# CVEs published 2019-02-05

66 CVEs were published on February 5, 2019: 5 critical, 2 high. 3 are now in CISA KEV. Days are UTC.

- [CVE-2018-18333](https://cve.now/CVE-2018-18333.md): A DLL hijacking vulnerability in Trend Micro Security 2019 (Consumer) versions below 15.0.0.1163 and below could allow an attacker to manipu (no CVSS, Trend Micro Security)
- [CVE-2018-18334](https://cve.now/CVE-2018-18334.md): A vulnerability in the Private Browser of Trend Micro Dr. (no CVSS, Trend Micro Dr. Safety for Android)
- [CVE-2018-3989](https://cve.now/CVE-2018-3989.md): An exploitable kernel memory disclosure vulnerability exists in the 0x8200E804 IOCTL handler functionality of WIBU-SYSTEMS WibuKey.sys Versi (CVSS 4.3)
- [CVE-2018-3990](https://cve.now/CVE-2018-3990.md): An exploitable pool corruption vulnerability exists in the 0x8200E804 IOCTL handler functionality of WIBU-SYSTEMS WibuKey.sys Version 6.40 ( (CVSS 9.3)
- [CVE-2018-3991](https://cve.now/CVE-2018-3991.md): An exploitable heap overflow vulnerability exists in the WkbProgramLow function of WibuKey Network server management, version 6.40.2402.500. (CVSS 10.0)
- [CVE-2018-18500](https://cve.now/CVE-2018-18500.md): A use-after-free vulnerability can occur while parsing an HTML5 stream in concert with custom HTML elements. (no CVSS)
- [CVE-2018-18501](https://cve.now/CVE-2018-18501.md): Mozilla developers and community members reported memory safety bugs present in Firefox 64 and Firefox ESR 60.4. (no CVSS, Mozilla Thunderbird · Mozilla Firefox ESR +1)
- [CVE-2018-18502](https://cve.now/CVE-2018-18502.md): Mozilla developers and community members reported memory safety bugs present in Firefox 64. (no CVSS, Mozilla Firefox)
- [CVE-2018-18503](https://cve.now/CVE-2018-18503.md): When JavaScript is used to create and manipulate an audio buffer, a potentially exploitable crash may occur because of a compartment mismatc (no CVSS, Mozilla Firefox)
- [CVE-2018-18504](https://cve.now/CVE-2018-18504.md): A crash and out-of-bounds read can occur when the buffer of a texture client is freed while it is still in use during graphic operations. (no CVSS)
- [CVE-2018-18505](https://cve.now/CVE-2018-18505.md): An earlier fix for an Inter-process Communication (IPC) vulnerability, CVE-2011-3079, added authentication to communication between IPC endp (no CVSS, Mozilla Thunderbird · Mozilla Firefox ESR +1)
- [CVE-2018-18506](https://cve.now/CVE-2018-18506.md): When proxy auto-detection is enabled, if a web server serves a Proxy Auto-Configuration (PAC) file or if a PAC file is loaded locally, this (no CVSS, Mozilla Firefox)
- [CVE-2019-6519](https://cve.now/CVE-2019-6519.md): WebAccess/SCADA, Version 8.3. (no CVSS)
- [CVE-2019-6521](https://cve.now/CVE-2019-6521.md): WebAccess/SCADA, Version 8.3. (no CVSS)
- [CVE-2019-6523](https://cve.now/CVE-2019-6523.md): WebAccess/SCADA, Version 8.3. (no CVSS)
- [CVE-2018-20250](https://cve.now/CVE-2018-20250.md): In WinRAR versions prior to and including 5.61, There is path traversal vulnerability when crafting the filename field of the ACE format (in (CVSS 7.8, KEV, Check Point Software Technologies WinRAR)
- [CVE-2018-20251](https://cve.now/CVE-2018-20251.md): In WinRAR versions prior to and including 5.61, there is path traversal vulnerability when crafting the filename field of the ACE format. (no CVSS, Check Point Software Technologies WinRAR)
