CVEs published March 27, 2019
75 CVEs were published on March 27, 2019: 0 critical, 19 high. 1 is now in CISA KEV.
- Published
- 75
- Critical
- 0
- High
- 19
- Medium
- 10
- Low
- 0
- Unrated
- 46
- Now in CISA KEV
- 1
- Fix available
- 13
Most affected products
- Extensible Firmware Interface Development Kit
- 9
- Cisco IOS XE Software
- 6
- Micro Focus Solutions Business Manager
- 4
- The Eclipse Foundation Eclipse Mosquitto
- 4
- Cisco IOS and IOS XE Software
- 3
- article2pdf Wordpress plug-in
- 2
- Cisco IOS and Cisco IOS-XE Software
- 2
- Cisco IOS and IOS-XE Software
- 2
- https://github.com/rails/rails · actionview
- 2
- [UNKNOWN] ceph
- 1
High 19
- CVE-2019-1749Cisco Aggregation Services Router 900 Route Switch Processor 3 OSPFv2 Denial of Service VulnerabilityCisco IOS XE Software
- CVE-2019-1750Cisco IOS XE Software Catalyst 4500 Cisco Discovery Protocol Denial of Service VulnerabilityCisco IOS XE Software
- CVE-2019-1747Cisco IOS and IOS XE Software Short Message Service Denial of Service VulnerabilityCisco IOS and IOS XE Software
- CVE-2019-1748Cisco IOS and IOS XE Software Network Plug-and-Play Agent Certificate Validation VulnerabilityCisco IOS and IOS XE Software
- CVE-2019-1746Cisco IOS and IOS XE Software Cluster Management Protocol Denial of Service VulnerabilityCisco IOS and IOS XE Software
- CVE-2019-1745Cisco IOS XE Software Command Injection VulnerabilityCisco IOS XE Software
- CVE-2019-1742Cisco IOS XE Software Information Disclosure VulnerabilityCisco IOS XE Software
- CVE-2019-1743Cisco IOS XE Software Arbitrary File Upload VulnerabilityCisco IOS XE Software
- CVE-2019-1740Cisco IOS and IOS XE Software Network-Based Application Recognition Denial of Service VulnerabilitiesCisco IOS and Cisco IOS-XE Software
- CVE-2019-1741Cisco IOS XE Software Encrypted Traffic Analytics Denial of Service VulnerabilityCisco IOS XE Software
- CVE-2019-1739Cisco IOS and IOS XE Software Network-Based Application Recognition Denial of Service VulnerabilitiesCisco IOS and Cisco IOS-XE Software
- CVE-2019-1738Cisco IOS and IOS XE Software Network-Based Application Recognition Denial of Service VulnerabilityCisco IOS and IOS-XE Software
- CVE-2019-1737Cisco IOS and IOS XE Software IP Service Level Agreement Denial of Service VulnerabilityCisco IOS and IOS-XE Software
- CVE-2019-0160Buffer overflow in system firmware for EDK II may allow unauthenticated user to potentially enable escalation of privilege and/or denial…Extensible Firmware Interface Development Kit
- CVE-2017-18364phpFK lite has XSS via the faq.php, members.php, or search.php query string or the user.php user parameter.
- CVE-2019-5418There is a File Content Disclosure vulnerability in Action View <5.2.2.1, <5.1.6.2, <5.0.7.2, <4.2.11.1 and v3 where specially crafted accephttps://github.com/rails/rails · actionview
- CVE-2019-3817A use-after-free flaw has been discovered in libcomps before version 0.1.10 in the way ObjMRTrees are merged.libcomps
- CVE-2019-3821A flaw was found in the way civetweb frontend was handling requests for ceph RGW server with SSL enabled.[UNKNOWN] ceph
- CVE-2019-3814It was discovered that Dovecot before versions 2.2.36.1 and 2.3.4.1 incorrectly handled client certificates.dovecot
Medium, low and unrated 56
- CVE-2018-19648An issue was discovered in ADTRAN PMAA 1.6.2-1, 1.6.3, and 1.6.4.
