# CVEs published 2019-01-04

10 CVEs were published on January 4, 2019: 0 critical, 0 high. Days are UTC.

- [CVE-2018-20673](https://cve.now/CVE-2018-20673.md): The demangle\_template function in cplus-dem.c in GNU libiberty, as distributed in GNU Binutils 2.31.1, contains an integer overflow vulnerab (no CVSS)
- [CVE-2018-20671](https://cve.now/CVE-2018-20671.md): load\_specific\_debug\_section in objdump.c in GNU Binutils through 2.31.1 contains an integer overflow vulnerability that can trigger a heap-b (no CVSS)
- [CVE-2019-5312](https://cve.now/CVE-2019-5312.md): An issue was discovered in weixin-java-tools v3.3.0. (no CVSS, com.github.binarywang:weixin-java-common)
- [CVE-2018-1657](https://cve.now/CVE-2018-1657.md): IBM Publishing Engine 2.1.2, 6.0.5, and 6.0.6 is vulnerable to cross-site scripting. (CVSS 5.4, IBM Rational Publishing Engine)
- [CVE-2018-1859](https://cve.now/CVE-2018-1859.md): IBM API Connect 5.0.0.0 through 5.0.8.4 could allow a user authenticated as an administrator with limited rights to escalate their privilege (CVSS 4.3, IBM API Connect)
- [CVE-2018-1888](https://cve.now/CVE-2018-1888.md): An untrusted search path vulnerability in IBM i Access for Windows versions 7.1 and earlier on Windows can allow arbitrary code execution vi (CVSS 5.3, IBM i Access for Windows)
- [CVE-2018-1951](https://cve.now/CVE-2018-1951.md): IBM Publishing Engine 2.1.2, 6.0.5, and 6.0.6 is vulnerable to cross-site scripting. (CVSS 5.4, IBM Rational Publishing Engine)
- [CVE-2019-5311](https://cve.now/CVE-2019-5311.md): An issue was discovered in YUNUCMS V1.1.8. (no CVSS)
- [CVE-2019-5009](https://cve.now/CVE-2019-5009.md): Vtiger CRM 7.1.0 before Hotfix2 allows uploading files with the extension "php3" in the logo upload field, if the uploaded file is in PNG fo (no CVSS)
- [CVE-2019-5310](https://cve.now/CVE-2019-5310.md): YUNUCMS 1.1.8 has XSS in app/admin/controller/System.php because crafted data can be written to the sys.php file, as demonstrated by site\_ti (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2019-01-04
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.