CVEs published January 3, 2019
58 CVEs were published on January 3, 2019: 1 critical, 1 high.
- Published
- 58
- Critical
- 1
- High
- 1
- Medium
- 4
- Low
- 1
- Unrated
- 51
- Now in CISA KEV
- 0
- Fix available
- 10
Most affected products
- Qualcomm Snapdragon Mobile, Snapdragon Wear
- 6
- dolibarr/dolibarr
- 5
- Qualcomm Snapdragon Automobile, Snapdragon Mobile, Snapdrag…
- 5
- ABB GATE-E1 and GATE-E2
- 2
- [UNKNOWN] Tower
- 1
- com.haulmont.cuba:cuba-web-toolkit
- 1
- com.hubspot.jinjava:jinjava
- 1
- Dell RSA Archer
- 1
- FreeBSD
- 1
- Qualcomm Snapdragon Automobile, Snapdragon Mobile
- 1
Critical 1
High 1
Medium, low and unrated 56
- CVE-2018-3986An exploitable information disclosure vulnerability exists in the "Secret Chats" functionality of the Telegram Android messaging applicationTelegram
- CVE-2018-8827The admin web interface on Technicolor MediaAccess TG789vac v2 HP devices with firmware v16.3.7190-2761005-20161004084353 displays unsanitis
- CVE-2019-5005An issue was discovered in Foxit Reader and PhantomPDF before 9.4 on Windows.
- CVE-2019-5006An issue was discovered in Foxit Reader and PhantomPDF before 9.4 on Windows.
- CVE-2019-5007An issue was discovered in Foxit Reader and PhantomPDF before 9.4 on Windows.
- CVE-2018-18995Pluto Safety PLC Gateway Ethernet devices ABB GATE-E1 and GATE-E2 all versions do not allow authentication to be configured on administrativABB GATE-E1 and GATE-E2
- CVE-2018-18997Pluto Safety PLC Gateway Ethernet devices in ABB GATE-E1 and GATE-E2 all versions allows an unauthenticated attacker using the administrativABB GATE-E1 and GATE-E2
- CVE-2018-19249The Stripe API v1 allows remote attackers to bypass intended access restrictions by replaying api.stripe.com /v1/tokens XMLHttpRequest data,
- CVE-2018-15780DSA-2018-224: RSA Archer GRC Platform Improper Access Control VulnerabilityDell RSA Archer
- CVE-2018-18004Incorrect Access Control in mod_inetd.cgi in VIVOTEK Network Camera Series products with firmware before XXXXXX-VVTK-0X09a allows remote att
- CVE-2018-18005Cross-site scripting in event_script.js in VIVOTEK Network Camera Series products with firmware 0x06x to 0x08x allows remote attackers to ex
- CVE-2018-18244Cross-site scripting in syslog.html in VIVOTEK Network Camera Series products with firmware 0x06x to 0x08x allows remote attackers to execut
- CVE-2018-19600Rhymix CMS 1.9.8.1 allows XSS via an index.php?module=admin&act=dispModuleAdminFileBox SVG upload.
- CVE-2018-19601Rhymix CMS 1.9.8.1 allows SSRF via an index.php?module=admin&act=dispModuleAdminFileBox SVG upload.
- CVE-2018-14481Osclass 3.7.4 has XSS via the query string to index.php, a different vulnerability than CVE-2014-6280.
- CVE-2018-19414Multiple cross-site scripting (XSS) vulnerabilities in Plikli CMS 4.0.0 allow remote attackers to inject arbitrary web script or HTML via th
- CVE-2018-19415Multiple SQL injection vulnerabilities in Plikli CMS 4.0.0 allow remote attackers to execute arbitrary SQL commands via the (1) id parameter
- CVE-2018-19505Remedy AR System Server in BMC Remedy 7.1 may fail to set the correct user context in certain impersonation scenarios, which can allow a use
- CVE-2018-19523DriverAgent 2.2015.7.14, which includes DrvAgent64.sys 1.0.0.1, allows a user to send an IOCTL (0x80002068) with a user defined buffer size.
- CVE-2018-19861Buffer overflow in MiniShare 1.4.1 and earlier allows remote attackers to execute arbitrary code via a long HTTP HEAD request.
- CVE-2018-19862Buffer overflow in MiniShare 1.4.1 and earlier allows remote attackers to execute arbitrary code via a long HTTP POST request.
- CVE-2018-19992A stored cross-site scripting (XSS) vulnerability in Dolibarr 8.0.2 allows remote authenticated users to inject arbitrary web script or HTMLdolibarr/dolibarr
- CVE-2018-19993A reflected cross-site scripting (XSS) vulnerability in Dolibarr 8.0.2 allows remote attackers to inject arbitrary web script or HTML via thdolibarr/dolibarr
- CVE-2018-19994An error-based SQL injection vulnerability in product/card.php in Dolibarr version 8.0.2 allows remote authenticated users to execute arbitrdolibarr/dolibarr
- CVE-2018-19995A stored cross-site scripting (XSS) vulnerability in Dolibarr 8.0.2 allows remote authenticated users to inject arbitrary web script or HTMLdolibarr/dolibarr
- CVE-2018-19998SQL injection vulnerability in user/card.php in Dolibarr version 8.0.2 allows remote authenticated users to execute arbitrary SQL commands vdolibarr/dolibarr
- CVE-2018-20512EPON CPE-WiFi devices 2.0.4-X000 are vulnerable to escalation of privileges by sending cooLogin=1, cooUser=admin, and timestamp=-1 cookies.