- [CVE-2018-20252](https://cve.now/CVE-2018-20252.md): In WinRAR versions prior to and including 5.60, there is an out-of-bounds write vulnerability during parsing of crafted ACE and RAR archive (no CVSS, Check Point Software Technologies WinRAR)
- [CVE-2018-8791](https://cve.now/CVE-2018-8791.md): rdesktop versions up to and including v1.8.3 contain an Out-Of-Bounds Read in function rdpdr\_process() that results in an information leak. (no CVSS, Check Point Software Technologies rdesktop)
- [CVE-2018-8792](https://cve.now/CVE-2018-8792.md): rdesktop versions up to and including v1.8.3 contain an Out-Of-Bounds Read in function cssp\_read\_tsrequest() that results in a Denial of Ser (no CVSS, Check Point Software Technologies rdesktop)
- [CVE-2018-8793](https://cve.now/CVE-2018-8793.md): rdesktop versions up to and including v1.8.3 contain a Heap-Based Buffer Overflow in function cssp\_read\_tsrequest() that results in a memory (no CVSS, Check Point Software Technologies rdesktop)
- [CVE-2018-8794](https://cve.now/CVE-2018-8794.md): rdesktop versions up to and including v1.8.3 contain an Integer Overflow that leads to an Out-Of-Bounds Write in function process\_bitmap\_upd (no CVSS, Check Point Software Technologies rdesktop)
- [CVE-2018-8795](https://cve.now/CVE-2018-8795.md): rdesktop versions up to and including v1.8.3 contain an Integer Overflow that leads to a Heap-Based Buffer Overflow in function process\_bitm (no CVSS, Check Point Software Technologies rdesktop)
- [CVE-2018-8796](https://cve.now/CVE-2018-8796.md): rdesktop versions up to and including v1.8.3 contain an Out-Of-Bounds Read in function process\_bitmap\_updates() that results in a Denial of (no CVSS, Check Point Software Technologies rdesktop)
- [CVE-2018-8797](https://cve.now/CVE-2018-8797.md): rdesktop versions up to and including v1.8.3 contain a Heap-Based Buffer Overflow in function process\_plane() that results in a memory corru (no CVSS, Check Point Software Technologies rdesktop)
- [CVE-2018-8798](https://cve.now/CVE-2018-8798.md): rdesktop versions up to and including v1.8.3 contain an Out-Of-Bounds Read in function rdpsnd\_process\_ping() that results in an information (no CVSS, Check Point Software Technologies rdesktop)
- [CVE-2018-8799](https://cve.now/CVE-2018-8799.md): rdesktop versions up to and including v1.8.3 contain an Out-Of-Bounds Read in function process\_secondary\_order() that results in a Denial of (no CVSS, Check Point Software Technologies rdesktop)
- [CVE-2018-8800](https://cve.now/CVE-2018-8800.md): rdesktop versions up to and including v1.8.3 contain a Heap-Based Buffer Overflow in function ui\_clip\_handle\_data() that results in a memory (no CVSS, Check Point Software Technologies rdesktop)
- [CVE-2019-6535](https://cve.now/CVE-2019-6535.md): Mitsubishi Electric MELSEC-Q Series PLCs Resource Exhaustion (CVSS 7.5, Mitsubishi Electric Q03/04/06/13/26UDVCPU · Mitsubishi E… +1)
- [CVE-2019-6590](https://cve.now/CVE-2019-6590.md): On BIG-IP LTM 13.0.0 to 13.0.1 and 12.1.0 to 12.1.3.6, under certain conditions, the TMM may consume excessive resources when processing SSL (no CVSS, F5 Networks BIG-IP)
- [CVE-2017-1177](https://cve.now/CVE-2017-1177.md): IBM BigFix Compliance 1.7 through 1.9.91 discloses sensitive information to unauthorized users. (CVSS 5.3, IBM BigFix Compliance)
