CVEs published January 29, 2019
34 CVEs were published on January 29, 2019: 0 critical, 0 high.
- Published
- 34
- Critical
- 0
- High
- 0
- Medium
- 5
- Low
- 1
- Unrated
- 28
- Now in CISA KEV
- 0
- Fix available
- 5
Most affected products
- croogo/croogo
- 5
- Power DNS pdns-recursor
- 2
- 3S-Smart Software Solutions GmbH CODESYS Control V3 product…
- 1
- IBM API Connect
- 1
- IBM DataPower Gateway
- 1
- IBM QRadar SIEM
- 1
- The Linux Foundation kernel
- 1
- Tridium Niagara Enterprise Security 2.3u1, all versions pri…
- 1
Medium, low and unrated 34
- CVE-2018-12609OX App Suite 7.8.4 and earlier allows Server-Side Request Forgery.
- CVE-2018-12610OX App Suite 7.8.4 and earlier allows Information Exposure.
- CVE-2018-12611OX App Suite 7.8.4 and earlier allows Directory Traversal.
- CVE-2018-15136TitanHQ SpamTitan before 7.01 has Improper input validation.
- CVE-2018-17431Web Console in Comodo UTM Firewall before 2.7.0 allows remote attackers to execute arbitrary code without authentication via a crafted URL.
- CVE-2018-19440ARM Trusted Firmware-A allows information disclosure.
- CVE-2018-19782Multiple cross-site scripting (XSS) vulnerabilities in GET requests in FreshRSS 1.11.1 allow remote attackers to inject arbitrary web script
- CVE-2018-19858PrinceXML, versions 10 and below, is vulnerable to XXE due to the lack of protection against external entities.
- CVE-2019-7168A stored-self XSS exists in Croogo through v3.0.5, allowing an attacker to execute HTML or JavaScript code in a vulnerable Blog field to /adcroogo/croogo
- CVE-2019-7169A stored-self XSS exists in Croogo through v3.0.5, allowing an attacker to execute HTML or JavaScript code in a vulnerable Title field to /acroogo/croogo
- CVE-2019-7170A stored-self XSS exists in Croogo through v3.0.5, allowing an attacker to execute HTML or JavaScript code in a vulnerable Title field to /acroogo/croogo
- CVE-2019-7171A stored-self XSS exists in Croogo through v3.0.5, allowing an attacker to execute HTML or JavaScript code in a vulnerable Title field to /acroogo/croogo
- CVE-2019-7172A stored-self XSS exists in ATutor through v2.2.4, allowing an attacker to execute HTML or JavaScript code in a vulnerable Real Name field t
- CVE-2019-7173A stored-self XSS exists in Croogo through v3.0.5, allowing an attacker to execute HTML or JavaScript code in a vulnerable Title field to /acroogo/croogo
- CVE-2019-3806An issue has been found in PowerDNS Recursor versions after 4.1.3 before 4.1.9 where Lua hooks are not properly applied to queries received Power DNS pdns-recursor
- CVE-2019-3807An issue has been found in PowerDNS Recursor versions 4.1.x before 4.1.9 where records in the answer section of responses received from authPower DNS pdns-recursor
- CVE-2018-10612In 3S-Smart Software Solutions GmbH CODESYS Control V3 products prior to version 3.5.14.0, user access management and communication encrypti3S-Smart Software Solutions GmbH CODESYS Control V3 product…
- CVE-2018-1668IBM DataPower Gateway 7.5.0.0 through 7.5.0.19, 7.5.1.0 through 7.5.1.18, 7.5.2.0 through 7.5.2.18, and 7.6.0.0 through 7.6.0.11 appliances IBM DataPower Gateway
- CVE-2018-16880A flaw was found in the Linux kernel's handle_rx() function in the [vhost_net] driver.The Linux Foundation kernel
- CVE-2018-1733IBM QRadar SIEM 7.2 and 7.3 fails to adequately filter user-controlled input data for syntax that has control-plane implications which couldIBM QRadar SIEM
- CVE-2018-18985Tridium Niagara Enterprise Security 2.3u1, all versions prior to 2.3.118.6, Niagara AX 3.8u4, all versions prior to 3.8.401.1, Niagara 4.4u2Tridium Niagara Enterprise Security 2.3u1, all versions pri…
- CVE-2018-1976IBM API Connect 5.0.0.0 through 5.0.8.4 is impacted by sensitive information disclosure via a REST API that could allow a user with administIBM API Connect
- CVE-2019-7160idreamsoft iCMS 7.0.13 allows admincp.php?app=files ../ Directory Traversal via the udir parameter to files.admincp.php, resulting in execut
- CVE-2019-7156In libdoc through 2019-01-28, calcFileBlockOffset in ole.c allows division by zero.
- CVE-2016-10740Various resources in Atlassian Crowd before version 2.10.1 allow remote attackers with administration rights to learn the passwords of confi
- CVE-2019-7146In elfutils 0.175, there is a buffer over-read in the ebl_object_note function in eblobjnote.c in libebl.
- CVE-2019-7147A buffer over-read exists in the function crc64ib in crc64.c in nasmlib in Netwide Assembler (NASM) 2.14rc16.
- CVE-2019-7148An attempted excessive memory allocation was discovered in the function read_long_names in elf_begin.c in libelf in elfutils 0.174.
- CVE-2019-7149A heap-based buffer over-read was discovered in the function read_srclines in dwarf_getsrclines.c in libdw in elfutils 0.175.
- CVE-2019-7150An issue was discovered in elfutils 0.175.
- CVE-2019-7151A NULL pointer dereference was discovered in wasm::Module::getFunctionOrNull in wasm/wasm.cpp in Binaryen 1.38.22.
- CVE-2019-7152A heap-based buffer over-read was discovered in wasm::WasmBinaryBuilder::processFunctions() in wasm/wasm-binary.cpp (when calling wasm::Wasm
- CVE-2019-7153A NULL pointer dereference was discovered in wasm::WasmBinaryBuilder::processFunctions() in wasm/wasm-binary.cpp (when calling wasm::WasmBin
- CVE-2019-7154The main function in tools/wasm2js.cpp in Binaryen 1.38.22 has a heap-based buffer overflow because Emscripten is misused, triggering an err