# CVEs published 2019-01-03

58 CVEs were published on January 3, 2019: 1 critical, 1 high. Days are UTC.

- [CVE-2018-3986](https://cve.now/CVE-2018-3986.md): An exploitable information disclosure vulnerability exists in the "Secret Chats" functionality of the Telegram Android messaging application (CVSS 4.2, Telegram)
- [CVE-2018-4012](https://cve.now/CVE-2018-4012.md): An exploitable buffer overflow vulnerability exists in the HTTP header-parsing function of the Webroot BrightCloud SDK. (CVSS 9.0, Webroot)
- [CVE-2018-8827](https://cve.now/CVE-2018-8827.md): The admin web interface on Technicolor MediaAccess TG789vac v2 HP devices with firmware v16.3.7190-2761005-20161004084353 displays unsanitis (no CVSS)
- [CVE-2019-5005](https://cve.now/CVE-2019-5005.md): An issue was discovered in Foxit Reader and PhantomPDF before 9.4 on Windows. (no CVSS)
- [CVE-2019-5006](https://cve.now/CVE-2019-5006.md): An issue was discovered in Foxit Reader and PhantomPDF before 9.4 on Windows. (no CVSS)
- [CVE-2019-5007](https://cve.now/CVE-2019-5007.md): An issue was discovered in Foxit Reader and PhantomPDF before 9.4 on Windows. (no CVSS)
- [CVE-2018-18995](https://cve.now/CVE-2018-18995.md): Pluto Safety PLC Gateway Ethernet devices ABB GATE-E1 and GATE-E2 all versions do not allow authentication to be configured on administrativ (no CVSS, ABB GATE-E1 and GATE-E2)
- [CVE-2018-18997](https://cve.now/CVE-2018-18997.md): Pluto Safety PLC Gateway Ethernet devices in ABB GATE-E1 and GATE-E2 all versions allows an unauthenticated attacker using the administrativ (no CVSS, ABB GATE-E1 and GATE-E2)
- [CVE-2018-19249](https://cve.now/CVE-2018-19249.md): The Stripe API v1 allows remote attackers to bypass intended access restrictions by replaying api.stripe.com /v1/tokens XMLHttpRequest data, (no CVSS)
- [CVE-2018-15780](https://cve.now/CVE-2018-15780.md): DSA-2018-224: RSA Archer GRC Platform Improper Access Control Vulnerability (CVSS 4.3, Dell RSA Archer)
- [CVE-2018-18004](https://cve.now/CVE-2018-18004.md): Incorrect Access Control in mod\_inetd.cgi in VIVOTEK Network Camera Series products with firmware before XXXXXX-VVTK-0X09a allows remote att (no CVSS)
- [CVE-2018-18005](https://cve.now/CVE-2018-18005.md): Cross-site scripting in event\_script.js in VIVOTEK Network Camera Series products with firmware 0x06x to 0x08x allows remote attackers to ex (no CVSS)
- [CVE-2018-18244](https://cve.now/CVE-2018-18244.md): Cross-site scripting in syslog.html in VIVOTEK Network Camera Series products with firmware 0x06x to 0x08x allows remote attackers to execut (no CVSS)
- [CVE-2018-19600](https://cve.now/CVE-2018-19600.md): Rhymix CMS 1.9.8.1 allows XSS via an index.php?module=admin&act=dispModuleAdminFileBox SVG upload. (no CVSS)
- [CVE-2018-19601](https://cve.now/CVE-2018-19601.md): Rhymix CMS 1.9.8.1 allows SSRF via an index.php?module=admin&act=dispModuleAdminFileBox SVG upload. (no CVSS)
- [CVE-2018-14481](https://cve.now/CVE-2018-14481.md): Osclass 3.7.4 has XSS via the query string to index.php, a different vulnerability than CVE-2014-6280. (no CVSS)
- [CVE-2018-19414](https://cve.now/CVE-2018-19414.md): Multiple cross-site scripting (XSS) vulnerabilities in Plikli CMS 4.0.0 allow remote attackers to inject arbitrary web script or HTML via th (no CVSS)
- [CVE-2018-19415](https://cve.now/CVE-2018-19415.md): Multiple SQL injection vulnerabilities in Plikli CMS 4.0.0 allow remote attackers to execute arbitrary SQL commands via the (1) id parameter (no CVSS)
- [CVE-2018-19505](https://cve.now/CVE-2018-19505.md): Remedy AR System Server in BMC Remedy 7.1 may fail to set the correct user context in certain impersonation scenarios, which can allow a use (no CVSS)
- [CVE-2018-19523](https://cve.now/CVE-2018-19523.md): DriverAgent 2.2015.7.14, which includes DrvAgent64.sys 1.0.0.1, allows a user to send an IOCTL (0x80002068) with a user defined buffer size. (no CVSS)
- [CVE-2018-19861](https://cve.now/CVE-2018-19861.md): Buffer overflow in MiniShare 1.4.1 and earlier allows remote attackers to execute arbitrary code via a long HTTP HEAD request. (no CVSS)
