CVEs published February 1, 2019
26 CVEs were published on February 1, 2019: 0 critical, 0 high.
- Published
- 26
- Critical
- 0
- High
- 0
- Medium
- 2
- Low
- 0
- Unrated
- 24
- Now in CISA KEV
- 0
- Fix available
- 12
Most affected products
- HackerOne m-server · m-server
- 2
- ICS-CERT LCDS Laquis SCADA
- 2
- Avaya Communication Manager
- 1
- colander
- 1
- HackerOne defaults-deep · defaults-deep
- 1
- HackerOne express-cart · express-cart
- 1
- HackerOne extend · extend
- 1
- HackerOne html-pages · html-pages
- 1
- HackerOne http-live-simulator · http-live-simulator
- 1
- HackerOne just-extend · just-extend
- 1
Medium, low and unrated 26
- CVE-2019-7308kernel/bpf/verifier.c in the Linux kernel before 4.20.6 performs undesirable out-of-bounds speculation on pointer arithmetic in various case
- CVE-2018-0722Path Traversal vulnerability in Photo Station versions: 5.7.2 and earlier in QTS 4.3.4, 5.4.4 and earlier in QTS 4.3.3, 5.2.8 and earlier inQNAP Photo Station
- CVE-2018-16479Path traversal vulnerability in http-live-simulator <1.0.7 causes unauthorized access to arbitrary files on disk by appending extra slashes HackerOne http-live-simulator · http-live-simulator
- CVE-2018-16480A XSS vulnerability was found in module public <0.1.4 that allows malicious Javascript code to run in the browser, due to the absence of sanHackerOne public · public
- CVE-2018-16481A XSS vulnerability was found in html-page <=2.1.1 that allows malicious Javascript code to be executed in the user's browser due to the absHackerOne html-pages · html-pages
- CVE-2018-16482A server directory traversal vulnerability was found on node module mcstatic <=0.0.20 that would allow an attack to access sensitive informaHackerOne mcstatic · mcstatic
- CVE-2018-16483A deficiency in the access control in module express-cart <=1.1.5 allows unprivileged users to add new users to the application as administrHackerOne express-cart · express-cart
- CVE-2018-16484A XSS vulnerability was found in module m-server <1.4.2 that allows malicious Javascript code or HTML to be executed, due to the lack of escHackerOne m-server · m-server
- CVE-2018-16485Path Traversal vulnerability in module m-server <1.4.1 allows malicious user to access unauthorized content of any file in the directory treHackerOne m-server · m-server
- CVE-2018-16486A prototype pollution vulnerability was found in defaults-deep <=0.2.4 that would allow a malicious user to inject properties onto Object.prHackerOne defaults-deep · defaults-deep
- CVE-2018-16487A prototype pollution vulnerability was found in lodash <4.17.11 where the functions merge, mergeWith, and defaultsDeep can be tricked into HackerOne lodash · lodash +1
- CVE-2018-16489A prototype pollution vulnerability was found in just-extend <4.0.0 that allows attack to inject properties onto Object.prototype through itHackerOne just-extend · just-extend
- CVE-2018-16490A prototype pollution vulnerability was found in module mpath <0.5.1 that allows an attacker to inject arbitrary properties onto Object.protHackerOne mpath · mpath
- CVE-2018-16491A prototype pollution vulnerability was found in node.extend <1.1.7, ~<2.0.1 that allows an attacker to inject arbitrary properties onto ObjHackerOne node.extend · node.extend
- CVE-2018-16492A prototype pollution vulnerability was found in module extend <2.0.2, ~<3.0.2 that allows an attacker to inject arbitrary properties onto OHackerOne extend · extend
- CVE-2018-16493A path traversal vulnerability was found in module static-resource-server 1.7.2 that allows unauthorized read access to any file on the servHackerOne static-resource-server · static-resource-server
- CVE-2018-19004LCDS Laquis SCADA prior to version 4.1.0.4150 allows out of bounds read when opening a specially crafted project file, which may allow data ICS-CERT LCDS Laquis SCADA
- CVE-2018-18988LCDS Laquis SCADA prior to version 4.1.0.4150 allows execution of script code by opening a specially crafted report format file.ICS-CERT LCDS Laquis SCADA
- CVE-2016-10741In the Linux kernel before 4.9.3, fs/xfs/xfs_aops.c allows local users to cause a denial of service (system crash) because there is a race c
- CVE-2018-5498Clustered Data ONTAP versions 9.0 through 9.4 are susceptible to a vulnerability which allows remote authenticated attackers to cause a DeniNetApp Clustered Data ONTAP
- CVE-2019-3604ePolicy Orchestrator Cloud update fixes multiple Cross-Site Request Forgery vulnerabilitiesMcAfee ePolicy Orchestrator Cloud
- CVE-2018-15617Communication Manager Denial of ServiceAvaya Communication Manager
- CVE-2017-18361In Pylons Colander through 1.6, the URL validator allows an attacker to potentially cause an infinite loop thereby causing a denial of servicolander
- CVE-2019-7300Artica Proxy 3.06.200056 allows remote attackers to execute arbitrary commands as root by reading the ressources/settings.inc ldap_admin and
- CVE-2019-7301Zen Load Balancer 3.10.1 allows remote authenticated admin users to execute arbitrary commands as root via shell metacharacters in the index
- CVE-2019-7298An issue was discovered on D-Link DIR-823G devices with firmware through 1.02B03.