# CVEs published 2019-01-15

60 CVEs were published on January 15, 2019: 4 critical, 8 high. Days are UTC.

- [CVE-2017-6921](https://cve.now/CVE-2017-6921.md): File REST resource does not properly validate (no CVSS, Drupal Core · drupal/core +1)
- [CVE-2018-6345](https://cve.now/CVE-2018-6345.md): The function number\_format is vulnerable to a heap overflow issue when its second argument ($dec\_points) is excessively large. (no CVSS, Facebook HHVM)
- [CVE-2018-7603](https://cve.now/CVE-2018-7603.md): Search Autocomplete (no CVSS, Drupal 3rd party module - Search Autocomplete)
- [CVE-2019-3554](https://cve.now/CVE-2019-3554.md): Wangle's AcceptRoutingHandler incorrectly casts a socket when accepting a TLS 1.3 connection, leading to a potential denial of service attac (no CVSS, Facebook Wangle)
- [CVE-2019-3557](https://cve.now/CVE-2019-3557.md): The implementations of streams for bz2 and php://output improperly implemented their readImpl functions, returning -1 consistently. (no CVSS, Facebook HHVM)
- [CVE-2018-14662](https://cve.now/CVE-2018-14662.md): It was found Ceph versions before 13.2.4 that authenticated ceph users with read only permissions could steal dm-crypt encryption keys used (CVSS 3.5, \[UNKNOWN\] ceph)
- [CVE-2019-0001](https://cve.now/CVE-2019-0001.md): Junos OS: MX Series: uncontrolled recursion and crash in Broadband Edge subscriber management daemon (bbe-smgd). (CVSS 7.5, Juniper Networks Junos OS)
- [CVE-2019-0002](https://cve.now/CVE-2019-0002.md): Junos OS: EX2300 and EX3400 series: Certain stateless firewall filter rules might not take effect (CVSS 5.8, Juniper Networks Junos OS)
- [CVE-2019-0003](https://cve.now/CVE-2019-0003.md): Junos OS: A flowspec BGP update with a specific term-order causes routing protocol daemon (rpd) process to crash with a core. (CVSS 7.5, Juniper Networks Junos OS)
- [CVE-2019-0004](https://cve.now/CVE-2019-0004.md): Juniper ATP: API and device keys are logged in a world-readable permissions file (CVSS 7.8, Juniper Networks Juniper ATP)
- [CVE-2019-0005](https://cve.now/CVE-2019-0005.md): On EX2300, EX3400, EX4600, QFX3K and QFX5K series, firewall filter configuration cannot perform packet matching on any IPv6 extension header (no CVSS)
- [CVE-2019-0006](https://cve.now/CVE-2019-0006.md): Junos OS: EX, QFX and MX series: Packet Forwarding Engine manager (FXPC) process crashes due to a crafted HTTP packet in a Virtual Chassis configuration (CVSS 9.8, Juniper Networks Junos OS)
- [CVE-2019-0007](https://cve.now/CVE-2019-0007.md): Junos OS: vMX series: Predictable IP ID sequence numbers vulnerability (CVSS 9.3, Juniper Networks Junos OS)
- [CVE-2019-0009](https://cve.now/CVE-2019-0009.md): Junos OS: EX2300 and EX3400: High disk I/O operations may disrupt the communication between RE and PFE (CVSS 5.5, Juniper Networks Junos OS)
- [CVE-2019-0010](https://cve.now/CVE-2019-0010.md): Junos OS: SRX Series: Crafted HTTP traffic may cause UTM to consume all mbufs, leading to Denial of Service (CVSS 7.5, Juniper Networks Junos OS)
- [CVE-2019-0011](https://cve.now/CVE-2019-0011.md): Junos OS: Kernel crash after processing specific incoming packet to the out of band management interface (CVE-2019-0011) (CVSS 6.5, Juniper Networks Junos OS)
- [CVE-2019-0012](https://cve.now/CVE-2019-0012.md): Junos OS: rpd crash on VPLS PE upon receipt of specific BGP message (CVSS 7.5, Juniper Networks Junos OS)
- [CVE-2019-0013](https://cve.now/CVE-2019-0013.md): Junos OS: RPD crash upon receipt of malformed PIM packet (CVSS 6.5, Juniper Networks Junos OS)
- [CVE-2019-0014](https://cve.now/CVE-2019-0014.md): Junos OS: QFX and PTX Series: FPC process crashes after J-Flow processes a malformed packet (CVSS 7.5, Juniper Networks Junos OS)