- CVE-2018-14814WECON Technology PI Studio HMI versions 4.1.9 and prior and PI Studio versions 4.2.34 and prior lacks proper validation of user-supplied…WECON Technology PI Studio HMI
- CVE-2017-9626Systems using the Marel Food Processing Systems Pluto platform do not restrict remote access.Marel Food Processing Systems Pluto platform
- CVE-2019-0161Stack overflow in XHCI for EDK II may allow an unauthenticated user to potentially enable denial of service via local access.Extensible Firmware Interface Development Kit
- CVE-2018-12181Stack overflow in corrupted bmp for EDK II may allow unprivileged user to potentially enable denial of service or elevation of privilege…Extensible Firmware Interface Development Kit
- CVE-2018-12180Buffer overflow in BlockIo service for EDK II may allow an unauthenticated user to potentially enable escalation of privilege, information…Extensible Firmware Interface Development Kit
- CVE-2018-12545In Eclipse Jetty version 9.3.x and 9.4.x, the server is vulnerable to Denial of Service conditions if a remote client sends either large…The Eclipse Foundation Eclipse Jetty · org.eclipse.jetty:je…
- CVE-2018-12179Improper configuration in system firmware for EDK II may allow unauthenticated user to potentially enable escalation of privilege…Extensible Firmware Interface Development Kit
- CVE-2017-7655In Eclipse Mosquitto version from 1.0 to 1.4.15, a Null Dereference vulnerability was found in the Mosquitto library which could lead to…The Eclipse Foundation Eclipse Mosquitto
- CVE-2018-12178Buffer overflow in network stack for EDK II may allow unprivileged user to potentially enable escalation of privilege and/or denial of…Extensible Firmware Interface Development Kit
- CVE-2018-12182Insufficient memory write check in SMM service for EDK II may allow an authenticated user to potentially enable escalation of privilege…Extensible Firmware Interface Development Kit
- CVE-2018-12183Stack overflow in DxeCore for EDK II may allow an unauthenticated user to potentially enable escalation of privilege, information…Extensible Firmware Interface Development Kit
- CVE-2018-3613Logic issue in variable service module for EDK II/UDK2018/UDK2017/UDK2015 may allow an authenticated user to potentially enable escalation…Extensible Firmware Interface Development Kit
- CVE-2018-15585Cross-Site Scripting (XSS) vulnerability in newwinform.php in GNUBOARD5 before 5.3.1.6 allows remote attackers to inject arbitrary web…
- CVE-2019-1010257An Information Disclosure / Data Modification issue exists in article2pdf_getfile.php in the article2pdf Wordpress plugin 0.24, 0.25…article2pdf Wordpress plug-in
- CVE-2019-1000031A disk space or quota exhaustion issue exists in article2pdf_getfile.php in the article2pdf Wordpress plugin 0.24, 0.25, 0.26, 0.27.article2pdf Wordpress plug-in
- CVE-2019-10238Sitemagic CMS v4.4 has XSS in SMFiles/FrmUpload.class.php via the filename parameter.
- CVE-2019-10237S-CMS PHP v1.0 has a CSRF vulnerability to add a new admin user via the 4.edu.php/admin/ajax.php?type=admin&action=add&lang=0 URI, a…
- CVE-2018-18994LCDS Laquis SCADA prior to version 4.1.0.4150 allows an out of bounds read when opening a specially crafted project file, which may cause…LCDS Laquis SCADA
- CVE-2018-12546In Eclipse Mosquitto version 1.0 to 1.5.5 (inclusive) when a client publishes a retained message to a topic, then has its access to that…The Eclipse Foundation Eclipse Mosquitto
- CVE-2018-12550When Eclipse Mosquitto version 1.0 to 1.5.5 (inclusive) is configured to use an ACL file, and that ACL file is empty, or contains only…The Eclipse Foundation Eclipse Mosquitto
- CVE-2018-12551When Eclipse Mosquitto version 1.0 to 1.5.5 (inclusive) is configured to use a password file for authentication, any malformed data in the…The Eclipse Foundation Eclipse Mosquitto
- CVE-2019-3829A vulnerability was found in gnutls versions from 3.5.8 before 3.6.7.gnutls
- CVE-2018-19016Rockwell Automation EtherNet/IP Web Server Modules 1756-EWEB (includes 1756-EWEBK) Version 5.001 and earlier, and CompactLogix 1768-EWEB…Rockwell Automation EtherNet/IP Web Server Modules 1756-EWE…
- CVE-2018-19643Solutions Business Manager (SBM) Information Leakage issue in version prior to 11.5Micro Focus Solutions Business Manager
Show all 56 entriesShow fewer entries
- CVE-2018-19644Solutions Business Manager (SBM) reflected cross site script issue in version prior to 11.5Micro Focus Solutions Business Manager
- CVE-2018-19466A vulnerability was found in Portainer before 1.20.0.
- CVE-2018-19642Solutions Business Manager (SBM) Denial of Service issue in version prior to 11.5Micro Focus Solutions Business Manager
- CVE-2018-19641Solutions Business Manager (SBM) Unauthenticated remote code execution issue in version prior to 11.5Micro Focus Solutions Business Manager
- CVE-2019-10233Teclib GLPI before 9.4.1.1 is affected by a timing attack associated with a cookie.