- CVE-2019-3575Sqla_yaml_fixtures 0.9.1 allows local users to execute arbitrary python code via the fixture_text argument in sqla_yaml_fixtures.load.sqla-yaml-fixtures
- CVE-2018-20663The Reporting Addon (aka Reports Addon) through 2019-01-02 for CUBA Platform through 6.10.x has Persistent XSS via the "Reports > Reports" ncom.haulmont.cuba:cuba-web-toolkit
- CVE-2018-20664Zoho ManageEngine ADSelfService Plus 5.x before build 5701 has XXE via an uploaded product license.
- CVE-2019-3905Zoho ManageEngine ADSelfService Plus 5.x before build 5703 has SSRF.
- CVE-2018-17161In FreeBSD before 11.2-STABLE(r348229), 11.2-RELEASE-p7, 12.0-STABLE(r342228), and 12.0-RELEASE-p1, insufficient validation of network-proviFreeBSD
- CVE-2018-16870It was found that wolfssl before 3.15.7 is vulnerable to a new variant of the Bleichenbacher attack to perform downgrade attacks against TLSwolfssl
- CVE-2018-16882A use-after-free issue was found in the way the Linux kernel's KVM hypervisor processed posted interrupts when nested(=1) virtualization is The Linux Foundation kernel:
- CVE-2018-16885A flaw was found in the Linux kernel that allows the userspace to call memcpy_fromiovecend() and similar functions with a zero offset and buThe Linux Foundation kernel
- CVE-2019-3701An issue was discovered in can_can_gw_rcv in net/can/gw.c in the Linux kernel through 4.19.13.
- CVE-2017-11004A non-secure user may be able to access certain registers in snapdragon automobile, snapdragon mobile and snapdragon wear in versions IPQ807Qualcomm Snapdragon Automobile, Snapdragon Mobile, Snapdrag…
- CVE-2017-18141When a 3rd party TEE has been loaded it is possible for the non-secure world to create a secure monitor call which will give it access to prQualcomm Snapdragon Automobile, Snapdragon Mobile, Snapdrag…
- CVE-2017-18319Information leak in UIM API debug messages in snapdragon mobile and snapdragon wear in versions MDM9206, MDM9607, MDM9615, MDM9625, MDM9635MQualcomm Snapdragon Mobile, Snapdragon Wear
- CVE-2017-18320QSEE unload attempt on a 3rd party TEE without previously loading results in a data abort in snapdragon automobile and snapdragon mobile in Qualcomm Snapdragon Automobile, Snapdragon Mobile
- CVE-2017-18321Security keys used by the terminal and NW for a session could be leaked in snapdragon mobile in versions MDM9650, MDM9655, SD 835, SDA660.Qualcomm Snapdragon Mobile
- CVE-2017-18322Cryptographic key material leaked in WCDMA debug messages in snapdragon mobile and snapdragon wear in versions MDM9206, MDM9607, MDM9615, MDQualcomm Snapdragon Mobile, Snapdragon Wear
- CVE-2017-18323Cryptographic key material leaked in TDSCDMA RRC debug messages in snapdragon automobile, snapdragon mobile and snapdragon wear in versions Qualcomm Snapdragon Automobile, Snapdragon Mobile, Snapdrag…
- CVE-2017-18324Cryptographic key material leaked in debug messages - GERAN in snapdragon mobile and snapdragon wear in versions MDM9206, MDM9607, MDM9615, Qualcomm Snapdragon Mobile, Snapdragon Wear
- CVE-2017-18326Cryptographic keys are printed in modem debug messages in snapdragon mobile and snapdragon wear in versions MDM9607, MDM9615, MDM9625, MDM96Qualcomm Snapdragon Mobile, Snapdragon Wear
- CVE-2017-18327Security keys are logged when any WCDMA call is configured or reconfigured in snapdragon automobile, snapdragon mobile and snapdragon wear iQualcomm Snapdragon Automobile, Snapdragon Mobile, Snapdrag…
- CVE-2017-18328Use after free in QSH client rule processing in snapdragon mobile and snapdragon wear in versions MDM9206, MDM9607, MDM9635M, MDM9640, MDM96Qualcomm Snapdragon Mobile, Snapdragon Wear
- CVE-2017-18329Possible Buffer overflow when transmitting an RTP packet in snapdragon automobile and snapdragon wear in versions MDM9615, MDM9625, MDM9635MQualcomm Snapdragon Mobile, Snapdragon Wear
- CVE-2017-18330Buffer overflow in AES-CCM and AES-GCM encryption via initialization vector in snapdragon automobile, snapdragon mobile and snapdragon wear Qualcomm Snapdragon Automobile, Snapdragon Mobile, Snapdrag…
- CVE-2018-16876ansible before versions 2.5.14, 2.6.11, 2.7.5 is vulnerable to a information disclosure flaw in vvv+ mode with no_log on that can lead to leRed Hat ansible · ansible
- CVE-2018-20662In Poppler 0.72.0, PDFDoc::setup in PDFDoc.cc allows attackers to cause a denial-of-service (application crash caused by Object.h SIGABRT, b
- CVE-2018-17172The web application on Xerox AltaLink B80xx before 100.008.028.05200, C8030/C8035 before 100.001.028.05200, C8045/C8055 before 100.002.028.0
- CVE-2018-18264Kubernetes Dashboard before 1.10.1 allows attackers to bypass authentication and use Dashboard's Service Account for reading secrets within
- CVE-2018-18893Jinjava before 2.4.6 does not block the getClass method, related to com/hubspot/jinjava/el/ext/JinjavaBeanELResolver.java.com.hubspot.jinjava:jinjava
- CVE-2018-20131The Code42 app before 6.8.4, as used in Code42 for Enterprise, on Linux installs with overly permissive permissions on the /usr/local/crashp
- CVE-2019-3580OpenRefine through 3.1 allows arbitrary file write because Directory Traversal can occur during the import of a crafted project file.