CVEs published in March 2018

1,348 vulnerabilities, 201 critical, 22 exploited.

• contec-touch smart home firmware Contec Smart Home 4.15 devices do not require authentication for new_user.php, edit_user.php,... CVE-2018-9162 9.8 CriticalMarch 31, 2018
• prismaindustriale checkweigher prismaweb Prisma Industriale Checkweigher PrismaWEB 1.21 allows remote attackers to discover the hardcoded... CVE-2018-9161 EPSS 56.7% 9.8 CriticalMarch 31, 2018
• frog cms project cms An issue was discovered in /admin/?/user/add in Frog CMS 0.9.5. The application's add user... CVE-2018-8908 Public exploit 8.8 HighMarch 31, 2018
• zblogcn z-blogphp Z-BlogPHP 1.5.1 Zero has CSRF in plugin_edit.php, resulting in the ability to execute arbitrary... CVE-2018-8893 8.8 HighMarch 31, 2018
• sickrage SiCKRAGE Discloses Plaintext Credentials CVE-2018-9160 Public exploitFix available EPSS 75.6% 9.8 CriticalMarch 31, 2018
• sparkjava spark Moderate severity vulnerability that affects com.sparkjava:spark-core CVE-2018-9159 Public exploitFix available 5.3 MediumMarch 31, 2018
• docker notary In Docker Notary before 0.1, the checkRoot function in gotuf/client/client.go does not check... CVE-2015-9259 Fix available 9.8 CriticalMarch 31, 2018
• docker notary Docker Notary Signature Algorithm Not Matched to Key vulnerability CVE-2015-9258 Fix available 7.5 HighMarch 31, 2018
• debian linux, eclipse mosquitto, the eclipse foundation eclipse mosquitto +2 more In Eclipse Mosquitto 1.4.14, if a Mosquitto instance is set running with a configuration file,... CVE-2017-7652 Fix available 7.5 HighMarch 31, 2018
• eclipse mosquitto, the eclipse foundation eclipse mosquitto, debian linux +2 more In Eclipse Mosquitto 1.4.14, a user can shutdown the Mosquitto server simply by filling the RAM... CVE-2017-7651 Public exploitFix available 7.5 HighMarch 31, 2018
• linux kernel The perf_cpu_time_max_percent_handler function in kernel/events/core.c in the Linux kernel before... CVE-2017-18255 Fix available 7.8 HighMarch 31, 2018
• lynxtechnology twonky server Cross-site scripting (XSS) vulnerability in Twonky Server 7.0.11 through 8.5 allows remote... CVE-2018-7203 Public exploit 6.1 MediumMarch 30, 2018
• lynxtechnology twonky server Directory traversal vulnerability in Twonky Server 7.0.11 through 8.5 allows remote attackers to... CVE-2018-7171 Public exploit EPSS 27.9% 7.5 HighMarch 30, 2018
• dlink dir-601 firmware An issue was discovered on D-Link DIR-601 B1 2.02NA devices. Being on the same local network as,... CVE-2018-5708 Public exploit 8.0 HighMarch 30, 2018
• dell emc rsa authentication agent for web for iis, rsa authentication agent for web +1 more RSA Authentication Agent version 8.0.1 and earlier for Web for IIS is affected by a problem where... CVE-2018-1234 5.5 MediumMarch 30, 2018
• dell emc rsa authentication agent for web for iis, rsa authentication agent for web for apache web server, rsa authentication agent for web +1 more RSA Authentication Agent version 8.0.1 and earlier for Web for both IIS and Apache Web Server are... CVE-2018-1233 6.1 MediumMarch 30, 2018
• dell emc rsa authentication agent for web for iis, rsa authentication agent for web for apache web server, rsa authentication agent for web +1 more RSA Authentication Agent version 8.0.1 and earlier for Web for both IIS and Apache Web Server are... CVE-2018-1232 7.5 HighMarch 30, 2018
