Weekly Vulnerabilities Reports > March 5 to 11, 2018
Overview
305 new vulnerabilities reported during this period, including 23 critical vulnerabilities and 58 high severity vulnerabilities. This weekly summary report vulnerabilities in 568 products from 112 vendors including Huawei, Debian, Cisco, Canonical, and Redhat. Vulnerabilities are notably categorized as "Cross-site Scripting", "Improper Input Validation", "Improper Restriction of Operations within the Bounds of a Memory Buffer", "Information Exposure", and "Out-of-bounds Read".
- 237 reported vulnerabilities are remotely exploitables.
- 17 reported vulnerabilities have public exploit available.
- 86 reported vulnerabilities are related to weaknesses in OWASP Top Ten.
- 262 reported vulnerabilities are exploitable by an anonymous user.
- Huawei has the most reported vulnerabilities, with 63 reported vulnerabilities.
- Dell has the most reported critical vulnerabilities, with 2 reported vulnerabilities.
VULNERABILITIES
VULNERABILITIES
VULNERABILITIES
VULNERABILITIES
VULNERABILITIES
EXPLOITABLE
EXPLOITABLE
AVAILABLE
ANONYMOUSLY
WEB APPLICATION
Vulnerability Details
The following table list reported vulnerabilities for the period covered by this report:
23 Critical Vulnerabilities
DATE | CVE | VENDOR | VULNERABILITY | CVSS |
---|---|---|---|---|
2018-03-09 | CVE-2014-6617 | Industrial Softing | Use of Hard-coded Credentials vulnerability in Industrial.Softing Fg-100 PB Profibus Firmware Fgx00Pbv2.02.0.00 Softing FG-100 PB PROFIBUS firmware version FG-x00-PB_V2.02.0.00 contains a hardcoded password for the root account, which allows remote attackers to obtain administrative access via a TELNET session. | 10.0 |
2018-03-08 | CVE-2018-7890 | Zohocorp | OS Command Injection vulnerability in Zohocorp Manageengine Applications Manager A remote code execution issue was discovered in Zoho ManageEngine Applications Manager before 13.6 (build 13640). | 10.0 |
2018-03-08 | CVE-2018-1216 | Dell | Use of Hard-coded Credentials vulnerability in Dell products A hard-coded password vulnerability was discovered in vApp Manager which is embedded in Dell EMC Unisphere for VMAX, Dell EMC Solutions Enabler, Dell EMC VASA Virtual Appliances, and Dell EMC VMAX Embedded Management (eManagement): Dell EMC Unisphere for VMAX Virtual Appliance versions prior to 8.4.0.18, Dell EMC Solutions Enabler Virtual Appliance versions prior to 8.4.0.21, Dell EMC VASA Virtual Appliance versions prior to 8.4.0.514, and Dell EMC VMAX Embedded Management (eManagement) versions prior to and including 1.4 (Enginuity Release 5977.1125.1125 and earlier). | 10.0 |
2018-03-08 | CVE-2017-7640 | Qnap | OS Command Injection vulnerability in Qnap Media Streaming Add-On QNAP NAS application Media Streaming add-on version 421.1.0.2, 430.1.2.0, and earlier allows remote attackers to run arbitrary OS commands against the system with root privileges. | 10.0 |
2018-03-08 | CVE-2018-0147 | Cisco | Deserialization of Untrusted Data vulnerability in Cisco Secure Access Control System 5.2(0.3) A vulnerability in Java deserialization used by Cisco Secure Access Control System (ACS) prior to release 5.8 patch 9 could allow an unauthenticated, remote attacker to execute arbitrary commands on an affected device. | 10.0 |
2018-03-06 | CVE-2018-6809 | Citrix | Unspecified vulnerability in Citrix products NetScaler ADC 10.5, 11.0, 11.1, and 12.0, and NetScaler Gateway 10.5, 11.0, 11.1, and 12.0 allow remote attackers to gain privilege on a target system. | 10.0 |
2018-03-05 | CVE-2018-7716 | Privatevpn | Unspecified vulnerability in Privatevpn 2.0.31 PrivateVPN 2.0.31 for macOS suffers from a root privilege escalation vulnerability with its com.privat.vpn.helper privileged helper tool. | 10.0 |
2018-03-05 | CVE-2018-7715 | Privatevpn | Unspecified vulnerability in Privatevpn 2.0.31 PrivateVPN 2.0.31 for macOS suffers from a root privilege escalation vulnerability with its com.privat.vpn.helper privileged helper tool. | 10.0 |
2018-03-05 | CVE-2018-7493 | Cactusvpn | Unspecified vulnerability in Cactusvpn CactusVPN through 6.0 for macOS suffers from a root privilege escalation vulnerability in its privileged helper tool. | 10.0 |
2018-03-05 | CVE-2018-7665 | Clip Bucket | Unrestricted Upload of File with Dangerous Type vulnerability in Clip-Bucket Clipbucket An issue was discovered in ClipBucket before 4.0.0 Release 4902. | 10.0 |
2018-03-05 | CVE-2018-7664 | Clip Bucket | OS Command Injection vulnerability in Clip-Bucket Clipbucket An issue was discovered in ClipBucket before 4.0.0 Release 4902. | 10.0 |
2018-03-07 | CVE-2016-5179 | Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability in Google Chrome OS Chrome OS before 53.0.2785.144 allows remote attackers to execute arbitrary commands at boot. | 9.8 | |
2018-03-06 | CVE-2018-6530 | Dlink | OS Command Injection vulnerability in Dlink products OS command injection vulnerability in soap.cgi (soapcgi_main in cgibin) in D-Link DIR-880L DIR-880L_REVA_FIRMWARE_PATCH_1.08B04 and previous versions, DIR-868L DIR868LA1_FW112b04 and previous versions, DIR-65L DIR-865L_REVA_FIRMWARE_PATCH_1.08.B01 and previous versions, and DIR-860L DIR860LA1_FW110b04 and previous versions allows remote attackers to execute arbitrary OS commands via the service parameter. | 9.8 |
2018-03-06 | CVE-2018-1343 | Netiq | Improper Authentication vulnerability in Netiq Privileged Account Manager PAM exposure enabling unauthenticated access to remote host | 9.8 |
2018-03-06 | CVE-2015-5377 | Elastic | Injection vulnerability in Elastic Elasticsearch Elasticsearch before 1.6.1 allows remote attackers to execute arbitrary code via unspecified vectors involving the transport protocol. | 9.8 |
2018-03-09 | CVE-2016-8783 | Huawei | Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability in Huawei Honor 6 Firmware and P9 Plus Firmware Touchscreen drive in Huawei H60 (Honor 6) Versions earlier than H60-L02_6.12.16 and P9 Plus Versions earlier than VIE-AL10BC00B356 has a stack overflow vulnerabilities. | 9.3 |
2018-03-09 | CVE-2017-17227 | Huawei | Out-of-bounds Read vulnerability in Huawei Mate 10 Firmware GPU driver in Huawei Mate 10 smart phones with the versions before ALP-L09 8.0.0.120(C212); The versions before ALP-L09 8.0.0.127(C900); The versions before ALP-L09 8.0.0.128(402/C02/C109/C346/C432/C652) has a out-of-bounds memory access vulnerability due to the input parameters validation. | 9.3 |
2018-03-09 | CVE-2018-0544 | Woodybells | Untrusted Search Path vulnerability in Woodybells Winshot Untrusted search path vulnerability in WinShot 1.53a and earlier (Installer) allows an attacker to gain privileges via a Trojan horse DLL in an unspecified directory. | 9.3 |
2018-03-09 | CVE-2018-0543 | Woodybells | Untrusted Search Path vulnerability in Woodybells Jtrim Untrusted search path vulnerability in Jtrim 1.53c and earlier (Installer) allows an attacker to gain privileges via a Trojan horse DLL in an unspecified directory. | 9.3 |
2018-03-07 | CVE-2018-1000118 | Electronjs | OS Command Injection vulnerability in Electronjs Electron Github Electron version Electron 1.8.2-beta.4 and earlier contains a Command Injection vulnerability in Protocol Handler that can result in command execute. | 9.3 |
2018-03-10 | CVE-2018-6312 | Foxconn | Weak Password Requirements vulnerability in Foxconn Ap-Fc4064-T Firmware Apgtb385.8.3Lb15W47Lte A privileged account with a weak default password on the Foxconn femtocell FEMTO AP-FC4064-T version AP_GT_B38_5.8.3lb15-W47 LTE Build 15 can be used to turn on the TELNET service via the web interface, which allows root login without any password. | 9.0 |
2018-03-09 | CVE-2018-6916 | Freebsd | Use After Free vulnerability in Freebsd 10.3/10.4/11.0 In FreeBSD before 11.1-STABLE, 11.1-RELEASE-p7, 10.4-STABLE, 10.4-RELEASE-p7, and 10.3-RELEASE-p28, the kernel does not properly validate IPsec packets coming from a trusted host. | 9.0 |
2018-03-08 | CVE-2018-1215 | Dell | Unrestricted Upload of File with Dangerous Type vulnerability in Dell products An arbitrary file upload vulnerability was discovered in vApp Manager which is embedded in Dell EMC Unisphere for VMAX, Dell EMC Solutions Enabler, Dell EMC VASA Virtual Appliances, and Dell EMC VMAX Embedded Management (eManagement): Dell EMC Unisphere for VMAX Virtual Appliance versions prior to 8.4.0.18, Dell EMC Solutions Enabler Virtual Appliance versions prior to 8.4.0.21, Dell EMC VASA Virtual Appliance versions prior to 8.4.0.514, and Dell EMC VMAX Embedded Management (eManagement) versions prior to and including 1.4 (Enginuity Release 5977.1125.1125 and earlier). | 9.0 |
58 High Vulnerabilities
DATE | CVE | VENDOR | VULNERABILITY | CVSS |
---|---|---|---|---|
2018-03-09 | CVE-2018-7999 | SIL | NULL Pointer Dereference vulnerability in SIL Graphite2 1.3.11 In libgraphite2 in graphite2 1.3.11, a NULL pointer dereference vulnerability was found in Segment.cpp during a dumbRendering operation, which may allow attackers to cause a denial of service or possibly have unspecified other impact via a crafted .ttf file. | 8.8 |
2018-03-05 | CVE-2017-18220 | Graphicsmagick | Use After Free vulnerability in Graphicsmagick 1.3.26 The ReadOneJNGImage and ReadJNGImage functions in coders/png.c in GraphicsMagick 1.3.26 allow remote attackers to cause a denial of service (magick/blob.c CloseBlob use-after-free) or possibly have unspecified other impact via a crafted file, a related issue to CVE-2017-11403. | 8.8 |
2018-03-09 | CVE-2017-17225 | Huawei | Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability in Huawei Mate 9 PRO Firmware The Near Field Communication (NFC) module in Huawei Mate 9 Pro mobile phones with the versions before LON-AL00B 8.0.0.340a(C00) has a buffer overflow vulnerability due to the lack of input validation. | 8.3 |
2018-03-09 | CVE-2018-0523 | Buffalo | OS Command Injection vulnerability in Buffalo Wxr-1900Dhp2 Firmware Buffalo WXR-1900DHP2 firmware Ver.2.48 and earlier allows an attacker to execute arbitrary OS commands via unspecified vectors. | 8.3 |
2018-03-09 | CVE-2018-0521 | Buffalo | Missing Authentication for Critical Function vulnerability in Buffalo Wxr-1900Dhp2 Firmware Buffalo WXR-1900DHP2 firmware Ver.2.48 and earlier allows an attacker to bypass authentication and execute arbitrary commands on the device via unspecified vectors. | 8.3 |
2018-03-09 | CVE-2017-10853 | Corega | Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability in Corega Cg-Wgr 1200 Firmware Buffer overflow in Corega CG-WGR1200 firmware 2.20 and earlier allows an attacker to execute arbitrary commands via unspecified vectors. | 8.3 |
2018-03-09 | CVE-2017-10852 | Corega | Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability in Corega Cg-Wgr 1200 Firmware Buffer overflow in Corega CG-WGR1200 firmware 2.20 and earlier allows an attacker to execute arbitrary code via unspecified vectors. | 8.3 |
2018-03-09 | CVE-2017-17223 | Huawei | Path Traversal vulnerability in Huawei products Huawei eSpace 7910 V200R003C30; eSpace 7950 V200R003C30; eSpace 8950 V200R003C00; V200R003C30 have a directory traversal vulnerability. | 8.0 |
2018-03-09 | CVE-2018-7235 | Schneider Electric | Improper Input Validation vulnerability in Schneider-Electric products A vulnerability exists in Schneider Electric's Pelco Sarix Professional in all firmware versions prior to 3.29.67 which could allow arbitrary system file download due to lack of validation of the shell meta characters with the value of 'system.download.sd_file' | 7.8 |
2018-03-09 | CVE-2018-7234 | Schneider Electric | Improper Certificate Validation vulnerability in Schneider-Electric products A vulnerability exists in Schneider Electric's Pelco Sarix Professional in all firmware versions prior to 3.29.67 which could allow arbitrary system file download due to lack of validation of SSL certificate. | 7.8 |
2018-03-09 | CVE-2016-8786 | Huawei | Improper Input Validation vulnerability in Huawei products Huawei S12700 V200R005C00, V200R006C00, V200R007C00, V200R008C00, S5700 V200R006C00, V200R007C00, V200R008C00, S6700 V200R008C00, S7700 V200R001C00, V200R002C00, V200R003C00, V200R005C00, V200R006C00, V200R007C00, V200R008C00, S9700 V200R001C00, V200R002C00, V200R003C00, V200R005C00, V200R006C00, V200R007C00, V200R008C00 have a denial of service (DoS) vulnerability. | 7.8 |
2018-03-05 | CVE-2017-18218 | Linux | Use After Free vulnerability in Linux Kernel In drivers/net/ethernet/hisilicon/hns/hns_enet.c in the Linux kernel before 4.13, local users can cause a denial of service (use-after-free and BUG) or possibly have unspecified other impact by leveraging differences in skb handling between hns_nic_net_xmit_hw and hns_nic_net_xmit. | 7.8 |
2018-03-05 | CVE-2018-5453 | Moxa | Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability in Moxa products An Improper Handling of Length Parameter Inconsistency issue was discovered in Moxa OnCell G3100-HSPA Series version 1.4 Build 16062919 and prior. | 7.8 |
2018-03-11 | CVE-2018-8057 | Westernbridgegroup | SQL Injection vulnerability in Westernbridgegroup Razor 0.8.0 A SQL Injection vulnerability exists in Western Bridge Cobub Razor 0.8.0 via the channel_name or platform parameter in a /index.php?/manage/channel/addchannel request, related to /application/controllers/manage/channel.php. | 7.5 |
2018-03-09 | CVE-2018-7238 | Schneider Electric | Classic Buffer Overflow vulnerability in Schneider-Electric products A buffer overflow vulnerability exist in the web-based GUI of Schneider Electric's Pelco Sarix Professional in all firmware versions prior to 3.29.67 which could allow an unauthenticated, remote attacker to execute arbitrary code. | 7.5 |