- [CVE-2017-1198](https://cve.now/CVE-2017-1198.md): IBM BigFix Compliance 1.7 through 1.9.91 (TEMA SUAv1 SCA SCM) stores sensitive information in URL parameters. (CVSS 3.7, IBM BigFix Compliance)
- [CVE-2017-1200](https://cve.now/CVE-2017-1200.md): IBM BigFix Compliance 1.7 through 1.9.91 (TEMA SUAv1 SCA SCM) does not validate, or incorrectly validates, a certificate.This weakness might (CVSS 3.7, IBM BigFix Compliance)
- [CVE-2017-1202](https://cve.now/CVE-2017-1202.md): IBM BigFix Compliance 1.7 through 1.9.91 (TEMA SUAv1 SCA SCM) is vulnerable to HTML injection. (CVSS 5.4, IBM BigFix Compliance)
- [CVE-2018-18986](https://cve.now/CVE-2018-18986.md): LCDS Laquis SCADA prior to version 4.1.0.4150 allows the opening of a specially crafted report format file that may cause an out of bounds r (no CVSS, LCDS Laquis SCADA)
- [CVE-2018-18990](https://cve.now/CVE-2018-18990.md): LCDS Laquis SCADA prior to version 4.1.0.4150 allows a user-supplied path in file operations prior to proper validation. (no CVSS, ICS-CERT LCDS Laquis SCADA)
- [CVE-2018-18992](https://cve.now/CVE-2018-18992.md): LCDS Laquis SCADA prior to version 4.1.0.4150 allows taking in user input without proper sanitation, which may allow an attacker to execute (no CVSS, ICS-CERT LCDS Laquis SCADA)
- [CVE-2018-18996](https://cve.now/CVE-2018-18996.md): LCDS Laquis SCADA prior to version 4.1.0.4150 allows taking in user input without proper authorization or sanitation, which may allow an att (no CVSS, ICS-CERT LCDS Laquis SCADA)
- [CVE-2018-18998](https://cve.now/CVE-2018-18998.md): LCDS Laquis SCADA prior to version 4.1.0.4150 uses hard coded credentials, which may allow an attacker unauthorized access to the system wit (no CVSS, ICS-CERT LCDS Laquis SCADA)
- [CVE-2018-19000](https://cve.now/CVE-2018-19000.md): LCDS Laquis SCADA prior to version 4.1.0.4150 allows an authentication bypass, which may allow an attacker access to sensitive data. (no CVSS, ICS-CERT LCDS Laquis SCADA)
- [CVE-2018-19002](https://cve.now/CVE-2018-19002.md): LCDS Laquis SCADA prior to version 4.1.0.4150 allows improper control of generation of code when opening a specially crafted project file, w (no CVSS, LCDS Laquis SCADA)
- [CVE-2018-19029](https://cve.now/CVE-2018-19029.md): LCDS Laquis SCADA prior to version 4.1.0.4150 allows an attacker using a specially crafted project file to supply a pointer for a controlled (no CVSS, LCDS Laquis SCADA)
- [CVE-2018-4056](https://cve.now/CVE-2018-4056.md): An exploitable SQL injection vulnerability exists in the administrator web portal function of coTURN prior to version 4.5.0.9. (CVSS 9.1, Talos coTURN)
- [CVE-2019-6591](https://cve.now/CVE-2019-6591.md): On BIG-IP APM 14.0.0 to 14.0.0.4, 13.0.0 to 13.1.1.3 and 12.1.0 to 12.1.3.7, a reflected cross-site scripting (XSS) vulnerability exists in (no CVSS, F5 Networks BIG-IP)
- [CVE-2019-7412](https://cve.now/CVE-2019-7412.md): The PS PHPCaptcha WP plugin before v1.2.0 for WordPress mishandles sanitization of input values. (no CVSS)
- [CVE-2019-7413](https://cve.now/CVE-2019-7413.md): In the Parallax Scroll (aka adamrob-parallax-scroll) plugin before 2.1 for WordPress, includes/adamrob-parralax-shortcode.php allows XSS via (no CVSS)
