# CVEs published 2019-02-01 26 CVEs were published on February 1, 2019: 0 critical, 0 high. Days are UTC. - [CVE-2019-7308](https://cve.now/CVE-2019-7308.md): kernel/bpf/verifier.c in the Linux kernel before 4.20.6 performs undesirable out-of-bounds speculation on pointer arithmetic in various case (no CVSS) - [CVE-2018-0722](https://cve.now/CVE-2018-0722.md): Path Traversal vulnerability in Photo Station versions: 5.7.2 and earlier in QTS 4.3.4, 5.4.4 and earlier in QTS 4.3.3, 5.2.8 and earlier in (no CVSS, QNAP Photo Station) - [CVE-2018-16479](https://cve.now/CVE-2018-16479.md): Path traversal vulnerability in http-live-simulator \<1.0.7 causes unauthorized access to arbitrary files on disk by appending extra slashes (no CVSS, HackerOne http-live-simulator · http-live-simulator) - [CVE-2018-16480](https://cve.now/CVE-2018-16480.md): A XSS vulnerability was found in module public \<0.1.4 that allows malicious Javascript code to run in the browser, due to the absence of san (no CVSS, HackerOne public · public) - [CVE-2018-16481](https://cve.now/CVE-2018-16481.md): A XSS vulnerability was found in html-page \<=2.1.1 that allows malicious Javascript code to be executed in the user's browser due to the abs (no CVSS, HackerOne html-pages · html-pages) - [CVE-2018-16482](https://cve.now/CVE-2018-16482.md): A server directory traversal vulnerability was found on node module mcstatic \<=0.0.20 that would allow an attack to access sensitive informa (no CVSS, HackerOne mcstatic · mcstatic) - [CVE-2018-16483](https://cve.now/CVE-2018-16483.md): A deficiency in the access control in module express-cart \<=1.1.5 allows unprivileged users to add new users to the application as administr (no CVSS, HackerOne express-cart · express-cart) - [CVE-2018-16484](https://cve.now/CVE-2018-16484.md): A XSS vulnerability was found in module m-server \<1.4.2 that allows malicious Javascript code or HTML to be executed, due to the lack of esc (no CVSS, HackerOne m-server · m-server) - [CVE-2018-16485](https://cve.now/CVE-2018-16485.md): Path Traversal vulnerability in module m-server \<1.4.1 allows malicious user to access unauthorized content of any file in the directory tre (no CVSS, HackerOne m-server · m-server) - [CVE-2018-16486](https://cve.now/CVE-2018-16486.md): A prototype pollution vulnerability was found in defaults-deep \<=0.2.4 that would allow a malicious user to inject properties onto Object.pr (no CVSS, HackerOne defaults-deep · defaults-deep) - [CVE-2018-16487](https://cve.now/CVE-2018-16487.md): A prototype pollution vulnerability was found in lodash \<4.17.11 where the functions merge, mergeWith, and defaultsDeep can be tricked into (no CVSS, HackerOne lodash · lodash +1) - [CVE-2018-16489](https://cve.now/CVE-2018-16489.md): A prototype pollution vulnerability was found in just-extend \<4.0.0 that allows attack to inject properties onto Object.prototype through it (no CVSS, HackerOne just-extend · just-extend) - [CVE-2018-16490](https://cve.now/CVE-2018-16490.md): A prototype pollution vulnerability was found in module mpath \<0.5.1 that allows an attacker to inject arbitrary properties onto Object.prot (no CVSS, HackerOne mpath · mpath) - [CVE-2018-16491](https://cve.now/CVE-2018-16491.md): A prototype pollution vulnerability was found in node.extend \<1.1.7, ~\<2.0.1 that allows an attacker to inject arbitrary properties onto Obj (no CVSS, HackerOne node.extend · node.extend) - [CVE-2018-16492](https://cve.now/CVE-2018-16492.md): A prototype pollution vulnerability was found in module extend \<2.0.2, ~\<3.0.2 that allows an attacker to inject arbitrary properties onto O (no CVSS, HackerOne extend · extend) - [CVE-2018-16493](https://cve.now/CVE-2018-16493.md): A path traversal vulnerability was found in module static-resource-server 1.7.2 that allows unauthorized read access to any file on the serv (no CVSS, HackerOne static-resource-server · static-resource-server) - [CVE-2018-19004](https://cve.now/CVE-2018-19004.md): LCDS Laquis SCADA prior to version 4.1.0.4150 allows out of bounds read when opening a specially crafted project file, which may allow data (no CVSS, ICS-CERT LCDS Laquis SCADA) - [CVE-2018-18988](https://cve.now/CVE-2018-18988.md): LCDS Laquis SCADA prior to version 4.1.0.4150 allows execution of script code by opening a specially crafted report format file. (no CVSS, ICS-CERT LCDS Laquis SCADA) - [CVE-2016-10741](https://cve.now/CVE-2016-10741.md): In the Linux kernel before 4.9.3, fs/xfs/xfs\_aops.c allows local users to cause a denial of service (system crash) because there is a race c (no CVSS) - [CVE-2018-5498](https://cve.now/CVE-2018-5498.md): Clustered Data ONTAP versions 9.0 through 9.4 are susceptible to a vulnerability which allows remote authenticated attackers to cause a Deni (no CVSS, NetApp Clustered Data ONTAP) - [CVE-2019-3604](https://cve.now/CVE-2019-3604.md): ePolicy Orchestrator Cloud update fixes multiple Cross-Site Request Forgery vulnerabilities (CVSS 4.8, McAfee ePolicy Orchestrator Cloud) - [CVE-2018-15617](https://cve.now/CVE-2018-15617.md): Communication Manager Denial of Service (CVSS 6.5, Avaya Communication Manager) - [CVE-2017-18361](https://cve.now/CVE-2017-18361.md): In Pylons Colander through 1.6, the URL validator allows an attacker to potentially cause an infinite loop thereby causing a denial of servi (no CVSS, colander) - [CVE-2019-7300](https://cve.now/CVE-2019-7300.md): Artica Proxy 3.06.200056 allows remote attackers to execute arbitrary commands as root by reading the ressources/settings.inc ldap\_admin and (no CVSS) - [CVE-2019-7301](https://cve.now/CVE-2019-7301.md): Zen Load Balancer 3.10.1 allows remote authenticated admin users to execute arbitrary commands as root via shell metacharacters in the index (no CVSS) - [CVE-2019-7298](https://cve.now/CVE-2019-7298.md): An issue was discovered on D-Link DIR-823G devices with firmware through 1.02B03. (no CVSS) --- Source: cve.now, built and run by Sazabi (AI-native observability and security) Page: https://cve.now/daily/2019-02-01 Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.