2018-03-09 | CVE-2018-7233 | Schneider Electric | Improper Input Validation vulnerability in Schneider-Electric products A vulnerability exists in Schneider Electric's Pelco Sarix Professional in all firmware versions prior to 3.29.67 which could allow execution of commands due to lack of validation of the shell meta characters with the value of 'model_name' or 'mac_address'. | 7.5 |
2018-03-09 | CVE-2018-7232 | Schneider Electric | Improper Input Validation vulnerability in Schneider-Electric products A vulnerability exists in Schneider Electric's Pelco Sarix Professional in all firmware versions prior to 3.29.67 which could allow execution of commands due to lack of validation of the shell meta characters with the value of 'network.ieee8021x.delete_certs'. | 7.5 |
2018-03-09 | CVE-2018-7231 | Schneider Electric | Improper Input Validation vulnerability in Schneider-Electric products A vulnerability exists in Schneider Electric's Pelco Sarix Professional in all firmware versions prior to 3.29.67 which could allow execution of commands due to lack of validation of the shell meta characters with the value of 'system.opkg.remove'. | 7.5 |
2018-03-09 | CVE-2018-7229 | Schneider Electric | Use of Hard-coded Credentials vulnerability in Schneider-Electric products A vulnerability exists in Schneider Electric's Pelco Sarix Professional in all firmware versions prior to 3.29.67 which could allow an unauthenticated, remote attacker to bypass authentication and gain administrator privileges because the use of hardcoded credentials. | 7.5 |
2018-03-09 | CVE-2018-7228 | Schneider Electric | Improper Authentication vulnerability in Schneider-Electric products A vulnerability exists in Schneider Electric's Pelco Sarix Professional in all firmware versions prior to 3.29.67 which could allow an unauthenticated, remote attacker to bypass authentication and get the administrator privileges. | 7.5 |
2018-03-09 | CVE-2014-4861 | Thycotic | Credentials Management vulnerability in Thycotic Secret Server 8.6.000000/8.6.000009 The Remote Desktop Launcher in Thycotic Secret Server before 8.6.000010 does not properly cleanup a temporary file that contains an encrypted password once a session has ended. | 7.5 |
2018-03-09 | CVE-2014-2592 | Arubanetworks | Unrestricted Upload of File with Dangerous Type vulnerability in Arubanetworks web Management Portal 6.3.0.60730 Unrestricted file upload vulnerability in Aruba Web Management portal allows remote attackers to execute arbitrary code by uploading a file with an executable extension. | 7.5 |
2018-03-09 | CVE-2018-7998 | Libvips Debian | NULL Pointer Dereference vulnerability in multiple products In libvips before 8.6.3, a NULL function pointer dereference vulnerability was found in the vips_region_generate function in region.c, which allows remote attackers to cause a denial of service or possibly have unspecified other impact via a crafted image file. | 7.5 |
2018-03-09 | CVE-2018-0524 | Jubat | Unspecified vulnerability in Jubat Jubatus Jubatus 1.0.2 and earlier allows remote code execution via unspecified vectors. | 7.5 |
2018-03-08 | CVE-2018-7183 | NTP Freebsd Canonical Netapp | Out-of-bounds Write vulnerability in multiple products Buffer overflow in the decodearr function in ntpq in ntp 4.2.8p6 through 4.2.8p10 allows remote attackers to execute arbitrary code by leveraging an ntpq query and sending a response with a crafted array. | 7.5 |
2018-03-07 | CVE-2018-7753 | Mozilla | Improper Input Validation vulnerability in Mozilla Bleach 2.1/2.1.1/2.1.2 An issue was discovered in Bleach 2.1.x before 2.1.3. | 7.5 |
2018-03-07 | CVE-2017-12174 | Apache Redhat | Resource Exhaustion vulnerability in multiple products It was found that when Artemis and HornetQ before 2.4.0 are configured with UDP discovery and JGroups discovery a huge byte array is created when receiving an unexpected multicast message. | 7.5 |
2018-03-07 | CVE-2017-15367 | Bacula | SQL Injection vulnerability in Bacula Bacula-Web Bacula-web before 8.0.0-rc2 is affected by multiple SQL Injection vulnerabilities that could allow an attacker to access the Bacula database and, depending on configuration, escalate privileges on the server. | 7.5 |
2018-03-07 | CVE-2014-5044 | GNU | Integer Overflow or Wraparound vulnerability in GNU Libgfortran Multiple integer overflows in libgfortran might allow remote attackers to execute arbitrary code or cause a denial of service (Fortran application crash) via vectors related to array allocation. | 7.5 |
2018-03-07 | CVE-2018-1000116 | NET Snmp Debian | Out-of-bounds Write vulnerability in multiple products NET-SNMP version 5.7.2 contains a heap corruption vulnerability in the UDP protocol handler that can result in command execution. | 7.5 |
2018-03-07 | CVE-2018-7739 | Antsle | Improper Input Validation vulnerability in Antsle Antman antsle antman before 0.9.1a allows remote attackers to bypass authentication via invalid characters in the username and password parameters, as demonstrated by a username=>&password=%0a string to the /login URI. | 7.5 |
2018-03-07 | CVE-2016-7443 | Exponentcms | Unrestricted Upload of File with Dangerous Type vulnerability in Exponentcms Exponent CMS Exponent CMS 2.3.0 through 2.3.9 allows remote attackers to have unspecified impact via vectors related to "uploading files to wrong location." | 7.5 |
2018-03-06 | CVE-2018-5469 | Belden | Improper Restriction of Excessive Authentication Attempts vulnerability in Belden products An Improper Restriction of Excessive Authentication Attempts issue was discovered in Belden Hirschmann RS, RSR, RSB, MACH100, MACH1000, MACH4000, MS, and OCTOPUS Classic Platform Switches. | 7.5 |
2018-03-06 | CVE-2018-7732 | Yxtcmf | SQL Injection vulnerability in Yxtcmf An issue was discovered in YxtCMF 3.1. | 7.5 |
2018-03-06 | CVE-2018-1000101 | Mingw W64 | Unspecified vulnerability in Mingw-W64 5.0.3 Mingw-w64 version 5.0.3 and earlier, 5.0.4, 6.0.0 and 7.0.0 contains an Improper Null Termination (CWE-170) vulnerability in mingw-w64-crt (libc)->(v)snprintf that can result in The bug may be used to corrupt subsequent string functions. | 7.5 |
2018-03-05 | CVE-2018-7714 | Opencv | Reachable Assertion vulnerability in Opencv 3.4.1 The validateInputImageSize function in modules/imgcodecs/src/loadsave.cpp in OpenCV 3.4.1 allows remote attackers to cause a denial of service (assertion failure) because (pixels <= (1<<30)) may be false. | 7.5 |
2018-03-05 | CVE-2018-7713 | Opencv | Reachable Assertion vulnerability in Opencv 3.4.1 The validateInputImageSize function in modules/imgcodecs/src/loadsave.cpp in OpenCV 3.4.1 allows remote attackers to cause a denial of service (assertion failure) because (size.width <= (1<<20)) may be false. | 7.5 |
2018-03-05 | CVE-2018-7712 | Opencv | Reachable Assertion vulnerability in Opencv 3.4.1 The validateInputImageSize function in modules/imgcodecs/src/loadsave.cpp in OpenCV 3.4.1 allows remote attackers to cause a denial of service (assertion failure) because (size.height <= (1<<20)) may be false. | 7.5 |
2018-03-05 | CVE-2017-18215 | XV Project Opensuse | Out-of-bounds Write vulnerability in multiple products xvpng.c in xv 3.10a has memory corruption (out-of-bounds write) when decoding PNG comment fields, leading to crashes or potentially code execution, because it uses an incorrect length value. | 7.5 |
2018-03-05 | CVE-2018-5455 | Moxa | Improper Authentication vulnerability in Moxa products A Reliance on Cookies without Validation and Integrity Checking issue was discovered in Moxa OnCell G3100-HSPA Series version 1.4 Build 16062919 and prior. | 7.5 |
2018-03-05 | CVE-2018-1316 | Apache | Path Traversal vulnerability in Apache ODE The ODE process deployment web service was sensible to deployment messages with forged names. | 7.5 |
2018-03-05 | CVE-2018-7667 | Adminer | Server-Side Request Forgery (SSRF) vulnerability in Adminer Adminer through 4.3.1 has SSRF via the server parameter. | 7.5 |
2018-03-05 | CVE-2018-7666 | Clip Bucket | SQL Injection vulnerability in Clip-Bucket Clipbucket An issue was discovered in ClipBucket before 4.0.0 Release 4902. | 7.5 |
2018-03-10 | CVE-2018-6311 | Foxconn | Unspecified vulnerability in Foxconn Ap-Fc4064-T Firmware Apgtb385.8.3Lb15W47Lte One can gain root access on the Foxconn femtocell FEMTO AP-FC4064-T version AP_GT_B38_5.8.3lb15-W47 LTE Build 15 via UART pins without any restrictions, which leads to full system compromise and disclosure of user communications. | 7.2 |
2018-03-09 | CVE-2017-17146 | Huawei | Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability in Huawei Dp300 Firmware V500R002C00 Huawei DP300 V500R002C00 have a buffer overflow vulnerability due to the lack of validation. | 7.2 |
2018-03-08 | CVE-2018-5313 | Rapidscada | Incorrect Permission Assignment for Critical Resource vulnerability in Rapidscada Rapid Scada 5.5.0 A vulnerability allows local attackers to escalate privilege on Rapid Scada 5.5.0 because of weak C:\SCADA permissions. | 7.2 |
2018-03-08 | CVE-2014-7272 | Sddm Project Fedoraproject | Permissions, Privileges, and Access Controls vulnerability in multiple products Simple Desktop Display Manager (SDDM) before 0.10.0 allows local users to gain root privileges because code running as root performs write operations within a user home directory, and this user may have created links in advance (exploitation requires the user to win a race condition in the ~/.Xauthority chown case, but not other cases). | 7.2 |
2018-03-08 | CVE-2018-1182 | EMC RSA | Improper Privilege Management vulnerability in multiple products An issue was discovered in EMC RSA Identity Governance and Lifecycle versions 7.0.1, 7.0.2, all patch levels (hardware appliance and software bundle deployments only); RSA Via Lifecycle and Governance version 7.0, all patch levels (hardware appliance and software bundle deployments only); RSA Identity Management & Governance (RSA IMG) versions 6.9.0, 6.9.1, all patch levels (hardware appliance and software bundle deployments only). | 7.2 |
2018-03-08 | CVE-2018-0224 | Cisco | OS Command Injection vulnerability in Cisco Staros 21.3.0.67664/21.5.0 A vulnerability in the CLI of the Cisco StarOS operating system for Cisco ASR 5000 Series Aggregation Services Routers could allow an authenticated, local attacker to execute arbitrary commands with root privileges on an affected operating system. | 7.2 |
2018-03-08 | CVE-2018-0221 | Cisco | OS Command Injection vulnerability in Cisco Identity Services Engine A vulnerability in specific CLI commands for the Cisco Identity Services Engine (ISE) could allow an authenticated, local attacker to perform command injection to the underlying operating system or cause a hang or disconnect of the user session. | 7.2 |
2018-03-08 | CVE-2018-0217 | Cisco | OS Command Injection vulnerability in Cisco products A vulnerability in the CLI of the Cisco StarOS operating system for Cisco ASR 5000 Series Aggregation Services Routers could allow an authenticated, local attacker to perform a command injection attack on an affected system. | 7.2 |
2018-03-08 | CVE-2018-0141 | Cisco | Use of Hard-coded Credentials vulnerability in Cisco products A vulnerability in Cisco Prime Collaboration Provisioning (PCP) Software 11.6 could allow an unauthenticated, local attacker to log in to the underlying Linux operating system. | 7.2 |
2018-03-07 | CVE-2018-1000117 | Python | Classic Buffer Overflow vulnerability in Python Python Software Foundation CPython version From 3.2 until 3.6.4 on Windows contains a Buffer Overflow vulnerability in os.symlink() function on Windows that can result in Arbitrary code execution, likely escalation of privilege. | 7.2 |
2018-03-07 | CVE-2018-7738 | Kernel | Unspecified vulnerability in Kernel Util-Linux In util-linux before 2.32-rc1, bash-completion/umount allows local users to gain privileges by embedding shell commands in a mountpoint name, which is mishandled during a umount command (within Bash) by a different user, as demonstrated by logging in as root and entering umount followed by a tab character for autocompletion. | 7.2 |
2018-03-06 | CVE-2017-6282 | Nvidia | Write-what-where Condition vulnerability in multiple products NVIDIA Tegra kernel driver contains a vulnerability in NVMAP where an attacker has the ability to write an arbitrary value to an arbitrary location which may lead to an escalation of privileges. | 7.2 |
2018-03-09 | CVE-2017-17328 | Huawei | Integer Overflow or Wraparound vulnerability in Huawei Mha-Al00A Firmware Mhaal00Ac00B125 Huawei smartphones with software of MHA-AL00AC00B125 have an integer overflow vulnerability. | 7.1 |
2018-03-09 | CVE-2017-17250 | Huawei | Out-of-bounds Write vulnerability in Huawei products Huawei AR120-S V200R005C32; AR1200 V200R005C32; AR1200-S V200R005C32; AR150 V200R005C32; AR150-S V200R005C32; AR160 V200R005C32; AR200 V200R005C32; AR200-S V200R005C32; AR2200-S V200R005C32; AR3200 V200R005C32; V200R007C00; AR510 V200R005C32; NetEngine16EX V200R005C32; SRG1300 V200R005C32; SRG2300 V200R005C32; SRG3300 V200R005C32 have an out-of-bounds write vulnerability. | 7.1 |
2018-03-05 | CVE-2017-17428 | Cavium Cisco | Use of a Broken or Risky Cryptographic Algorithm vulnerability in multiple products Cavium Nitrox SSL, Nitrox V SSL, and TurboSSL software development kits (SDKs) allow remote attackers to decrypt TLS ciphertext data by leveraging a Bleichenbacher RSA padding oracle, aka a ROBOT attack. | 7.1 |
182 Medium Vulnerabilities
DATE | CVE | VENDOR | VULNERABILITY | CVSS |
---|---|---|---|---|
