# CVEs published 2019-01-08

71 CVEs were published on January 8, 2019: 0 critical, 2 high. 2 are now in CISA KEV. Days are UTC.

- [CVE-2019-5716](https://cve.now/CVE-2019-5716.md): In Wireshark 2.6.0 to 2.6.5, the 6LoWPAN dissector could crash. (no CVSS)
- [CVE-2019-5717](https://cve.now/CVE-2019-5717.md): In Wireshark 2.6.0 to 2.6.5 and 2.4.0 to 2.4.11, the P\_MUL dissector could crash. (no CVSS)
- [CVE-2019-5718](https://cve.now/CVE-2019-5718.md): In Wireshark 2.6.0 to 2.6.5 and 2.4.0 to 2.4.11, the RTSE dissector and other ASN.1 dissectors could crash. (no CVSS)
- [CVE-2019-5719](https://cve.now/CVE-2019-5719.md): In Wireshark 2.6.0 to 2.6.5 and 2.4.0 to 2.4.11, the ISAKMP dissector could crash. (no CVSS)
- [CVE-2019-5721](https://cve.now/CVE-2019-5721.md): In Wireshark 2.4.0 to 2.4.11, the ENIP dissector could crash. (no CVSS)
- [CVE-2019-5725](https://cve.now/CVE-2019-5725.md): qibosoft through V7 allows remote attackers to read arbitrary files via the member/index.php main parameter, as demonstrated by SSRF to a UR (no CVSS)
- [CVE-2019-0536](https://cve.now/CVE-2019-0536.md): An information disclosure vulnerability exists when the Windows kernel improperly handles objects in memory, aka "Windows Kernel Information (no CVSS, Microsoft Windows)
- [CVE-2019-0537](https://cve.now/CVE-2019-0537.md): An information disclosure vulnerability exists when Visual Studio improperly discloses arbitrary file contents if the victim opens a malicio (no CVSS, Microsoft Visual Studio)
- [CVE-2019-0538](https://cve.now/CVE-2019-0538.md): A remote code execution vulnerability exists when the Windows Jet Database Engine improperly handles objects in memory, aka "Jet Database En (no CVSS)
- [CVE-2019-0539](https://cve.now/CVE-2019-0539.md): A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka "C (no CVSS, Microsoft Edge · Microsoft ChakraCore +1)
- [CVE-2019-0541](https://cve.now/CVE-2019-0541.md): A remote code execution vulnerability exists in the way that the MSHTML engine inproperly validates input, aka "MSHTML Engine Remote Code Ex (CVSS 8.8, KEV, Microsoft Office · Microsoft Internet Explorer +1)
- [CVE-2019-0543](https://cve.now/CVE-2019-0543.md): An elevation of privilege vulnerability exists when Windows improperly handles authentication requests, aka "Microsoft Windows Elevation of (CVSS 7.8, KEV)
- [CVE-2019-0545](https://cve.now/CVE-2019-0545.md): An information disclosure vulnerability exists in .NET Framework and .NET Core which allows bypassing Cross-origin Resource Sharing (CORS) c (no CVSS, Microsoft .NET Core · Microsoft .NET Framework +1)
- [CVE-2019-0546](https://cve.now/CVE-2019-0546.md): A remote code execution vulnerability exists in Visual Studio when the C++ compiler improperly handles specific combinations of C++ construc (no CVSS, Microsoft Visual Studio)
- [CVE-2019-0547](https://cve.now/CVE-2019-0547.md): A memory corruption vulnerability exists in the Windows DHCP client when an attacker sends specially crafted DHCP responses to a client, aka (no CVSS, Microsoft Windows)
- [CVE-2019-0548](https://cve.now/CVE-2019-0548.md): A denial of service vulnerability exists when ASP.NET Core improperly handles web requests, aka "ASP.NET Core Denial of Service Vulnerabilit (no CVSS, Microsoft ASP.NET Core)
- [CVE-2019-0549](https://cve.now/CVE-2019-0549.md): An information disclosure vulnerability exists when the Windows kernel improperly handles objects in memory, aka "Windows Kernel Information (no CVSS, Microsoft Windows)
- [CVE-2019-0550](https://cve.now/CVE-2019-0550.md): A remote code execution vulnerability exists when Windows Hyper-V on a host server fails to properly validate input from an authenticated us (no CVSS, Microsoft Windows 10 Servers · Microsoft Windows)
- [CVE-2019-0551](https://cve.now/CVE-2019-0551.md): A remote code execution vulnerability exists when Windows Hyper-V on a host server fails to properly validate input from an authenticated us (no CVSS, Microsoft Windows Server · Microsoft Windows)