- [CVE-2019-0015](https://cve.now/CVE-2019-0015.md): Junos OS: SRX Series: Deleted dynamic VPN users are allowed to establish VPN connections until reboot (CVSS 5.4, Juniper Networks Junos OS)
- [CVE-2019-0016](https://cve.now/CVE-2019-0016.md): Junos Space: Authenticated user able to delete devices without delete device privileges (CVSS 6.5, Juniper Networks Junos Space)
- [CVE-2019-0017](https://cve.now/CVE-2019-0017.md): Junos Space: Unrestricted file upload vulnerability (CVSS 6.5, Juniper Networks Junos Space)
- [CVE-2019-0018](https://cve.now/CVE-2019-0018.md): Juniper ATP: Persistent Cross-Site Scripting (XSS) vulnerability in file upload menu (CVSS 5.4, Juniper Networks Juniper ATP)
- [CVE-2019-0020](https://cve.now/CVE-2019-0020.md): Juniper ATP: Hard coded credentials used in Web Collector (CVSS 10.0, Juniper Networks Juniper ATP)
- [CVE-2019-0021](https://cve.now/CVE-2019-0021.md): Juniper ATP: secret CLI inputs are logged to /var/log/syslog in clear text (CVSS 7.1, Juniper Networks Juniper ATP)
- [CVE-2019-0022](https://cve.now/CVE-2019-0022.md): Juniper ATP: Two hard coded credentials sharing the same password give an attacker the ability to take control of any installation of the software. (CVSS 10.0, Juniper Networks Juniper ATP)
- [CVE-2019-0023](https://cve.now/CVE-2019-0023.md): Juniper ATP: Persistent Cross-Site Scripting vulnerability in the Golden VM menu (CVSS 5.4, Juniper Networks Juniper ATP)
- [CVE-2019-0024](https://cve.now/CVE-2019-0024.md): Juniper ATP: Persistent Cross-Site Scripting vulnerability in the Email Collectors menu (CVSS 5.4, Juniper Networks Juniper ATP)
- [CVE-2019-0025](https://cve.now/CVE-2019-0025.md): Juniper ATP: Persistent Cross-Site Scripting vulnerability in RADIUS configuration menu (CVSS 5.4, Juniper Networks Juniper ATP)
- [CVE-2019-0026](https://cve.now/CVE-2019-0026.md): Juniper ATP: Persistent Cross-Site Scripting vulnerability in Zone configuration (CVSS 5.4, Juniper Networks Juniper ATP)
- [CVE-2019-0027](https://cve.now/CVE-2019-0027.md): Juniper ATP: Persistent Cross-Site Scripting vulnerability in Snort Rules configuration (CVSS 5.4, Juniper Networks Juniper ATP)
- [CVE-2019-0029](https://cve.now/CVE-2019-0029.md): Juniper ATP: Splunk credentials are in logged in clear text (CVSS 8.8, Juniper Networks Juniper ATP)
- [CVE-2019-0030](https://cve.now/CVE-2019-0030.md): Juniper ATP: Password hashing uses DES and a hardcoded salt (CVSS 6.7, Juniper Networks Juniper ATP)
- [CVE-2017-6924](https://cve.now/CVE-2017-6924.md): REST API can bypass comment approval - Access Bypass - Moderately Critical (no CVSS, Drupal Core · drupal/core +1)
- [CVE-2018-15440](https://cve.now/CVE-2018-15440.md): Cisco Identity Services Engine Multiple Cross-Site Scripting Vulnerabilities (CVSS 6.1, Cisco Identity Services Engine Software)
- [CVE-2018-15463](https://cve.now/CVE-2018-15463.md): Cisco Identity Services Engine Multiple Cross-Site Scripting Vulnerabilities (CVSS 6.1, Cisco Identity Services Engine Software)
- [CVE-2018-1772](https://cve.now/CVE-2018-1772.md): IBM SPSS Analytic Server 3.1.1.1 is vulnerable to cross-site scripting. (no CVSS)
- [CVE-2018-16846](https://cve.now/CVE-2018-16846.md): It was found in Ceph versions before 13.2.4 that authenticated ceph RGW users can cause a denial of service against OMAPs holding bucket ind (CVSS 6.5, \[UNKNOWN\] ceph)
- [CVE-2017-6925](https://cve.now/CVE-2017-6925.md): In versions of Drupal 8 core prior to 8.3.7; There is a vulnerability in the entity access system that could allow unwanted access to view, (no CVSS, drupal/core · drupal/drupal)
- [CVE-2017-18356](https://cve.now/CVE-2017-18356.md): In the Automattic WooCommerce plugin before 3.2.4 for WordPress, an attack is possible after gaining access to the target site with a user a (no CVSS)