• google android, qualcomm, inc. android for msm, firefox os for msm, qrd android +1 more The touchscreen driver synaptics_dsx in Android for MSM, Firefox OS for MSM, and QRD Android... CVE-2017-9723 7.8 HighMarch 30, 2018
• qcacld 2.0 project 2.0, qualcomm, inc. android for msm, firefox os for msm, qrd android +1 more While parsing Netlink attributes in... CVE-2017-9694 7.8 HighMarch 30, 2018
• google android, qualcomm, inc. android for msm, firefox os for msm, qrd android +1 more The length of attribute value for STA_EXT_CAPABILITY in __wlan_hdd_change_station in Android for... CVE-2017-9693 5.5 MediumMarch 30, 2018
• google android, qualcomm, inc. android for msm, firefox os for msm, qrd android +1 more When an atomic commit is issued on a writeback panel with a NULL output_layer parameter in... CVE-2017-9692 7.8 HighMarch 30, 2018
• google android, qualcomm, inc. android for msm, firefox os for msm, qrd android +1 more There is a race condition in Android for MSM, Firefox OS for MSM, and QRD Android that allows to... CVE-2017-9691 4.7 MediumMarch 30, 2018
• google android, qualcomm, inc. android for msm, firefox os for msm, qrd android +1 more In msm_isp_prepare_v4l2_buf in Android for MSM, Firefox OS for MSM, and QRD Android before 2017... CVE-2017-17771 7.8 HighMarch 30, 2018
• google android, qualcomm, inc. android for msm, firefox os for msm, qrd android +1 more Information leakage in Android for MSM, Firefox OS for MSM, and QRD Android can occur in the... CVE-2017-17769 5.5 MediumMarch 30, 2018
• google android, qualcomm, inc. android for msm, firefox os for msm, qrd android +1 more In wma_peer_info_event_handler() in Android for MSM, Firefox OS for MSM, and QRD Android before... CVE-2017-17766 9.8 CriticalMarch 30, 2018
• tp-shop tpshop SSRF (Server Side Request Forgery) in tpshop 2.0.5 and 2.0.6 allows remote attackers to obtain... CVE-2017-16614 9.8 CriticalMarch 30, 2018
• google android, qualcomm, inc. android for msm, firefox os for msm, qrd android +1 more While processing the QCA_NL80211_VENDOR_SUBCMD_SET_TXPOWER_SCALE_DECR_DB vendor command, in which... CVE-2017-15859 7.5 HighMarch 30, 2018
• google android, qualcomm, inc. android for msm, firefox os for msm, qrd android +1 more Information leak of the ISPIF base address in Android for MSM, Firefox OS for MSM, and QRD... CVE-2017-15852 7.8 HighMarch 30, 2018
• google android, qualcomm, inc. android for msm, firefox os for msm, qrd android +1 more In the video_ioctl2() function in the camera driver in Android for MSM, Firefox OS for MSM, and... CVE-2017-15846 7.8 HighMarch 30, 2018
• google android, qualcomm, inc. android for msm, firefox os for msm, qrd android +1 more Due to a race condition in MDSS rotator in Android for MSM, Firefox OS for MSM, and QRD Android... CVE-2017-15826 7.8 HighMarch 30, 2018
• google android, qualcomm, inc. android for msm, firefox os for msm, qrd android +1 more In spectral_create_samp_msg() in Android for MSM, Firefox OS for MSM, and QRD Android before 2017... CVE-2017-15823 7.8 HighMarch 30, 2018
• google android, qualcomm, inc. android for msm, firefox os for msm, qrd android +1 more In the function msm_pcm_hw_params() in Android for MSM, Firefox OS for MSM, and QRD Android... CVE-2017-14892 7.8 HighMarch 30, 2018
