CVEs published January 8, 2019
71 CVEs were published on January 8, 2019: 0 critical, 2 high. 2 are now in CISA KEV.
- Published
- 71
- Critical
- 0
- High
- 2
- Medium
- 6
- Low
- 0
- Unrated
- 63
- Now in CISA KEV
- 2
- Fix available
- 16
Most affected products
- Microsoft Windows
- 14
- Microsoft Windows Server · Microsoft Windows
- 5
- Microsoft Edge · Microsoft ChakraCore +1
- 3
- Microsoft Edge
- 2
- Microsoft Exchange Server
- 2
- Microsoft SharePoint
- 2
- Microsoft Visual Studio
- 2
- Microsoft Windows 10 Servers · Microsoft Windows
- 2
- Microsoft Windows Server 2012 R2 · Microsoft Windows RT +2
- 2
- SAP SE SAP Cloud Connector
- 2
High 2
- CVE-2019-0541A remote code execution vulnerability exists in the way that the MSHTML engine inproperly validates input, aka "MSHTML Engine Remote Code ExMicrosoft Office · Microsoft Internet Explorer +1
- CVE-2019-0543An elevation of privilege vulnerability exists when Windows improperly handles authentication requests, aka "Microsoft Windows Elevation of
Medium, low and unrated 69
- CVE-2019-5716In Wireshark 2.6.0 to 2.6.5, the 6LoWPAN dissector could crash.
- CVE-2019-5717In Wireshark 2.6.0 to 2.6.5 and 2.4.0 to 2.4.11, the P_MUL dissector could crash.
- CVE-2019-5718In Wireshark 2.6.0 to 2.6.5 and 2.4.0 to 2.4.11, the RTSE dissector and other ASN.1 dissectors could crash.
- CVE-2019-5719In Wireshark 2.6.0 to 2.6.5 and 2.4.0 to 2.4.11, the ISAKMP dissector could crash.
- CVE-2019-5721In Wireshark 2.4.0 to 2.4.11, the ENIP dissector could crash.
- CVE-2019-5725qibosoft through V7 allows remote attackers to read arbitrary files via the member/index.php main parameter, as demonstrated by SSRF to a UR
- CVE-2019-0536An information disclosure vulnerability exists when the Windows kernel improperly handles objects in memory, aka "Windows Kernel InformationMicrosoft Windows
- CVE-2019-0537An information disclosure vulnerability exists when Visual Studio improperly discloses arbitrary file contents if the victim opens a malicioMicrosoft Visual Studio
- CVE-2019-0538A remote code execution vulnerability exists when the Windows Jet Database Engine improperly handles objects in memory, aka "Jet Database En
- CVE-2019-0539A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka "CMicrosoft Edge · Microsoft ChakraCore +1
- CVE-2019-0545An information disclosure vulnerability exists in .NET Framework and .NET Core which allows bypassing Cross-origin Resource Sharing (CORS) cMicrosoft .NET Core · Microsoft .NET Framework +1
- CVE-2019-0546A remote code execution vulnerability exists in Visual Studio when the C++ compiler improperly handles specific combinations of C++ construcMicrosoft Visual Studio
- CVE-2019-0547A memory corruption vulnerability exists in the Windows DHCP client when an attacker sends specially crafted DHCP responses to a client, akaMicrosoft Windows
- CVE-2019-0548A denial of service vulnerability exists when ASP.NET Core improperly handles web requests, aka "ASP.NET Core Denial of Service VulnerabilitMicrosoft ASP.NET Core
- CVE-2019-0549An information disclosure vulnerability exists when the Windows kernel improperly handles objects in memory, aka "Windows Kernel InformationMicrosoft Windows
- CVE-2019-0550A remote code execution vulnerability exists when Windows Hyper-V on a host server fails to properly validate input from an authenticated usMicrosoft Windows 10 Servers · Microsoft Windows
- CVE-2019-0551A remote code execution vulnerability exists when Windows Hyper-V on a host server fails to properly validate input from an authenticated usMicrosoft Windows Server · Microsoft Windows
- CVE-2019-0552An elevation of privilege exists in Windows COM Desktop Broker, aka "Windows COM Elevation of Privilege Vulnerability." This affects WindowsMicrosoft Windows Server 2012 R2 · Microsoft Windows RT +2
- CVE-2019-0553An information disclosure vulnerability exists when Windows Subsystem for Linux improperly handles objects in memory, aka "Windows SubsystemMicrosoft Windows 10 Servers · Microsoft Windows
- CVE-2019-0554An information disclosure vulnerability exists when the Windows kernel improperly handles objects in memory, aka "Windows Kernel InformationMicrosoft Windows