- [CVE-2017-18357](https://cve.now/CVE-2017-18357.md): Shopware before 5.3.4 has a PHP Object Instantiation issue via the sort parameter to the loadPreviewAction() method of the Shopware\_Controll (no CVSS, shopware/shopware)
- [CVE-2017-18358](https://cve.now/CVE-2017-18358.md): LimeSurvey before 2.72.4 has Stored XSS by using the Continue Later (aka Resume later) feature to enter an email address, which is mishandle (no CVSS)
- [CVE-2018-20713](https://cve.now/CVE-2018-20713.md): Shopware before 5.4.3 allows SQL Injection by remote authenticated users, aka SW-21404. (no CVSS, shopware/shopware)
- [CVE-2018-20714](https://cve.now/CVE-2018-20714.md): The logging system of the Automattic WooCommerce plugin before 3.4.6 for WordPress is vulnerable to a File Deletion vulnerability. (no CVSS)
- [CVE-2018-20715](https://cve.now/CVE-2018-20715.md): The DB abstraction layer of OXID eSales 4.10.6 is vulnerable to SQL injection via the oxid or synchoxid parameter to the oxConfig::getReques (no CVSS)
- [CVE-2018-20716](https://cve.now/CVE-2018-20716.md): CubeCart before 6.1.13 has SQL Injection via the validate\[\] parameter of the "I forgot my Password!" feature. (no CVSS)
- [CVE-2018-20717](https://cve.now/CVE-2018-20717.md): In the orders section of PrestaShop before 1.7.2.5, an attack is possible after gaining access to a target store with a user role with the r (no CVSS, prestashop/prestashop)
- [CVE-2018-20718](https://cve.now/CVE-2018-20718.md): In Pydio before 8.2.2, an attack is possible via PHP Object Injection because a user is allowed to use the $phpserial$a:0:{} syntax to store (no CVSS)
- [CVE-2018-20719](https://cve.now/CVE-2018-20719.md): In Tiki before 17.2, the user task component is vulnerable to a SQL Injection via the tiki-user\_tasks.php show\_history parameter. (no CVSS)
- [CVE-2019-3811](https://cve.now/CVE-2019-3811.md): A vulnerability was found in sssd. (CVSS 4.1, The sssd Project sssd)
- [CVE-2019-6294](https://cve.now/CVE-2019-6294.md): An issue was discovered in EasyCMS 1.5. (no CVSS)
- [CVE-2019-6295](https://cve.now/CVE-2019-6295.md): Cleanto 5.0 has SQL Injection via the assets/lib/service\_method\_ajax.php service\_id parameter. (no CVSS)
- [CVE-2019-6296](https://cve.now/CVE-2019-6296.md): Cleanto 5.0 has SQL Injection via the assets/lib/export\_ajax.php id parameter. (no CVSS)
- [CVE-2019-6289](https://cve.now/CVE-2019-6289.md): uploads/include/dialog/select\_soft.php in DedeCMS V57\_UTF8\_SP2 allows remote attackers to execute arbitrary PHP code by uploading with a saf (no CVSS)
- [CVE-2018-20712](https://cve.now/CVE-2018-20712.md): A heap-based buffer over-read exists in the function d\_expression\_1 in cp-demangle.c in GNU libiberty, as distributed in GNU Binutils 2.31.1 (no CVSS)
- [CVE-2019-6267](https://cve.now/CVE-2019-6267.md): The Premium WP Suite Easy Redirect Manager plugin 28.07-17 for WordPress has XSS via a crafted GET request that is mishandled during log vie (no CVSS)
- [CVE-2019-6290](https://cve.now/CVE-2019-6290.md): An infinite recursion issue was discovered in eval.c in Netwide Assembler (NASM) through 2.14.02. (no CVSS)
- [CVE-2019-6291](https://cve.now/CVE-2019-6291.md): An issue was discovered in the function expr6 in eval.c in Netwide Assembler (NASM) through 2.14.02. (no CVSS)
- [CVE-2019-6292](https://cve.now/CVE-2019-6292.md): An issue was discovered in singledocparser.cpp in yaml-cpp (aka LibYaml-C++) 0.6.2. (no CVSS)
- [CVE-2019-6293](https://cve.now/CVE-2019-6293.md): An issue was discovered in the function mark\_beginning\_as\_normal in nfa.c in flex 2.6.4. (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2019-01-15
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.