# CVEs published 2019-01-22 27 CVEs were published on January 22, 2019: 0 critical, 0 high. 1 is now in CISA KEV. Days are UTC. - [CVE-2018-19011](https://cve.now/CVE-2018-19011.md): CX-Supervisor (Versions 3.42 and prior) can execute code that has been injected into a project file. (no CVSS, ICS-CERT CX-Supervisor) - [CVE-2018-19013](https://cve.now/CVE-2018-19013.md): An attacker could inject commands to delete files and/or delete the contents of a file on CX-Supervisor (Versions 3.42 and prior) through a (no CVSS, ICS-CERT CX-Supervisor) - [CVE-2018-19017](https://cve.now/CVE-2018-19017.md): Several use after free vulnerabilities have been identified in CX-Supervisor (Versions 3.42 and prior). (no CVSS, ICS-CERT CX-Supervisor) - [CVE-2018-19019](https://cve.now/CVE-2018-19019.md): A type confusion vulnerability exists when processing project files in CX-Supervisor (Versions 3.42 and prior). (no CVSS, ICS-CERT CX-Supervisor) - [CVE-2019-6260](https://cve.now/CVE-2019-6260.md): The ASPEED ast2400 and ast2500 Baseband Management Controller (BMC) hardware and firmware implement Advanced High-performance Bus (AHB) brid (no CVSS) - [CVE-2018-6443](https://cve.now/CVE-2018-6443.md): A vulnerability in Brocade Network Advisor Versions before 14.3.1 could allow an unauthenticated, remote attacker to log in to the JBoss Adm (no CVSS, Brocade Communications Systems Brocade Network Advisor) - [CVE-2018-6444](https://cve.now/CVE-2018-6444.md): A Vulnerability in Brocade Network Advisor versions before 14.1.0 could allow a remote unauthenticated attacker to execute arbitray code. (no CVSS, Brocade Communications Systems Brocade Network Advisor) - [CVE-2018-6445](https://cve.now/CVE-2018-6445.md): A Vulnerability in Brocade Network Advisor versions before 14.0.3 could allow a remote unauthenticated attacker to export the current user d (no CVSS, Brocade Communications Systems Brocade Network Advisor) - [CVE-2017-6923](https://cve.now/CVE-2017-6923.md): Access bypass in Drupal 8 views (no CVSS, Drupal core · drupal/core +1) - [CVE-2019-6507](https://cve.now/CVE-2019-6507.md): An issue was discovered in creditease-sec insight through 2018-09-11. (no CVSS) - [CVE-2019-6508](https://cve.now/CVE-2019-6508.md): An issue was discovered in creditease-sec insight through 2018-09-11. (no CVSS) - [CVE-2019-6509](https://cve.now/CVE-2019-6509.md): An issue was discovered in creditease-sec insight through 2018-09-11. (no CVSS) - [CVE-2019-6510](https://cve.now/CVE-2019-6510.md): An issue was discovered in creditease-sec insight through 2018-09-11. (no CVSS) - [CVE-2017-6922](https://cve.now/CVE-2017-6922.md): Files uploaded by anonymous users into a private file system can be accessed by other anonymous users (no CVSS, Drupal Core · drupal/core +1) - [CVE-2018-14666](https://cve.now/CVE-2018-14666.md): An improper authorization flaw was found in the Smart Class feature of Foreman. (CVSS 6.8, \[UNKNOWN\] Satellite) - [CVE-2018-19634](https://cve.now/CVE-2018-19634.md): CA Service Desk Manager 14.1 and 17 contain a vulnerability that can allow a malicious actor to access survey information. (no CVSS, CA Technologies CA Service Desk Manager) - [CVE-2018-19635](https://cve.now/CVE-2018-19635.md): CA Service Desk Manager 14.1 and 17 contain a vulnerability that can allow a malicious actor to escalate privileges in the user interface. (no CVSS, CA Technologies CA Service Desk Manager) - [CVE-2019-6338](https://cve.now/CVE-2019-6338.md): third-party PEAR Archive\_Tar library updates (no CVSS, Drupal core · drupal/core +1) - [CVE-2019-6339](https://cve.now/CVE-2019-6339.md): PHAR stream wrapper Arbitrary PHP code execution (no CVSS, Drupal core · drupal/core +1) - [CVE-2018-13374](https://cve.now/CVE-2018-13374.md): A Improper Access Control in Fortinet FortiOS 6.0.2, 5.6.7 and before, FortiADC 6.1.0, 6.0.0 to 6.0.1, 5.4.0 to 5.4.4 allows attacker to obt (CVSS 4.3, KEV, Fortinet FortiOS, fortiADC) - [CVE-2019-1003000](https://cve.now/CVE-2019-1003000.md): A sandbox bypass vulnerability exists in Script Security Plugin 1.49 and earlier in src/main/java/org/jenkinsci/plugins/scriptsecurity/sandb (no CVSS, Jenkins project Script Security Plugin · org.jenkins-ci.plu…) - [CVE-2019-1003001](https://cve.now/CVE-2019-1003001.md): A sandbox bypass vulnerability exists in Pipeline: Groovy Plugin 2.61 and earlier in src/main/java/org/jenkinsci/plugins/workflow/cps/CpsFlo (no CVSS, Jenkins project Pipeline: Groovy Plugin · org.jenkins-ci… +2) - [CVE-2019-1003002](https://cve.now/CVE-2019-1003002.md): A sandbox bypass vulnerability exists in Pipeline: Declarative Plugin 1.3.3 and earlier in pipeline-model-definition/src/main/groovy/org/jen (no CVSS, Jenkins project Pipeline: Declarative Plugin · org.jenkinsc…) - [CVE-2019-1003003](https://cve.now/CVE-2019-1003003.md): An improper authorization vulnerability exists in Jenkins 2.158 and earlier, LTS 2.150.1 and earlier in core/src/main/java/hudson/security/T (no CVSS, Jenkins project Jenkins · org.jenkins-ci.main:jenkins-core) - [CVE-2019-1003004](https://cve.now/CVE-2019-1003004.md): An improper authorization vulnerability exists in Jenkins 2.158 and earlier, LTS 2.150.1 and earlier in core/src/main/java/hudson/security/A (no CVSS, Jenkins project Jenkins · org.jenkins-ci.main:jenkins-core) - [CVE-2019-6503](https://cve.now/CVE-2019-6503.md): There is a deserialization vulnerability in Chatopera cosin v3.10.0. (no CVSS) - [CVE-2019-6502](https://cve.now/CVE-2019-6502.md): sc\_context\_create in ctx.c in libopensc in OpenSC 0.19.0 has a memory leak, as demonstrated by a call from eidenv. (no CVSS) --- Source: cve.now, built and run by Sazabi (AI-native observability and security) Page: https://cve.now/daily/2019-01-22 Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.