- [CVE-2019-0552](https://cve.now/CVE-2019-0552.md): An elevation of privilege exists in Windows COM Desktop Broker, aka "Windows COM Elevation of Privilege Vulnerability." This affects Windows (no CVSS, Microsoft Windows Server 2012 R2 · Microsoft Windows RT +2)
- [CVE-2019-0553](https://cve.now/CVE-2019-0553.md): An information disclosure vulnerability exists when Windows Subsystem for Linux improperly handles objects in memory, aka "Windows Subsystem (no CVSS, Microsoft Windows 10 Servers · Microsoft Windows)
- [CVE-2019-0554](https://cve.now/CVE-2019-0554.md): An information disclosure vulnerability exists when the Windows kernel improperly handles objects in memory, aka "Windows Kernel Information (no CVSS, Microsoft Windows)
- [CVE-2019-0555](https://cve.now/CVE-2019-0555.md): An elevation of privilege vulnerability exists in the Microsoft XmlDocument class that could allow an attacker to escape from the AppContain (no CVSS)
- [CVE-2019-0556](https://cve.now/CVE-2019-0556.md): A cross-site-scripting (XSS) vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web reques (CVSS 5.4, Microsoft SharePoint)
- [CVE-2019-0557](https://cve.now/CVE-2019-0557.md): A cross-site-scripting (XSS) vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web reques (CVSS 5.4, Microsoft SharePoint)
- [CVE-2019-0558](https://cve.now/CVE-2019-0558.md): A cross-site-scripting (XSS) vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web reques (CVSS 5.4, Microsoft SharePoint Server · Microsoft SharePoint +1)
- [CVE-2019-0559](https://cve.now/CVE-2019-0559.md): An information disclosure vulnerability exists when Microsoft Outlook improperly handles certain types of messages, aka "Microsoft Outlook I (no CVSS, Microsoft Office · Microsoft Outlook)
- [CVE-2019-0560](https://cve.now/CVE-2019-0560.md): An information disclosure vulnerability exists when Microsoft Office improperly discloses the contents of its memory, aka "Microsoft Office (no CVSS, Microsoft Office)
- [CVE-2019-0561](https://cve.now/CVE-2019-0561.md): An information disclosure vulnerability exists when Microsoft Word macro buttons are used improperly, aka "Microsoft Word Information Disclo (no CVSS, Microsoft Word · Microsoft Office)
- [CVE-2019-0562](https://cve.now/CVE-2019-0562.md): An elevation of privilege vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request t (no CVSS, Microsoft SharePoint Server · Microsoft SharePoint)
- [CVE-2019-0564](https://cve.now/CVE-2019-0564.md): A denial of service vulnerability exists when ASP.NET Core improperly handles web requests, aka "ASP.NET Core Denial of Service Vulnerabilit (no CVSS, Microsoft ASP.NET Core · Microsoft.AspNetCore.WebSockets +5)
- [CVE-2019-0565](https://cve.now/CVE-2019-0565.md): A remote code execution vulnerability exists when Microsoft Edge improperly accesses objects in memory, aka "Microsoft Edge Memory Corruptio (no CVSS, Microsoft Edge)
- [CVE-2019-0566](https://cve.now/CVE-2019-0566.md): An elevation of privilege vulnerability exists in Microsoft Edge Browser Broker COM object, aka "Microsoft Edge Elevation of Privilege Vulne (no CVSS, Microsoft Edge)
- [CVE-2019-0567](https://cve.now/CVE-2019-0567.md): A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka "C (no CVSS, Microsoft Edge · Microsoft ChakraCore +1)
- [CVE-2019-0568](https://cve.now/CVE-2019-0568.md): A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka "C (no CVSS, Microsoft Edge · Microsoft ChakraCore +1)
- [CVE-2019-0569](https://cve.now/CVE-2019-0569.md): An information disclosure vulnerability exists when the Windows kernel improperly handles objects in memory, aka "Windows Kernel Information (no CVSS, Microsoft Windows)
- [CVE-2019-0570](https://cve.now/CVE-2019-0570.md): An elevation of privilege vulnerability exists when the Windows Runtime improperly handles objects in memory, aka "Windows Runtime Elevation (no CVSS, Microsoft Windows Server 2012 R2 · Microsoft Windows RT +2)