- [CVE-2016-1000282](https://cve.now/CVE-2016-1000282.md): Haraka version 2.8.8 and earlier comes with a plugin for processing attachments for zip files. (no CVSS, Haraka)
- [CVE-2018-11803](https://cve.now/CVE-2018-11803.md): Subversion's mod\_dav\_svn Apache HTTPD module versions 1.11.0 and 1.10.0 to 1.10.3 will crash after dereferencing an uninitialized pointer if (no CVSS, Apache Software Foundation Apache Subversion)
- [CVE-2019-3818](https://cve.now/CVE-2019-3818.md): The kube-rbac-proxy container before version 0.4.1 as used in Red Hat OpenShift Container Platform does not honor TLS configurations, allowi (CVSS 3.7, \[UNKNOWN\] kube-rbac-proxy)
- [CVE-2019-7402](https://cve.now/CVE-2019-7402.md): An issue was discovered in PHPMyWind 5.5. (no CVSS)
- [CVE-2019-7403](https://cve.now/CVE-2019-7403.md): An issue was discovered in PHPMyWind 5.5. (no CVSS)
- [CVE-2017-18362](https://cve.now/CVE-2017-18362.md): ConnectWise ManagedITSync integration through 2017 for Kaseya VSA is vulnerable to unauthenticated remote commands that allow full direct ac (CVSS 9.8, KEV)
- [CVE-2018-20753](https://cve.now/CVE-2018-20753.md): Kaseya VSA RMM before R9.3 9.3.0.35, R9.4 before 9.4.0.36, and R9.5 before 9.5.0.5 allows unprivileged remote attackers to execute PowerShel (CVSS 9.8, KEV)
- [CVE-2019-7400](https://cve.now/CVE-2019-7400.md): Rukovoditel before 2.4.1 allows XSS. (no CVSS)
- [CVE-2018-15655](https://cve.now/CVE-2018-15655.md): An issue was discovered in 42Gears SureMDM before 2018-11-27, related to CORS settings. (no CVSS)
- [CVE-2018-15656](https://cve.now/CVE-2018-15656.md): An issue was discovered in the registration API endpoint in 42Gears SureMDM before 2018-11-27. (no CVSS)
- [CVE-2018-15657](https://cve.now/CVE-2018-15657.md): An SSRF issue was discovered in 42Gears SureMDM before 2018-11-27 via the /api/DownloadUrlResponse.ashx "url" parameter. (no CVSS)
- [CVE-2018-15658](https://cve.now/CVE-2018-15658.md): An issue was discovered in 42Gears SureMDM before 2018-11-27. (no CVSS)
- [CVE-2018-15659](https://cve.now/CVE-2018-15659.md): An issue was discovered in 42Gears SureMDM before 2018-11-27, related to the access policy for Silverlight applications. (no CVSS)
- [CVE-2019-7388](https://cve.now/CVE-2019-7388.md): An issue was discovered in /bin/goahead on D-Link DIR-823G devices with firmware 1.02B03. (no CVSS)
- [CVE-2019-7389](https://cve.now/CVE-2019-7389.md): An issue was discovered in /bin/goahead on D-Link DIR-823G devices with the firmware 1.02B03. (no CVSS)
- [CVE-2019-7390](https://cve.now/CVE-2019-7390.md): An issue was discovered in /bin/goahead on D-Link DIR-823G devices with firmware 1.02B03. (no CVSS)
- [CVE-2019-7395](https://cve.now/CVE-2019-7395.md): In ImageMagick before 7.0.8-25, a memory leak exists in WritePSDChannel in coders/psd.c. (no CVSS)
- [CVE-2019-7396](https://cve.now/CVE-2019-7396.md): In ImageMagick before 7.0.8-25, a memory leak exists in ReadSIXELImage in coders/sixel.c. (no CVSS)
- [CVE-2019-7397](https://cve.now/CVE-2019-7397.md): In ImageMagick before 7.0.8-25 and GraphicsMagick through 1.3.31, several memory leaks exist in WritePDFImage in coders/pdf.c. (no CVSS)
- [CVE-2019-7398](https://cve.now/CVE-2019-7398.md): In ImageMagick before 7.0.8-25, a memory leak exists in WriteDIBImage in coders/dib.c. (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2019-02-05
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.