2018-03-10 | CVE-2017-18223 | BMC | Improper Authentication vulnerability in BMC Remedy Action Request System BMC Remedy AR System before 9.1 SP3, when Remedy AR Authentication is enabled, allows attackers to obtain administrative access. | 6.8 |
2018-03-09 | CVE-2018-7239 | Schneider Electric | Untrusted Search Path vulnerability in Schneider-Electric products A DLL hijacking vulnerability exists in Schneider Electric's SoMove Software and associated DTM software components in all versions prior to 2.6.2 which could allow an attacker to execute arbitrary code. | 6.8 |
2018-03-09 | CVE-2018-7230 | Schneider Electric | XXE vulnerability in Schneider-Electric products A XML external entity (XXE) vulnerability exists in the import.cgi of the web interface component of the Schneider Electric's Pelco Sarix Professional in all firmware versions prior to 3.29.67. | 6.8 |
2018-03-09 | CVE-2017-15315 | Huawei | Missing Release of Resource after Effective Lifetime vulnerability in Huawei products Patch module of Huawei NIP6300 V500R001C20SPC100, V500R001C20SPC200, NIP6600 V500R001C20SPC100, V500R001C20SPC200, Secospace USG6300 V500R001C20SPC100, V500R001C20SPC200, Secospace USG6500 V500R001C20SPC100, V500R001C20SPC200 has a memory leak vulnerability. | 6.8 |
2018-03-09 | CVE-2016-9606 | Redhat | Improper Input Validation vulnerability in Redhat Resteasy JBoss RESTEasy before version 3.1.2 could be forced into parsing a request with YamlProvider, resulting in unmarshalling of potentially untrusted data which could allow an attacker to execute arbitrary code with RESTEasy application permissions. | 6.8 |
2018-03-09 | CVE-2018-8002 | Podofo Project | Infinite Loop vulnerability in Podofo Project Podofo 0.9.5 In PoDoFo 0.9.5, there exists an infinite loop vulnerability in PdfParserObject::ParseFileComplete() in PdfParserObject.cpp which may result in stack overflow. | 6.8 |
2018-03-09 | CVE-2018-8001 | Podofo Project | Out-of-bounds Read vulnerability in Podofo Project Podofo 0.9.5 In PoDoFo 0.9.5, there exists a heap-based buffer over-read vulnerability in UnescapeName() in PdfName.cpp. | 6.8 |
2018-03-09 | CVE-2018-8000 | Podofo Project | Out-of-bounds Write vulnerability in Podofo Project Podofo 0.9.5 In PoDoFo 0.9.5, there exists a heap-based buffer overflow vulnerability in PoDoFo::PdfTokenizer::GetNextToken() in PdfTokenizer.cpp, a related issue to CVE-2017-5886. | 6.8 |
2018-03-09 | CVE-2017-17324 | Huawei | Integer Overflow or Wraparound vulnerability in Huawei Mate 9 PRO Firmware Lonal00Bc00B139D/Lonal00Bc00B229 Huawei Mate 9 Pro smartphones with software LON-AL00BC00B139D; LON-AL00BC00B229 have an integer overflow vulnerability. | 6.8 |
2018-03-09 | CVE-2017-17226 | Tripadvisor | Improper Input Validation vulnerability in Tripadvisor Tamobileapp The TripAdvisor app with the versions before TAMobileApp-24.6.4 pre-installed in some Huawei mobile phones have an arbitrary URL loading vulnerability due to insufficient input validation and improper configuration. | 6.8 |
2018-03-09 | CVE-2018-0522 | Buffalo | Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability in Buffalo Wxr-1900Dhp2 Firmware Buffer overflow in Buffalo WXR-1900DHP2 firmware Ver.2.48 and earlier allows an attacker to execute arbitrary code via a specially crafted file. | 6.8 |
2018-03-08 | CVE-2018-7889 | Calibre Ebook | Deserialization of Untrusted Data vulnerability in Calibre-Ebook Calibre 3.18.0 gui2/viewer/bookmarkmanager.py in Calibre 3.18 calls cPickle.load on imported bookmark data, which allows remote attackers to execute arbitrary code via a crafted .pickle file, as demonstrated by Python code that contains an os.system call. | 6.8 |
2018-03-08 | CVE-2018-7871 | Libming Debian | Out-of-bounds Read vulnerability in multiple products There is a heap-based buffer over-read in the getName function of util/decompile.c in libming 0.4.8 for CONSTANT16 data. | 6.8 |
2018-03-08 | CVE-2018-1442 | IBM | Cross-Site Request Forgery (CSRF) vulnerability in IBM Monitoring 8.1.4 IBM Application Performance Management - Response Time Monitoring Agent (IBM Monitoring 8.1.4) is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts. | 6.8 |
2018-03-08 | CVE-2017-7641 | Qnap | Cross-Site Request Forgery (CSRF) vulnerability in Qnap Media Streaming Add-On QNAP NAS application Media Streaming add-on version 421.1.0.2, 430.1.2.0, and earlier does not utilize CSRF protections. | 6.8 |
2018-03-08 | CVE-2018-0215 | Cisco | Cross-Site Request Forgery (CSRF) vulnerability in Cisco Identity Services Engine 2.0(0.234) A vulnerability in the web-based management interface of Cisco Identity Services Engine (ISE) could allow an unauthenticated, remote attacker to conduct a cross-site request forgery (CSRF) attack and perform arbitrary actions on an affected device. | 6.8 |
2018-03-08 | CVE-2018-0210 | Cisco | Cross-Site Request Forgery (CSRF) vulnerability in Cisco Data Center Network Manager 10.4(1.128)/10.4(2) A vulnerability in the web-based management interface of Cisco Data Center Network Manager could allow an unauthenticated, remote attacker to conduct a cross-site request forgery (CSRF) attack and perform arbitrary actions on an affected device. | 6.8 |
2018-03-08 | CVE-2018-0209 | Cisco | Unspecified vulnerability in Cisco Small Business 500 Series Stackable Managed Switches Firmware 2.2.5.68/2.3.0.130 A vulnerability in the Simple Network Management Protocol (SNMP) subsystem communication channel through the Cisco 550X Series Stackable Managed Switches could allow an authenticated, remote attacker to cause the device to reload unexpectedly, causing a denial of service (DoS) condition. | 6.8 |
2018-03-08 | CVE-2018-0087 | Cisco | Improper Authentication vulnerability in Cisco Asyncos 10.5.1296 A vulnerability in the FTP server of the Cisco Web Security Appliance (WSA) could allow an unauthenticated, remote attacker to log in to the FTP server of the device without a valid password. | 6.8 |
2018-03-07 | CVE-2018-7752 | Gpac Debian Canonical | Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability in multiple products GPAC through 0.7.1 has a Buffer Overflow in the gf_media_avc_read_sps function in media_tools/av_parsers.c, a different vulnerability than CVE-2018-1000100. | 6.8 |
2018-03-07 | CVE-2018-7565 | Polycom | Cross-Site Request Forgery (CSRF) vulnerability in Polycom QDX 6000 Firmware CSRF exists on Polycom QDX 6000 devices. | 6.8 |
2018-03-07 | CVE-2018-7746 | Cobub | Cross-site Scripting vulnerability in Cobub Razor 0.7.2 An issue was discovered in Western Bridge Cobub Razor 0.7.2. | 6.8 |
2018-03-07 | CVE-2018-7720 | Cobub | Cross-Site Request Forgery (CSRF) vulnerability in Cobub Razor 0.7.2 A cross-site request forgery (CSRF) vulnerability exists in Western Bridge Cobub Razor 0.7.2 via /index.php?/user/createNewUser/, resulting in account creation. | 6.8 |
2018-03-07 | CVE-2017-11649 | Draytek | Cross-Site Request Forgery (CSRF) vulnerability in Draytek Vigorap 910C Firmware 1.2.0 Cross-site request forgery (CSRF) vulnerability in DrayTek Vigor AP910C devices with firmware 1.2.0_RC3 build r6594 allows remote attackers to hijack the authentication of unspecified users for requests that enable SNMP on the remote device via vectors involving goform/setSnmp. | 6.8 |
2018-03-06 | CVE-2018-5465 | Belden | Session Fixation vulnerability in Belden products A Session Fixation issue was discovered in Belden Hirschmann RS, RSR, RSB, MACH100, MACH1000, MACH4000, MS, and OCTOPUS Classic Platform Switches. | 6.8 |
2018-03-06 | CVE-2018-7733 | Yxtcmf | Cross-Site Request Forgery (CSRF) vulnerability in Yxtcmf An issue was discovered in YxtCMF 3.1. | 6.8 |
2018-03-06 | CVE-2018-1000100 | Gpac Project Canonical | Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability in multiple products GPAC MP4Box version 0.7.1 and earlier contains a Buffer Overflow vulnerability in src/isomedia/avc_ext.c lines 2417 to 2420 that can result in Heap chunks being modified, this could lead to RCE. | 6.8 |
2018-03-06 | CVE-2018-7307 | Auth0 | Cross-Site Request Forgery (CSRF) vulnerability in Auth0 Auth0.Js The Auth0 Auth0.js library before 9.3 has CSRF because it mishandles the case where the authorization response lacks the state parameter. | 6.8 |
2018-03-05 | CVE-2018-7711 | Simplesamlphp Debian | Improper Verification of Cryptographic Signature vulnerability in multiple products HTTPRedirect.php in the saml2 library in SimpleSAMLphp before 1.15.4 has an incorrect check of return values in the signature validation utilities, allowing an attacker to get invalid signatures accepted as valid by forcing an error during validation. | 6.8 |
2018-03-09 | CVE-2016-0276 | IBM | Improper Input Validation vulnerability in IBM Financial Transaction Manager IBM Financial Transaction Manager (FTM) for ACH Services for Multi-Platform 2.1.1.2 and 3.0.0.x before fp0013, Financial Transaction Manager (FTM) for Check Services for Multi-Platform 2.1.1.2 and 3.0.0.x before fp0013, and Financial Transaction Manager (FTM) for Corporate Payment Services (CPS) for Multi-Platform 2.1.1.2 and 3.0.0.x before fp0013 allows remote attackers to execute arbitrary code via a crafted serialized Java Message Service (JMS) ObjectMessage object. | 6.5 |
2018-03-09 | CVE-2017-17222 | Huawei | Improper Input Validation vulnerability in Huawei Espace 7950 Firmware and Espace 8950 Firmware Import Language Package function in Huawei eSpace 7950 V200R003C30; eSpace 8950 V200R003C00; V200R003C30 has a remote code execution vulnerability. | 6.5 |
2018-03-09 | CVE-2017-17221 | Huawei | Improper Input Validation vulnerability in Huawei Espace 7950 Firmware and Espace 8950 Firmware Import Signal Tone function in Huawei eSpace 7950 V200R003C30; eSpace 8950 V200R003C00; V200R003C30 has a remote code execution vulnerability. | 6.5 |
2018-03-08 | CVE-2018-7876 | Libming Debian | Resource Exhaustion vulnerability in multiple products In libming 0.4.8, a memory exhaustion vulnerability was found in the function parseSWF_ACTIONRECORD in util/parser.c, which allows remote attackers to cause a denial of service via a crafted file. | 6.5 |
2018-03-08 | CVE-2018-7873 | Libming Debian | Out-of-bounds Write vulnerability in multiple products There is a heap-based buffer overflow in the getString function of util/decompile.c in libming 0.4.8 for INTEGER data. | 6.5 |
2018-03-08 | CVE-2018-7866 | Libming Debian | NULL Pointer Dereference vulnerability in multiple products A NULL pointer dereference was discovered in newVar3 in util/decompile.c in libming 0.4.8. | 6.5 |
2018-03-08 | CVE-2018-0213 | Cisco | Improper Input Validation vulnerability in Cisco Identity Services Engine 2.1(0.904) A vulnerability in the credential reset functionality for Cisco Identity Services Engine (ISE) could allow an authenticated, remote attacker to gain elevated privileges. | 6.5 |
2018-03-06 | CVE-2018-7735 | Afian | SQL Injection vulnerability in Afian Filerun Afian FileRun (before 2018.02.13) suffers from a remote SQL injection vulnerability, when logged in as superuser, via the search parameter in a /?module=metadata§ion=cpanel&page=list_filetypes request. | 6.5 |
2018-03-06 | CVE-2018-7734 | Afian | SQL Injection vulnerability in Afian Filerun Afian FileRun (before 2018.02.13) suffers from a remote SQL injection vulnerability, when logged in as superuser, via the search parameter in a /?module=users§ion=cpanel&page=list request. | 6.5 |
2018-03-05 | CVE-2017-18219 | Graphicsmagick Debian | Allocation of Resources Without Limits or Throttling vulnerability in multiple products An issue was discovered in GraphicsMagick 1.3.26. | 6.5 |
2018-03-09 | CVE-2018-7237 | Schneider Electric | Improper Input Validation vulnerability in Schneider-Electric products A vulnerability exists in Schneider Electric's Pelco Sarix Professional in all firmware versions prior to 3.29.67 which could allow a remote attacker to delete arbitrary system file due to lack of validation of the /login/bin/set_param to the file name with the value of 'system.delete.sd_file' | 6.4 |
2018-03-08 | CVE-2017-7638 | Qnap | Improper Authentication vulnerability in Qnap Media Streaming Add-On QNAP NAS application Media Streaming add-on version 421.1.0.2, 430.1.2.0, and earlier does not authenticate requests properly. | 6.4 |
2018-03-06 | CVE-2018-5467 | Belden | Information Exposure vulnerability in Belden products An Information Exposure Through Query Strings in GET Request issue was discovered in Belden Hirschmann RS, RSR, RSB, MACH100, MACH1000, MACH4000, MS, and OCTOPUS Classic Platform Switches. | 6.4 |
2018-03-06 | CVE-2017-15519 | Netapp | Improper Authentication vulnerability in Netapp Snapcenter Server 2.0/3.0/3.0.1 Versions of SnapCenter 2.0 through 3.0.1 allow unauthenticated remote attackers to view and modify backup related data via the Plug-in for NAS File Services. | 6.4 |
2018-03-05 | CVE-2017-17131 | Huawei | Infinite Loop vulnerability in Huawei products Huawei DP300 V500R002C00; RP200 V500R002C00; V600R006C00; TE30 V100R001C10; V600R006C00; TE50 V600R006C00; TE60 V100R001C10; V500R002C00; V600R006C00; VP9660 V500R002C10 have an DoS vulnerability due to insufficient validation of the parameter when a putty comment key is loaded. | 6.3 |
2018-03-06 | CVE-2018-7736 | Zblogcn | Cross-site Scripting vulnerability in Zblogcn Z-Blogphp 1.5.1.1740 In Z-BlogPHP 1.5.1.1740, cmd.php has XSS via the ZC_BLOG_SUBNAME parameter or ZC_UPLOAD_FILETYPE parameter. | 6.1 |
