# CVEs published 2019-02-06

51 CVEs were published on February 6, 2019: 0 critical, 4 high. Days are UTC.

- [CVE-2018-20760](https://cve.now/CVE-2018-20760.md): In GPAC 0.7.1 and earlier, gf\_text\_get\_utf8\_line in media\_tools/text\_import.c in libgpac\_static.a allows an out-of-bounds write because a… (no CVSS)
- [CVE-2018-20761](https://cve.now/CVE-2018-20761.md): GPAC version 0.7.1 and earlier has a Buffer Overflow vulnerability in the gf\_sm\_load\_init function in scene\_manager.c in libgpac\_static.a. (no CVSS)
- [CVE-2018-20762](https://cve.now/CVE-2018-20762.md): GPAC version 0.7.1 and earlier has a buffer overflow vulnerability in the cat\_multiple\_files function in applications/mp4box/fileimport.c… (no CVSS)
- [CVE-2018-20763](https://cve.now/CVE-2018-20763.md): In GPAC 0.7.1 and earlier, gf\_text\_get\_utf8\_line in media\_tools/text\_import.c in libgpac\_static.a allows an out-of-bounds write because of… (no CVSS)
- [CVE-2018-7813](https://cve.now/CVE-2018-7813.md): A Type Confusion (CWE-843) vulnerability exists in Eurotherm by Schneider Electric GUIcon V2.0 (Gold Build 683.0) on pcwin.dll which could… (no CVSS, Schneider Electric SE Eurotherm by Schneider Electric GUIcon)
- [CVE-2018-7814](https://cve.now/CVE-2018-7814.md): A Stack-based Buffer Overflow (CWE-121) vulnerability exists in Eurotherm by Schneider Electric GUIcon V2.0 (Gold Build 683.0) which could… (no CVSS, Schneider Electric SE Eurotherm by Schneider Electric GUIcon)
- [CVE-2018-7815](https://cve.now/CVE-2018-7815.md): A Type Confusion (CWE-843) vulnerability exists in Eurotherm by Schneider Electric GUIcon V2.0 (Gold Build 683.0) on c3core.dll which… (no CVSS, Schneider Electric SE Eurotherm by Schneider Electric GUIcon)
- [CVE-2018-7817](https://cve.now/CVE-2018-7817.md): A Use After Free (CWE-416) vulnerability exists in Zelio Soft 2 v5.1 and prior versions which could cause remote code execution when… (no CVSS, Schneider Electric SE Zelio Soft 2 v5.1 and prior versions)
- [CVE-2018-7839](https://cve.now/CVE-2018-7839.md): A Cryptographic Issue (CWE-310) vulnerability exists in IIoT Monitor 3.1.38 which could allow information disclosure. (no CVSS, Schneider Electric SE IIoT Monitor)
- [CVE-2018-3973](https://cve.now/CVE-2018-3973.md): An exploitable out of bounds write exists in the CAL parsing functionality of Canvas Draw version 5.0.0. (CVSS 8.8, Talos ACD Systems)
- [CVE-2018-3976](https://cve.now/CVE-2018-3976.md): An exploitable out-of-bounds write exists in the CALS Raster file format-parsing functionality of Canvas Draw version 5.0.0.28. (CVSS 8.8, Talos ACD Systems)
- [CVE-2018-3980](https://cve.now/CVE-2018-3980.md): An exploitable out-of-bounds write exists in the TIFF-parsing functionality of Canvas Draw version 5.0.0. (CVSS 8.8, Talos ACD Systems)
- [CVE-2019-6517](https://cve.now/CVE-2019-6517.md): BD FACSLyric Research Use Only, Windows 10 Professional Operating System, U.S. (no CVSS, ICS-CERT BD FACSLyric)
- [CVE-2019-7543](https://cve.now/CVE-2019-7543.md): In KindEditor 4.1.11, the php/demo.php content1 parameter has a reflected Cross-site Scripting (XSS) vulnerability. (no CVSS)
- [CVE-2019-7544](https://cve.now/CVE-2019-7544.md): An issue was discovered in MyWebSQL 3.7. (no CVSS)
- [CVE-2019-7545](https://cve.now/CVE-2019-7545.md): In DbNinja 3.2.7, the Add Host function of the Manage Hosts pages has a Stored Cross-site Scripting (XSS) vulnerability in the User Name… (no CVSS)
- [CVE-2019-7546](https://cve.now/CVE-2019-7546.md): An issue was discovered in SIDU 6.0. (no CVSS)
- [CVE-2019-7547](https://cve.now/CVE-2019-7547.md): An issue was discovered in SIDU 6.0. (no CVSS)
