# CVEs published 2019-02-04

71 CVEs were published on February 4, 2019: 0 critical, 3 high. Days are UTC.

- [CVE-2018-15778](https://cve.now/CVE-2018-15778.md): DSA-2019-019: Dell Networking OS10 OS Command Injection Vulnerability (CVSS 8.8, Dell Networking OS10)
- [CVE-2019-7387](https://cve.now/CVE-2019-7387.md): A local file inclusion vulnerability exists in the web interface of Systrome Cumilon ISG-600C, ISG-600H, and ISG-800W 1.1-R2.1\_TRUNK-2018091 (no CVSS)
- [CVE-2016-1000271](https://cve.now/CVE-2016-1000271.md): Joomla extension DT Register version before 3.1.12 (Joomla 3.x) / 2.8.18 (Joomla 2.5) contains an SQL injection in "/index.php?controller=ca (no CVSS)
- [CVE-2018-1000998](https://cve.now/CVE-2018-1000998.md): FreeBSD CVSweb version 2.x contains a Cross Site Scripting (XSS) vulnerability in all pages that can result in limited impact--CVSweb is ano (no CVSS)
- [CVE-2018-1675](https://cve.now/CVE-2018-1675.md): IBM Tivoli Application Dependency Discovery Manager 7.2.2 and 7.3 could expose password hashes in stored in system memory on target systems (CVSS 6.8, IBM Tivoli Application Dependency Discovery Manager)
- [CVE-2018-1801](https://cve.now/CVE-2018-1801.md): IBM App Connect V11.0.0.0 through V11.0.0.1, IBM Integration Bus V10.0.0.0 through V10.0.0.13, IBM Integration Bus V9.0.0.0 through V9.0.0.1 (CVSS 5.3, IBM Integration Bus · IBM WebSphere Message Broker +1)
- [CVE-2018-1962](https://cve.now/CVE-2018-1962.md): IBM Security Identity Manager 7.0.1 Virtual Appliance does not invalidate session tokens when the logout button is pressed. (CVSS 4.0, IBM Security Identity Manager)
- [CVE-2018-1970](https://cve.now/CVE-2018-1970.md): IBM Security Identity Manager 7.0.1 is vulnerable to a XML External Entity Injection (XXE) attack when processing XML data. (CVSS 7.1, IBM Security Identity Manager)
- [CVE-2018-20752](https://cve.now/CVE-2018-20752.md): An issue was discovered in Recon-ng before 4.9.5. (no CVSS)
- [CVE-2019-1000001](https://cve.now/CVE-2019-1000001.md): TeamPass version 2.1.27 and earlier contains a Storing Passwords in a Recoverable Format vulnerability in Shared password vaults that can re (no CVSS, nilsteampassnet/teampass)
- [CVE-2019-1000002](https://cve.now/CVE-2019-1000002.md): Gitea version 1.6.2 and earlier contains a Incorrect Access Control vulnerability in Delete/Edit file functionallity that can result in the (no CVSS, code.gitea.io/gitea)
- [CVE-2019-1000003](https://cve.now/CVE-2019-1000003.md): MapSVG MapSVG Lite version 3.2.3 contains a Cross Site Request Forgery (CSRF) vulnerability in REST endpoint /wp-admin/admin-ajax.php?action (no CVSS)
- [CVE-2019-1000004](https://cve.now/CVE-2019-1000004.md): yugandhargangu JspMyAdmin2 version 1.0.6 and earlier contains a Cross Site Scripting (XSS) vulnerability in sidebar and table data that can (no CVSS)
- [CVE-2019-1000005](https://cve.now/CVE-2019-1000005.md): mPDF version 7.1.7 and earlier contains a CWE-502: Deserialization of Untrusted Data vulnerability in getImage() method of Image/ImageProces (no CVSS, mpdf/mpdf)
- [CVE-2019-1000006](https://cve.now/CVE-2019-1000006.md): RIOT RIOT-OS version after commit 7af03ab624db0412c727eed9ab7630a5282e2fd3 contains a Buffer Overflow vulnerability in sock\_dns, an implemen (no CVSS)
- [CVE-2019-1000007](https://cve.now/CVE-2019-1000007.md): aioxmpp version 0.10.2 and earlier contains a Improper Handling of Structural Elements vulnerability in Stanza Parser, rollback during error (no CVSS, aioxmpp)
- [CVE-2019-1000008](https://cve.now/CVE-2019-1000008.md): All versions of Helm between Helm \>=2.0.0 and \< 2.12.2 contains a CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path (no CVSS, helm.sh/helm)
