CVEs published January 2, 2019
29 CVEs were published on January 2, 2019: 0 critical, 0 high.
- Published
- 29
- Critical
- 0
- High
- 0
- Medium
- 0
- Low
- 0
- Unrated
- 29
- Now in CISA KEV
- 0
- Fix available
- 7
Most affected products
- com.fasterxml.jackson.core:jackson-databind
- 7
- Apache Software Foundation Apache CouchDB
- 1
- Huawei Technologies Co. some HG products
- 1
- TOBESOFT XPLATFORM ActiveX
- 1
Medium, low and unrated 29
- CVE-2018-13045SQL injection vulnerability in the "Bazar" page in Yeswiki Cercopitheque 2018-06-19-1 and earlier allows attackers to execute arbitrary SQL
- CVE-2018-14718FasterXML jackson-databind 2.x before 2.9.7 might allow remote attackers to execute arbitrary code by leveraging failure to block the slf4j-com.fasterxml.jackson.core:jackson-databind
- CVE-2018-14719FasterXML jackson-databind 2.x before 2.9.7 might allow remote attackers to execute arbitrary code by leveraging failure to block the blaze-com.fasterxml.jackson.core:jackson-databind
- CVE-2018-14720FasterXML jackson-databind 2.x before 2.9.7 might allow attackers to conduct external XML entity (XXE) attacks by leveraging failure to bloccom.fasterxml.jackson.core:jackson-databind
- CVE-2018-14721FasterXML jackson-databind 2.x before 2.9.7 might allow remote attackers to conduct server-side request forgery (SSRF) attacks by leveragingcom.fasterxml.jackson.core:jackson-databind
- CVE-2018-15490An issue was discovered in ExpressVPN on Windows.
- CVE-2018-19360FasterXML jackson-databind 2.x before 2.9.8 might allow attackers to have unspecified impact by leveraging failure to block the axis2-transpcom.fasterxml.jackson.core:jackson-databind
- CVE-2018-19361FasterXML jackson-databind 2.x before 2.9.8 might allow attackers to have unspecified impact by leveraging failure to block the openjpa clascom.fasterxml.jackson.core:jackson-databind
- CVE-2018-19362FasterXML jackson-databind 2.x before 2.9.8 might allow attackers to have unspecified impact by leveraging failure to block the jboss-commoncom.fasterxml.jackson.core:jackson-databind
- CVE-2018-19371The SaveUserSettings service in Content Manager in SDL Web 8.5.0 has an XXE Vulnerability that allows reading sensitive files from the syste
- CVE-2018-19478In Artifex Ghostscript before 9.26, a carefully crafted PDF file can trigger an extremely long running computation when parsing the file.
- CVE-2018-20100An issue was discovered on August Connect devices.
- CVE-2018-20114On D-Link DIR-818LW Rev.A 2.05.B03 and DIR-860L Rev.B 2.03.B03 devices, unauthenticated remote OS command execution can occur in the soap.cg
- CVE-2018-20166A file-upload vulnerability exists in Rukovoditel 2.3.1.
- CVE-2018-20211ExifTool 8.32 allows local users to gain privileges by creating a %TEMP%\par-%username%\cache-exiftool-8.32 folder with a victim's username,
- CVE-2018-20326ChinaMobile PLC Wireless Router GPN2.4P21-C-CN devices with firmware W2001EN-00 have XSS via the cgi-bin/webproc?getpage=html/index.html var
- CVE-2018-20659An issue was discovered in Bento4 1.5.1-627.
- CVE-2019-3576inxedu through 2018-12-24 has a SQL Injection vulnerability that can lead to information disclosure via the deleteFaveorite/ PATH_INFO.
- CVE-2019-3577An issue was discovered in Waimai Super Cms 20150505.
- CVE-2018-7900There is an information leak vulnerability in some Huawei HG products.Huawei Technologies Co. some HG products
- CVE-2018-20658The server in Core FTP 2.0 build 653 on 32-bit platforms allows remote attackers to cause a denial of service (daemon crash) via a crafted X
- CVE-2019-3572An issue was discovered in libming 0.4.8.
- CVE-2019-3573In libsixel v1.8.2, there is an infinite loop in the function sixel_decode_raw_impl() in the file fromsixel.c, as demonstrated by sixel2png.
- CVE-2019-3574In libsixel v1.8.2, there is a heap-based buffer over-read in the function load_jpeg() in the file loader.c, as demonstrated by img2sixel.
- CVE-2018-17188Prior to CouchDB version 2.3.0, CouchDB allowed for runtime-configuration of key components of the database.Apache Software Foundation Apache CouchDB
- CVE-2018-20657The demangle_template function in cplus-dem.c in GNU libiberty, as distributed in GNU Binutils 2.31.1, has a memory leak via a crafted strin
- CVE-2018-5197A vulnerability in the ExtCommon.dll user extension module version 9.2, 9.2.1, 9.2.2 of Xplatform ActiveX could allow attacker to perform a TOBESOFT XPLATFORM ActiveX
- CVE-2019-3501The OUGC Awards plugin before 1.8.19 for MyBB allows XSS via a crafted award reason that is mishandled on the awards page or in a user profi
- CVE-2019-3500aria2c in aria2 1.33.1, when --log is used, can store an HTTP Basic Authentication username and password in a file, which might allow local