2018-03-06 | CVE-2018-6529 | Dlink | Cross-site Scripting vulnerability in Dlink products XSS vulnerability in htdocs/webinc/js/bsc_sms_inbox.php in D-Link DIR-868L DIR868LA1_FW112b04 and previous versions, DIR-865L DIR-865L_REVA_FIRMWARE_PATCH_1.08.B01 and previous versions, and DIR-860L DIR860LA1_FW110b04 and previous versions allows remote attackers to read a cookie via a crafted Treturn parameter to soap.cgi. | 6.1 |
2018-03-06 | CVE-2018-6528 | Dlink | Cross-site Scripting vulnerability in Dlink products XSS vulnerability in htdocs/webinc/body/bsc_sms_send.php in D-Link DIR-868L DIR868LA1_FW112b04 and previous versions, DIR-865L DIR-865L_REVA_FIRMWARE_PATCH_1.08.B01 and previous versions, and DIR-860L DIR860LA1_FW110b04 and previous versions allows remote attackers to read a cookie via a crafted receiver parameter to soap.cgi. | 6.1 |
2018-03-06 | CVE-2018-6527 | Dlink | Cross-site Scripting vulnerability in Dlink products XSS vulnerability in htdocs/webinc/js/adv_parent_ctrl_map.php in D-Link DIR-868L DIR868LA1_FW112b04 and previous versions, DIR-865L DIR-865L_REVA_FIRMWARE_PATCH_1.08.B01 and previous versions, and DIR-860L DIR860LA1_FW110b04 and previous versions allows remote attackers to read a cookie via a crafted deviceid parameter to soap.cgi. | 6.1 |
2018-03-05 | CVE-2017-7437 | Netiq | Cross-site Scripting vulnerability in Netiq Privileged Account Manager 3.1 NetIQ Privileged Account Manager before 3.1 Patch Update 3 allowed cross site scripting attacks via the "type" and "account" parameters of json requests. | 6.1 |
2018-03-05 | CVE-2017-7427 | Netiq | Cross-site Scripting vulnerability in Netiq Identity Manager 4.5/4.6 Multiple cross site scripting attacks were found in the Identity Manager Plug-in, hosted on iManager 2.7.7.7, before Identity Manager 4.6.1. | 6.1 |
2018-03-09 | CVE-2016-0272 | IBM | Cross-Site Request Forgery (CSRF) vulnerability in IBM Financial Transaction Manager Cross-site request forgery (CSRF) vulnerability in IBM Financial Transaction Manager (FTM) for ACH Services for Multi-Platform 2.1.1.2 and 3.0.0.x before fp0013, Financial Transaction Manager (FTM) for Check Services for Multi-Platform 2.1.1.2 and 3.0.0.x before fp0013, and Financial Transaction Manager (FTM) for Corporate Payment Services (CPS) for Multi-Platform 2.1.1.2 and 3.0.0.x before fp0013 allows remote attackers to hijack the authentication of arbitrary users via unspecified vectors. | 6.0 |
2018-03-11 | CVE-2018-8059 | Suse | Improper Certificate Validation vulnerability in Suse Portus 2.3.0 The Djelibeybi configuration examples for use of NGINX in SUSE Portus 2.3, when applied to certain configurations involving Docker Compose, have a Missing SSL Certificate Validation issue because no proxy_ssl_* directives are used. | 5.8 |
2018-03-09 | CVE-2018-7236 | Schneider Electric | Improper Authentication vulnerability in Schneider-Electric products A vulnerability exists in Schneider Electric's Pelco Sarix Professional in all firmware versions prior to 3.29.67 which could enable SSH service due to lack of authentication for /login/bin/set_param could enable SSH service. | 5.8 |
2018-03-09 | CVE-2017-10854 | Corega | Missing Authentication for Critical Function vulnerability in Corega Cg-Wgr 1200 Firmware Corega CG-WGR1200 firmware 2.20 and earlier allows an attacker to bypass authentication and change the login password via unspecified vectors. | 5.8 |
2018-03-08 | CVE-2018-1220 | EMC | Open Redirect vulnerability in EMC RSA Archer EMC RSA Archer, versions prior to 6.2.0.8, contains a redirect vulnerability in the QuickLinks feature. | 5.8 |
2018-03-08 | CVE-2018-0216 | Cisco | Cross-Site Request Forgery (CSRF) vulnerability in Cisco Identity Services Engine A vulnerability in the web-based management interface of Cisco Identity Services Engine (ISE) could allow an unauthenticated, remote attacker to conduct a cross-site request forgery (CSRF) attack and perform arbitrary actions on an affected device. | 5.8 |
2018-03-07 | CVE-2018-7473 | Soconnect | Open Redirect vulnerability in Soconnect Sowifi Hotspot Firmware 140 Open redirect vulnerability in the SO Connect SO WIFI hotspot web interface, prior to version 140, allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL. | 5.8 |
2018-03-06 | CVE-2018-5461 | Belden | Inadequate Encryption Strength vulnerability in Belden products An Inadequate Encryption Strength issue was discovered in Belden Hirschmann RS, RSR, RSB, MACH100, MACH1000, MACH4000, MS, and OCTOPUS Classic Platform Switches. | 5.8 |
2018-03-09 | CVE-2017-17304 | Huawei | Improper Input Validation vulnerability in Huawei Dp300 Firmware The CIDAM Protocol on some Huawei Products has multiple input validation vulnerabilities due to insufficient validation of specific messages when the protocol is implemented. | 5.5 |
2018-03-09 | CVE-2017-17170 | Huawei | Improper Input Validation vulnerability in Huawei Dp300 Firmware The CIDAM Protocol on some Huawei Products has multiple input validation vulnerabilities due to insufficient validation of specific messages when the protocol is implemented. | 5.5 |
2018-03-09 | CVE-2017-17169 | Huawei | Improper Input Validation vulnerability in Huawei Dp300 Firmware The CIDAM Protocol on some Huawei Products has multiple input validation vulnerabilities due to insufficient validation of specific messages when the protocol is implemented. | 5.5 |
2018-03-09 | CVE-2017-17168 | Huawei | Improper Input Validation vulnerability in Huawei Dp300 Firmware The CIDAM Protocol on some Huawei Products has multiple input validation vulnerabilities due to insufficient validation of specific messages when the protocol is implemented. | 5.5 |
2018-03-09 | CVE-2018-1071 | ZSH Debian Canonical Redhat | Stack-based Buffer Overflow vulnerability in multiple products zsh through version 5.4.2 is vulnerable to a stack-based buffer overflow in the exec.c:hashcmd() function. | 5.5 |
2018-03-06 | CVE-2018-7731 | Exempi Project Canonical | NULL Pointer Dereference vulnerability in multiple products An issue was discovered in Exempi through 2.4.4. | 5.5 |
2018-03-06 | CVE-2018-7730 | Exempi Project Debian Canonical | Out-of-bounds Read vulnerability in multiple products An issue was discovered in Exempi through 2.4.4. | 5.5 |
2018-03-06 | CVE-2018-7729 | Exempi Project Canonical | Out-of-bounds Read vulnerability in multiple products An issue was discovered in Exempi through 2.4.4. | 5.5 |
2018-03-06 | CVE-2018-7728 | Exempi Project Canonical Debian | Out-of-bounds Read vulnerability in multiple products An issue was discovered in Exempi through 2.4.4. | 5.5 |
2018-03-09 | CVE-2018-1069 | Redhat | Incorrect Permission Assignment for Critical Resource vulnerability in Redhat Openshift 3.7 Red Hat OpenShift Enterprise version 3.7 is vulnerable to access control override for container network filesystems. | 5.4 |
2018-03-09 | CVE-2018-7536 | Canonical Djangoproject Debian Redhat | Incorrect Regular Expression vulnerability in multiple products An issue was discovered in Django 2.0 before 2.0.3, 1.11 before 1.11.11, and 1.8 before 1.8.19. | 5.3 |
2018-03-07 | CVE-2018-7675 | Microfocus | Information Exposure vulnerability in Microfocus Sentinel In NetIQ Sentinel before 8.1.x, a Sentinel user is logged into the Sentinel Web Interface. | 5.3 |
2018-03-06 | CVE-2018-7737 | Zblogcn | Information Exposure vulnerability in Zblogcn Z-Blogphp 1.5.1.1740 In Z-BlogPHP 1.5.1.1740, there is Web Site physical path leakage, as demonstrated by admin_footer.php or admin_footer.php. | 5.3 |
2018-03-11 | CVE-2018-8056 | Cobub | Information Exposure vulnerability in Cobub Razor 0.8.0 Physical path Leakage exists in Western Bridge Cobub Razor 0.8.0 via an invalid channel_name parameter to /index.php?/manage/channel/addchannel or a direct request to /export.php. | 5.0 |
2018-03-11 | CVE-2018-7213 | Abine | Improper Authentication vulnerability in Abine Blur 7.8.2424 The Password Manager Extension in Abine Blur 7.8.242* before 7.8.2428 allows attackers to bypass the Multi-Factor Authentication and macOS disk-encryption protection mechanisms, and consequently exfiltrate secured data, because the right-click context menu is not secured. | 5.0 |
2018-03-09 | CVE-2018-7227 | Schneider Electric | Improper Authentication vulnerability in Schneider-Electric products A vulnerability exists in Schneider Electric's Pelco Sarix Professional in all firmware versions prior to 3.29.67 which could allow retrieving of specially crafted URLs without authentication that can reveal sensitive information to an attacker. | 5.0 |
2018-03-09 | CVE-2016-8782 | Huawei | Resource Management Errors vulnerability in Huawei Cloudengine 12800 Firmware Huawei CloudEngine 12800 V100R003C00, V100R003C10, V100R005C00, V100R005C10, V100R006C00 have a memory leak vulnerability. | 5.0 |
2018-03-09 | CVE-2018-7582 | Weblogexpert | Allocation of Resources Without Limits or Throttling vulnerability in Weblogexpert Weblog Expert 9.4 WebLog Expert Web Server Enterprise 9.4 allows Remote Denial Of Service (daemon crash) via a long HTTP Accept Header to TCP port 9991. | 5.0 |
2018-03-09 | CVE-2018-7537 | Canonical Djangoproject Debian | Incorrect Regular Expression vulnerability in multiple products An issue was discovered in Django 2.0 before 2.0.3, 1.11 before 1.11.11, and 1.8 before 1.8.19. | 5.0 |
2018-03-09 | CVE-2017-17220 | Huawei | Out-of-bounds Read vulnerability in Huawei products SCCPX module in Huawei DP300 V500R002C00; RP200 V500R002C00; V600R006C00; TE30 V100R001C10; V500R002C00; V600R006C00; TE40 V500R002C00; V600R006C00; TE50 V500R002C00; V600R006C00; TE60 V100R001C10; V500R002C00; V600R006C00 has an invalid memory access vulnerabilities. | 5.0 |
2018-03-09 | CVE-2017-17219 | Huawei | Improper Input Validation vulnerability in Huawei products SCCPX module in Huawei DP300 V500R002C00; RP200 V500R002C00; V600R006C00; TE30 V100R001C10; V500R002C00; V600R006C00; TE40 V500R002C00; V600R006C00; TE50 V500R002C00; V600R006C00; TE60 V100R001C10; V500R002C00; V600R006C00 has an invalid memory access vulnerabilities. | 5.0 |
2018-03-09 | CVE-2017-17218 | Huawei | Out-of-bounds Read vulnerability in Huawei products SCCPX module in Huawei DP300 V500R002C00; RP200 V500R002C00; V600R006C00; TE30 V100R001C10; V500R002C00; V600R006C00; TE40 V500R002C00; V600R006C00; TE50 V500R002C00; V600R006C00; TE60 V100R001C10; V500R002C00; V600R006C00 has an out-of-bounds read vulnerability. | 5.0 |
2018-03-09 | CVE-2018-0525 | Jubat | Path Traversal vulnerability in Jubat Jubatus Directory traversal vulnerability in Jubatus 1.0.2 and earlier allows remote attackers to read arbitrary files via unspecified vectors. | 5.0 |
2018-03-08 | CVE-2018-4840 | Siemens | Missing Authentication for Critical Function vulnerability in Siemens products A vulnerability has been identified in DIGSI 4 (All versions < V4.92), EN100 Ethernet module DNP3 variant (All versions < V1.05.00), EN100 Ethernet module IEC 104 variant (All versions), EN100 Ethernet module IEC 61850 variant (All versions < V4.30), EN100 Ethernet module Modbus TCP variant (All versions), EN100 Ethernet module PROFINET IO variant (All versions). | 5.0 |
2018-03-08 | CVE-2018-4838 | Siemens | Missing Authentication for Critical Function vulnerability in Siemens products A vulnerability has been identified in EN100 Ethernet module IEC 61850 variant (All versions < V4.30), EN100 Ethernet module DNP3 variant (All versions < V1.04), EN100 Ethernet module PROFINET IO variant (All versions), EN100 Ethernet module Modbus TCP variant (All versions), EN100 Ethernet module IEC 104 variant (All versions < V1.22). | 5.0 |
2018-03-08 | CVE-2018-1387 | IBM | Information Exposure vulnerability in IBM products IBM Application Performance Management for Monitoring & Diagnostics (IBM Monitoring 8.1.3 and 8.1.4) may release sensitive personal data to the staff who can access to the database of this product. | 5.0 |
2018-03-08 | CVE-2017-1625 | IBM | Information Exposure vulnerability in IBM Qradar Pulse IBM Pulse for QRadar 1.0.0 - 1.0.3 discloses sensitive information to unauthorized users. | 5.0 |
2018-03-07 | CVE-2018-7204 | Giribaz | Information Exposure Through Log Files vulnerability in Giribaz File Manager inc/logger.php in the Giribaz File Manager plugin before 5.0.2 for WordPress logged activity related to the plugin in /wp-content/uploads/file-manager/log.txt. | 5.0 |
2018-03-07 | CVE-2018-5452 | Emerson | Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability in Emerson Controlwave Micro Firmware A Stack-based Buffer Overflow issue was discovered in Emerson Process Management ControlWave Micro Process Automation Controller: ControlWave Micro [ProConOS v.4.01.280] firmware: CWM v.05.78.00 and prior. | 5.0 |
2018-03-07 | CVE-2018-7745 | Cobub | Improper Authentication vulnerability in Cobub Razor 0.7.2 An issue was discovered in Western Bridge Cobub Razor 0.7.2. | 5.0 |
2018-03-07 | CVE-2018-1054 | Fedoraproject Redhat | Out-of-bounds Read vulnerability in multiple products An out-of-bounds memory read flaw was found in the way 389-ds-base handled certain LDAP search filters, affecting all versions including 1.4.x. | 5.0 |
2018-03-06 | CVE-2018-7185 | NTP Synology Canonical Netapp HPE Oracle | The protocol engine in ntp 4.2.6 before 4.2.8p11 allows a remote attackers to cause a denial of service (disruption) by continually sending a packet with a zero-origin timestamp and source IP address of the "other side" of an interleaved association causing the victim ntpd to reset its association. | 5.0 |
2018-03-06 | CVE-2018-7184 | NTP Synology Slackware Canonical Netapp | ntpd in ntp 4.2.8p4 before 4.2.8p11 drops bad packets before updating the "received" timestamp, which allows remote attackers to cause a denial of service (disruption) by sending a packet with a zero-origin timestamp causing the association to reset and setting the contents of the packet as the most recent timestamp. | 5.0 |