• google android, qualcomm, inc. android for msm, firefox os for msm, qrd android +1 more In the KGSL driver function _gpuobj_map_useraddr() in Android for MSM, Firefox OS for MSM, and... CVE-2017-14891 5.3 MediumMarch 30, 2018
• google android, qualcomm, inc. android for msm, firefox os for msm, qrd android +1 more In the function wma_unified_power_debug_stats_event_handler() in Android for MSM, Firefox OS for... CVE-2017-14883 9.8 CriticalMarch 30, 2018
• google android, qualcomm, inc. android for msm, firefox os for msm, qrd android +1 more While calling the IPA IOCTL handler for IPA_IOC_ADD_HDR_PROC_CTX in Android for MSM, Firefox OS... CVE-2017-14881 9.8 CriticalMarch 30, 2018
• google android, qualcomm, inc. android for msm, firefox os for msm, qrd android +1 more While the IPA driver in Android for MSM, Firefox OS for MSM, and QRD Android before 2017-08-31 is... CVE-2017-14877 9.8 CriticalMarch 30, 2018
• google android, qualcomm, inc. android for msm, firefox os for msm, qrd android +1 more In msm_ispif_config_stereo() in Android for MSM, Firefox OS for MSM, and QRD Android before 2017... CVE-2017-14876 9.8 CriticalMarch 30, 2018
• google android, qualcomm, inc. android for msm, firefox os for msm, qrd android +1 more In the handler for the ioctl command VIDIOC_MSM_ISP_DUAL_HW_LPM_MODE in Android for MSM, Firefox... CVE-2017-14875 7.5 HighMarch 30, 2018
• google android, qualcomm, inc. android for msm, firefox os for msm, qrd android +1 more libOmxVenc in Android for MSM, Firefox OS for MSM, and QRD Android copies the output buffer to an... CVE-2017-11087 7.5 HighMarch 30, 2018
• elastic x-pack, x-pack security +1 more X-Pack Security versions 6.2.0, 6.2.1, and 6.2.2 are vulnerable to a user impersonation attack... CVE-2018-3822 9.8 CriticalMarch 30, 2018
• elastic kibana Kibana versions after 5.1.1 and before 5.6.7 and 6.1.3 had a cross-site scripting (XSS)... CVE-2018-3821 6.1 MediumMarch 30, 2018
• elastic kibana Kibana versions after 6.1.0 and before 6.1.3 had a cross-site scripting (XSS) vulnerability in... CVE-2018-3820 6.1 MediumMarch 30, 2018
• elastic kibana The fix in Kibana for ESA-2017-23 was incomplete. With X-Pack security enabled, Kibana versions... CVE-2018-3819 6.1 MediumMarch 30, 2018
• elastic kibana Kibana versions 5.1.1 to 6.1.2 and 5.6.6 had a cross-site scripting (XSS) vulnerability via the... CVE-2018-3818 6.1 MediumMarch 30, 2018
• elastic logstash When logging warnings regarding deprecated settings, Logstash before 5.6.6 and 6.x before 6.1.2... CVE-2018-3817 6.5 MediumMarch 30, 2018
• kingsoft internet security 9 plus A NULL pointer dereference bug in the function ObReferenceObjectByHandle in the Kingsoft Internet... CVE-2018-9151 5.5 MediumMarch 30, 2018
• westerndigital my cloud firmware Western Digital WD My Cloud v04.05.00-320 devices embed the session token (aka PHPSESSID) in... CVE-2018-9148 9.8 CriticalMarch 30, 2018
• rails rails-html-sanitizer, rubyonrails html sanitizer +1 more rails-html-sanitizer Cross-site Scripting vulnerability CVE-2018-3741 Fix available 6.1 MediumMarch 30, 2018
• hapi hoek node module, hapijs hoek +1 more Prototype Pollution in hoek CVE-2018-3728 Fix available 8.8 HighMarch 30, 2018
• gespage Cross-site scripting (XSS) vulnerabilities in version 7.5.7 of Gespage software allow remote... CVE-2018-9147 6.1 MediumMarch 30, 2018
• Show olderLoading…