# CVEs published 2019-01-29

34 CVEs were published on January 29, 2019: 0 critical, 0 high. Days are UTC.

- [CVE-2018-12609](https://cve.now/CVE-2018-12609.md): OX App Suite 7.8.4 and earlier allows Server-Side Request Forgery. (no CVSS)
- [CVE-2018-12610](https://cve.now/CVE-2018-12610.md): OX App Suite 7.8.4 and earlier allows Information Exposure. (no CVSS)
- [CVE-2018-12611](https://cve.now/CVE-2018-12611.md): OX App Suite 7.8.4 and earlier allows Directory Traversal. (no CVSS)
- [CVE-2018-15136](https://cve.now/CVE-2018-15136.md): TitanHQ SpamTitan before 7.01 has Improper input validation. (no CVSS)
- [CVE-2018-17431](https://cve.now/CVE-2018-17431.md): Web Console in Comodo UTM Firewall before 2.7.0 allows remote attackers to execute arbitrary code without authentication via a crafted URL. (no CVSS)
- [CVE-2018-19440](https://cve.now/CVE-2018-19440.md): ARM Trusted Firmware-A allows information disclosure. (no CVSS)
- [CVE-2018-19782](https://cve.now/CVE-2018-19782.md): Multiple cross-site scripting (XSS) vulnerabilities in GET requests in FreshRSS 1.11.1 allow remote attackers to inject arbitrary web script (no CVSS)
- [CVE-2018-19858](https://cve.now/CVE-2018-19858.md): PrinceXML, versions 10 and below, is vulnerable to XXE due to the lack of protection against external entities. (no CVSS)
- [CVE-2019-7168](https://cve.now/CVE-2019-7168.md): A stored-self XSS exists in Croogo through v3.0.5, allowing an attacker to execute HTML or JavaScript code in a vulnerable Blog field to /ad (no CVSS, croogo/croogo)
- [CVE-2019-7169](https://cve.now/CVE-2019-7169.md): A stored-self XSS exists in Croogo through v3.0.5, allowing an attacker to execute HTML or JavaScript code in a vulnerable Title field to /a (no CVSS, croogo/croogo)
- [CVE-2019-7170](https://cve.now/CVE-2019-7170.md): A stored-self XSS exists in Croogo through v3.0.5, allowing an attacker to execute HTML or JavaScript code in a vulnerable Title field to /a (no CVSS, croogo/croogo)
- [CVE-2019-7171](https://cve.now/CVE-2019-7171.md): A stored-self XSS exists in Croogo through v3.0.5, allowing an attacker to execute HTML or JavaScript code in a vulnerable Title field to /a (no CVSS, croogo/croogo)
- [CVE-2019-7172](https://cve.now/CVE-2019-7172.md): A stored-self XSS exists in ATutor through v2.2.4, allowing an attacker to execute HTML or JavaScript code in a vulnerable Real Name field t (no CVSS)
- [CVE-2019-7173](https://cve.now/CVE-2019-7173.md): A stored-self XSS exists in Croogo through v3.0.5, allowing an attacker to execute HTML or JavaScript code in a vulnerable Title field to /a (no CVSS, croogo/croogo)
- [CVE-2019-3806](https://cve.now/CVE-2019-3806.md): An issue has been found in PowerDNS Recursor versions after 4.1.3 before 4.1.9 where Lua hooks are not properly applied to queries received (CVSS 5.4, Power DNS pdns-recursor)
- [CVE-2019-3807](https://cve.now/CVE-2019-3807.md): An issue has been found in PowerDNS Recursor versions 4.1.x before 4.1.9 where records in the answer section of responses received from auth (CVSS 3.7, Power DNS pdns-recursor)
- [CVE-2018-10612](https://cve.now/CVE-2018-10612.md): In 3S-Smart Software Solutions GmbH CODESYS Control V3 products prior to version 3.5.14.0, user access management and communication encrypti (no CVSS, 3S-Smart Software Solutions GmbH CODESYS Control V3 product…)
