# CVEs published 2019-01-28

28 CVEs were published on January 28, 2019: 0 critical, 1 high. Days are UTC.

- [CVE-2018-19010](https://cve.now/CVE-2018-19010.md): Drager Infinity Delta, Infinity Delta, all versions, Delta XL, all versions, Kappa, all version, and Infinity Explorer C700, all versions. (no CVSS, ICS-CERT Dräger Infinity Delta)
- [CVE-2018-19014](https://cve.now/CVE-2018-19014.md): Drager Infinity Delta, Infinity Delta, all versions, Delta XL, all versions, Kappa, all version, and Infinity Explorer C700, all versions. (no CVSS, ICS-CERT Dräger Infinity Delta)
- [CVE-2018-19721](https://cve.now/CVE-2018-19721.md): Adobe Acrobat and Reader versions 2018.011.20058 and earlier, 2017.011.30099 and earlier, and 2015.006.30448 and earlier have an out-of-boun (no CVSS)
- [CVE-2018-19723](https://cve.now/CVE-2018-19723.md): Adobe Acrobat and Reader versions 2018.011.20058 and earlier, 2017.011.30099 and earlier, and 2015.006.30448 and earlier have an out-of-boun (no CVSS)
- [CVE-2018-19012](https://cve.now/CVE-2018-19012.md): Drager Infinity Delta, Infinity Delta, all versions, Delta XL, all versions, Kappa, all version, and Infinity Explorer C700, all versions. (no CVSS, ICS-CERT Dräger Infinity Delta)
- [CVE-2019-3462](https://cve.now/CVE-2019-3462.md): Incorrect sanitation of the 302 redirect field in HTTP transport method of apt versions 1.4.8 and earlier can lead to content injection by a (no CVSS, Debian GNU/Linux apt as used in Debian Stretch and Ubuntu)
- [CVE-2019-6990](https://cve.now/CVE-2019-6990.md): A stored-self XSS exists in web/skins/classic/views/zones.php of ZoneMinder through 1.32.3, allowing an attacker to execute HTML or JavaScri (no CVSS)
- [CVE-2019-6991](https://cve.now/CVE-2019-6991.md): A classic Stack-based buffer overflow exists in the zmLoadUser() function in zm\_user.cpp of the zmu binary in ZoneMinder through 1.32.3, all (no CVSS)
- [CVE-2019-6992](https://cve.now/CVE-2019-6992.md): A stored-self XSS exists in web/skins/classic/views/controlcaps.php of ZoneMinder through 1.32.3, allowing an attacker to execute HTML or Ja (no CVSS)
- [CVE-2018-19015](https://cve.now/CVE-2018-19015.md): An attacker could inject commands to launch programs and create, write, and read files on CX-Supervisor (Versions 3.42 and prior) through a (no CVSS, ICS-CERT CX-Supervisor)
- [CVE-2018-19724](https://cve.now/CVE-2018-19724.md): Adobe Experience Manager Forms versions 6.2, 6.3 and 6.4 have a stored cross-site scripting vulnerability. (no CVSS, Adobe Experience Manager Forms)
- [CVE-2018-19726](https://cve.now/CVE-2018-19726.md): Adobe Experience Manager versions 6.4, 6.3, 6.2, 6.1, and 6.0 have a stored cross-site scripting vulnerability. (no CVSS, Adobe Experience Manager)
- [CVE-2018-19727](https://cve.now/CVE-2018-19727.md): Adobe Experience Manager versions 6.4, 6.3, 6.2, 6.1, and 6.0 have a reflected cross-site scripting vulnerability. (no CVSS, Adobe Experience Manager)
- [CVE-2018-19728](https://cve.now/CVE-2018-19728.md): Adobe Acrobat and Reader versions 2019.008.20081 and earlier, 2019.008.20080 and earlier, 2019.008.20081 and earlier, 2017.011.30106 and ear (no CVSS, Adobe Acrobat and Reader)
- [CVE-2019-3593](https://cve.now/CVE-2019-3593.md): Exploitation of Privilege/Trust vulnerability (CVSS 7.5, Mcafee Total Protection)
- [CVE-2019-6988](https://cve.now/CVE-2019-6988.md): An issue was discovered in OpenJPEG 2.3.0. (no CVSS)
- [CVE-2018-10910](https://cve.now/CVE-2018-10910.md): A bug in Bluez may allow for the Bluetooth Discoverable state being set to on when no Bluetooth agent is registered with the system. (CVSS 4.5, The Bluez Project bluez)
- [CVE-2019-3815](https://cve.now/CVE-2019-3815.md): A memory leak was discovered in the backport of fixes for CVE-2018-16864 in Red Hat Enterprise Linux. (CVSS 3.3, The systemd Project systemd)
- [CVE-2019-6986](https://cve.now/CVE-2019-6986.md): SPARQL Injection in VIVO Vitro v1.10.0 allows a remote attacker to execute arbitrary SPARQL via the uri parameter, leading to a regular expr (no CVSS, org.vivoweb:vitro-project)
- [CVE-2018-16889](https://cve.now/CVE-2018-16889.md): Ceph does not properly sanitize encryption keys in debug logging for v4 auth. (CVSS 5.5, The Ceph Project ceph)
- [CVE-2019-6982](https://cve.now/CVE-2019-6982.md): An issue was discovered in Foxit 3D Plugin Beta before 9.4.0.16807 for Foxit Reader and PhantomPDF. (no CVSS)
- [CVE-2019-6983](https://cve.now/CVE-2019-6983.md): An issue was discovered in Foxit 3D Plugin Beta before 9.4.0.16807 for Foxit Reader and PhantomPDF. (no CVSS)
- [CVE-2019-6984](https://cve.now/CVE-2019-6984.md): An issue was discovered in Foxit 3D Plugin Beta before 9.4.0.16807 for Foxit Reader and PhantomPDF. (no CVSS)
- [CVE-2019-6985](https://cve.now/CVE-2019-6985.md): An issue was discovered in Foxit 3D Plugin Beta before 9.4.0.16807 for Foxit Reader and PhantomPDF. (no CVSS)
- [CVE-2018-20744](https://cve.now/CVE-2018-20744.md): The Olivier Poitrey Go CORS handler through 1.3.0 actively converts a wildcard CORS policy into reflecting an arbitrary Origin header value, (no CVSS, github.com/gofiber/fiber/v2 · github.com/rs/cors)
- [CVE-2018-20745](https://cve.now/CVE-2018-20745.md): Yii 2.x through 2.0.15.1 actively converts a wildcard CORS policy into reflecting an arbitrary Origin header value, which is incompatible wi (no CVSS, yiisoft/yii2)
- [CVE-2019-6979](https://cve.now/CVE-2019-6979.md): An issue was discovered in the User IP History Logs (aka IP\_History\_Logs) plugin 1.0.2 for MyBB. (no CVSS)
- [CVE-2019-6978](https://cve.now/CVE-2019-6978.md): The GD Graphics Library (aka LibGD) 2.2.5 has a double free in the gdImage\*Ptr() functions in gd\_gif\_out.c, gd\_jpeg.c, and gd\_wbmp.c. (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2019-01-28
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.