- CVE-2019-0555An elevation of privilege vulnerability exists in the Microsoft XmlDocument class that could allow an attacker to escape from the AppContain
- CVE-2019-0556A cross-site-scripting (XSS) vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web requesMicrosoft SharePoint
- CVE-2019-0557A cross-site-scripting (XSS) vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web requesMicrosoft SharePoint
- CVE-2019-0558A cross-site-scripting (XSS) vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web requesMicrosoft SharePoint Server · Microsoft SharePoint +1
- CVE-2019-0559An information disclosure vulnerability exists when Microsoft Outlook improperly handles certain types of messages, aka "Microsoft Outlook IMicrosoft Office · Microsoft Outlook
- CVE-2019-0560An information disclosure vulnerability exists when Microsoft Office improperly discloses the contents of its memory, aka "Microsoft Office Microsoft Office
- CVE-2019-0561An information disclosure vulnerability exists when Microsoft Word macro buttons are used improperly, aka "Microsoft Word Information DiscloMicrosoft Word · Microsoft Office
- CVE-2019-0562An elevation of privilege vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request tMicrosoft SharePoint Server · Microsoft SharePoint
- CVE-2019-0564A denial of service vulnerability exists when ASP.NET Core improperly handles web requests, aka "ASP.NET Core Denial of Service VulnerabilitMicrosoft ASP.NET Core · Microsoft.AspNetCore.WebSockets +5
- CVE-2019-0565A remote code execution vulnerability exists when Microsoft Edge improperly accesses objects in memory, aka "Microsoft Edge Memory CorruptioMicrosoft Edge
- CVE-2019-0566An elevation of privilege vulnerability exists in Microsoft Edge Browser Broker COM object, aka "Microsoft Edge Elevation of Privilege VulneMicrosoft Edge
- CVE-2019-0567A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka "CMicrosoft Edge · Microsoft ChakraCore +1
- CVE-2019-0568A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka "CMicrosoft Edge · Microsoft ChakraCore +1
- CVE-2019-0569An information disclosure vulnerability exists when the Windows kernel improperly handles objects in memory, aka "Windows Kernel InformationMicrosoft Windows
- CVE-2019-0570An elevation of privilege vulnerability exists when the Windows Runtime improperly handles objects in memory, aka "Windows Runtime ElevationMicrosoft Windows Server 2012 R2 · Microsoft Windows RT +2
- CVE-2019-0571An elevation of privilege vulnerability exists when the Windows Data Sharing Service improperly handles file operations, aka "Windows Data SMicrosoft Windows Server · Microsoft Windows
- CVE-2019-0572An elevation of privilege vulnerability exists when the Windows Data Sharing Service improperly handles file operations, aka "Windows Data SMicrosoft Windows Server · Microsoft Windows
- CVE-2019-0573An elevation of privilege vulnerability exists when the Windows Data Sharing Service improperly handles file operations, aka "Windows Data SMicrosoft Windows Server · Microsoft Windows
- CVE-2019-0574An elevation of privilege vulnerability exists when the Windows Data Sharing Service improperly handles file operations, aka "Windows Data SMicrosoft Windows Server · Microsoft Windows
- CVE-2019-0575A remote code execution vulnerability exists when the Windows Jet Database Engine improperly handles objects in memory, aka "Jet Database EnMicrosoft Windows
- CVE-2019-0576A remote code execution vulnerability exists when the Windows Jet Database Engine improperly handles objects in memory, aka "Jet Database EnMicrosoft Windows
- CVE-2019-0577A remote code execution vulnerability exists when the Windows Jet Database Engine improperly handles objects in memory, aka "Jet Database EnMicrosoft Windows
- CVE-2019-0578A remote code execution vulnerability exists when the Windows Jet Database Engine improperly handles objects in memory, aka "Jet Database En
- CVE-2019-0579A remote code execution vulnerability exists when the Windows Jet Database Engine improperly handles objects in memory, aka "Jet Database EnMicrosoft Windows
- CVE-2019-0580A remote code execution vulnerability exists when the Windows Jet Database Engine improperly handles objects in memory, aka "Jet Database EnMicrosoft Windows