- [CVE-2018-19862](https://cve.now/CVE-2018-19862.md): Buffer overflow in MiniShare 1.4.1 and earlier allows remote attackers to execute arbitrary code via a long HTTP POST request. (no CVSS)
- [CVE-2018-19992](https://cve.now/CVE-2018-19992.md): A stored cross-site scripting (XSS) vulnerability in Dolibarr 8.0.2 allows remote authenticated users to inject arbitrary web script or HTML (no CVSS, dolibarr/dolibarr)
- [CVE-2018-19993](https://cve.now/CVE-2018-19993.md): A reflected cross-site scripting (XSS) vulnerability in Dolibarr 8.0.2 allows remote attackers to inject arbitrary web script or HTML via th (no CVSS, dolibarr/dolibarr)
- [CVE-2018-19994](https://cve.now/CVE-2018-19994.md): An error-based SQL injection vulnerability in product/card.php in Dolibarr version 8.0.2 allows remote authenticated users to execute arbitr (no CVSS, dolibarr/dolibarr)
- [CVE-2018-19995](https://cve.now/CVE-2018-19995.md): A stored cross-site scripting (XSS) vulnerability in Dolibarr 8.0.2 allows remote authenticated users to inject arbitrary web script or HTML (no CVSS, dolibarr/dolibarr)
- [CVE-2018-19998](https://cve.now/CVE-2018-19998.md): SQL injection vulnerability in user/card.php in Dolibarr version 8.0.2 allows remote authenticated users to execute arbitrary SQL commands v (no CVSS, dolibarr/dolibarr)
- [CVE-2018-20512](https://cve.now/CVE-2018-20512.md): EPON CPE-WiFi devices 2.0.4-X000 are vulnerable to escalation of privileges by sending cooLogin=1, cooUser=admin, and timestamp=-1 cookies. (no CVSS)
- [CVE-2019-3575](https://cve.now/CVE-2019-3575.md): Sqla\_yaml\_fixtures 0.9.1 allows local users to execute arbitrary python code via the fixture\_text argument in sqla\_yaml\_fixtures.load. (no CVSS, sqla-yaml-fixtures)
- [CVE-2018-20663](https://cve.now/CVE-2018-20663.md): The Reporting Addon (aka Reports Addon) through 2019-01-02 for CUBA Platform through 6.10.x has Persistent XSS via the "Reports \> Reports" n (no CVSS, com.haulmont.cuba:cuba-web-toolkit)
- [CVE-2018-20664](https://cve.now/CVE-2018-20664.md): Zoho ManageEngine ADSelfService Plus 5.x before build 5701 has XXE via an uploaded product license. (no CVSS)
- [CVE-2019-3905](https://cve.now/CVE-2019-3905.md): Zoho ManageEngine ADSelfService Plus 5.x before build 5703 has SSRF. (no CVSS)
- [CVE-2018-17161](https://cve.now/CVE-2018-17161.md): In FreeBSD before 11.2-STABLE(r348229), 11.2-RELEASE-p7, 12.0-STABLE(r342228), and 12.0-RELEASE-p1, insufficient validation of network-provi (no CVSS, FreeBSD)
- [CVE-2018-16870](https://cve.now/CVE-2018-16870.md): It was found that wolfssl before 3.15.7 is vulnerable to a new variant of the Bleichenbacher attack to perform downgrade attacks against TLS (no CVSS, wolfssl)
- [CVE-2018-16882](https://cve.now/CVE-2018-16882.md): A use-after-free issue was found in the way the Linux kernel's KVM hypervisor processed posted interrupts when nested(=1) virtualization is (CVSS 6.1, The Linux Foundation kernel:)
- [CVE-2018-16885](https://cve.now/CVE-2018-16885.md): A flaw was found in the Linux kernel that allows the userspace to call memcpy\_fromiovecend() and similar functions with a zero offset and bu (CVSS 4.7, The Linux Foundation kernel)
- [CVE-2019-3701](https://cve.now/CVE-2019-3701.md): An issue was discovered in can\_can\_gw\_rcv in net/can/gw.c in the Linux kernel through 4.19.13. (no CVSS)
- [CVE-2017-11004](https://cve.now/CVE-2017-11004.md): A non-secure user may be able to access certain registers in snapdragon automobile, snapdragon mobile and snapdragon wear in versions IPQ807 (no CVSS, Qualcomm Snapdragon Automobile, Snapdragon Mobile, Snapdrag…)
- [CVE-2017-18141](https://cve.now/CVE-2017-18141.md): When a 3rd party TEE has been loaded it is possible for the non-secure world to create a secure monitor call which will give it access to pr (no CVSS, Qualcomm Snapdragon Automobile, Snapdragon Mobile, Snapdrag…)
- [CVE-2017-18319](https://cve.now/CVE-2017-18319.md): Information leak in UIM API debug messages in snapdragon mobile and snapdragon wear in versions MDM9206, MDM9607, MDM9615, MDM9625, MDM9635M (no CVSS, Qualcomm Snapdragon Mobile, Snapdragon Wear)
- [CVE-2017-18320](https://cve.now/CVE-2017-18320.md): QSEE unload attempt on a 3rd party TEE without previously loading results in a data abort in snapdragon automobile and snapdragon mobile in (no CVSS, Qualcomm Snapdragon Automobile, Snapdragon Mobile)
