang (no CVSS)
- [CVE-2018-9135](https://cve.now/CVE-2018-9135.md): In ImageMagick 7.0.7-24 Q16, there is a heap-based buffer over-read in IsWEBPImageLossless in coders/webp.c. (no CVSS)
- [CVE-2018-9136](https://cve.now/CVE-2018-9136.md): windrvr1260.sys in Jungo DriverWizard WinDriver 12.6.0 allows attackers to cause a denial of service (BSOD) via a crafted .exe file, a diffe (no CVSS)
- [CVE-2018-9138](https://cve.now/CVE-2018-9138.md): An issue was discovered in cplus-dem.c in GNU libiberty, as distributed in GNU Binutils 2.29 and 2.30. (no CVSS)
- [CVE-2018-9139](https://cve.now/CVE-2018-9139.md): On Samsung mobile devices with N(7.x) software, a buffer overflow in the vision service allows code execution in a privileged process via a (no CVSS)
- [CVE-2018-9140](https://cve.now/CVE-2018-9140.md): On Samsung mobile devices with M(6.0) software, the Email application allows XSS via an event attribute and arbitrary file loading via a src (no CVSS)
- [CVE-2018-9141](https://cve.now/CVE-2018-9141.md): On Samsung mobile devices with L(5.x), M(6.0), and N(7.x) software, Gallery allows remote attackers to execute arbitrary code via a BMP file (no CVSS)
- [CVE-2018-9142](https://cve.now/CVE-2018-9142.md): On Samsung mobile devices with N(7.x) software, attackers can install an arbitrary APK in the Secure Folder SD Card area because of faulty v (no CVSS)
- [CVE-2018-9143](https://cve.now/CVE-2018-9143.md): On Samsung mobile devices with M(6.0) and N(7.x) software, a heap overflow in the sensorhub binder service leads to code execution in a priv (no CVSS)
- [CVE-2018-9144](https://cve.now/CVE-2018-9144.md): In Exiv2 0.26, there is an out-of-bounds read in Exiv2::Internal::binaryToString in image.cpp. (no CVSS)
- [CVE-2018-9145](https://cve.now/CVE-2018-9145.md): In the DataBuf class in include/exiv2/types.hpp in Exiv2 0.26, an issue exists in the constructor with an initial buffer size. (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2018-03-30
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.