2018-03-06 | CVE-2018-7182 | NTP Canonical Netapp | Out-of-bounds Read vulnerability in multiple products The ctl_getitem method in ntpd in ntp-4.2.8p6 before 4.2.8p11 allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted mode 6 packet with a ntpd instance from 4.2.8p6 through 4.2.8p10. | 5.0 |
2018-03-06 | CVE-2018-6810 | Citrix | Path Traversal vulnerability in Citrix products Directory traversal vulnerability in NetScaler ADC 10.5, 11.0, 11.1, and 12.0, and NetScaler Gateway 10.5, 11.0, 11.1, and 12.0 allows remote attackers to traverse the directory on the target system via a crafted request. | 5.0 |
2018-03-06 | CVE-2018-6808 | Citrix | Information Exposure vulnerability in Citrix products NetScaler ADC 10.5, 11.0, 11.1, and 12.0, and NetScaler Gateway 10.5, 11.0, 11.1, and 12.0 allow remote attackers to download arbitrary files on the target system. | 5.0 |
2018-03-06 | CVE-2017-6280 | Information Exposure vulnerability in Google Android NVIDIA driver contains a possible out-of-bounds read vulnerability due to a leak which may lead to information disclosure. | 5.0 | |
2018-03-05 | CVE-2017-17144 | Huawei | Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability in Huawei products Backup feature of SIP module in Huawei DP300 V500R002C00; V500R002C00SPC100; V500R002C00SPC200; V500R002C00SPC300; V500R002C00SPC400; V500R002C00SPC500; V500R002C00SPC600; V500R002C00SPC800; V500R002C00SPC900; V500R002C00SPCa00; RP200 V500R002C00SPC200; V600R006C00; V600R006C00SPC200; RSE6500 V500R002C00SPC100; V500R002C00SPC200; V500R002C00SPC300; V500R002C00SPC300T; V500R002C00SPC500; V500R002C00SPC600; V500R002C00SPC700; V500R002C00T; TE30 V100R001C10; V100R001C10SPC100; V100R001C10SPC200B010; V100R001C10SPC300; V100R001C10SPC500; V100R001C10SPC600; V100R001C10SPC700B010; V100R001C10SPC800; V500R002C00SPC200; V500R002C00SPC500; V500R002C00SPC600; V500R002C00SPC700; V500R002C00SPC900; V500R002C00SPCb00; V600R006C00; TE40 V500R002C00SPC600; V500R002C00SPC700; V500R002C00SPC900; V500R002C00SPCb00; V600R006C00; V600R006C00SPC200; TE50 V500R002C00SPC600; V500R002C00SPC700; V500R002C00SPCb00; V600R006C00; V600R006C00SPC200; TE60 V100R001C01SPC100; V100R001C01SPC107TB010; V100R001C10; V100R001C10SPC300; V100R001C10SPC400; V100R001C10SPC500; V100R001C10SPC600; V100R001C10SPC700; V100R001C10SPC800; V100R001C10SPC900; V500R002C00; V500R002C00SPC100; V500R002C00SPC200; V500R002C00SPC300; V500R002C00SPC600; V500R002C00SPC700; V500R002C00SPC800; V500R002C00SPC900; V500R002C00SPCa00; V500R002C00SPCb00; V500R002C00SPCd00; V600R006C00; V600R006C00SPC100; V600R006C00SPC200; V600R006C00SPC300; TP3106 V100R002C00; V100R002C00SPC200; V100R002C00SPC400; V100R002C00SPC600; V100R002C00SPC700; V100R002C00SPC800; TP3206 V100R002C00; V100R002C00SPC200; V100R002C00SPC400; V100R002C00SPC600; V100R002C00SPC700; V100R002C10; ViewPoint 9030 V100R011C02SPC100; V100R011C03B012SP15; V100R011C03B012SP16; V100R011C03B015SP03; V100R011C03LGWL01SPC100; V100R011C03SPC100; V100R011C03SPC200; V100R011C03SPC300; V100R011C03SPC400; V100R011C03SPC500; eSpace U1960 V200R003C30SPC200; eSpace U1981 V100R001C20SPC700; V200R003C20SPCa00 has an overflow vulnerability when the module process a specific amount of state. | 5.0 |
2018-03-05 | CVE-2017-17143 | Huawei | Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability in Huawei products SIP module in Huawei DP300 V500R002C00; V500R002C00SPC100; V500R002C00SPC200; V500R002C00SPC300; V500R002C00SPC400; V500R002C00SPC500; V500R002C00SPC600; V500R002C00SPC800; V500R002C00SPC900; V500R002C00SPCa00; RP200 V500R002C00SPC200; V600R006C00; V600R006C00SPC200; RSE6500 V500R002C00SPC100; V500R002C00SPC200; V500R002C00SPC300; V500R002C00SPC300T; V500R002C00SPC500; V500R002C00SPC600; V500R002C00SPC700; V500R002C00T; TE30 V100R001C10; V100R001C10SPC100; V100R001C10SPC200B010; V100R001C10SPC300; V100R001C10SPC500; V100R001C10SPC600; V100R001C10SPC700B010; V100R001C10SPC800; V500R002C00SPC200; V500R002C00SPC500; V500R002C00SPC600; V500R002C00SPC700; V500R002C00SPC900; V500R002C00SPCb00; V600R006C00; TE40 V500R002C00SPC600; V500R002C00SPC700; V500R002C00SPC900; V500R002C00SPCb00; V600R006C00; V600R006C00SPC200; TE50 V500R002C00SPC600; V500R002C00SPC700; V500R002C00SPCb00; V600R006C00; V600R006C00SPC200; TE60 V100R001C01SPC100; V100R001C01SPC107TB010; V100R001C10; V100R001C10SPC300; V100R001C10SPC400; V100R001C10SPC500; V100R001C10SPC600; V100R001C10SPC700; V100R001C10SPC800; V100R001C10SPC900; V500R002C00; V500R002C00SPC100; V500R002C00SPC200; V500R002C00SPC300; V500R002C00SPC600; V500R002C00SPC700; V500R002C00SPC800; V500R002C00SPC900; V500R002C00SPCa00; V500R002C00SPCb00; V500R002C00SPCd00; V600R006C00; V600R006C00SPC100; V600R006C00SPC200; V600R006C00SPC300; TP3106 V100R002C00; V100R002C00SPC200; V100R002C00SPC400; V100R002C00SPC600; V100R002C00SPC700; V100R002C00SPC800; TP3206 V100R002C00; V100R002C00SPC200; V100R002C00SPC400; V100R002C00SPC600; V100R002C00SPC700; V100R002C10; ViewPoint 9030 V100R011C02SPC100; V100R011C03B012SP15; V100R011C03B012SP16; V100R011C03B015SP03; V100R011C03LGWL01SPC100; V100R011C03SPC100; V100R011C03SPC200; V100R011C03SPC300; V100R011C03SPC400; V100R011C03SPC500; eSpace U1960 V200R003C30SPC200; eSpace U1981 V100R001C20SPC700; V200R003C20SPCa00 has an overflow vulnerability that the module cannot parse a malformed SIP message when validating variables. | 5.0 |
2018-03-05 | CVE-2017-17142 | Huawei | Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability in Huawei products SIP module in Huawei DP300 V500R002C00; V500R002C00SPC100; V500R002C00SPC200; V500R002C00SPC300; V500R002C00SPC400; V500R002C00SPC500; V500R002C00SPC600; V500R002C00SPC800; V500R002C00SPC900; V500R002C00SPCa00; RP200 V500R002C00SPC200; V600R006C00; V600R006C00SPC200; RSE6500 V500R002C00SPC100; V500R002C00SPC200; V500R002C00SPC300; V500R002C00SPC300T; V500R002C00SPC500; V500R002C00SPC600; V500R002C00SPC700; V500R002C00T; TE30 V100R001C10; V100R001C10SPC100; V100R001C10SPC200B010; V100R001C10SPC300; V100R001C10SPC500; V100R001C10SPC600; V100R001C10SPC700B010; V100R001C10SPC800; V500R002C00SPC200; V500R002C00SPC500; V500R002C00SPC600; V500R002C00SPC700; V500R002C00SPC900; V500R002C00SPCb00; V600R006C00; TE40 V500R002C00SPC600; V500R002C00SPC700; V500R002C00SPC900; V500R002C00SPCb00; V600R006C00; V600R006C00SPC200; TE50 V500R002C00SPC600; V500R002C00SPC700; V500R002C00SPCb00; V600R006C00; V600R006C00SPC200; TE60 V100R001C01SPC100; V100R001C01SPC107TB010; V100R001C10; V100R001C10SPC300; V100R001C10SPC400; V100R001C10SPC500; V100R001C10SPC600; V100R001C10SPC700; V100R001C10SPC800; V100R001C10SPC900; V500R002C00; V500R002C00SPC100; V500R002C00SPC200; V500R002C00SPC300; V500R002C00SPC600; V500R002C00SPC700; V500R002C00SPC800; V500R002C00SPC900; V500R002C00SPCa00; V500R002C00SPCb00; V500R002C00SPCd00; V600R006C00; V600R006C00SPC100; V600R006C00SPC200; V600R006C00SPC300; TP3106 V100R002C00; V100R002C00SPC200; V100R002C00SPC400; V100R002C00SPC600; V100R002C00SPC700; V100R002C00SPC800; TP3206 V100R002C00; V100R002C00SPC200; V100R002C00SPC400; V100R002C00SPC600; V100R002C00SPC700; V100R002C10; ViewPoint 9030 V100R011C02SPC100; V100R011C03B012SP15; V100R011C03B012SP16; V100R011C03B015SP03; V100R011C03LGWL01SPC100; V100R011C03SPC100; V100R011C03SPC200; V100R011C03SPC300; V100R011C03SPC400; V100R011C03SPC500; eSpace U1960 V200R003C30SPC200; eSpace U1981 V100R001C20SPC700; V200R003C20SPCa00 has an overflow vulnerability that attacker can exploit by sending a specially crafted SIP message leading to a process reboot at random. | 5.0 |
2018-03-05 | CVE-2017-16922 | Wowza | Path Traversal vulnerability in Wowza Streaming Engine In com.wowza.wms.timedtext.http.HTTPProviderCaptionFile in Wowza Streaming Engine before 4.7.1, traversal of the directory structure and retrieval of a file are possible via a remote, specifically crafted HTTP request. | 5.0 |
2018-03-05 | CVE-2017-7633 | Qnap | Information Exposure vulnerability in Qnap Qfinder PRO 6.1.0.0317 QNAP Qfinder Pro 6.1.0.0317 and earlier may expose sensitive information contained in NAS devices. | 5.0 |
2018-03-05 | CVE-2018-0491 | Torproject | Use After Free vulnerability in Torproject TOR A use-after-free issue was discovered in Tor 0.3.2.x before 0.3.2.10. | 5.0 |
2018-03-05 | CVE-2018-0490 | Torproject Debian | NULL Pointer Dereference vulnerability in multiple products An issue was discovered in Tor before 0.2.9.15, 0.3.1.x before 0.3.1.10, and 0.3.2.x before 0.3.2.10. | 5.0 |
2018-03-05 | CVE-2018-7644 | Simplesamlphp | Improper Verification of Cryptographic Signature vulnerability in Simplesamlphp The XmlSecLibs library as used in the saml2 library in SimpleSAMLphp before 1.15.3 incorrectly verifies signatures on SAML assertions, allowing a remote attacker to construct a crafted SAML assertion on behalf of an Identity Provider that would pass as cryptographically valid, thereby allowing them to impersonate a user from that Identity Provider, aka a key confusion issue. | 5.0 |
2018-03-05 | CVE-2018-1000115 | Memcached Canonical Debian Redhat | Resource Exhaustion vulnerability in multiple products Memcached version 1.5.5 contains an Insufficient Control of Network Message Volume (Network Amplification, CWE-406) vulnerability in the UDP support of the memcached server that can result in denial of service via network flood (traffic amplification of 1:50,000 has been reported by reliable sources). | 5.0 |
2018-03-05 | CVE-2018-7668 | Testlink | Information Exposure vulnerability in Testlink TestLink through 1.9.16 allows remote attackers to read arbitrary attachments via a modified ID field to /lib/attachments/attachmentdownload.php. | 5.0 |
2018-03-09 | CVE-2017-15323 | Huawei | Resource Exhaustion vulnerability in Huawei products Huawei DP300 V500R002C00, NIP6600 V500R001C00, V500R001C20, V500R001C30, Secospace USG6500 V500R001C00, V500R001C20, V500R001C30, TE60 V100R001C01, V100R001C10, V100R003C00, V500R002C00, V600R006C00, TP3106 V100R001C06, V100R002C00, VP9660 V200R001C02, V200R001C30, V500R002C00, V500R002C10, ViewPoint 8660 V100R008C03, ViewPoint 9030 V100R011C02, V100R011C03, eCNS210_TD V100R004C10, eSpace U1981 V200R003C30 have a DoS vulnerability caused by memory exhaustion in some Huawei products. | 4.9 |
2018-03-09 | CVE-2017-17148 | Huawei | Improper Input Validation vulnerability in Huawei Dp300 Firmware V500R002C00 Huawei DP300 V500R002C00 have a DoS vulnerability due to the lack of validation when the malloc is called. | 4.9 |
2018-03-09 | CVE-2017-17147 | Huawei | Integer Overflow or Wraparound vulnerability in Huawei Dp300 Firmware V500R002C00 Huawei DP300 V500R002C00 have an integer overflow vulnerability due to the lack of validation. | 4.9 |
2018-03-08 | CVE-2018-0211 | Cisco | Improper Input Validation vulnerability in Cisco Identity Services Engine 2.1(0.474)/2.2(1.145)/2.4(0.247) A vulnerability in specific CLI commands for the Cisco Identity Services Engine could allow an authenticated, local attacker to cause a denial of service (DoS) condition. | 4.9 |
2018-03-07 | CVE-2018-7740 | Linux Redhat Canonical Debian | Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability in Linux Kernel The resv_map_release function in mm/hugetlb.c in the Linux kernel through 4.15.7 allows local users to cause a denial of service (BUG) via a crafted application that makes mmap system calls and has a large pgoff argument to the remap_file_pages system call. | 4.9 |
2018-03-07 | CVE-2017-18221 | Linux | Improper Input Validation vulnerability in Linux Kernel The __munlock_pagevec function in mm/mlock.c in the Linux kernel before 4.11.4 allows local users to cause a denial of service (NR_MLOCK accounting corruption) via crafted use of mlockall and munlockall system calls. | 4.9 |
2018-03-06 | CVE-2017-6283 | Nvidia | Information Exposure vulnerability in multiple products NVIDIA Security Engine contains a vulnerability in the RSA function where the keyslot read/write lock permissions are cleared on a chip reset which may lead to information disclosure. | 4.9 |
2018-03-09 | CVE-2018-7995 | Linux Canonical Debian | Race Condition vulnerability in multiple products Race condition in the store_int_with_restart() function in arch/x86/kernel/cpu/mcheck/mce.c in the Linux kernel through 4.15.7 allows local users to cause a denial of service (panic) by leveraging root access to write to the check_interval file in a /sys/devices/system/machinecheck/machinecheck<cpu number> directory. | 4.7 |
2018-03-06 | CVE-2018-5729 | MIT Fedoraproject Debian Redhat | NULL Pointer Dereference vulnerability in multiple products MIT krb5 1.6 or later allows an authenticated kadmin with permission to add principals to an LDAP Kerberos database to cause a denial of service (NULL pointer dereference) or bypass a DN container check by supplying tagged data that is internal to the database module. | 4.7 |
2018-03-09 | CVE-2018-7581 | Weblogexpert | Incorrect Permission Assignment for Critical Resource vulnerability in Weblogexpert Weblog Expert 9.4 \ProgramData\WebLog Expert\WebServer\WebServer.cfg in WebLog Expert Web Server Enterprise 9.4 has weak permissions (BUILTIN\Users:(ID)C), which allows local users to set a cleartext password and login as admin. | 4.6 |
2018-03-08 | CVE-2014-7271 | Sddm Project Fedoraproject | Missing Authentication for Critical Function vulnerability in multiple products Simple Desktop Display Manager (SDDM) before 0.10.0 allows local users to log in as user "sddm" without authentication. | 4.6 |
