CVEs published January 23, 2019
28 CVEs were published on January 23, 2019: 0 critical, 9 high.
- Published
- 28
- Critical
- 0
- High
- 9
- Medium
- 8
- Low
- 0
- Unrated
- 11
- Now in CISA KEV
- 0
- Fix available
- 8
Most affected products
- Cisco WebEx WRF Player
- 5
- Apache Software Foundation Apache Airflow · apache-airflow
- 4
- Cisco Identity Services Engine Software
- 3
- Avaya IP Office
- 1
- Cisco Firepower Management Center
- 1
- Cisco IoT Field Network Director
- 1
- Cisco Prime Infrastructure
- 1
- Cisco Webex Teams
- 1
- IBM Financial Transaction Manager
- 1
- IBM Security Key Lifecycle Manager
- 1
High 9
- CVE-2019-1636Cisco Webex Teams URI Handler Insecure Library Loading VulnerabilityCisco Webex Teams
- CVE-2019-1637Cisco Webex Network Recording Player Arbitrary Code Execution VulnerabilitiesCisco WebEx WRF Player
- CVE-2019-1638Cisco Webex Network Recording Player Arbitrary Code Execution VulnerabilitiesCisco WebEx WRF Player
- CVE-2019-1639Cisco Webex Network Recording Player Arbitrary Code Execution VulnerabilitiesCisco WebEx WRF Player
- CVE-2019-1640Cisco Webex Network Recording Player Arbitrary Code Execution VulnerabilitiesCisco WebEx WRF Player
- CVE-2019-1641Cisco Webex Network Recording Player Arbitrary Code Execution VulnerabilitiesCisco WebEx WRF Player
- CVE-2019-1644Cisco IoT Field Network Director Resource Exhaustion Denial of Service VulnerabilityCisco IoT Field Network Director
- CVE-2019-3584Exploitation of Authentication vulnerabilityMcafee MVision Endpoint
- CVE-2019-3587DLL Search Order Hijacking vulnerabilityMcafee Total Protection
Medium, low and unrated 19
- CVE-2019-1642Cisco Firepower Management Center Cross-Site Scripting VulnerabilityCisco Firepower Management Center
- CVE-2019-1643Cisco Prime Infrastructure Cross-Site Scripting VulnerabilityCisco Prime Infrastructure
- CVE-2018-0187Cisco Identity Services Engine Privileged Account Sensitive Information Disclosure VulnerabilityCisco Identity Services Engine Software
- CVE-2018-1000997A path traversal vulnerability exists in the Stapler web framework used by Jenkins 2.145 and earlier, LTS 2.138.1 and earlier in core/src/maorg.jenkins-ci.main:jenkins-core · org.kohsuke.stapler:stap…
- CVE-2018-15455Cisco Identity Services Engine Logging Cross-Site Scripting VulnerabilityCisco Identity Services Engine Software
- CVE-2018-15459Cisco Identity Services Engine Privilege Escalation VulnerabilityCisco Identity Services Engine Software
- CVE-2019-6719An issue has been found in libIEC61850 v1.3.1.
- CVE-2019-6713app\admin\controller\RouteController.php in ThinkCMF 5.0.190111 allows remote attackers to execute arbitrary PHP code by using vectors invol
- CVE-2019-6707PHPSHE 1.7 has SQL injection via the admin.php?mod=product&act=state product_id[] parameter.
- CVE-2019-6708PHPSHE 1.7 has SQL injection via the admin.php?mod=order state parameter.
- CVE-2017-15720In Apache Airflow 1.8.2 and earlier, an authenticated user can execute code remotely on the Airflow webserver by creating a special object.Apache Software Foundation Apache Airflow · apache-airflow
- CVE-2017-17835In Apache Airflow 1.8.2 and earlier, a CSRF vulnerability allowed for a remote command injection on a default install of Airflow.Apache Software Foundation Apache Airflow · apache-airflow
- CVE-2017-17836In Apache Airflow 1.8.2 and earlier, an experimental Airflow feature displayed authenticated cookies, as well as passwords to databases usedApache Software Foundation Apache Airflow · apache-airflow
- CVE-2018-15614IP Office one-X Portal XSSAvaya IP Office
- CVE-2018-20245The LDAP auth backend (airflow.contrib.auth.backends.ldap_auth) prior to Apache Airflow 1.10.1 was misconfigured and contained improper checApache Software Foundation Apache Airflow · apache-airflow
- CVE-2018-1751IBM Security Key Lifecycle Manager 3.0 through 3.0.0.2 uses weaker than expected cryptographic algorithms that could allow an attacker to deIBM Security Key Lifecycle Manager
- CVE-2018-2026IBM Financial Transaction Manager 3.2.1 for Digital Payments could allow an authenticated user to obtain a directory listing of internal proIBM Financial Transaction Manager
- CVE-2019-6691phpwind 9.0.2.170426 UTF8 allows SQL Injection via the admin.php?m=backup&c=backup&a=doback tabledb[] parameter, related to the "--backup da
- CVE-2019-6706Lua 5.3.5 has a use-after-free in lua_upvaluejoin in lapi.c.