- [CVE-2019-7548](https://cve.now/CVE-2019-7548.md): SQLAlchemy 1.2.17 has SQL Injection when the group\_by parameter can be controlled. (no CVSS, sqlalchemy)
- [CVE-2018-16890](https://cve.now/CVE-2018-16890.md): libcurl versions from 7.36.0 to before 7.64.0 is vulnerable to a heap buffer out-of-bounds read. (CVSS 5.4, The curl Project curl)
- [CVE-2019-3820](https://cve.now/CVE-2019-3820.md): It was discovered that the gnome-shell lock screen since version 3.15.91 did not properly restrict all contextual actions. (CVSS 4.8, The Gnome Project gnome-shell)
- [CVE-2019-3822](https://cve.now/CVE-2019-3822.md): libcurl versions from 7.36.0 to before 7.64.0 are vulnerable to a stack-based buffer overflow. (CVSS 7.1, The curl Project curl)
- [CVE-2019-3823](https://cve.now/CVE-2019-3823.md): libcurl versions from 7.34.0 to before 7.64.0 are vulnerable to a heap out-of-bounds read in the code handling the end-of-response for SMTP. (CVSS 4.3, The curl Project curl)
- [CVE-2019-3825](https://cve.now/CVE-2019-3825.md): A vulnerability was discovered in gdm before 3.31.4. (CVSS 6.3, The Gnome Projectr gdm)
- [CVE-2015-9282](https://cve.now/CVE-2015-9282.md): The Pie Chart Panel plugin through 2019-01-02 for Grafana is vulnerable to XSS via legend data or tooltip data. (no CVSS)
- [CVE-2019-3463](https://cve.now/CVE-2019-3463.md): Insufficient sanitization of arguments passed to rsync can bypass the restrictions imposed by rssh, a restricted shell that should… (no CVSS, Debian GNU/Linux rssh)
- [CVE-2019-3464](https://cve.now/CVE-2019-3464.md): Insufficient sanitization of environment variables passed to rsync can bypass the restrictions imposed by rssh, a restricted shell that… (no CVSS, Debian GNU/Linux rssh)
- [CVE-2018-20755](https://cve.now/CVE-2018-20755.md): MODX Revolution through v2.7.0-pl allows XSS via the User Photo field. (no CVSS, modx/revolution)
- [CVE-2018-20756](https://cve.now/CVE-2018-20756.md): MODX Revolution through v2.7.0-pl allows XSS via a document resource (such as pagetitle), which is mishandled during an Update action, a… (no CVSS, modx/revolution)
- [CVE-2018-20757](https://cve.now/CVE-2018-20757.md): MODX Revolution through v2.7.0-pl allows XSS via an extended user field such as Container name or Attribute name. (no CVSS, modx/revolution)
- [CVE-2018-20758](https://cve.now/CVE-2018-20758.md): MODX Revolution through v2.7.0-pl allows XSS via User Settings such as Description. (no CVSS, modx/revolution)
- [CVE-2019-1003005](https://cve.now/CVE-2019-1003005.md): A sandbox bypass vulnerability exists in Jenkins Script Security Plugin 1.50 and earlier in… (no CVSS, Jenkins project Jenkins Script Security Plugin · org.jenkin…)
- [CVE-2019-1003006](https://cve.now/CVE-2019-1003006.md): A sandbox bypass vulnerability exists in Jenkins Groovy Plugin 2.0 and earlier in… (no CVSS, Jenkins project Jenkins Groovy Plugin · org.jenkins-ci.plug…)
- [CVE-2019-1003007](https://cve.now/CVE-2019-1003007.md): A cross-site request forgery vulnerability exists in Jenkins Warnings Plugin 5.0.0 and earlier in… (no CVSS, Jenkins project Jenkins Warnings Plugin · org.jvnet.hudson.…)
- [CVE-2019-1003008](https://cve.now/CVE-2019-1003008.md): A cross-site request forgery vulnerability exists in Jenkins Warnings Next Generation Plugin 2.1.1 and earlier in… (no CVSS, Jenkins project Jenkins Warnings Next Generation Plugin · i…)
- [CVE-2019-1003009](https://cve.now/CVE-2019-1003009.md): An improper certificate validation vulnerability exists in Jenkins Active Directory Plugin 2.10 and earlier in… (no CVSS, Jenkins project Jenkins Active Directory Plugin · org.jenki…)
- [CVE-2019-1003010](https://cve.now/CVE-2019-1003010.md): A cross-site request forgery vulnerability exists in Jenkins Git Plugin 3.9.1 and earlier in… (no CVSS, org.jenkins-ci.plugins:git)
