CVEs published January 22, 2019
27 CVEs were published on January 22, 2019: 0 critical, 0 high. 1 is now in CISA KEV.
- Published
- 27
- Critical
- 0
- High
- 0
- Medium
- 2
- Low
- 0
- Unrated
- 25
- Now in CISA KEV
- 1
- Fix available
- 9
Most affected products
- ICS-CERT CX-Supervisor
- 4
- Brocade Communications Systems Brocade Network Advisor
- 3
- Drupal core · drupal/core +1
- 3
- CA Technologies CA Service Desk Manager
- 2
- Jenkins project Jenkins · org.jenkins-ci.main:jenkins-core
- 2
- [UNKNOWN] Satellite
- 1
- Drupal Core · drupal/core +1
- 1
- Fortinet FortiOS, fortiADC
- 1
- Jenkins project Pipeline: Declarative Plugin · org.jenkinsc…
- 1
- Jenkins project Pipeline: Groovy Plugin · org.jenkins-ci… +2
- 1
Medium, low and unrated 27
- CVE-2018-19011CX-Supervisor (Versions 3.42 and prior) can execute code that has been injected into a project file.ICS-CERT CX-Supervisor
- CVE-2018-19013An attacker could inject commands to delete files and/or delete the contents of a file on CX-Supervisor (Versions 3.42 and prior) through a ICS-CERT CX-Supervisor
- CVE-2018-19017Several use after free vulnerabilities have been identified in CX-Supervisor (Versions 3.42 and prior).ICS-CERT CX-Supervisor
- CVE-2018-19019A type confusion vulnerability exists when processing project files in CX-Supervisor (Versions 3.42 and prior).ICS-CERT CX-Supervisor
- CVE-2019-6260The ASPEED ast2400 and ast2500 Baseband Management Controller (BMC) hardware and firmware implement Advanced High-performance Bus (AHB) brid
- CVE-2018-6443A vulnerability in Brocade Network Advisor Versions before 14.3.1 could allow an unauthenticated, remote attacker to log in to the JBoss AdmBrocade Communications Systems Brocade Network Advisor
- CVE-2018-6444A Vulnerability in Brocade Network Advisor versions before 14.1.0 could allow a remote unauthenticated attacker to execute arbitray code.Brocade Communications Systems Brocade Network Advisor
- CVE-2018-6445A Vulnerability in Brocade Network Advisor versions before 14.0.3 could allow a remote unauthenticated attacker to export the current user dBrocade Communications Systems Brocade Network Advisor
- CVE-2017-6923Access bypass in Drupal 8 viewsDrupal core · drupal/core +1
- CVE-2019-6507An issue was discovered in creditease-sec insight through 2018-09-11.
- CVE-2019-6508An issue was discovered in creditease-sec insight through 2018-09-11.
- CVE-2019-6509An issue was discovered in creditease-sec insight through 2018-09-11.
- CVE-2019-6510An issue was discovered in creditease-sec insight through 2018-09-11.
- CVE-2017-6922Files uploaded by anonymous users into a private file system can be accessed by other anonymous usersDrupal Core · drupal/core +1
- CVE-2018-14666An improper authorization flaw was found in the Smart Class feature of Foreman.[UNKNOWN] Satellite
- CVE-2018-19634CA Service Desk Manager 14.1 and 17 contain a vulnerability that can allow a malicious actor to access survey information.CA Technologies CA Service Desk Manager
- CVE-2018-19635CA Service Desk Manager 14.1 and 17 contain a vulnerability that can allow a malicious actor to escalate privileges in the user interface.CA Technologies CA Service Desk Manager
- CVE-2019-6338third-party PEAR Archive_Tar library updatesDrupal core · drupal/core +1
- CVE-2019-6339PHAR stream wrapper Arbitrary PHP code executionDrupal core · drupal/core +1
- CVE-2018-13374A Improper Access Control in Fortinet FortiOS 6.0.2, 5.6.7 and before, FortiADC 6.1.0, 6.0.0 to 6.0.1, 5.4.0 to 5.4.4 allows attacker to obtFortinet FortiOS, fortiADC
- CVE-2019-1003000A sandbox bypass vulnerability exists in Script Security Plugin 1.49 and earlier in src/main/java/org/jenkinsci/plugins/scriptsecurity/sandbJenkins project Script Security Plugin · org.jenkins-ci.plu…
- CVE-2019-1003001A sandbox bypass vulnerability exists in Pipeline: Groovy Plugin 2.61 and earlier in src/main/java/org/jenkinsci/plugins/workflow/cps/CpsFloJenkins project Pipeline: Groovy Plugin · org.jenkins-ci… +2
- CVE-2019-1003002A sandbox bypass vulnerability exists in Pipeline: Declarative Plugin 1.3.3 and earlier in pipeline-model-definition/src/main/groovy/org/jenJenkins project Pipeline: Declarative Plugin · org.jenkinsc…
- CVE-2019-1003003An improper authorization vulnerability exists in Jenkins 2.158 and earlier, LTS 2.150.1 and earlier in core/src/main/java/hudson/security/TJenkins project Jenkins · org.jenkins-ci.main:jenkins-core
- CVE-2019-1003004An improper authorization vulnerability exists in Jenkins 2.158 and earlier, LTS 2.150.1 and earlier in core/src/main/java/hudson/security/AJenkins project Jenkins · org.jenkins-ci.main:jenkins-core
- CVE-2019-6503There is a deserialization vulnerability in Chatopera cosin v3.10.0.
- CVE-2019-6502sc_context_create in ctx.c in libopensc in OpenSC 0.19.0 has a memory leak, as demonstrated by a call from eidenv.