- [CVE-2017-18321](https://cve.now/CVE-2017-18321.md): Security keys used by the terminal and NW for a session could be leaked in snapdragon mobile in versions MDM9650, MDM9655, SD 835, SDA660. (no CVSS, Qualcomm Snapdragon Mobile)
- [CVE-2017-18322](https://cve.now/CVE-2017-18322.md): Cryptographic key material leaked in WCDMA debug messages in snapdragon mobile and snapdragon wear in versions MDM9206, MDM9607, MDM9615, MD (no CVSS, Qualcomm Snapdragon Mobile, Snapdragon Wear)
- [CVE-2017-18323](https://cve.now/CVE-2017-18323.md): Cryptographic key material leaked in TDSCDMA RRC debug messages in snapdragon automobile, snapdragon mobile and snapdragon wear in versions (no CVSS, Qualcomm Snapdragon Automobile, Snapdragon Mobile, Snapdrag…)
- [CVE-2017-18324](https://cve.now/CVE-2017-18324.md): Cryptographic key material leaked in debug messages - GERAN in snapdragon mobile and snapdragon wear in versions MDM9206, MDM9607, MDM9615, (no CVSS, Qualcomm Snapdragon Mobile, Snapdragon Wear)
- [CVE-2017-18326](https://cve.now/CVE-2017-18326.md): Cryptographic keys are printed in modem debug messages in snapdragon mobile and snapdragon wear in versions MDM9607, MDM9615, MDM9625, MDM96 (no CVSS, Qualcomm Snapdragon Mobile, Snapdragon Wear)
- [CVE-2017-18327](https://cve.now/CVE-2017-18327.md): Security keys are logged when any WCDMA call is configured or reconfigured in snapdragon automobile, snapdragon mobile and snapdragon wear i (no CVSS, Qualcomm Snapdragon Automobile, Snapdragon Mobile, Snapdrag…)
- [CVE-2017-18328](https://cve.now/CVE-2017-18328.md): Use after free in QSH client rule processing in snapdragon mobile and snapdragon wear in versions MDM9206, MDM9607, MDM9635M, MDM9640, MDM96 (no CVSS, Qualcomm Snapdragon Mobile, Snapdragon Wear)
- [CVE-2017-18329](https://cve.now/CVE-2017-18329.md): Possible Buffer overflow when transmitting an RTP packet in snapdragon automobile and snapdragon wear in versions MDM9615, MDM9625, MDM9635M (no CVSS, Qualcomm Snapdragon Mobile, Snapdragon Wear)
- [CVE-2017-18330](https://cve.now/CVE-2017-18330.md): Buffer overflow in AES-CCM and AES-GCM encryption via initialization vector in snapdragon automobile, snapdragon mobile and snapdragon wear (no CVSS, Qualcomm Snapdragon Automobile, Snapdragon Mobile, Snapdrag…)
- [CVE-2018-16876](https://cve.now/CVE-2018-16876.md): ansible before versions 2.5.14, 2.6.11, 2.7.5 is vulnerable to a information disclosure flaw in vvv+ mode with no\_log on that can lead to le (CVSS 3.1, Red Hat ansible · ansible)
- [CVE-2018-16879](https://cve.now/CVE-2018-16879.md): Ansible Tower before version 3.3.3 does not set a secure channel as it is using the default insecure configuration channel settings for mess (CVSS 7.3, \[UNKNOWN\] Tower)
- [CVE-2018-20662](https://cve.now/CVE-2018-20662.md): In Poppler 0.72.0, PDFDoc::setup in PDFDoc.cc allows attackers to cause a denial-of-service (application crash caused by Object.h SIGABRT, b (no CVSS)
- [CVE-2018-17172](https://cve.now/CVE-2018-17172.md): The web application on Xerox AltaLink B80xx before 100.008.028.05200, C8030/C8035 before 100.001.028.05200, C8045/C8055 before 100.002.028.0 (no CVSS)
- [CVE-2018-18264](https://cve.now/CVE-2018-18264.md): Kubernetes Dashboard before 1.10.1 allows attackers to bypass authentication and use Dashboard's Service Account for reading secrets within (no CVSS)
- [CVE-2018-18893](https://cve.now/CVE-2018-18893.md): Jinjava before 2.4.6 does not block the getClass method, related to com/hubspot/jinjava/el/ext/JinjavaBeanELResolver.java. (no CVSS, com.hubspot.jinjava:jinjava)
- [CVE-2018-20131](https://cve.now/CVE-2018-20131.md): The Code42 app before 6.8.4, as used in Code42 for Enterprise, on Linux installs with overly permissive permissions on the /usr/local/crashp (no CVSS)
- [CVE-2019-3580](https://cve.now/CVE-2019-3580.md): OpenRefine through 3.1 allows arbitrary file write because Directory Traversal can occur during the import of a crafted project file. (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2019-01-03
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.