# CVEs published 2019-01-23 28 CVEs were published on January 23, 2019: 0 critical, 9 high. Days are UTC. - [CVE-2019-1636](https://cve.now/CVE-2019-1636.md): Cisco Webex Teams URI Handler Insecure Library Loading Vulnerability (CVSS 7.8, Cisco Webex Teams) - [CVE-2019-1637](https://cve.now/CVE-2019-1637.md): Cisco Webex Network Recording Player Arbitrary Code Execution Vulnerabilities (CVSS 7.8, Cisco WebEx WRF Player) - [CVE-2019-1638](https://cve.now/CVE-2019-1638.md): Cisco Webex Network Recording Player Arbitrary Code Execution Vulnerabilities (CVSS 7.8, Cisco WebEx WRF Player) - [CVE-2019-1639](https://cve.now/CVE-2019-1639.md): Cisco Webex Network Recording Player Arbitrary Code Execution Vulnerabilities (CVSS 7.8, Cisco WebEx WRF Player) - [CVE-2019-1640](https://cve.now/CVE-2019-1640.md): Cisco Webex Network Recording Player Arbitrary Code Execution Vulnerabilities (CVSS 7.8, Cisco WebEx WRF Player) - [CVE-2019-1641](https://cve.now/CVE-2019-1641.md): Cisco Webex Network Recording Player Arbitrary Code Execution Vulnerabilities (CVSS 7.8, Cisco WebEx WRF Player) - [CVE-2019-1642](https://cve.now/CVE-2019-1642.md): Cisco Firepower Management Center Cross-Site Scripting Vulnerability (CVSS 6.1, Cisco Firepower Management Center) - [CVE-2019-1643](https://cve.now/CVE-2019-1643.md): Cisco Prime Infrastructure Cross-Site Scripting Vulnerability (CVSS 6.1, Cisco Prime Infrastructure) - [CVE-2019-1644](https://cve.now/CVE-2019-1644.md): Cisco IoT Field Network Director Resource Exhaustion Denial of Service Vulnerability (CVSS 7.5, Cisco IoT Field Network Director) - [CVE-2018-0187](https://cve.now/CVE-2018-0187.md): Cisco Identity Services Engine Privileged Account Sensitive Information Disclosure Vulnerability (CVSS 6.5, Cisco Identity Services Engine Software) - [CVE-2018-1000997](https://cve.now/CVE-2018-1000997.md): A path traversal vulnerability exists in the Stapler web framework used by Jenkins 2.145 and earlier, LTS 2.138.1 and earlier in core/src/ma (no CVSS, org.jenkins-ci.main:jenkins-core · org.kohsuke.stapler:stap…) - [CVE-2018-15455](https://cve.now/CVE-2018-15455.md): Cisco Identity Services Engine Logging Cross-Site Scripting Vulnerability (CVSS 6.1, Cisco Identity Services Engine Software) - [CVE-2018-15459](https://cve.now/CVE-2018-15459.md): Cisco Identity Services Engine Privilege Escalation Vulnerability (CVSS 6.5, Cisco Identity Services Engine Software) - [CVE-2019-6719](https://cve.now/CVE-2019-6719.md): An issue has been found in libIEC61850 v1.3.1. (no CVSS) - [CVE-2019-6713](https://cve.now/CVE-2019-6713.md): app\\admin\\controller\\RouteController.php in ThinkCMF 5.0.190111 allows remote attackers to execute arbitrary PHP code by using vectors invol (no CVSS) - [CVE-2019-6707](https://cve.now/CVE-2019-6707.md): PHPSHE 1.7 has SQL injection via the admin.php?mod=product&act=state product\_id\[\] parameter. (no CVSS) - [CVE-2019-6708](https://cve.now/CVE-2019-6708.md): PHPSHE 1.7 has SQL injection via the admin.php?mod=order state parameter. (no CVSS) - [CVE-2017-15720](https://cve.now/CVE-2017-15720.md): In Apache Airflow 1.8.2 and earlier, an authenticated user can execute code remotely on the Airflow webserver by creating a special object. (no CVSS, Apache Software Foundation Apache Airflow · apache-airflow) - [CVE-2017-17835](https://cve.now/CVE-2017-17835.md): In Apache Airflow 1.8.2 and earlier, a CSRF vulnerability allowed for a remote command injection on a default install of Airflow. (no CVSS, Apache Software Foundation Apache Airflow · apache-airflow) - [CVE-2017-17836](https://cve.now/CVE-2017-17836.md): In Apache Airflow 1.8.2 and earlier, an experimental Airflow feature displayed authenticated cookies, as well as passwords to databases used (no CVSS, Apache Software Foundation Apache Airflow · apache-airflow) - [CVE-2018-15614](https://cve.now/CVE-2018-15614.md): IP Office one-X Portal XSS (CVSS 6.8, Avaya IP Office) - [CVE-2018-20245](https://cve.now/CVE-2018-20245.md): The LDAP auth backend (airflow.contrib.auth.backends.ldap\_auth) prior to Apache Airflow 1.10.1 was misconfigured and contained improper chec (no CVSS, Apache Software Foundation Apache Airflow · apache-airflow) - [CVE-2018-1751](https://cve.now/CVE-2018-1751.md): IBM Security Key Lifecycle Manager 3.0 through 3.0.0.2 uses weaker than expected cryptographic algorithms that could allow an attacker to de (CVSS 5.9, IBM Security Key Lifecycle Manager) - [CVE-2018-2026](https://cve.now/CVE-2018-2026.md): IBM Financial Transaction Manager 3.2.1 for Digital Payments could allow an authenticated user to obtain a directory listing of internal pro (CVSS 4.3, IBM Financial Transaction Manager) - [CVE-2019-3584](https://cve.now/CVE-2019-3584.md): Exploitation of Authentication vulnerability (CVSS 7.4, Mcafee MVision Endpoint) - [CVE-2019-3587](https://cve.now/CVE-2019-3587.md): DLL Search Order Hijacking vulnerability (CVSS 7.2, Mcafee Total Protection) - [CVE-2019-6691](https://cve.now/CVE-2019-6691.md): phpwind 9.0.2.170426 UTF8 allows SQL Injection via the admin.php?m=backup&c=backup&a=doback tabledb\[\] parameter, related to the "--backup da (no CVSS) - [CVE-2019-6706](https://cve.now/CVE-2019-6706.md): Lua 5.3.5 has a use-after-free in lua\_upvaluejoin in lapi.c. (no CVSS) --- Source: cve.now, built and run by Sazabi (AI-native observability and security) Page: https://cve.now/daily/2019-01-23 Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.