- [CVE-2019-1000009](https://cve.now/CVE-2019-1000009.md): Helm ChartMuseum version \>=0.1.0 and \< 0.8.1 contains a CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal (no CVSS)
- [CVE-2019-1000010](https://cve.now/CVE-2019-1000010.md): phpIPAM version 1.3.2 and earlier contains a Cross Site Scripting (XSS) vulnerability in subnet-scan-telnet.php that can result in executing (no CVSS)
- [CVE-2019-1000011](https://cve.now/CVE-2019-1000011.md): API Platform version from 2.2.0 to 2.3.5 contains an Incorrect Access Control vulnerability in GraphQL delete mutations that can result in a (no CVSS, api-platform/core)
- [CVE-2019-1000012](https://cve.now/CVE-2019-1000012.md): Hex package manager version 0.14.0 through 0.18.2 contains a Signing oracle vulnerability in Package registry verification that can result i (no CVSS)
- [CVE-2019-1000013](https://cve.now/CVE-2019-1000013.md): Hex package manager hex\_core version 0.3.0 and earlier contains a Signing oracle vulnerability in Package registry verification that can res (no CVSS)
- [CVE-2019-1000014](https://cve.now/CVE-2019-1000014.md): Erlang/OTP Rebar3 version 3.7.0 through 3.7.5 contains a Signing oracle vulnerability in Package registry verification that can result in Pa (no CVSS)
- [CVE-2019-1000015](https://cve.now/CVE-2019-1000015.md): Chamilo Chamilo-lms version 1.11.8 and earlier contains a Cross Site Scripting (XSS) vulnerability in main/messages/new\_message.php, main/so (no CVSS)
- [CVE-2019-1000016](https://cve.now/CVE-2019-1000016.md): FFMPEG version 4.1 contains a CWE-129: Improper Validation of Array Index vulnerability in libavcodec/cbs\_av1.c that can result in Denial of (no CVSS)
- [CVE-2019-1000017](https://cve.now/CVE-2019-1000017.md): Chamilo Chamilo-lms version 1.11.8 and earlier contains an Incorrect Access Control vulnerability in Tickets component that can result in an (no CVSS)
- [CVE-2019-1000018](https://cve.now/CVE-2019-1000018.md): rssh version 2.3.4 contains a CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in a (no CVSS)
- [CVE-2019-1000019](https://cve.now/CVE-2019-1000019.md): libarchive version commit bf9aec176c6748f0ee7a678c5f9f9555b9a757c1 onwards (release v3.0.2 onwards) contains a CWE-125: Out-of-bounds Read v (no CVSS)
- [CVE-2019-1000020](https://cve.now/CVE-2019-1000020.md): libarchive version commit 5a98dcf8a86364b3c2c469c85b93647dfb139961 onwards (version v2.8.0 onwards) contains a CWE-835: Loop with Unreachabl (no CVSS)
- [CVE-2019-1000021](https://cve.now/CVE-2019-1000021.md): slixmpp version before commit 7cd73b594e8122dddf847953fcfc85ab4d316416 contains an incorrect Access Control vulnerability in XEP-0223 plugin (no CVSS, slixmpp)
- [CVE-2019-1000022](https://cve.now/CVE-2019-1000022.md): Taoensso Sente version Prior to version 1.14.0 contains a Cross Site Request Forgery (CSRF) vulnerability in WebSocket handshake endpoint th (no CVSS)
- [CVE-2019-1000023](https://cve.now/CVE-2019-1000023.md): OPT/NET BV OPTOSS Next Gen Network Management System (NG-NetMS) version v3.6-2 and earlier versions contains a SQL Injection vulnerability i (no CVSS)
- [CVE-2019-1000024](https://cve.now/CVE-2019-1000024.md): OPT/NET BV NG-NetMS version v3.6-2 and earlier versions contains a Cross Site Scripting (XSS) vulnerability in /js/libs/jstree/demo/filebrow (no CVSS)
- [CVE-2019-4038](https://cve.now/CVE-2019-4038.md): IBM Security Identity Manager 6.0 and 7.0 could allow an attacker to create unexpected control flow paths through the application, potential (CVSS 7.2, IBM Security Identity Manager)
- [CVE-2018-20751](https://cve.now/CVE-2018-20751.md): An issue was discovered in crop\_page in PoDoFo 0.9.6. (no CVSS)
