# CVEs published 2019-01-07

8 CVEs were published on January 7, 2019: 0 critical, 0 high. Days are UTC.

- [CVE-2015-9275](https://cve.now/CVE-2015-9275.md): ARC 5.21q allows directory traversal via a full pathname in an archive file. (no CVSS)
- [CVE-2018-11798](https://cve.now/CVE-2018-11798.md): The Apache Thrift Node.js static web server in versions 0.9.2 through 0.11.0 have been determined to contain a security vulnerability in whi (no CVSS, Apache Software Foundation Apache Thrift · org.apache.thrif…)
- [CVE-2018-1320](https://cve.now/CVE-2018-1320.md): Apache Thrift Java client library versions 0.5.0 through 0.11.0 can bypass SASL negotiation isComplete validation in the org.apache.thrift.t (no CVSS, Apache Software Foundation Apache Thrift · org.apache.thrif…)
- [CVE-2019-5488](https://cve.now/CVE-2019-5488.md): EARCLINK ESPCMS-P8 has SQL injection in the install\_pack/index.php?ac=Member&at=verifyAccount verify\_key parameter. (no CVSS)
- [CVE-2019-5489](https://cve.now/CVE-2019-5489.md): The mincore() implementation in mm/mincore.c in the Linux kernel through 4.19.13 allowed local attackers to observe page cache access patter (no CVSS)
- [CVE-2018-11788](https://cve.now/CVE-2018-11788.md): Apache Karaf provides a features deployer, which allows users to "hot deploy" a features XML by dropping the file directly in the deploy fol (no CVSS, Apache Software Foundation Apache Karaf · org.apache.karaf.…)
- [CVE-2018-5481](https://cve.now/CVE-2018-5481.md): OnCommand Unified Manager for 7-Mode (core package) prior to 5.2.4 uses cookies that lack the secure attribute in certain circumstances maki (no CVSS, NetApp OnCommand Unified Manager for 7-Mode)
- [CVE-2018-5410](https://cve.now/CVE-2018-5410.md): Dokan file system driver contains a stack-based buffer overflow (no CVSS, Dokan Open Source File System)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2019-01-07
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.