CVEs published January 15, 2019
60 CVEs were published on January 15, 2019: 4 critical, 8 high.
- Published
- 60
- Critical
- 4
- High
- 8
- Medium
- 18
- Low
- 1
- Unrated
- 29
- Now in CISA KEV
- 0
- Fix available
- 35
Most affected products
- Juniper Networks Juniper ATP
- 12
- Juniper Networks Junos OS
- 12
- [UNKNOWN] ceph
- 2
- Cisco Identity Services Engine Software
- 2
- Drupal Core · drupal/core +1
- 2
- Facebook HHVM
- 2
- Juniper Networks Junos Space
- 2
- shopware/shopware
- 2
- Drupal 3rd party module - Search Autocomplete
- 1
- drupal/core · drupal/drupal
- 1
Critical 4
- CVE-2019-0006Junos OS: EX, QFX and MX series: Packet Forwarding Engine manager (FXPC) process crashes due to a crafted HTTP packet in a Virtual Chassis configurationJuniper Networks Junos OS
- CVE-2019-0007Junos OS: vMX series: Predictable IP ID sequence numbers vulnerabilityJuniper Networks Junos OS
- CVE-2019-0020Juniper ATP: Hard coded credentials used in Web CollectorJuniper Networks Juniper ATP
- CVE-2019-0022Juniper ATP: Two hard coded credentials sharing the same password give an attacker the ability to take control of any installation of the software.Juniper Networks Juniper ATP
High 8
- CVE-2019-0001Junos OS: MX Series: uncontrolled recursion and crash in Broadband Edge subscriber management daemon (bbe-smgd).Juniper Networks Junos OS
- CVE-2019-0003Junos OS: A flowspec BGP update with a specific term-order causes routing protocol daemon (rpd) process to crash with a core.Juniper Networks Junos OS
- CVE-2019-0004Juniper ATP: API and device keys are logged in a world-readable permissions fileJuniper Networks Juniper ATP
- CVE-2019-0010Junos OS: SRX Series: Crafted HTTP traffic may cause UTM to consume all mbufs, leading to Denial of ServiceJuniper Networks Junos OS
- CVE-2019-0012Junos OS: rpd crash on VPLS PE upon receipt of specific BGP messageJuniper Networks Junos OS
- CVE-2019-0014Junos OS: QFX and PTX Series: FPC process crashes after J-Flow processes a malformed packetJuniper Networks Junos OS
- CVE-2019-0021Juniper ATP: secret CLI inputs are logged to /var/log/syslog in clear textJuniper Networks Juniper ATP
- CVE-2019-0029Juniper ATP: Splunk credentials are in logged in clear textJuniper Networks Juniper ATP
Medium, low and unrated 48
- CVE-2017-6921File REST resource does not properly validateDrupal Core · drupal/core +1
- CVE-2018-6345The function number_format is vulnerable to a heap overflow issue when its second argument ($dec_points) is excessively large.Facebook HHVM
- CVE-2018-7603Search AutocompleteDrupal 3rd party module - Search Autocomplete
- CVE-2019-3554Wangle's AcceptRoutingHandler incorrectly casts a socket when accepting a TLS 1.3 connection, leading to a potential denial of service attacFacebook Wangle
- CVE-2019-3557The implementations of streams for bz2 and php://output improperly implemented their readImpl functions, returning -1 consistently.Facebook HHVM
- CVE-2018-14662It was found Ceph versions before 13.2.4 that authenticated ceph users with read only permissions could steal dm-crypt encryption keys used [UNKNOWN] ceph
- CVE-2019-0002Junos OS: EX2300 and EX3400 series: Certain stateless firewall filter rules might not take effectJuniper Networks Junos OS
- CVE-2019-0005On EX2300, EX3400, EX4600, QFX3K and QFX5K series, firewall filter configuration cannot perform packet matching on any IPv6 extension header
- CVE-2019-0009Junos OS: EX2300 and EX3400: High disk I/O operations may disrupt the communication between RE and PFEJuniper Networks Junos OS
- CVE-2019-0011Junos OS: Kernel crash after processing specific incoming packet to the out of band management interface (CVE-2019-0011)Juniper Networks Junos OS
- CVE-2019-0013Junos OS: RPD crash upon receipt of malformed PIM packetJuniper Networks Junos OS
- CVE-2019-0015Junos OS: SRX Series: Deleted dynamic VPN users are allowed to establish VPN connections until rebootJuniper Networks Junos OS
- CVE-2019-0016Junos Space: Authenticated user able to delete devices without delete device privilegesJuniper Networks Junos Space
- CVE-2019-0017Junos Space: Unrestricted file upload vulnerabilityJuniper Networks Junos Space
- CVE-2019-0018Juniper ATP: Persistent Cross-Site Scripting (XSS) vulnerability in file upload menuJuniper Networks Juniper ATP
- CVE-2019-0023Juniper ATP: Persistent Cross-Site Scripting vulnerability in the Golden VM menuJuniper Networks Juniper ATP
- CVE-2019-0024Juniper ATP: Persistent Cross-Site Scripting vulnerability in the Email Collectors menuJuniper Networks Juniper ATP
- CVE-2019-0025Juniper ATP: Persistent Cross-Site Scripting vulnerability in RADIUS configuration menuJuniper Networks Juniper ATP
- CVE-2019-0026Juniper ATP: Persistent Cross-Site Scripting vulnerability in Zone configurationJuniper Networks Juniper ATP
- CVE-2019-0027Juniper ATP: Persistent Cross-Site Scripting vulnerability in Snort Rules configurationJuniper Networks Juniper ATP
- CVE-2019-0030Juniper ATP: Password hashing uses DES and a hardcoded saltJuniper Networks Juniper ATP
- CVE-2017-6924REST API can bypass comment approval - Access Bypass - Moderately CriticalDrupal Core · drupal/core +1
- CVE-2018-15440Cisco Identity Services Engine Multiple Cross-Site Scripting VulnerabilitiesCisco Identity Services Engine Software
- CVE-2018-15463Cisco Identity Services Engine Multiple Cross-Site Scripting VulnerabilitiesCisco Identity Services Engine Software
- CVE-2018-1772IBM SPSS Analytic Server 3.1.1.1 is vulnerable to cross-site scripting.