2018-03-08 | CVE-2018-1443 | IBM | Improper Authentication vulnerability in IBM products An XML parsing vulnerability affects IBM SAML-based single sign-on (SSO) systems (IBM Security Access Manager 9.0.0 - 9.0.4 and IBM Tivoli Federated Identity Manager 6.2 - 6.0.2.) This vulnerability can allow an attacker with authenticated access to trick SAML systems into authenticating as a different user without knowledge of the victim users password. | 4.6 |
2018-03-08 | CVE-2017-18222 | Linux | Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability in Linux Kernel In the Linux kernel before 4.12, Hisilicon Network Subsystem (HNS) does not consider the ETH_SS_PRIV_FLAGS case when retrieving sset_count data, which allows local users to cause a denial of service (buffer overflow and memory corruption) or possibly have unspecified other impact, as demonstrated by incompatibility between hns_get_sset_count and ethtool_get_strings. | 4.6 |
2018-03-08 | CVE-2018-0214 | Cisco | OS Command Injection vulnerability in Cisco Identity Services Engine 2.1(102.103) A vulnerability in certain CLI commands of Cisco Identity Services Engine (ISE) could allow an authenticated, local attacker to execute arbitrary commands on the host operating system with the privileges of the local user, aka Command Injection. | 4.6 |
2018-03-06 | CVE-2017-6296 | Nvidia | Race Condition vulnerability in multiple products NVIDIA TrustZone Software contains a TOCTOU issue in the DRM application which may lead to the denial of service or possible escalation of privileges. | 4.4 |
2018-03-11 | CVE-2018-8050 | Afflib Project | Improper Input Validation vulnerability in Afflib Project Afflib The af_get_page() function in lib/afflib_pages.cpp in AFFLIB (aka AFFLIBv3) through 3.7.16 allows remote attackers to cause a denial of service (segmentation fault) via a corrupt AFF image that triggers an unexpected pagesize value. | 4.3 |
2018-03-09 | CVE-2016-8785 | Huawei | Improper Input Validation vulnerability in Huawei products Huawei S12700 V200R007C00, V200R008C00, S5700 V200R007C00, S7700 V200R002C00, V200R005C00, V200R006C00, V200R007C00, V200R008C00, S9700 V200R007C00 have an input validation vulnerability. | 4.3 |
2018-03-09 | CVE-2016-9591 | Jasper Project Redhat Debian | Use After Free vulnerability in multiple products JasPer before version 2.0.12 is vulnerable to a use-after-free in the way it decodes certain JPEG 2000 image files resulting in a crash on the application using JasPer. | 4.3 |
2018-03-09 | CVE-2016-8612 | Apache Redhat Netapp | Improper Input Validation vulnerability in multiple products Apache HTTP Server mod_cluster before version httpd 2.4.23 is vulnerable to an Improper Input Validation in the protocol parsing logic in the load balancer resulting in a Segmentation Fault in the serving httpd process. | 4.3 |
2018-03-09 | CVE-2017-17327 | Huawei | Unspecified vulnerability in Huawei Mha-Al00A Firmware Mhaal00Ac00B125 Huawei smartphones with software of MHA-AL00AC00B125 have an improper resource management vulnerability. | 4.3 |
2018-03-09 | CVE-2017-17325 | Huawei | Unspecified vulnerability in Huawei Hicinema 8.0.3.308/8.0.4.300 Huawei video applications HiCinema with software of 8.0.3.308; 8.0.4.300 have a permission control vulnerability. | 4.3 |
2018-03-09 | CVE-2017-17322 | Huawei | Information Exposure vulnerability in Huawei Honor Smart Scale Application Firmware 1.1.1 Huawei Honor Smart Scale Application with software of 1.1.1 has an information disclosure vulnerability. | 4.3 |
2018-03-09 | CVE-2017-17279 | Huawei | Unspecified vulnerability in Huawei Mate 9 PRO Firmware The soundtrigger module in Huawei Mate 9 Pro smart phones with software of the versions before LON-AL00B 8.0.0.343(C00) has an authentication bypass vulnerability due to the improper design of the module. | 4.3 |
2018-03-09 | CVE-2017-17217 | Huawei | Out-of-bounds Write vulnerability in Huawei products Media Gateway Control Protocol (MGCP) in Huawei DP300 V500R002C00; RP200 V500R002C00SPC200; V600R006C00; TE30 V100R001C10; V500R002C00; V600R006C00; TE40 V500R002C00; V600R006C00; TE50 V500R002C00; V600R006C00; TE60 V100R001C10; V500R002C00; V600R006C00 has an out-of-bounds write vulnerability. | 4.3 |
2018-03-09 | CVE-2017-17216 | Huawei | Out-of-bounds Read vulnerability in Huawei products Media Gateway Control Protocol (MGCP) in Huawei DP300 V500R002C00; RP200 V500R002C00SPC200; V600R006C00; TE30 V100R001C10; V500R002C00; V600R006C00; TE40 V500R002C00; V600R006C00; TE50 V500R002C00; V600R006C00; TE60 V100R001C10; V500R002C00; V600R006C00 have an out-of-bounds read vulnerability. | 4.3 |
2018-03-09 | CVE-2017-17200 | Huawei | Out-of-bounds Read vulnerability in Huawei products Huawei DP300 V500R002C00; RP200 V500R002C00; V600R006C00; TE30 V100R001C10; V500R002C00; V600R006C00; TE40 V500R002C00; V600R006C00; TE50 V500R002C00; V600R006C00; TE60 V100R001C10; V500R002C00; V600R006C00 have an out-of-bounds read vulnerability due to the improper processing of malformed H323 messages. | 4.3 |
2018-03-09 | CVE-2017-17199 | Huawei | Out-of-bounds Read vulnerability in Huawei products Huawei DP300 V500R002C00; RP200 V500R002C00; V600R006C00; TE30 V100R001C10; V500R002C00; V600R006C00; TE40 V500R002C00; V600R006C00; TE50 V500R002C00; V600R006C00; TE60 V100R001C10; V500R002C00; V600R006C00 have an out-of-bounds read vulnerability due to the improper processing of malformed H323 messages. | 4.3 |
2018-03-09 | CVE-2017-17167 | Huawei | Use of a Broken or Risky Cryptographic Algorithm vulnerability in Huawei products Huawei DP300 V500R002C00; TP3206 V100R002C00; ViewPoint 9030 V100R011C02; V100R011C03 have a use of a broken or risky cryptographic algorithm vulnerability. | 4.3 |
2018-03-09 | CVE-2018-7997 | Eramba | Cross-site Scripting vulnerability in Eramba E1.0.6.033 Eramba e1.0.6.033 has Reflected XSS on the Error page of the CSV file inclusion tab of the /importTool/preview URI, with a CSV file polluted with malicious JavaScript. | 4.3 |
2018-03-09 | CVE-2018-7996 | Eramba | Cross-site Scripting vulnerability in Eramba E1.0.6.033 Eramba e1.0.6.033 has Stored XSS on the tooltip box via the /programScopes description parameter. | 4.3 |
2018-03-09 | CVE-2018-0547 | Soflyy | Cross-site Scripting vulnerability in Soflyy WP ALL Import Cross-site scripting vulnerability in WP All Import plugin prior to version 3.4.7 for WordPress allows an attacker to inject arbitrary web script or HTML via unspecified vectors. | 4.3 |
2018-03-09 | CVE-2018-0546 | Soflyy | Cross-site Scripting vulnerability in Soflyy WP ALL Import Cross-site scripting vulnerability in WP All Import plugin prior to version 3.4.6 for WordPress allows an attacker to inject arbitrary web script or HTML via unspecified vectors. | 4.3 |
2018-03-09 | CVE-2018-7894 | Eramba | Cross-site Scripting vulnerability in Eramba E1.0.6.033 Eramba e1.0.6.033 has Reflected XSS in reviews/filterIndex/ThirdPartyRiskReview via the advanced_filter parameter (aka the Search Parameter). | 4.3 |
2018-03-08 | CVE-2018-7877 | Libming Debian | Out-of-bounds Write vulnerability in multiple products There is a heap-based buffer overflow in the getString function of util/decompile.c in libming 0.4.8 for DOUBLE data. | 4.3 |
2018-03-08 | CVE-2018-7875 | Libming Debian | Out-of-bounds Read vulnerability in multiple products There is a heap-based buffer over-read in the getString function of util/decompile.c in libming 0.4.8 for CONSTANT8 data. | 4.3 |
2018-03-08 | CVE-2018-7874 | Libming Debian | Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability in multiple products An invalid memory address dereference was discovered in strlenext in util/decompile.c in libming 0.4.8. | 4.3 |
2018-03-08 | CVE-2018-7872 | Libming Debian | NULL Pointer Dereference vulnerability in multiple products An invalid memory address dereference was discovered in the function getName in libming 0.4.8 for CONSTANT16 data. | 4.3 |
2018-03-08 | CVE-2018-7870 | Libming Debian | NULL Pointer Dereference vulnerability in multiple products An invalid memory address dereference was discovered in getString in util/decompile.c in libming 0.4.8 for CONSTANT16 data. | 4.3 |
2018-03-08 | CVE-2018-7869 | Libming Debian | Missing Release of Resource after Effective Lifetime vulnerability in multiple products There is a memory leak triggered in the function dcinit of util/decompile.c in libming 0.4.8, which will lead to a denial of service attack. | 4.3 |
2018-03-08 | CVE-2018-7868 | Libming Debian | Out-of-bounds Read vulnerability in multiple products There is a heap-based buffer over-read in the getName function of util/decompile.c in libming 0.4.8 for CONSTANT8 data. | 4.3 |
2018-03-08 | CVE-2018-7867 | Libming Debian | Out-of-bounds Write vulnerability in multiple products There is a heap-based buffer overflow in the getString function of util/decompile.c in libming 0.4.8 during a RegisterNumber sprintf. | 4.3 |
2018-03-08 | CVE-2017-7634 | Qnap | Cross-site Scripting vulnerability in Qnap Media Streaming Add-On Cross-site scripting (XSS) vulnerability in QNAP NAS application Media Streaming add-on version 421.1.0.2, 430.1.2.0, and earlier allows remote attackers to inject arbitrary web script or HTML. | 4.3 |
2018-03-08 | CVE-2018-0223 | Cisco | Cross-site Scripting vulnerability in Cisco Security Manager 4.9(0)Qa99 A vulnerability in DesktopServlet in the web-based management interface of Cisco Security Manager could allow an unauthenticated, remote attacker to conduct a reflected cross-site scripting (XSS) attack against a user of the web-based interface. | 4.3 |
2018-03-08 | CVE-2018-0219 | Cisco | Cross-site Scripting vulnerability in Cisco Unified Computing System Director 6.6(0.0) A vulnerability in the web-based management interface of Cisco Unified Computing System (UCS) Director could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the web-based management interface of an affected device. | 4.3 |
2018-03-08 | CVE-2018-0218 | Cisco | XXE vulnerability in Cisco Secure Access Control Server Solution Engine 5.8(0.8) A vulnerability in the web-based user interface of the Cisco Secure Access Control Server prior to 5.8 patch 9 could allow an unauthenticated, remote attacker to gain read access to certain information in the affected system. | 4.3 |
2018-03-08 | CVE-2018-0212 | Cisco | Cross-site Scripting vulnerability in Cisco Identity Services Engine A vulnerability in the web-based management interface of Cisco Identity Services Engine (ISE) could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the web-based management interface of an affected device. | 4.3 |
2018-03-08 | CVE-2018-0207 | Cisco | XXE vulnerability in Cisco Secure Access Control Server Solution Engine 5.8(0.8) A vulnerability in the web-based user interface of the Cisco Secure Access Control Server prior to 5.8 patch 9 could allow an unauthenticated, remote attacker to gain read access to certain information in the affected system. | 4.3 |
2018-03-08 | CVE-2018-0144 | Cisco | Cross-site Scripting vulnerability in Cisco Prime Data Center Network Manager 10.4(1.109) A vulnerability in the web-based management interface of Cisco Prime Data Center Network Manager could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the web-based management interface of an affected device. | 4.3 |
2018-03-07 | CVE-2018-7564 | Polycom | Cross-site Scripting vulnerability in Polycom QDX 6000 Firmware Stored XSS exists on Polycom QDX 6000 devices. | 4.3 |
2018-03-07 | CVE-2018-1000119 | Sinatrarb | Information Exposure Through Discrepancy vulnerability in Sinatrarb Rack-Protection 2.0.0 Sinatra rack-protection versions 1.5.4 and 2.0.0.rc3 and earlier contains a timing attack vulnerability in the CSRF token checking that can result in signatures can be exposed. | 4.3 |
2018-03-07 | CVE-2018-7741 | Eramba | Cross-site Scripting vulnerability in Eramba E1.0.6.033 Eramba e1.0.6.033 has Reflected XSS in the Date Filter via the created parameter to the /crons URI. | 4.3 |
2018-03-07 | CVE-2018-7721 | Metinfo | Cross-site Scripting vulnerability in Metinfo 6.0.0 Cross Site Scripting (XSS) exists in MetInfo 6.0.0 via /feedback/index.php because app/system/feedback/web/feedback.class.php mishandles input data. | 4.3 |
2018-03-07 | CVE-2017-11650 | Draytek | Cross-site Scripting vulnerability in Draytek Vigorap 910C Firmware 1.2.0 Cross-site scripting (XSS) vulnerability in DrayTek Vigor AP910C devices with firmware 1.2.0_RC3 build r6594 allows remote attackers to inject arbitrary web script or HTML via vectors involving home.asp. | 4.3 |
2018-03-06 | CVE-2018-5471 | Belden | Cleartext Transmission of Sensitive Information vulnerability in Belden products A Cleartext Transmission of Sensitive Information issue was discovered in Belden Hirschmann RS, RSR, RSB, MACH100, MACH1000, MACH4000, MS, and OCTOPUS Classic Platform Switches. | 4.3 |
2018-03-06 | CVE-2018-6811 | Citrix | Cross-site Scripting vulnerability in Citrix products Multiple cross-site scripting (XSS) vulnerabilities in Citrix NetScaler ADC 10.5, 11.0, 11.1, and 12.0, and NetScaler Gateway 10.5, 11.0, 11.1, and 12.0 allow remote attackers to inject arbitrary web script or HTML via the Citrix NetScaler interface. | 4.3 |
2018-03-06 | CVE-2018-6019 | Samsung | Cleartext Transmission of Sensitive Information vulnerability in Samsung Display Solutions 3.01 Samsung Display Solutions App before 3.02 for Android allows man-in-the-middle attackers to spoof B2B content by leveraging failure to use encryption during information transmission. | 4.3 |
2018-03-06 | CVE-2018-7727 | Zziplib Project Redhat | Missing Release of Resource after Effective Lifetime vulnerability in multiple products An issue was discovered in ZZIPlib 0.13.68. | 4.3 |