- [CVE-2019-0571](https://cve.now/CVE-2019-0571.md): An elevation of privilege vulnerability exists when the Windows Data Sharing Service improperly handles file operations, aka "Windows Data S (no CVSS, Microsoft Windows Server · Microsoft Windows)
- [CVE-2019-0572](https://cve.now/CVE-2019-0572.md): An elevation of privilege vulnerability exists when the Windows Data Sharing Service improperly handles file operations, aka "Windows Data S (no CVSS, Microsoft Windows Server · Microsoft Windows)
- [CVE-2019-0573](https://cve.now/CVE-2019-0573.md): An elevation of privilege vulnerability exists when the Windows Data Sharing Service improperly handles file operations, aka "Windows Data S (no CVSS, Microsoft Windows Server · Microsoft Windows)
- [CVE-2019-0574](https://cve.now/CVE-2019-0574.md): An elevation of privilege vulnerability exists when the Windows Data Sharing Service improperly handles file operations, aka "Windows Data S (no CVSS, Microsoft Windows Server · Microsoft Windows)
- [CVE-2019-0575](https://cve.now/CVE-2019-0575.md): A remote code execution vulnerability exists when the Windows Jet Database Engine improperly handles objects in memory, aka "Jet Database En (no CVSS, Microsoft Windows)
- [CVE-2019-0576](https://cve.now/CVE-2019-0576.md): A remote code execution vulnerability exists when the Windows Jet Database Engine improperly handles objects in memory, aka "Jet Database En (no CVSS, Microsoft Windows)
- [CVE-2019-0577](https://cve.now/CVE-2019-0577.md): A remote code execution vulnerability exists when the Windows Jet Database Engine improperly handles objects in memory, aka "Jet Database En (no CVSS, Microsoft Windows)
- [CVE-2019-0578](https://cve.now/CVE-2019-0578.md): A remote code execution vulnerability exists when the Windows Jet Database Engine improperly handles objects in memory, aka "Jet Database En (no CVSS)
- [CVE-2019-0579](https://cve.now/CVE-2019-0579.md): A remote code execution vulnerability exists when the Windows Jet Database Engine improperly handles objects in memory, aka "Jet Database En (no CVSS, Microsoft Windows)
- [CVE-2019-0580](https://cve.now/CVE-2019-0580.md): A remote code execution vulnerability exists when the Windows Jet Database Engine improperly handles objects in memory, aka "Jet Database En (no CVSS, Microsoft Windows)
- [CVE-2019-0581](https://cve.now/CVE-2019-0581.md): A remote code execution vulnerability exists when the Windows Jet Database Engine improperly handles objects in memory, aka "Jet Database En (no CVSS, Microsoft Windows)
- [CVE-2019-0582](https://cve.now/CVE-2019-0582.md): A remote code execution vulnerability exists when the Windows Jet Database Engine improperly handles objects in memory, aka "Jet Database En (no CVSS, Microsoft Windows)
- [CVE-2019-0583](https://cve.now/CVE-2019-0583.md): A remote code execution vulnerability exists when the Windows Jet Database Engine improperly handles objects in memory, aka "Jet Database En (no CVSS, Microsoft Windows)
- [CVE-2019-0584](https://cve.now/CVE-2019-0584.md): A remote code execution vulnerability exists when the Windows Jet Database Engine improperly handles objects in memory, aka "Jet Database En (no CVSS, Microsoft Windows)
- [CVE-2019-0585](https://cve.now/CVE-2019-0585.md): A remote code execution vulnerability exists in Microsoft Word software when it fails to properly handle objects in memory, aka "Microsoft W (no CVSS, Microsoft Word · Microsoft Office +1)
- [CVE-2019-0586](https://cve.now/CVE-2019-0586.md): A remote code execution vulnerability exists in Microsoft Exchange software when the software fails to properly handle objects in memory, ak (no CVSS, Microsoft Exchange Server)
- [CVE-2019-0588](https://cve.now/CVE-2019-0588.md): An information disclosure vulnerability exists when the Microsoft Exchange PowerShell API grants calendar contributors more view permissions (no CVSS, Microsoft Exchange Server)