- CVE-2018-16846It was found in Ceph versions before 13.2.4 that authenticated ceph RGW users can cause a denial of service against OMAPs holding bucket ind[UNKNOWN] ceph
- CVE-2017-6925In versions of Drupal 8 core prior to 8.3.7; There is a vulnerability in the entity access system that could allow unwanted access to view, drupal/core · drupal/drupal
- CVE-2017-18356In the Automattic WooCommerce plugin before 3.2.4 for WordPress, an attack is possible after gaining access to the target site with a user a
- CVE-2017-18357Shopware before 5.3.4 has a PHP Object Instantiation issue via the sort parameter to the loadPreviewAction() method of the Shopware_Controllshopware/shopware
- CVE-2017-18358LimeSurvey before 2.72.4 has Stored XSS by using the Continue Later (aka Resume later) feature to enter an email address, which is mishandle
- CVE-2018-20713Shopware before 5.4.3 allows SQL Injection by remote authenticated users, aka SW-21404.shopware/shopware
- CVE-2018-20714The logging system of the Automattic WooCommerce plugin before 3.4.6 for WordPress is vulnerable to a File Deletion vulnerability.
- CVE-2018-20715The DB abstraction layer of OXID eSales 4.10.6 is vulnerable to SQL injection via the oxid or synchoxid parameter to the oxConfig::getReques
- CVE-2018-20716CubeCart before 6.1.13 has SQL Injection via the validate[] parameter of the "I forgot my Password!" feature.
- CVE-2018-20717In the orders section of PrestaShop before 1.7.2.5, an attack is possible after gaining access to a target store with a user role with the rprestashop/prestashop
- CVE-2018-20718In Pydio before 8.2.2, an attack is possible via PHP Object Injection because a user is allowed to use the $phpserial$a:0:{} syntax to store
- CVE-2018-20719In Tiki before 17.2, the user task component is vulnerable to a SQL Injection via the tiki-user_tasks.php show_history parameter.
- CVE-2019-3811A vulnerability was found in sssd.The sssd Project sssd
- CVE-2019-6294An issue was discovered in EasyCMS 1.5.
- CVE-2019-6295Cleanto 5.0 has SQL Injection via the assets/lib/service_method_ajax.php service_id parameter.
- CVE-2019-6296Cleanto 5.0 has SQL Injection via the assets/lib/export_ajax.php id parameter.
- CVE-2019-6289uploads/include/dialog/select_soft.php in DedeCMS V57_UTF8_SP2 allows remote attackers to execute arbitrary PHP code by uploading with a saf
- CVE-2018-20712A heap-based buffer over-read exists in the function d_expression_1 in cp-demangle.c in GNU libiberty, as distributed in GNU Binutils 2.31.1
- CVE-2019-6267The Premium WP Suite Easy Redirect Manager plugin 28.07-17 for WordPress has XSS via a crafted GET request that is mishandled during log vie
- CVE-2019-6290An infinite recursion issue was discovered in eval.c in Netwide Assembler (NASM) through 2.14.02.
- CVE-2019-6291An issue was discovered in the function expr6 in eval.c in Netwide Assembler (NASM) through 2.14.02.
- CVE-2019-6292An issue was discovered in singledocparser.cpp in yaml-cpp (aka LibYaml-C++) 0.6.2.
- CVE-2019-6293An issue was discovered in the function mark_beginning_as_normal in nfa.c in flex 2.6.4.