# CVEs published 2019-01-25

13 CVEs were published on January 25, 2019: 0 critical, 0 high. Days are UTC.

- [CVE-2019-6966](https://cve.now/CVE-2019-6966.md): An issue was discovered in Bento4 1.5.1-628. (no CVSS)
- [CVE-2018-19009](https://cve.now/CVE-2018-19009.md): Pilz PNOZmulti Configurator prior to version 10.9 allows an authenticated attacker with local access to the system containing the PNOZmulti (no CVSS, Pilz PNOZmulti Configurator)
- [CVE-2018-19021](https://cve.now/CVE-2018-19021.md): A specially crafted script could bypass the authentication of a maintenance port of Emerson DeltaV DCS Versions 11.3.1, 11.3.2, 12.3.1, 13.3 (no CVSS, Emerson DeltaV)
- [CVE-2018-19023](https://cve.now/CVE-2018-19023.md): Hetronic Nova-M prior to verson r161 uses fixed codes that are reproducible by sniffing and re-transmission. (no CVSS, Hetronic Nova-M)
- [CVE-2018-16881](https://cve.now/CVE-2018-16881.md): A denial of service vulnerability was found in rsyslog in the imptcp module. (CVSS 5.3, The rsyslog Project rsyslog:)
- [CVE-2019-3819](https://cve.now/CVE-2019-3819.md): A flaw was found in the Linux kernel in the function hid\_debug\_events\_read() in drivers/hid/hid-debug.c file which may enter an infinite loo (CVSS 4.2, The Linux Foundation kernel:)
- [CVE-2018-20743](https://cve.now/CVE-2018-20743.md): murmur in Mumble through 1.2.19 before 2018-08-31 mishandles multiple concurrent requests that are persisted in the database, which allows r (no CVSS)
- [CVE-2019-6956](https://cve.now/CVE-2019-6956.md): An issue was discovered in Freeware Advanced Audio Decoder 2 (FAAD2) 2.8.8. (no CVSS)
- [CVE-2019-6805](https://cve.now/CVE-2019-6805.md): SQL Injection was found in S-CMS version V3.0 via the alipay/alipayapi.php O\_id parameter. (no CVSS)
- [CVE-2017-18359](https://cve.now/CVE-2017-18359.md): PostGIS 2.x before 2.3.3, as used with PostgreSQL, allows remote attackers to cause a denial of service via crafted ST\_AsX3D function input, (no CVSS)
- [CVE-2019-6803](https://cve.now/CVE-2019-6803.md): typora through 0.9.9.20.3 beta has XSS, with resultant remote command execution, via the left outline bar. (no CVSS)
- [CVE-2019-6804](https://cve.now/CVE-2019-6804.md): An XSS issue was discovered on the Job Edit page in Rundeck Community Edition before 3.0.13, related to assets/javascripts/workflowStepEdito (no CVSS, org.rundeck:rundeck)
- [CVE-2019-6802](https://cve.now/CVE-2019-6802.md): CRLF Injection in pypiserver 1.2.5 and below allows attackers to set arbitrary HTTP headers and possibly conduct XSS attacks via a %0d%0a in (no CVSS, pypiserver)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2019-01-25
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.