2018-03-06 | CVE-2018-7726 | Zziplib Project Canonical Redhat | Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability in multiple products An issue was discovered in ZZIPlib 0.13.68. | 4.3 |
2018-03-06 | CVE-2018-7725 | Zziplib Project Canonical Redhat | Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability in multiple products An issue was discovered in ZZIPlib 0.13.68. | 4.3 |
2018-03-06 | CVE-2017-9786 | Projectsend | Cross-site Scripting vulnerability in Projectsend Cross-site scripting (XSS) vulnerability in ProjectSend (formerly cFTP) before commit 6c3710430be26feb5371cb0377e5355d6f9a27ca allows remote attackers to inject arbitrary web script or HTML via the Description field in My account Name updated, related to home.php and actions-log.php. | 4.3 |
2018-03-06 | CVE-2017-9783 | Projectsend | Cross-site Scripting vulnerability in Projectsend Cross-site scripting (XSS) vulnerability in ProjectSend (formerly cFTP) before commit 6c3710430be26feb5371cb0377e5355d6f9a27ca allows remote attackers to inject arbitrary web script or HTML via the Description field in a Site name updated. | 4.3 |
2018-03-05 | CVE-2018-7717 | Kubik Rubik | Cross-site Scripting vulnerability in Kubik-Rubik Simple Image Gallery Extended The htmlImageAddTitleAttribute function in sige.php in the Kubik-Rubik Simple Image Gallery Extended (SIGE) extension 3.2.3 for Joomla! has XSS via a crafted image header, as demonstrated by the Caption-Abstract header object in a JPEG file. | 4.3 |
2018-03-05 | CVE-2017-18217 | Invoiceplane | Cross-site Scripting vulnerability in Invoiceplane An issue was discovered in InvoicePlane before 1.5.5. | 4.3 |
2018-03-05 | CVE-2018-7698 | D Link | Insufficiently Protected Credentials vulnerability in D-Link Mydlink+ 3.8.5 An issue was discovered in D-Link mydlink+ 3.8.5 build 259 for DCS-933L 1.05.04 and DCS-934L 1.05.04 devices. | 4.3 |
2018-03-05 | CVE-2017-8165 | Huawei | Information Exposure vulnerability in Huawei Mate 9 Firmware Mate 9 Huawei smart phones with versions earlier than MHA-AL00BC00B233 have a sensitive information leak vulnerability. | 4.3 |
2018-03-05 | CVE-2017-8164 | Huawei | Improper Input Validation vulnerability in Huawei products Some Huawei smart phones with software EVA-L09C34B142; EVA-L09C40B196; EVA-L09C432B210; EVA-L09C440B138; EVA-L09C464B150; EVA-L09C530B127; EVA-L09C55B190; EVA-L09C576B150; EVA-L09C635B221; EVA-L09C636B193; EVA-L09C675B130; EVA-L09C688B143; EVA-L09C703B160; EVA-L09C706B145; EVA-L09GBRC555B171; EVA-L09IRLC368B160; EVA-L19C10B190; EVA-L19C185B220; EVA-L19C20B160; EVA-L19C432B210; EVA-L19C636B190; EVA-L29C20B160; EVA-L29C636B191; EVA-TL00C01B198; VIE-L09C02B131; VIE-L09C109B181; VIE-L09C113B170; VIE-L09C150B170; VIE-L09C25B120; VIE-L09C40B181; VIE-L09C432B181; VIE-L09C55B170; VIE-L09C605B131; VIE-L09ITAC555B130; VIE-L29C10B170; VIE-L29C185B181; VIE-L29C605B131; VIE-L29C636B202 have a denial of service (DoS) vulnerability. | 4.3 |
2018-03-05 | CVE-2017-17141 | Huawei | Missing Release of Resource after Effective Lifetime vulnerability in Huawei products Huawei S12700 V200R005C00; V200R006C00; V200R007C00; V200R007C01; V200R007C20; V200R008C00; V200R009C00;S1700 V200R006C10; V200R009C00;S2700 V100R006C03; V200R003C00; V200R005C00; V200R006C00; V200R006C10; V200R007C00; V200R007C00B050; V200R007C00SPC009T; V200R007C00SPC019T; V200R008C00; V200R009C00;S3700 V100R006C03;S5700 V200R001C00; V200R001C01; V200R002C00; V200R003C00; V200R003C02; V200R005C00; V200R005C01; V200R005C02; V200R005C03; V200R006C00; V200R007C00; V200R008C00; V200R009C00;S6700 V200R001C00; V200R001C01; V200R002C00; V200R003C00; V200R005C00; V200R005C01; V200R005C02; V200R008C00; V200R009C00;S7700 V200R001C00; V200R001C01; V200R002C00; V200R003C00; V200R005C00; V200R006C00; V200R006C01; V200R007C00; V200R007C01; V200R008C00; V200R008C06; V200R009C00;S9700 V200R001C00; V200R001C01; V200R002C00; V200R003C00; V200R005C00; V200R006C00; V200R007C00; V200R007C01; V200R008C00; V200R009C00 have a memory leak vulnerability. | 4.3 |
2018-03-05 | CVE-2017-17140 | Huawei | Information Exposure vulnerability in Huawei Enjoy 5S Firmware and Y6 PRO Firmware Huawei Enjoy 5s and Y6 Pro smartphones with software the versions before TAG-AL00C92B170; the versions before TIT-L01C576B121 have an information leak vulnerability due to the lack of parameter validation. | 4.3 |
2018-03-05 | CVE-2017-17139 | Huawei | Information Exposure vulnerability in Huawei Mate 9 Firmware and Mate 9 PRO Firmware Huawei Mate 9 and Mate 9 pro smart phones with software the versions before MHA-AL00B 8.0.0.334(C00); the versions before LON-AL00B 8.0.0.334(C00) have a information leak vulnerability in the date service proxy implementation. | 4.3 |
2018-03-05 | CVE-2018-7663 | Voten | Cross-site Scripting vulnerability in Voten An issue was discovered in resources/views/layouts/app.blade.php in Voten.co before 2017-08-25. | 4.3 |
2018-03-09 | CVE-2016-0286 | IBM | Information Exposure vulnerability in IBM Tivoli Business Service Manager 6.1.0/6.1.1 IBM Tivoli Business Service Manager 6.1.0 before 6.1.0-TIV-BSM-FP0004 and 6.1.1 before 6.1.1-TIV-BSM-FP0004 allows remote authenticated users to obtain administrator passwords by leveraging unspecified privileges. | 4.0 |
2018-03-09 | CVE-2016-0268 | IBM | XXE vulnerability in IBM Financial Transaction Manager XML external entity (XXE) vulnerability in IBM Financial Transaction Manager (FTM) for ACH Services for Multi-Platform 2.1.1.2 and 3.0.0.x before fp0013, Financial Transaction Manager (FTM) for Check Services for Multi-Platform 2.1.1.2 and 3.0.0.x before fp0013, and Financial Transaction Manager (FTM) for Corporate Payment Services (CPS) for Multi-Platform 2.1.1.2 and 3.0.0.x before fp0013 allows remote authenticated users to obtain sensitive information via crafted XML data. | 4.0 |
2018-03-09 | CVE-2017-17323 | Huawei | Incorrect Authorization vulnerability in Huawei Ibmc Firmware V200R002C10/V200R002C20/V200R002C30 Huawei iBMC V200R002C10; V200R002C20; V200R002C30 have an improper authorization vulnerability. | 4.0 |
2018-03-09 | CVE-2017-17303 | Huawei | Information Exposure vulnerability in Huawei products Huawei DP300 V500R002C00; V500R002C00B010; V500R002C00B011; V500R002C00B012; V500R002C00B013; V500R002C00B014; V500R002C00B017; V500R002C00B018; V500R002C00SPC100; V500R002C00SPC200; V500R002C00SPC300; V500R002C00SPC400; V500R002C00SPC500; V500R002C00SPC600; V500R002C00SPC800; V500R002C00SPC900; V500R002C00SPCa00; RP200 V500R002C00SPC200; V600R006C00; V600R006C00SPC200; V600R006C00SPC300; TE30 V100R001C10SPC300; V100R001C10SPC500; V100R001C10SPC600; V100R001C10SPC700B010; V500R002C00SPC200; V500R002C00SPC500; V500R002C00SPC600; V500R002C00SPC700; V500R002C00SPC900; V500R002C00SPCb00; V600R006C00; V600R006C00SPC200; V600R006C00SPC300; TE40 V500R002C00SPC600; V500R002C00SPC700; V500R002C00SPC900; V500R002C00SPCb00; V600R006C00; V600R006C00SPC200; V600R006C00SPC300; TE50 V500R002C00SPC600; V500R002C00SPC700; V500R002C00SPCb00; V600R006C00; V600R006C00SPC200; V600R006C00SPC300; TE60 V100R001C10; V100R001C10B001; V100R001C10B002; V100R001C10B010; V100R001C10B011; V100R001C10B012; V100R001C10B013; V100R001C10B014; V100R001C10B016; V100R001C10B017; V100R001C10B018; V100R001C10B019; V100R001C10SPC400; V100R001C10SPC500; V100R001C10SPC600; V100R001C10SPC700; V100R001C10SPC800B011; V100R001C10SPC900; V500R002C00; V500R002C00B010; V500R002C00B011; V500R002C00SPC100; V500R002C00SPC200; V500R002C00SPC300; V500R002C00SPC600; V500R002C00SPC700; V500R002C00SPC800; V500R002C00SPC900; V500R002C00SPCa00; V500R002C00SPCb00; V500R002C00SPCd00; V500R002C00SPCe00; V600R006C00; V600R006C00SPC100; V600R006C00SPC200; V600R006C00SPC300 use the CIDAM protocol, which contains sensitive information in the message when it is implemented. | 4.0 |
2018-03-09 | CVE-2017-17281 | Huawei | Out-of-bounds Read vulnerability in Huawei products SFTP module in Huawei DP300 V500R002C00; RP200 V600R006C00; TE30 V100R001C10; V500R002C00; V600R006C00; TE40 V500R002C00; V600R006C00; TE50 V500R002C00; V600R006C00; TE60 V100R001C10; V500R002C00; V600R006C00 has an out-of-bounds read vulnerability. | 4.0 |
2018-03-08 | CVE-2018-1219 | EMC | Unspecified vulnerability in EMC RSA Archer EMC RSA Archer, versions prior to 6.2.0.8, contains an improper access control vulnerability on an API which is used to enumerate user information. | 4.0 |
2018-03-05 | CVE-2018-5255 | Arista | Unspecified vulnerability in Arista EOS The Mlag agent in Arista EOS 4.19 before 4.19.4M and 4.20 before 4.20.2F allows remote attackers to cause a denial of service (agent restart) via crafted UDP packets. | 4.0 |
42 Low Vulnerabilities
DATE | CVE | VENDOR | VULNERABILITY | CVSS |
---|---|---|---|---|
2018-03-06 | CVE-2018-5730 | MIT Fedoraproject Debian Redhat | LDAP Injection vulnerability in multiple products MIT krb5 1.6 or later allows an authenticated kadmin with permission to add principals to an LDAP Kerberos database to circumvent a DN containership check by supplying both a "linkdn" and "containerdn" database argument, or by supplying a DN string which is a left extension of a container DN string but is not hierarchically within the container DN. | 3.8 |
2018-03-06 | CVE-2017-6295 | Nvidia | Out-of-bounds Read vulnerability in multiple products NVIDIA TrustZone Software contains a vulnerability in the Keymaster implementation where the software reads data past the end, or before the beginning, of the intended buffer; and may lead to denial of service or information disclosure. | 3.6 |
2018-03-09 | CVE-2018-7290 | Tiki | Cross-site Scripting vulnerability in Tiki Tikiwiki Cms/Groupware Cross Site Scripting (XSS) exists in Tiki before 12.13, 15.6, 17.2, and 18.1. | 3.5 |
2018-03-09 | CVE-2016-0274 | IBM | 7PK - Security Features vulnerability in IBM Financial Transaction Manager IBM Financial Transaction Manager (FTM) for ACH Services for Multi-Platform 2.1.1.2 and 3.0.0.x before fp0013, Financial Transaction Manager (FTM) for Check Services for Multi-Platform 2.1.1.2 and 3.0.0.x before fp0013, and Financial Transaction Manager (FTM) for Corporate Payment Services (CPS) for Multi-Platform 2.1.1.2 and 3.0.0.x before fp0013 allows remote attackers to conduct clickjacking attacks via a crafted web site. | 3.5 |
2018-03-09 | CVE-2016-0253 | IBM | Cross-site Scripting vulnerability in IBM Financial Transaction Manager Cross-site scripting (XSS) vulnerability in IBM Financial Transaction Manager (FTM) for ACH Services for Multi-Platform 2.1.1.2 and 3.0.0.x before fp0013, Financial Transaction Manager (FTM) for Check Services for Multi-Platform 2.1.1.2 and 3.0.0.x before fp0013, and Financial Transaction Manager (FTM) for Corporate Payment Services (CPS) for Multi-Platform 2.1.1.2 and 3.0.0.x before fp0013 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. | 3.5 |
2018-03-08 | CVE-2018-4839 | Siemens | Inadequate Encryption Strength vulnerability in Siemens products A vulnerability has been identified in DIGSI 4 (All versions < V4.92), EN100 Ethernet module DNP3 variant (All versions < V1.05.00), EN100 Ethernet module IEC 104 variant (All versions), EN100 Ethernet module IEC 61850 variant (All versions < V4.30), EN100 Ethernet module Modbus TCP variant (All versions), EN100 Ethernet module PROFINET IO variant (All versions), Other SIPROTEC 4 relays (All versions), Other SIPROTEC Compact relays (All versions), SIPROTEC 4 7SD80 (All versions < V4.70), SIPROTEC 4 7SJ61 (All versions < V4.96), SIPROTEC 4 7SJ62 (All versions < V4.96), SIPROTEC 4 7SJ64 (All versions < V4.96), SIPROTEC 4 7SJ66 (All versions < V4.30), SIPROTEC Compact 7SJ80 (All versions < V4.77), SIPROTEC Compact 7SK80 (All versions < V4.77). | 3.5 |
2018-03-08 | CVE-2018-0220 | Cisco | Cross-site Scripting vulnerability in Cisco Videoscape Anyres Live 9.7.6 A vulnerability in the web-based management interface of Cisco Videoscape AnyRes Live could allow an authenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the web-based management interface of an affected device. | 3.5 |
2018-03-08 | CVE-2018-0208 | Cisco | Cross-site Scripting vulnerability in Cisco Email Encryption 5.3.0 A vulnerability in the web-based management interface of the (cloud based) Cisco Registered Envelope Service could allow an authenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the web-based management interface of the affected service. | 3.5 |
2018-03-07 | CVE-2014-8780 | Jease | Cross-site Scripting vulnerability in Jease 2.11 Cross-site scripting (XSS) vulnerability in Jease 2.11 allows remote authenticated users to inject arbitrary web script or HTML via a content section note. | 3.5 |
2018-03-06 | CVE-2018-7170 | NTP Synology Slackware Netapp HPE | Unspecified vulnerability in NTP ntpd in ntp 4.2.x before 4.2.8p7 and 4.3.x before 4.3.92 allows authenticated users that know the private symmetric key to create arbitrarily-many ephemeral associations in order to win the clock selection of ntpd and modify a victim's clock via a Sybil attack. | 3.5 |
2018-03-06 | CVE-2018-7724 | Piwigo | Cross-Site Request Forgery (CSRF) vulnerability in Piwigo 2.9.3 The management panel in Piwigo 2.9.3 has stored XSS via the name parameter in a /admin.php?page=photo-${photo_number} request. | 3.5 |
2018-03-06 | CVE-2018-7723 | Piwigo | Cross-site Scripting vulnerability in Piwigo 2.9.3 The management panel in Piwigo 2.9.3 has stored XSS via the virtual_name parameter in a /admin.php?page=cat_list request, a different issue than CVE-2017-9836. | 3.5 |
