# CVEs published 2019-01-02 29 CVEs were published on January 2, 2019: 0 critical, 0 high. Days are UTC. - [CVE-2018-13045](https://cve.now/CVE-2018-13045.md): SQL injection vulnerability in the "Bazar" page in Yeswiki Cercopitheque 2018-06-19-1 and earlier allows attackers to execute arbitrary SQL (no CVSS) - [CVE-2018-14718](https://cve.now/CVE-2018-14718.md): FasterXML jackson-databind 2.x before 2.9.7 might allow remote attackers to execute arbitrary code by leveraging failure to block the slf4j- (no CVSS, com.fasterxml.jackson.core:jackson-databind) - [CVE-2018-14719](https://cve.now/CVE-2018-14719.md): FasterXML jackson-databind 2.x before 2.9.7 might allow remote attackers to execute arbitrary code by leveraging failure to block the blaze- (no CVSS, com.fasterxml.jackson.core:jackson-databind) - [CVE-2018-14720](https://cve.now/CVE-2018-14720.md): FasterXML jackson-databind 2.x before 2.9.7 might allow attackers to conduct external XML entity (XXE) attacks by leveraging failure to bloc (no CVSS, com.fasterxml.jackson.core:jackson-databind) - [CVE-2018-14721](https://cve.now/CVE-2018-14721.md): FasterXML jackson-databind 2.x before 2.9.7 might allow remote attackers to conduct server-side request forgery (SSRF) attacks by leveraging (no CVSS, com.fasterxml.jackson.core:jackson-databind) - [CVE-2018-15490](https://cve.now/CVE-2018-15490.md): An issue was discovered in ExpressVPN on Windows. (no CVSS) - [CVE-2018-19360](https://cve.now/CVE-2018-19360.md): FasterXML jackson-databind 2.x before 2.9.8 might allow attackers to have unspecified impact by leveraging failure to block the axis2-transp (no CVSS, com.fasterxml.jackson.core:jackson-databind) - [CVE-2018-19361](https://cve.now/CVE-2018-19361.md): FasterXML jackson-databind 2.x before 2.9.8 might allow attackers to have unspecified impact by leveraging failure to block the openjpa clas (no CVSS, com.fasterxml.jackson.core:jackson-databind) - [CVE-2018-19362](https://cve.now/CVE-2018-19362.md): FasterXML jackson-databind 2.x before 2.9.8 might allow attackers to have unspecified impact by leveraging failure to block the jboss-common (no CVSS, com.fasterxml.jackson.core:jackson-databind) - [CVE-2018-19371](https://cve.now/CVE-2018-19371.md): The SaveUserSettings service in Content Manager in SDL Web 8.5.0 has an XXE Vulnerability that allows reading sensitive files from the syste (no CVSS) - [CVE-2018-19478](https://cve.now/CVE-2018-19478.md): In Artifex Ghostscript before 9.26, a carefully crafted PDF file can trigger an extremely long running computation when parsing the file. (no CVSS) - [CVE-2018-20100](https://cve.now/CVE-2018-20100.md): An issue was discovered on August Connect devices. (no CVSS) - [CVE-2018-20114](https://cve.now/CVE-2018-20114.md): On D-Link DIR-818LW Rev.A 2.05.B03 and DIR-860L Rev.B 2.03.B03 devices, unauthenticated remote OS command execution can occur in the soap.cg (no CVSS) - [CVE-2018-20166](https://cve.now/CVE-2018-20166.md): A file-upload vulnerability exists in Rukovoditel 2.3.1. (no CVSS) - [CVE-2018-20211](https://cve.now/CVE-2018-20211.md): ExifTool 8.32 allows local users to gain privileges by creating a %TEMP%\\par-%username%\\cache-exiftool-8.32 folder with a victim's username, (no CVSS) - [CVE-2018-20326](https://cve.now/CVE-2018-20326.md): ChinaMobile PLC Wireless Router GPN2.4P21-C-CN devices with firmware W2001EN-00 have XSS via the cgi-bin/webproc?getpage=html/index.html var (no CVSS) - [CVE-2018-20659](https://cve.now/CVE-2018-20659.md): An issue was discovered in Bento4 1.5.1-627. (no CVSS) - [CVE-2019-3576](https://cve.now/CVE-2019-3576.md): inxedu through 2018-12-24 has a SQL Injection vulnerability that can lead to information disclosure via the deleteFaveorite/ PATH\_INFO. (no CVSS) - [CVE-2019-3577](https://cve.now/CVE-2019-3577.md): An issue was discovered in Waimai Super Cms 20150505. (no CVSS) - [CVE-2018-7900](https://cve.now/CVE-2018-7900.md): There is an information leak vulnerability in some Huawei HG products. (no CVSS, Huawei Technologies Co. some HG products) - [CVE-2018-20658](https://cve.now/CVE-2018-20658.md): The server in Core FTP 2.0 build 653 on 32-bit platforms allows remote attackers to cause a denial of service (daemon crash) via a crafted X (no CVSS) - [CVE-2019-3572](https://cve.now/CVE-2019-3572.md): An issue was discovered in libming 0.4.8. (no CVSS) - [CVE-2019-3573](https://cve.now/CVE-2019-3573.md): In libsixel v1.8.2, there is an infinite loop in the function sixel\_decode\_raw\_impl() in the file fromsixel.c, as demonstrated by sixel2png. (no CVSS) - [CVE-2019-3574](https://cve.now/CVE-2019-3574.md): In libsixel v1.8.2, there is a heap-based buffer over-read in the function load\_jpeg() in the file loader.c, as demonstrated by img2sixel. (no CVSS) - [CVE-2018-17188](https://cve.now/CVE-2018-17188.md): Prior to CouchDB version 2.3.0, CouchDB allowed for runtime-configuration of key components of the database. (no CVSS, Apache Software Foundation Apache CouchDB) - [CVE-2018-20657](https://cve.now/CVE-2018-20657.md): The demangle\_template function in cplus-dem.c in GNU libiberty, as distributed in GNU Binutils 2.31.1, has a memory leak via a crafted strin (no CVSS) - [CVE-2018-5197](https://cve.now/CVE-2018-5197.md): A vulnerability in the ExtCommon.dll user extension module version 9.2, 9.2.1, 9.2.2 of Xplatform ActiveX could allow attacker to perform a (no CVSS, TOBESOFT XPLATFORM ActiveX) - [CVE-2019-3501](https://cve.now/CVE-2019-3501.md): The OUGC Awards plugin before 1.8.19 for MyBB allows XSS via a crafted award reason that is mishandled on the awards page or in a user profi (no CVSS) - [CVE-2019-3500](https://cve.now/CVE-2019-3500.md): aria2c in aria2 1.33.1, when --log is used, can store an HTTP Basic Authentication username and password in a file, which might allow local (no CVSS) --- Source: cve.now, built and run by Sazabi (AI-native observability and security) Page: https://cve.now/daily/2019-01-02 Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.