- [CVE-2018-1668](https://cve.now/CVE-2018-1668.md): IBM DataPower Gateway 7.5.0.0 through 7.5.0.19, 7.5.1.0 through 7.5.1.18, 7.5.2.0 through 7.5.2.18, and 7.6.0.0 through 7.6.0.11 appliances (CVSS 5.3, IBM DataPower Gateway)
- [CVE-2018-16880](https://cve.now/CVE-2018-16880.md): A flaw was found in the Linux kernel's handle\_rx() function in the \[vhost\_net\] driver. (CVSS 5.9, The Linux Foundation kernel)
- [CVE-2018-1733](https://cve.now/CVE-2018-1733.md): IBM QRadar SIEM 7.2 and 7.3 fails to adequately filter user-controlled input data for syntax that has control-plane implications which could (CVSS 5.3, IBM QRadar SIEM)
- [CVE-2018-18985](https://cve.now/CVE-2018-18985.md): Tridium Niagara Enterprise Security 2.3u1, all versions prior to 2.3.118.6, Niagara AX 3.8u4, all versions prior to 3.8.401.1, Niagara 4.4u2 (no CVSS, Tridium Niagara Enterprise Security 2.3u1, all versions pri…)
- [CVE-2018-1976](https://cve.now/CVE-2018-1976.md): IBM API Connect 5.0.0.0 through 5.0.8.4 is impacted by sensitive information disclosure via a REST API that could allow a user with administ (CVSS 4.9, IBM API Connect)
- [CVE-2019-7160](https://cve.now/CVE-2019-7160.md): idreamsoft iCMS 7.0.13 allows admincp.php?app=files ../ Directory Traversal via the udir parameter to files.admincp.php, resulting in execut (no CVSS)
- [CVE-2019-7156](https://cve.now/CVE-2019-7156.md): In libdoc through 2019-01-28, calcFileBlockOffset in ole.c allows division by zero. (no CVSS)
- [CVE-2016-10740](https://cve.now/CVE-2016-10740.md): Various resources in Atlassian Crowd before version 2.10.1 allow remote attackers with administration rights to learn the passwords of confi (no CVSS)
- [CVE-2019-7146](https://cve.now/CVE-2019-7146.md): In elfutils 0.175, there is a buffer over-read in the ebl\_object\_note function in eblobjnote.c in libebl. (no CVSS)
- [CVE-2019-7147](https://cve.now/CVE-2019-7147.md): A buffer over-read exists in the function crc64ib in crc64.c in nasmlib in Netwide Assembler (NASM) 2.14rc16. (no CVSS)
- [CVE-2019-7148](https://cve.now/CVE-2019-7148.md): An attempted excessive memory allocation was discovered in the function read\_long\_names in elf\_begin.c in libelf in elfutils 0.174. (no CVSS)
- [CVE-2019-7149](https://cve.now/CVE-2019-7149.md): A heap-based buffer over-read was discovered in the function read\_srclines in dwarf\_getsrclines.c in libdw in elfutils 0.175. (no CVSS)
- [CVE-2019-7150](https://cve.now/CVE-2019-7150.md): An issue was discovered in elfutils 0.175. (no CVSS)
- [CVE-2019-7151](https://cve.now/CVE-2019-7151.md): A NULL pointer dereference was discovered in wasm::Module::getFunctionOrNull in wasm/wasm.cpp in Binaryen 1.38.22. (no CVSS)
- [CVE-2019-7152](https://cve.now/CVE-2019-7152.md): A heap-based buffer over-read was discovered in wasm::WasmBinaryBuilder::processFunctions() in wasm/wasm-binary.cpp (when calling wasm::Wasm (no CVSS)
- [CVE-2019-7153](https://cve.now/CVE-2019-7153.md): A NULL pointer dereference was discovered in wasm::WasmBinaryBuilder::processFunctions() in wasm/wasm-binary.cpp (when calling wasm::WasmBin (no CVSS)
- [CVE-2019-7154](https://cve.now/CVE-2019-7154.md): The main function in tools/wasm2js.cpp in Binaryen 1.38.22 has a heap-based buffer overflow because Emscripten is misused, triggering an err (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2019-01-29
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.