- [CVE-2019-0622](https://cve.now/CVE-2019-0622.md): An elevation of privilege vulnerability exists when Skype for Andriod fails to properly handle specific authentication requests, aka "Skype (no CVSS, Microsoft Skype)
- [CVE-2018-2484](https://cve.now/CVE-2018-2484.md): SAP Enterprise Financial Services (fixed in SAPSCORE 1.13, 1.14, 1.15; S4CORE 1.01, 1.02, 1.03; EA-FINSERV 1.10, 2.0, 5.0, 6.0, 6.03, 6.04, (no CVSS, SAP SE SAP Enterprise Financial Services)
- [CVE-2018-2499](https://cve.now/CVE-2018-2499.md): A security weakness in SAP Financial Consolidation Cube Designer (BOBJ\_EADES fixed in versions 8.0, 10.1) may allow an attacker to discover (no CVSS, SAP SE SAP Financial Consolidation Cube Designer)
- [CVE-2019-0238](https://cve.now/CVE-2019-0238.md): SAP Commerce (previously known as SAP Hybris Commerce), before version 6.7, does not sufficiently encode user-controlled inputs, resulting i (no CVSS, SAP SE SAP Commerce)
- [CVE-2019-0240](https://cve.now/CVE-2019-0240.md): SAP Business Objects Mobile for Android (before 6.3.5) application allows an attacker to provide malicious input in the form of a SAP BI lin (no CVSS, SAP SE SAP Business Objects Mobile for Android)
- [CVE-2019-0241](https://cve.now/CVE-2019-0241.md): SAP Work and Inventory Manager (Agentry\_SDK , before 7.0, 7.1) allows an attacker to prevent legitimate users from accessing a service, eith (no CVSS, SAP SE SAP Work and Inventory Manager)
- [CVE-2019-0243](https://cve.now/CVE-2019-0243.md): Under some circumstances, masterdata maintenance in SAP BW/4HANA (fixed in DW4CORE version 1.0 (SP08)) does not perform necessary authorizat (no CVSS, SAP SE SAP BW/4HANA)
- [CVE-2019-0244](https://cve.now/CVE-2019-0244.md): SAP CRM WebClient UI (fixed in SAPSCORE 1.12; S4FND 1.02; WEBCUIF 7.31, 7.46, 7.47, 7.48, 8.0, 8.01) does not sufficiently encode user-contr (no CVSS, SAP SE SAP CRM WebClient UI)
- [CVE-2019-0245](https://cve.now/CVE-2019-0245.md): SAP CRM WebClient UI (fixed in SAPSCORE 1.12; S4FND 1.02; WEBCUIF 7.31, 7.46, 7.47, 7.48, 8.0, 8.01) does not sufficiently encode user-contr (no CVSS, SAP SE SAP CRM WebClient UI)
- [CVE-2019-0246](https://cve.now/CVE-2019-0246.md): SAP Cloud Connector, before version 2.11.3, does not perform any authentication checks for functionalities that require user identity. (no CVSS, SAP SE SAP Cloud Connector)
- [CVE-2019-0247](https://cve.now/CVE-2019-0247.md): SAP Cloud Connector, before version 2.11.3, allows an attacker to inject code that can be executed by the application. (no CVSS, SAP SE SAP Cloud Connector)
- [CVE-2019-0248](https://cve.now/CVE-2019-0248.md): Under certain conditions SAP Gateway of ABAP Application Server (fixed in SAP\_GWFND 7.5, 7.51, 7.52, 7.53; SAP\_BASIS 7.5) allows an attacker (no CVSS, SAP SE SAP Gateway of ABAP Application Server)
- [CVE-2019-0249](https://cve.now/CVE-2019-0249.md): Under certain conditions SAP Landscape Management (VCM 3.0) allows an attacker to access information which would otherwise be restricted. (no CVSS, SAP SE SAP Landscape Management)
- [CVE-2018-1918](https://cve.now/CVE-2018-1918.md): IBM Jazz Reporting Service (JRS) 6.0.3, 6.0.4, 6.0.5, and 6.0.6 is vulnerable to cross-site scripting. (CVSS 5.4, IBM Jazz Reporting Service)
- [CVE-2018-1932](https://cve.now/CVE-2018-1932.md): IBM API Connect 5.0.0.0 through 5.0.8.4 is affected by a vulnerability in the role-based access control in the management server that could (CVSS 4.9, IBM API Connect)
- [CVE-2018-1993](https://cve.now/CVE-2018-1993.md): IBM Spectrum Scale (GPFS) 4.1.1, 4.2.0, 4.2.1, 4.2.2, 4.2.3, and 5.0.0 where the use of Local Read Only Cache (LROC) is enabled may caused r (CVSS 4.0, IBM Spectrum Scale)
- [CVE-2019-5720](https://cve.now/CVE-2019-5720.md): includes/db/class.reflines\_db.inc in FrontAccounting 2.4.6 contains a SQL Injection vulnerability in the reference field that can allow the (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2019-01-08
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.