# CVEs published 2019-01-14

14 CVEs were published on January 14, 2019: 1 critical, 0 high. Days are UTC.

- [CVE-2018-16888](https://cve.now/CVE-2018-16888.md): It was discovered systemd does not correctly check the content of PIDFile files before using it to kill processes. (CVSS 4.4, The systemd Project systemd)
- [CVE-2019-6283](https://cve.now/CVE-2019-6283.md): In LibSass 3.5.5, a heap-based buffer over-read exists in Sass::Prelexer::parenthese\_scope in prelexer.hpp. (no CVSS)
- [CVE-2019-6284](https://cve.now/CVE-2019-6284.md): In LibSass 3.5.5, a heap-based buffer over-read exists in Sass::Prelexer::alternatives in prelexer.hpp. (no CVSS)
- [CVE-2019-6285](https://cve.now/CVE-2019-6285.md): The SingleDocParser::HandleFlowSequence function in yaml-cpp (aka LibYaml-C++) 0.6.2 allows remote attackers to cause a denial of service (s (no CVSS)
- [CVE-2019-6286](https://cve.now/CVE-2019-6286.md): In LibSass 3.5.5, a heap-based buffer over-read exists in Sass::Prelexer::skip\_over\_scopes in prelexer.hpp when called from Sass::Parser::pa (no CVSS)
- [CVE-2018-16886](https://cve.now/CVE-2018-16886.md): etcd versions 3.2.x before 3.2.26 and 3.3.x before 3.3.11 are vulnerable to an improper authentication issue when role-based access control (CVSS 6.8, The etcd Project etcd: · go.etcd.io/etcd/v3 +1)
- [CVE-2019-6278](https://cve.now/CVE-2019-6278.md): XSS exists in JPress v1.0.4 via Markdown input, or Markdown input with the code input option. (no CVSS)
- [CVE-2018-1956](https://cve.now/CVE-2018-1956.md): IBM Security Identity Manager 6.0.0 does not require that users should have strong passwords by default, which makes it easier for attackers (CVSS 5.9, IBM Security Identity Manager)
- [CVE-2018-1967](https://cve.now/CVE-2018-1967.md): IBM Security Identity Manager 6.0.0 is vulnerable to cross-site scripting. (CVSS 6.1, IBM Security Identity Manager)
- [CVE-2018-1969](https://cve.now/CVE-2018-1969.md): IBM Security Identity Manager 6.0.0 allows the attacker to upload or transfer files of dangerous types that can be automatically processed w (CVSS 9.0, IBM Security Identity Manager)
- [CVE-2019-6259](https://cve.now/CVE-2019-6259.md): An issue was discovered in idreamsoft iCMS V7.0.13. (no CVSS)
- [CVE-2019-6251](https://cve.now/CVE-2019-6251.md): WebKitGTK and WPE WebKit prior to version 2.24.1 are vulnerable to address bar spoofing upon certain JavaScript redirections. (no CVSS)
- [CVE-2019-6256](https://cve.now/CVE-2019-6256.md): A Denial of Service issue was discovered in the LIVE555 Streaming Media libraries as used in Live555 Media Server 0.93. (no CVSS)
- [CVE-2019-6257](https://cve.now/CVE-2019-6257.md): A Server Side Request Forgery (SSRF) vulnerability in elFinder before 2.1.46 could allow a malicious user to access the content of internal (no CVSS, studio-42/elfinder)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2019-01-14
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.