- [CVE-2019-7324](https://cve.now/CVE-2019-7324.md): app/Core/Paginator.php in Kanboard before 1.2.8 has XSS in pagination sorting. (no CVSS)
- [CVE-2019-7325](https://cve.now/CVE-2019-7325.md): Reflected Cross Site Scripting (XSS) exists in ZoneMinder through 1.32.3, as multiple views under web/skins/classic/views insecurely utilize (no CVSS)
- [CVE-2019-7326](https://cve.now/CVE-2019-7326.md): Self - Stored Cross Site Scripting (XSS) exists in ZoneMinder through 1.32.3, allowing an attacker to execute HTML or JavaScript code via a (no CVSS)
- [CVE-2019-7327](https://cve.now/CVE-2019-7327.md): Reflected Cross Site Scripting (XSS) exists in ZoneMinder through 1.32.3, allowing an attacker to execute HTML or JavaScript code via a vuln (no CVSS)
- [CVE-2019-7328](https://cve.now/CVE-2019-7328.md): Reflected Cross Site Scripting (XSS) exists in ZoneMinder through 1.32.3, allowing an attacker to execute HTML or JavaScript code via a vuln (no CVSS)
- [CVE-2019-7329](https://cve.now/CVE-2019-7329.md): Reflected Cross Site Scripting (XSS) exists in ZoneMinder through 1.32.3, as the form action on multiple views utilizes $\_SERVER\['PHP\_SELF'\] (no CVSS)
- [CVE-2019-7330](https://cve.now/CVE-2019-7330.md): Reflected Cross Site Scripting (XSS) exists in ZoneMinder through 1.32.3, allowing an attacker to execute HTML or JavaScript code via a vuln (no CVSS)
- [CVE-2019-7331](https://cve.now/CVE-2019-7331.md): Self - Stored Cross Site Scripting (XSS) exists in ZoneMinder through 1.32.3 while editing an existing monitor field named "signal check col (no CVSS)
- [CVE-2019-7332](https://cve.now/CVE-2019-7332.md): Reflected Cross Site Scripting (XSS) exists in ZoneMinder through 1.32.3, allowing an attacker to execute HTML or JavaScript code via a vuln (no CVSS)
- [CVE-2019-7333](https://cve.now/CVE-2019-7333.md): Reflected Cross Site Scripting (XSS) exists in ZoneMinder through 1.32.3, allowing an attacker to execute HTML or JavaScript code via a vuln (no CVSS)
- [CVE-2019-7334](https://cve.now/CVE-2019-7334.md): Reflected Cross Site Scripting (XSS) exists in ZoneMinder through 1.32.3, allowing an attacker to execute HTML or JavaScript code via a vuln (no CVSS)
- [CVE-2019-7335](https://cve.now/CVE-2019-7335.md): Self - Stored XSS exists in ZoneMinder through 1.32.3, allowing an attacker to execute HTML or JavaScript code in the view 'log' as it insec (no CVSS)
- [CVE-2019-7336](https://cve.now/CVE-2019-7336.md): Self - Stored Cross Site Scripting (XSS) exists in ZoneMinder through 1.32.3, as the view \_monitor\_filters.php contains takes in input from (no CVSS)
- [CVE-2019-7337](https://cve.now/CVE-2019-7337.md): Reflected Cross Site Scripting (XSS) exists in ZoneMinder through 1.32.3 as the view 'events' (events.php) insecurely displays the limit par (no CVSS)
- [CVE-2019-7338](https://cve.now/CVE-2019-7338.md): Self - Stored XSS exists in ZoneMinder through 1.32.3, allowing an attacker to execute HTML or JavaScript code in the view 'group' as it ins (no CVSS)
- [CVE-2019-7339](https://cve.now/CVE-2019-7339.md): POST - Cross Site Scripting (XSS) exists in ZoneMinder through 1.32.3, allowing an attacker to execute HTML or JavaScript code via a vulnera (no CVSS)
- [CVE-2019-7340](https://cve.now/CVE-2019-7340.md): POST - Cross Site Scripting (XSS) exists in ZoneMinder through 1.32.3, allowing an attacker to execute HTML or JavaScript code via a vulnera (no CVSS)
- [CVE-2019-7341](https://cve.now/CVE-2019-7341.md): Reflected - Cross Site Scripting (XSS) exists in ZoneMinder through 1.32.3, allowing an attacker to execute HTML or JavaScript code via a vu (no CVSS)
