CVEs published January 25, 2019
13 CVEs were published on January 25, 2019: 0 critical, 0 high.
- Published
- 13
- Critical
- 0
- High
- 0
- Medium
- 2
- Low
- 0
- Unrated
- 11
- Now in CISA KEV
- 0
- Fix available
- 2
Most affected products
- Emerson DeltaV
- 1
- Hetronic Nova-M
- 1
- org.rundeck:rundeck
- 1
- Pilz PNOZmulti Configurator
- 1
- pypiserver
- 1
- The Linux Foundation kernel:
- 1
- The rsyslog Project rsyslog:
- 1
Medium, low and unrated 13
- CVE-2019-6966An issue was discovered in Bento4 1.5.1-628.
- CVE-2018-19009Pilz PNOZmulti Configurator prior to version 10.9 allows an authenticated attacker with local access to the system containing the PNOZmulti Pilz PNOZmulti Configurator
- CVE-2018-19021A specially crafted script could bypass the authentication of a maintenance port of Emerson DeltaV DCS Versions 11.3.1, 11.3.2, 12.3.1, 13.3Emerson DeltaV
- CVE-2018-19023Hetronic Nova-M prior to verson r161 uses fixed codes that are reproducible by sniffing and re-transmission.Hetronic Nova-M
- CVE-2018-16881A denial of service vulnerability was found in rsyslog in the imptcp module.The rsyslog Project rsyslog:
- CVE-2019-3819A flaw was found in the Linux kernel in the function hid_debug_events_read() in drivers/hid/hid-debug.c file which may enter an infinite looThe Linux Foundation kernel:
- CVE-2018-20743murmur in Mumble through 1.2.19 before 2018-08-31 mishandles multiple concurrent requests that are persisted in the database, which allows r
- CVE-2019-6956An issue was discovered in Freeware Advanced Audio Decoder 2 (FAAD2) 2.8.8.
- CVE-2019-6805SQL Injection was found in S-CMS version V3.0 via the alipay/alipayapi.php O_id parameter.
- CVE-2017-18359PostGIS 2.x before 2.3.3, as used with PostgreSQL, allows remote attackers to cause a denial of service via crafted ST_AsX3D function input,
- CVE-2019-6803typora through 0.9.9.20.3 beta has XSS, with resultant remote command execution, via the left outline bar.
- CVE-2019-6804An XSS issue was discovered on the Job Edit page in Rundeck Community Edition before 3.0.13, related to assets/javascripts/workflowStepEditoorg.rundeck:rundeck
- CVE-2019-6802CRLF Injection in pypiserver 1.2.5 and below allows attackers to set arbitrary HTTP headers and possibly conduct XSS attacks via a %0d%0a inpypiserver