# CVEs published 2019-01-31 29 CVEs were published on January 31, 2019: 1 critical, 0 high. Days are UTC. - [CVE-2019-7297](https://cve.now/CVE-2019-7297.md): An issue was discovered on D-Link DIR-823G devices with firmware through 1.02B03. (no CVSS) - [CVE-2018-17928](https://cve.now/CVE-2018-17928.md): The product CMS-770 (Software Versions 1.7.1 and prior)is vulnerable that an attacker can read sensitive configuration files by bypassing th (no CVSS, ABB CMS-770) - [CVE-2018-5560](https://cve.now/CVE-2018-5560.md): Guardzilla All-In-One Video Security System Hard-Coded Credential (CVSS 10.0, Practecol Guardzilla All-In-One Video Security System) - [CVE-2019-7295](https://cve.now/CVE-2019-7295.md): typora through 0.9.63 has XSS, with resultant remote command execution, during block rendering of a mathematical formula. (no CVSS) - [CVE-2019-7296](https://cve.now/CVE-2019-7296.md): typora through 0.9.64 has XSS, with resultant remote command execution, during inline rendering of a mathematical formula. (no CVSS) - [CVE-2018-12548](https://cve.now/CVE-2018-12548.md): In OpenJDK + Eclipse OpenJ9 version 0.11.0 builds, the public jdk.crypto.jniprovider.NativeCrypto class contains public static natives which (no CVSS, The Eclipse Foundation Eclipse OpenJ9) - [CVE-2018-6241](https://cve.now/CVE-2018-6241.md): NVIDIA Tegra Gralloc module contains a vulnerability in driver in which it does not validate input parameter of the registerbuffer API, whic (no CVSS, Nvidia Android) - [CVE-2018-15515](https://cve.now/CVE-2018-15515.md): The CaptivelPortal service on D-Link Central WiFiManager CWM-100 1.03 r0098 devices will load a Trojan horse "quserex.dll" from the Captivel (no CVSS) - [CVE-2018-15516](https://cve.now/CVE-2018-15516.md): The FTP service on D-Link Central WiFiManager CWM-100 1.03 r0098 devices allows remote attackers to conduct a PORT command bounce scan via p (no CVSS) - [CVE-2018-15517](https://cve.now/CVE-2018-15517.md): The MailConnect feature on D-Link Central WiFiManager CWM-100 1.03 r0098 devices is intended to check a connection to an SMTP server but act (no CVSS) - [CVE-2018-18940](https://cve.now/CVE-2018-18940.md): servlet/SnoopServlet (a servlet installed by default) in Netscape Enterprise 3.63 has reflected XSS via an arbitrary parameter=\[XSS\] in the (no CVSS) - [CVE-2018-18941](https://cve.now/CVE-2018-18941.md): In Vignette Content Management version 6, it is possible to gain remote access to administrator privileges by discovering the admin password (no CVSS) - [CVE-2018-19040](https://cve.now/CVE-2018-19040.md): The Media File Manager plugin 1.4.2 for WordPress allows directory listing via a ../ directory traversal in the dir parameter of an mrelocat (no CVSS) - [CVE-2018-19041](https://cve.now/CVE-2018-19041.md): The Media File Manager plugin 1.4.2 for WordPress allows XSS via the dir parameter of an mrelocator\_getdir action to the wp-admin/admin-ajax (no CVSS) - [CVE-2018-19042](https://cve.now/CVE-2018-19042.md): The Media File Manager plugin 1.4.2 for WordPress allows arbitrary file movement via a ../ directory traversal in the dir\_from and dir\_to pa (no CVSS) - [CVE-2018-19043](https://cve.now/CVE-2018-19043.md): The Media File Manager plugin 1.4.2 for WordPress allows arbitrary file renaming (specifying a "from" and "to" filename) via a ../ directory (no CVSS) - [CVE-2019-7282](https://cve.now/CVE-2019-7282.md): In NetKit through 0.17, rcp.c in the rcp client allows remote rsh servers to bypass intended access restrictions via the filename of . (no CVSS) - [CVE-2019-7283](https://cve.now/CVE-2019-7283.md): An issue was discovered in rcp in NetKit through 0.17. (no CVSS) - [CVE-2018-17926](https://cve.now/CVE-2018-17926.md): The product M2M ETHERNET (FW Versions 2.22 and prior, ETH-FW Versions 1.01 and prior) is vulnerable in that an attacker can upload a malicio (no CVSS, ABB M2M ETHERNET) - [CVE-2018-11790](https://cve.now/CVE-2018-11790.md): When loading a document with Apache Open Office 4.1.5 and earlier with smaller end line termination than the operating system uses, the defe (no CVSS, Apache Software Foundation Apache OpenOffice) - [CVE-2019-4040](https://cve.now/CVE-2019-4040.md): IBM I 7.2 and 7.3 is vulnerable to cross-site scripting. (CVSS 6.1, IBM i) - [CVE-2017-18360](https://cve.now/CVE-2017-18360.md): In change\_port\_settings in drivers/usb/serial/io\_ti.c in the Linux kernel before 4.11.3, local users could cause a denial of service by divi (no CVSS) - [CVE-2019-6438](https://cve.now/CVE-2019-6438.md): SchedMD Slurm before 17.11.13 and 18.x before 18.08.5 mishandles 32-bit systems. (no CVSS) - [CVE-2019-7216](https://cve.now/CVE-2019-7216.md): An issue was discovered in FileChucker 4.99e-free-e02. (no CVSS) - [CVE-2019-7249](https://cve.now/CVE-2019-7249.md): In Keybase before 2.12.6 on macOS, the move RPC to the Helper was susceptible to time-to-check-time-to-use bugs and would also allow one use (no CVSS) - [CVE-2019-7250](https://cve.now/CVE-2019-7250.md): An issue was discovered in the Cross Reference Add-on 36 for Google Docs. (no CVSS) - [CVE-2019-6109](https://cve.now/CVE-2019-6109.md): An issue was discovered in OpenSSH 7.9. (CVSS 6.8) - [CVE-2019-6110](https://cve.now/CVE-2019-6110.md): In OpenSSH 7.9, due to accepting and displaying arbitrary stderr output from the server, a malicious server (or Man-in-The-Middle attacker) (CVSS 6.8) - [CVE-2019-6111](https://cve.now/CVE-2019-6111.md): An issue was discovered in OpenSSH 7.9. (CVSS 5.9) --- Source: cve.now, built and run by Sazabi (AI-native observability and security) Page: https://cve.now/daily/2019-01-31 Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.