- [CVE-2019-7342](https://cve.now/CVE-2019-7342.md): POST - Cross Site Scripting (XSS) exists in ZoneMinder through 1.32.3, allowing an attacker to execute HTML or JavaScript code via a vulnera (no CVSS)
- [CVE-2019-7343](https://cve.now/CVE-2019-7343.md): Reflected - Cross Site Scripting (XSS) exists in ZoneMinder through 1.32.3, allowing an attacker to execute HTML or JavaScript code via a vu (no CVSS)
- [CVE-2019-7344](https://cve.now/CVE-2019-7344.md): Reflected XSS exists in ZoneMinder through 1.32.3, allowing an attacker to execute HTML or JavaScript code in the view 'filter' as it insecu (no CVSS)
- [CVE-2019-7345](https://cve.now/CVE-2019-7345.md): Self - Stored Cross Site Scripting (XSS) exists in ZoneMinder through 1.32.3, as the view 'options' (options.php) does no input validation f (no CVSS)
- [CVE-2019-7346](https://cve.now/CVE-2019-7346.md): A CSRF check issue exists in ZoneMinder through 1.32.3 as whenever a CSRF check fails, a callback function is called displaying a "Try again (no CVSS)
- [CVE-2019-7347](https://cve.now/CVE-2019-7347.md): A Time-of-check Time-of-use (TOCTOU) Race Condition exists in ZoneMinder through 1.32.3 as a session remains active for an authenticated use (no CVSS)
- [CVE-2019-7348](https://cve.now/CVE-2019-7348.md): Self - Stored Cross Site Scripting (XSS) exists in ZoneMinder through 1.32.3, allowing an attacker to execute HTML or JavaScript code via a (no CVSS)
- [CVE-2019-7349](https://cve.now/CVE-2019-7349.md): Reflected Cross Site Scripting (XSS) exists in ZoneMinder through 1.32.3, allowing an attacker to execute HTML or JavaScript code via a vuln (no CVSS)
- [CVE-2019-7350](https://cve.now/CVE-2019-7350.md): Session fixation exists in ZoneMinder through 1.32.3, as an attacker can fixate his own session cookies to the next logged-in user, thereby (no CVSS)
- [CVE-2019-7351](https://cve.now/CVE-2019-7351.md): Log Injection exists in ZoneMinder through 1.32.3, as an attacker can entice the victim to visit a specially crafted link, which in turn wil (no CVSS)
- [CVE-2019-7352](https://cve.now/CVE-2019-7352.md): Self - Stored Cross Site Scripting (XSS) exists in ZoneMinder through 1.32.3, as the view 'state' (aka Run State) (state.php) does no input (no CVSS)
- [CVE-2019-3461](https://cve.now/CVE-2019-3461.md): Debian tmpreaper version 1.6.13+nmu1 has a race condition when doing a (bind) mount via rename() which could result in local privilege escal (no CVSS, Debian GNU/Linux tmpreaper)
- [CVE-2019-3813](https://cve.now/CVE-2019-3813.md): Spice, versions 0.5.2 through 0.14.1, are vulnerable to an out-of-bounds read due to an off-by-one error in memslot\_get\_virt. (no CVSS, Red Hat Spice)
- [CVE-2018-11760](https://cve.now/CVE-2018-11760.md): When using PySpark , it's possible for a different local user to connect to the Spark application and impersonate the user running the Spark (no CVSS, Apache Software Foundation Apache Spark · pyspark)
- [CVE-2019-7323](https://cve.now/CVE-2019-7323.md): GUP (generic update process) in LightySoft LogMX before 7.4.0 does not properly verify the authenticity of updates, which allows man-in-the- (no CVSS)
- [CVE-2019-7316](https://cve.now/CVE-2019-7316.md): An issue was discovered in CSS-TRICKS Chat2 through 2015-05-05. (no CVSS)
- [CVE-2019-7317](https://cve.now/CVE-2019-7317.md): png\_image\_free in png.c in libpng 1.6.x before 1.6.37 has a use-after-free because png\_image\_free\_function is called under png\_safe\_execute. (CVSS 5.3)
- [CVE-2019-7314](https://cve.now/CVE-2019-7314.md): liblivemedia in Live555 before 2019.02.03 mishandles the termination of an RTSP stream after RTP/RTCP-over-RTSP has been set up, which could (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2019-02-04
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.