- CVE-2019-10232Teclib GLPI through 9.3.3 has SQL injection via the "cycle" parameter in /scripts/unlock_tasks.php.
- CVE-2019-10231Teclib GLPI before 9.4.1.1 is affected by a PHP type juggling vulnerability allowing bypass of authentication.
- CVE-2017-2752A potential security vulnerability caused by incomplete obfuscation of application configuration information was discovered in Tommy…Tommy Hilfiger TH24/7 Android app
- CVE-2017-2748A potential security vulnerability caused by the use of insecure (http) transactions during login has been identified with early versions…Isaac Mizrahi Smartwatch Mobile App
- CVE-2018-5927HP Support Assistant before 8.7.50.3 allows an unauthorized person with local access to load arbitrary code.HP Support Assistant
- CVE-2019-6536Opening a specially crafted LCDS LAquis SCADA before 4.3.1.71 ELS file may result in a write past the end of an allocated buffer, which…LCDS - Leão Consultoria e Desenvolvimento de Sistemas Ltda…
- CVE-2018-5926A potential vulnerability has been identified in HP Remote Graphics Software’s certificate authentication process version 7.5.0 and earlier.HP Remote Graphics Software
- CVE-2018-5923In HP LaserJet Enterprise, HP PageWide Enterprise, HP LaserJet Managed, and HP OfficeJet Enterprise Printers, solution application…HP LaserJet Enterprise, HP PageWide Enterprise, HP LaserJet…
- CVE-2019-9860Due to unencrypted signal communication and predictability of rolling codes, an attacker can "desynchronize" an ABUS Secvest wireless…
- CVE-2019-9862An issue was discovered on ABUS Secvest wireless alarm system FUAA50000 3.01.01 in conjunction with Secvest remote control FUBE50014 or…
- CVE-2019-5420A remote code execution vulnerability in development mode Rails <5.2.2.1, <6.0.0.beta3 can allow an attacker to guess the automatically…https://github.com/rails/rails · railties
- CVE-2019-5419There is a possible denial of service vulnerability in Action View (Rails) <5.2.2.1, <5.1.6.2, <5.0.7.2, <4.2.11.1 where specially crafted…https://github.com/rails/rails · actionview
- CVE-2019-9863Due to the use of an insecure algorithm for rolling codes in the ABUS Secvest wireless alarm system FUAA50000 3.01.01 and its remote…
- CVE-2018-16207PowerAct Pro Master Agent for Windows Version 5.13 and earlier allows authenticated attackers to bypass access restriction to alter or…OMRON SOCIAL SOLUTIONS Co. PowerAct Pro Master Agent for Wi…
- CVE-2019-5926Cross-site scripting vulnerability in KinagaCMS versions prior to 6.5 allows remote authenticated attackers to inject arbitrary web script…Project Kinaga KinagaCMS
- CVE-2019-5927Directory traversal vulnerability in 'an' App for iOS Version 3.2.0 and earlier allows remote attackers to read arbitrary files via…PERSOL CAREER CO. 'an' App for iOS
- CVE-2019-3840A NULL pointer dereference flaw was discovered in libvirt before version 5.0.0 in the way it gets interface information through the QEMU…The libvirt Project libvirt
- CVE-2018-10934A cross-site scripting (XSS) vulnerability was found in the JBoss Management Console versions before 7.1.6.CR1, 7.1.6.GA.Red Hat wildfly-core
- CVE-2019-3877A vulnerability was found in mod_auth_mellon before v0.14.2.uninett mod_auth_mellon
- CVE-2019-9917ZNC before 1.7.3-rc1 allows an existing remote user to cause a Denial of Service (crash) via invalid encoding.
- CVE-2019-10125An issue was discovered in aio_poll() in fs/aio.c in the Linux kernel through 5.0.4.
- CVE-2016-10744In Select2 through 4.0.5, as used in Snipe-IT and other products, rich selectlists allow XSS.select2
- CVE-2019-10118Snipe-IT before 4.6.14 has XSS, as demonstrated by log_meta values and the user's last name in the API.snipe/snipe-it
- CVE-2019-7167Zcash, before the Sapling network upgrade (2018-10-28), had a counterfeiting vulnerability.
- CVE-2019-3828Ansible fetch module before versions 2.5.15, 2.6.14, 2.7.8 has a path traversal vulnerability which allows copying and overwriting files…Red Hat Ansible · ansible
- CVE-2019-3847A vulnerability was found in moodle before versions 3.6.3, 3.5.5, 3.4.8 and 3.1.17.[UNKNOWN] Moodle · moodle/moodle