- [CVE-2019-1003011](https://cve.now/CVE-2019-1003011.md): An information exposure and denial of service vulnerability exists in Jenkins Token Macro Plugin 2.5 and earlier in… (no CVSS, Jenkins project Jenkins Token Macro Plugin · org.jenkins-ci…)
- [CVE-2019-1003012](https://cve.now/CVE-2019-1003012.md): A data modification vulnerability exists in Jenkins Blue Ocean Plugins 1.10.1 and earlier in blueocean-core-js/src/js/bundleStartup.js… (no CVSS, Jenkins project Jenkins Blue Ocean Plugins · io.jenkins.blu…)
- [CVE-2019-1003013](https://cve.now/CVE-2019-1003013.md): An cross-site scripting vulnerability exists in Jenkins Blue Ocean Plugins 1.10.1 and earlier in… (no CVSS, Jenkins project Jenkins Blue Ocean Plugins · io.jenkins.blu…)
- [CVE-2019-1003014](https://cve.now/CVE-2019-1003014.md): An cross-site scripting vulnerability exists in Jenkins Config File Provider Plugin 3.4.1 and earlier in… (no CVSS, Jenkins project Jenkins Config File Provider Plugin · org.j…)
- [CVE-2019-1003015](https://cve.now/CVE-2019-1003015.md): An XML external entity processing vulnerability exists in Jenkins Job Import Plugin 2.1 and earlier in… (no CVSS, Jenkins project Jenkins Job Import Plugin · org.jenkins-ci.…)
- [CVE-2019-1003016](https://cve.now/CVE-2019-1003016.md): An exposure of sensitive information vulnerability exists in Jenkins Job Import Plugin 2.1 and earlier in… (no CVSS, Jenkins project Jenkins Job Import Plugin · org.jenkins-ci.…)
- [CVE-2019-1003017](https://cve.now/CVE-2019-1003017.md): A data modification vulnerability exists in Jenkins Job Import Plugin 3.0 and earlier in JobImportAction.java that allows attackers to… (no CVSS, Jenkins project Jenkins Job Import Plugin · org.jenkins-ci.…)
- [CVE-2019-1003018](https://cve.now/CVE-2019-1003018.md): An exposure of sensitive information vulnerability exists in Jenkins GitHub Authentication Plugin 0.29 and earlier in… (no CVSS, Jenkins project Jenkins GitHub Authentication Plugin · org.…)
- [CVE-2019-1003019](https://cve.now/CVE-2019-1003019.md): An session fixation vulnerability exists in Jenkins GitHub Authentication Plugin 0.29 and earlier in GithubSecurityRealm.java that allows… (no CVSS, Jenkins project Jenkins GitHub Authentication Plugin · org.…)
- [CVE-2019-1003020](https://cve.now/CVE-2019-1003020.md): A server-side request forgery vulnerability exists in Jenkins Kanboard Plugin 1.5.10 and earlier in KanboardGlobalConfiguration.java that… (no CVSS, Jenkins project Jenkins Kanboard Plugin · org.jenkins-ci.pl…)
- [CVE-2019-1003021](https://cve.now/CVE-2019-1003021.md): An exposure of sensitive information vulnerability exists in Jenkins OpenId Connect Authentication Plugin 1.4 and earlier in… (no CVSS, Jenkins project Jenkins OpenId Connect Authentication Plugi…)
- [CVE-2019-1003022](https://cve.now/CVE-2019-1003022.md): A denial of service vulnerability exists in Jenkins Monitoring Plugin 1.74.0 and earlier in PluginImpl.java that allows attackers to kill… (no CVSS, Jenkins project Jenkins Monitoring Plugin · org.jvnet.hudso…)
- [CVE-2019-1003023](https://cve.now/CVE-2019-1003023.md): A cross-site scripting vulnerability exists in Jenkins Warnings Next Generation Plugin 1.0.1 and earlier in… (no CVSS, Jenkins project Jenkins Warnings Next Generation Plugin · i…)
- [CVE-2019-6504](https://cve.now/CVE-2019-6504.md): Insufficient output sanitization in the Automic Web Interface (AWI), in CA Automic Workload Automation 12.0 to 12.2, allow attackers to… (no CVSS, CA Technologies - A Broadcom Company CA Automic Workload Au…)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/archive/2019-02-06
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.