2018-03-06 | CVE-2018-7722 | Piwigo | Cross-site Scripting vulnerability in Piwigo 2.9.3 The management panel in Piwigo 2.9.3 has stored XSS via the name parameter in a /ws.php?format=json request. | 3.5 |
2018-03-06 | CVE-2018-7650 | HOT Scripts Clone Project | Cross-site Scripting vulnerability in HOT Scripts Clone Project HOT Scripts Clone 3.1 PHP Scripts Mall Hot Scripts Clone:Script Classified Version 3.1 Application is vulnerable to stored XSS within the "Add New" function for a Management User. | 3.5 |
2018-03-06 | CVE-2018-1062 | Redhat | Improper Cross-boundary Removal of Sensitive Data vulnerability in Redhat Ovirt-Engine A vulnerability was discovered in oVirt 4.1.x before 4.1.9, where the combination of Enable Discard and Wipe After Delete flags for VM disks managed by oVirt, could cause a disk to be incompletely zeroed when removed from a VM. | 3.5 |
2018-03-09 | CVE-2016-8784 | Huawei | Resource Management Errors vulnerability in Huawei Cloudengine 12800 Firmware Huawei CloudEngine 12800 V100R003C00, V100R003C10, V100R005C00, V100R005C10, V100R006C00 have a memory leak vulnerability. | 3.3 |
2018-03-05 | CVE-2018-5449 | Moxa | NULL Pointer Dereference vulnerability in Moxa products A NULL Pointer Dereference issue was discovered in Moxa OnCell G3100-HSPA Series version 1.4 Build 16062919 and prior. | 3.3 |
2018-03-09 | CVE-2017-17282 | Huawei | Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability in Huawei products SCCP (Signalling Connection Control Part) module in Huawei DP300 V500R002C00, RP200 V500R002C00, V600R006C00, TE30 V100R001C10, V500R002C00, V600R006C00, TE40 V500R002C00, V600R006C00, TE50 V500R002C00, V600R006C00, TE60 V100R001C10, V500R002C00, V600R006C00 has a buffer overflow vulnerability. | 2.9 |
2018-03-09 | CVE-2017-17280 | Huawei | Information Exposure vulnerability in Huawei Lon-Al00B Firmware Lonal00Bc00 NFC (Near Field Communication) module in Huawei mobile phones with software LON-AL00BC00 has an information leak vulnerability. | 2.9 |
2018-03-09 | CVE-2016-9585 | Redhat | Deserialization of Untrusted Data vulnerability in Redhat Jboss Enterprise Application Platform 5.0.0 Red Hat JBoss EAP version 5 is vulnerable to a deserialization of untrusted data in the JMX endpoint when deserializes the credentials passed to it. | 2.6 |
2018-03-10 | CVE-2018-8043 | Linux Canonical | NULL Pointer Dereference vulnerability in Linux Kernel The unimac_mdio_probe function in drivers/net/phy/mdio-bcm-unimac.c in the Linux kernel through 4.15.8 does not validate certain resource availability, which allows local users to cause a denial of service (NULL pointer dereference). | 2.1 |
2018-03-09 | CVE-2017-15314 | Huawei | Missing Release of Resource after Effective Lifetime vulnerability in Huawei products Huawei DP300 V500R002C00, RP200 V500R002C00SPC200, V600R006C00, TE30 V100R001C10SPC300, V100R001C10SPC500, V100R001C10SPC600, V100R001C10SPC700, V500R002C00SPC200, V500R002C00SPC500, V500R002C00SPC600, V500R002C00SPC700, V500R002C00SPC900, V500R002C00SPCb00, V600R006C00, TE40 V500R002C00SPC600, V500R002C00SPC700, V500R002C00SPC900, V500R002C00SPCb00, V600R006C00, TE50 V500R002C00SPC600, V500R002C00SPC700, V500R002C00SPCb00, V600R006C00, TE60 V100R001C10, V500R002C00, V600R006C00 have a memory leak vulnerability due to memory don't be released when the XML parser process some node fail. | 2.1 |
2018-03-09 | CVE-2016-0275 | IBM | Information Exposure vulnerability in IBM Financial Transaction Manager IBM Financial Transaction Manager (FTM) for ACH Services for Multi-Platform 2.1.1.2 and 3.0.0.x before fp0013, Financial Transaction Manager (FTM) for Check Services for Multi-Platform 2.1.1.2 and 3.0.0.x before fp0013, and Financial Transaction Manager (FTM) for Corporate Payment Services (CPS) for Multi-Platform 2.1.1.2 and 3.0.0.x before fp0013 allows local users to obtain sensitive information via vectors related to cacheable HTTPS responses. | 2.1 |
2018-03-09 | CVE-2017-17330 | Huawei | Missing Release of Resource after Effective Lifetime vulnerability in Huawei Ar3200 Firmware and Ngfw Module Firmware Huawei AR3200 V200R005C32; V200R006C10; V200R006C11; V200R007C00; V200R007C01; V200R007C02; V200R008C00; V200R008C10; V200R008C20; V200R008C30; NGFW Module V500R001C00; V500R001C20; V500R002C00 have a memory leak vulnerability. | 2.1 |
2018-03-09 | CVE-2017-17329 | Huawei | Missing Release of Resource after Effective Lifetime vulnerability in Huawei Viewpoint 8660 Firmware V100R008C03 Huawei ViewPoint 8660 V100R008C03 have a memory leak vulnerability. | 2.1 |
2018-03-09 | CVE-2017-17326 | Huawei | Unspecified vulnerability in Huawei Mate 9 PRO Fimware Lonal00Bc00B139D/Lonal00Bc00B229 Huawei Mate 9 Pro Smartphones with software of LON-AL00BC00B139D; LON-AL00BC00B229 have an activation lock bypass vulnerability. | 2.1 |
2018-03-09 | CVE-2017-17321 | Huawei | Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability in Huawei Ensp Firmware Huawei eNSP software with software of versions earlier than V100R002C00B510 has a buffer overflow vulnerability. | 2.1 |
2018-03-09 | CVE-2017-17150 | Huawei | Infinite Loop vulnerability in Huawei products Timergrp module in Huawei DP300 V500R002C00; RP200 V500R002C00; V600R006C00; TE30 V100R001C10; V500R002C00; V600R006C00; TE40 V500R002C00; V600R006C00; TE50 V500R002C00; V600R006C00; TE60 V100R001C10; V500R002C00; V600R006C00 have an DoS vulnerability due to insufficient validation of the parameter. | 2.1 |
2018-03-09 | CVE-2017-17149 | Huawei | Unspecified vulnerability in Huawei Hiwallet 5.0.3.100/8.0.0.301 Huawei HiWallet App with the versions before 8.0.4 has an arbitrary lock pattern change vulnerability. | 2.1 |
2018-03-09 | CVE-2017-17145 | Huawei | Unspecified vulnerability in Huawei Honor V9 Play Firmware Huawei Honor V9 Play smart phones with the versions before Jimmy-AL00AC00B135 have an authentication bypass vulnerability due to the improper design of a component. | 2.1 |
2018-03-08 | CVE-2018-7757 | Linux | Missing Release of Resource after Effective Lifetime vulnerability in Linux Kernel Memory leak in the sas_smp_get_phy_events function in drivers/scsi/libsas/sas_expander.c in the Linux kernel through 4.15.7 allows local users to cause a denial of service (memory consumption) via many read accesses to files in the /sys/class/sas_phy directory, as demonstrated by the /sys/class/sas_phy/phy-1:0:12/invalid_dword_count file. | 2.1 |
2018-03-08 | CVE-2017-6152 | F5 | Improper Privilege Management vulnerability in F5 Big-Iq Centralized Management 5.1.0/5.2.0 A local user on F5 BIG-IQ Centralized Management 5.1.0-5.2.0 with the Access Manager role has privileges to change the passwords of other users on the system, including the local admin account password. | 2.1 |
2018-03-08 | CVE-2018-7755 | Linux Canonical | Information Exposure vulnerability in Linux Kernel An issue was discovered in the fd_locked_ioctl function in drivers/block/floppy.c in the Linux kernel through 4.15.7. | 2.1 |
2018-03-06 | CVE-2017-6284 | Nvidia | Information Exposure vulnerability in multiple products NVIDIA Security Engine contains a vulnerability in the Deterministic Random Bit Generator (DRBG) where the DRBG does not properly initialize and store or transmits sensitive data using a weakened encryption scheme that is unable to protect sensitive data which may lead to information disclosure.This issue is rated as moderate. | 2.1 |
2018-03-05 | CVE-2017-17138 | Huawei | Improper Input Validation vulnerability in Huawei products PEM module of DP300 V500R002C00; IPS Module V500R001C00; V500R001C30; NGFW Module V500R001C00; V500R002C00; NIP6300 V500R001C00; V500R001C30; NIP6600 V500R001C00; V500R001C30; RP200 V500R002C00; V600R006C00; S12700 V200R007C00; V200R007C01; V200R008C00; V200R009C00; V200R010C00; S1700 V200R006C10; V200R009C00; V200R010C00; S2700 V200R006C10; V200R007C00; V200R008C00; V200R009C00; V200R010C00; S5700 V200R006C00; V200R007C00; V200R008C00; V200R009C00; V200R010C00; S6700 V200R008C00; V200R009C00; V200R010C00; S7700 V200R007C00; V200R008C00; V200R009C00; V200R010C00; S9700 V200R007C00; V200R007C01; V200R008C00; V200R009C00; V200R010C00; Secospace USG6300 V500R001C00; V500R001C30; Secospace USG6500 V500R001C00; V500R001C30; Secospace USG6600 V500R001C00; V500R001C30S; TE30 V100R001C02; V100R001C10; V500R002C00; V600R006C00; TE40 V500R002C00; V600R006C00; TE50 V500R002C00; V600R006C00; TE60 V100R001C01; V100R001C10; V500R002C00; V600R006C00; TP3106 V100R002C00; TP3206 V100R002C00; V100R002C10; USG9500 V500R001C00; V500R001C30; ViewPoint 9030 V100R011C02; V100R011C03 has a DoS vulnerability in PEM module of Huawei products due to insufficient verification. | 2.1 |
2018-03-05 | CVE-2017-17137 | Huawei | Out-of-bounds Read vulnerability in Huawei products PEM module of Huawei DP300 V500R002C00; IPS Module V500R001C00; V500R001C30; NGFW Module V500R001C00; V500R002C00; NIP6300 V500R001C00; V500R001C30; NIP6600 V500R001C00; V500R001C30; RP200 V500R002C00; V600R006C00; S12700 V200R007C00; V200R007C01; V200R008C00; V200R009C00; V200R010C00; S1700 V200R006C10; V200R009C00; V200R010C00; S2700 V200R006C10; V200R007C00; V200R008C00; V200R009C00; V200R010C00; S5700 V200R006C00; V200R007C00; V200R008C00; V200R009C00; V200R010C00; S6700 V200R008C00; V200R009C00; V200R010C00; S7700 V200R007C00; V200R008C00; V200R009C00; V200R010C00; S9700 V200R007C00; V200R007C01; V200R008C00; V200R009C00; V200R010C00; Secospace USG6300 V500R001C00; V500R001C30; Secospace USG6500 V500R001C00; V500R001C30; Secospace USG6600 V500R001C00; V500R001C30S; TE30 V100R001C02; V100R001C10; V500R002C00; V600R006C00; TE40 V500R002C00; V600R006C00; TE50 V500R002C00; V600R006C00; TE60 V100R001C01; V100R001C10; V500R002C00; V600R006C00; TP3106 V100R002C00; TP3206 V100R002C00; V100R002C10; USG9500 V500R001C00; V500R001C30; ViewPoint 9030 V100R011C02; V100R011C03 has an Out-of-Bounds memory access vulnerability due to insufficient verification. | 2.1 |
2018-03-05 | CVE-2017-17136 | Huawei | Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability in Huawei products PEM module of Huawei DP300 V500R002C00; IPS Module V500R001C00; V500R001C30; NGFW Module V500R001C00; V500R002C00; NIP6300 V500R001C00; V500R001C30; NIP6600 V500R001C00; V500R001C30; RP200 V500R002C00; V600R006C00; S12700 V200R007C00; V200R007C01; V200R008C00; V200R009C00; V200R010C00; S1700 V200R006C10; V200R009C00; V200R010C00; S2700 V200R006C10; V200R007C00; V200R008C00; V200R009C00; V200R010C00; S5700 V200R006C00; V200R007C00; V200R008C00; V200R009C00; V200R010C00; S6700 V200R008C00; V200R009C00; V200R010C00; S7700 V200R007C00; V200R008C00; V200R009C00; V200R010C00; S9700 V200R007C00; V200R007C01; V200R008C00; V200R009C00; V200R010C00; Secospace USG6300 V500R001C00; V500R001C30; Secospace USG6500 V500R001C00; V500R001C30; Secospace USG6600 V500R001C00; V500R001C30S; TE30 V100R001C02; V100R001C10; V500R002C00; V600R006C00; TE40 V500R002C00; V600R006C00; TE50 V500R002C00; V600R006C00; TE60 V100R001C01; V100R001C10; V500R002C00; V600R006C00; TP3106 V100R002C00; TP3206 V100R002C00; V100R002C10; USG9500 V500R001C00; V500R001C30; ViewPoint 9030 V100R011C02; V100R011C03 has a heap overflow vulnerability due to insufficient verification. | 2.1 |
2018-03-05 | CVE-2017-17135 | Huawei | NULL Pointer Dereference vulnerability in Huawei products PEM module of Huawei DP300 V500R002C00; IPS Module V500R001C00; V500R001C30; NGFW Module V500R001C00; V500R002C00; NIP6300 V500R001C00; V500R001C30; NIP6600 V500R001C00; V500R001C30; RP200 V500R002C00; V600R006C00; S12700 V200R007C00; V200R007C01; V200R008C00; V200R009C00; V200R010C00; S1700 V200R006C10; V200R009C00; V200R010C00; S2700 V200R006C10; V200R007C00; V200R008C00; V200R009C00; V200R010C00; S5700 V200R006C00; V200R007C00; V200R008C00; V200R009C00; V200R010C00; S6700 V200R008C00; V200R009C00; V200R010C00; S7700 V200R007C00; V200R008C00; V200R009C00; V200R010C00; S9700 V200R007C00; V200R007C01; V200R008C00; V200R009C00; V200R010C00; Secospace USG6300 V500R001C00; V500R001C30; Secospace USG6500 V500R001C00; V500R001C30; Secospace USG6600 V500R001C00; V500R001C30S; TE30 V100R001C02; V100R001C10; V500R002C00; V600R006C00; TE40 V500R002C00; V600R006C00; TE50 V500R002C00; V600R006C00; TE60 V100R001C01; V100R001C10; V500R002C00; V600R006C00; TP3106 V100R002C00; TP3206 V100R002C00; V100R002C10; USG9500 V500R001C00; V500R001C30; ViewPoint 9030 V100R011C02; V100R011C03 has a null pointer reference vulnerability due to insufficient verification. | 2.1 |
2018-03-05 | CVE-2017-17134 | Huawei | NULL Pointer Dereference vulnerability in Huawei products XML parser in Huawei DP300 V500R002C00; RP200 V500R002C00SPC200; V600R006C00; TE30 V100R001C10; V500R002C00; V600R006C00; TE40 V500R002C00; V600R006C00; TE50 V500R002C00; V600R006C00; TE60 V100R001C10; V500R002C00; V600R006C00 has a DoS vulnerability. | 2.1 |
2018-03-05 | CVE-2017-17133 | Huawei | NULL Pointer Dereference vulnerability in Huawei Vp9660 Firmware V500R002C10 Huawei VP9660 V500R002C10 has a null pointer reference vulnerability in license module due to insufficient verification. | 2.1 |
2018-03-05 | CVE-2017-17132 | Huawei | Use of Externally-Controlled Format String vulnerability in Huawei Vp9660 Firmware V500R002C10 Huawei VP9660 V500R002C10 has a uncontrolled format string vulnerability when the license module output the log information. | 2.1 |
2018-03-05 | CVE-2017-18216 | Linux | NULL Pointer Dereference vulnerability in Linux Kernel In fs/ocfs2/cluster/nodemanager.c in the Linux kernel before 4.15, local users can cause a denial of service (NULL pointer dereference and BUG) because a required mutex is not used. | 2.1 |