# CVEs published 2018-03-31

9 CVEs were published on March 31, 2018: 0 critical, 0 high. Days are UTC.

- [CVE-2018-8893](https://cve.now/CVE-2018-8893.md): Z-BlogPHP 1.5.1 Zero has CSRF in plugin\_edit.php, resulting in the ability to execute arbitrary PHP code. (no CVSS)
- [CVE-2018-8908](https://cve.now/CVE-2018-8908.md): An issue was discovered in /admin/?/user/add in Frog CMS 0.9.5. (no CVSS)
- [CVE-2018-9161](https://cve.now/CVE-2018-9161.md): Prisma Industriale Checkweigher PrismaWEB 1.21 allows remote attackers to discover the hardcoded prisma password for the prismaweb account b (no CVSS)
- [CVE-2018-9162](https://cve.now/CVE-2018-9162.md): Contec Smart Home 4.15 devices do not require authentication for new\_user.php, edit\_user.php, delete\_user.php, and user.php, as demonstrated (no CVSS)
- [CVE-2015-9258](https://cve.now/CVE-2015-9258.md): In Docker Notary before 0.1, gotuf/signed/verify.go has a Signature Algorithm Not Matched to Key vulnerability. (no CVSS, github.com/docker/notary)
- [CVE-2015-9259](https://cve.now/CVE-2015-9259.md): In Docker Notary before 0.1, the checkRoot function in gotuf/client/client.go does not check expiry of root.json files, despite a comment st (no CVSS)
- [CVE-2018-9159](https://cve.now/CVE-2018-9159.md): In Spark before 2.7.2, a remote attacker can read unintended static files via various representations of absolute or relative pathnames, as (no CVSS, com.sparkjava:spark-core)
- [CVE-2018-9160](https://cve.now/CVE-2018-9160.md): SickRage before v2018.03.09-1 includes cleartext credentials in HTTP responses. (no CVSS, sickrage)
- [CVE-2017-18255](https://cve.now/CVE-2017-18255.md): The perf\_cpu\_time\_max\_percent\_handler function in kernel/events/core.c in the Linux kernel before 4.11 allows local users to cause a denial (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2018-03-31
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.