- CVE-2019-0581A remote code execution vulnerability exists when the Windows Jet Database Engine improperly handles objects in memory, aka "Jet Database EnMicrosoft Windows
- CVE-2019-0582A remote code execution vulnerability exists when the Windows Jet Database Engine improperly handles objects in memory, aka "Jet Database EnMicrosoft Windows
- CVE-2019-0583A remote code execution vulnerability exists when the Windows Jet Database Engine improperly handles objects in memory, aka "Jet Database EnMicrosoft Windows
- CVE-2019-0584A remote code execution vulnerability exists when the Windows Jet Database Engine improperly handles objects in memory, aka "Jet Database EnMicrosoft Windows
- CVE-2019-0585A remote code execution vulnerability exists in Microsoft Word software when it fails to properly handle objects in memory, aka "Microsoft WMicrosoft Word · Microsoft Office +1
- CVE-2019-0586A remote code execution vulnerability exists in Microsoft Exchange software when the software fails to properly handle objects in memory, akMicrosoft Exchange Server
- CVE-2019-0588An information disclosure vulnerability exists when the Microsoft Exchange PowerShell API grants calendar contributors more view permissionsMicrosoft Exchange Server
- CVE-2019-0622An elevation of privilege vulnerability exists when Skype for Andriod fails to properly handle specific authentication requests, aka "Skype Microsoft Skype
- CVE-2018-2484SAP Enterprise Financial Services (fixed in SAPSCORE 1.13, 1.14, 1.15; S4CORE 1.01, 1.02, 1.03; EA-FINSERV 1.10, 2.0, 5.0, 6.0, 6.03, 6.04, SAP SE SAP Enterprise Financial Services
- CVE-2018-2499A security weakness in SAP Financial Consolidation Cube Designer (BOBJ_EADES fixed in versions 8.0, 10.1) may allow an attacker to discover SAP SE SAP Financial Consolidation Cube Designer
- CVE-2019-0238SAP Commerce (previously known as SAP Hybris Commerce), before version 6.7, does not sufficiently encode user-controlled inputs, resulting iSAP SE SAP Commerce
- CVE-2019-0240SAP Business Objects Mobile for Android (before 6.3.5) application allows an attacker to provide malicious input in the form of a SAP BI linSAP SE SAP Business Objects Mobile for Android
- CVE-2019-0241SAP Work and Inventory Manager (Agentry_SDK , before 7.0, 7.1) allows an attacker to prevent legitimate users from accessing a service, eithSAP SE SAP Work and Inventory Manager
- CVE-2019-0243Under some circumstances, masterdata maintenance in SAP BW/4HANA (fixed in DW4CORE version 1.0 (SP08)) does not perform necessary authorizatSAP SE SAP BW/4HANA
- CVE-2019-0244SAP CRM WebClient UI (fixed in SAPSCORE 1.12; S4FND 1.02; WEBCUIF 7.31, 7.46, 7.47, 7.48, 8.0, 8.01) does not sufficiently encode user-contrSAP SE SAP CRM WebClient UI
- CVE-2019-0245SAP CRM WebClient UI (fixed in SAPSCORE 1.12; S4FND 1.02; WEBCUIF 7.31, 7.46, 7.47, 7.48, 8.0, 8.01) does not sufficiently encode user-contrSAP SE SAP CRM WebClient UI
- CVE-2019-0246SAP Cloud Connector, before version 2.11.3, does not perform any authentication checks for functionalities that require user identity.SAP SE SAP Cloud Connector
- CVE-2019-0247SAP Cloud Connector, before version 2.11.3, allows an attacker to inject code that can be executed by the application.SAP SE SAP Cloud Connector
- CVE-2019-0248Under certain conditions SAP Gateway of ABAP Application Server (fixed in SAP_GWFND 7.5, 7.51, 7.52, 7.53; SAP_BASIS 7.5) allows an attackerSAP SE SAP Gateway of ABAP Application Server
- CVE-2019-0249Under certain conditions SAP Landscape Management (VCM 3.0) allows an attacker to access information which would otherwise be restricted.SAP SE SAP Landscape Management
- CVE-2018-1918IBM Jazz Reporting Service (JRS) 6.0.3, 6.0.4, 6.0.5, and 6.0.6 is vulnerable to cross-site scripting.IBM Jazz Reporting Service
- CVE-2018-1932IBM API Connect 5.0.0.0 through 5.0.8.4 is affected by a vulnerability in the role-based access control in the management server that could IBM API Connect
- CVE-2018-1993IBM Spectrum Scale (GPFS) 4.1.1, 4.2.0, 4.2.1, 4.2.2, 4.2.3, and 5.0.0 where the use of Local Read Only Cache (LROC) is enabled may caused rIBM Spectrum Scale
- CVE-2019-5720includes/db/class.reflines_db.inc in FrontAccounting 2.4.6 contains a SQL Injection vulnerability in the reference field that can allow the