CVEs published February 6, 2019
51 CVEs were published on February 6, 2019: 0 critical, 4 high.
- Published
- 51
- Critical
- 0
- High
- 4
- Medium
- 4
- Low
- 0
- Unrated
- 43
- Now in CISA KEV
- 0
- Fix available
- 23
Most affected products
- modx/revolution
- 4
- Jenkins project Jenkins Job Import Plugin · org.jenkins-ci.…
- 3
- Schneider Electric SE Eurotherm by Schneider Electric GUIcon
- 3
- Talos ACD Systems
- 3
- The curl Project curl
- 3
- Debian GNU/Linux rssh
- 2
- Jenkins project Jenkins Blue Ocean Plugins · io.jenkins.blu…
- 2
- Jenkins project Jenkins GitHub Authentication Plugin · org.…
- 2
- Jenkins project Jenkins Warnings Next Generation Plugin · i…
- 2
- CA Technologies - A Broadcom Company CA Automic Workload Au…
- 1
High 4
- CVE-2018-3973An exploitable out of bounds write exists in the CAL parsing functionality of Canvas Draw version 5.0.0.Talos ACD Systems
- CVE-2018-3976An exploitable out-of-bounds write exists in the CALS Raster file format-parsing functionality of Canvas Draw version 5.0.0.28.Talos ACD Systems
- CVE-2018-3980An exploitable out-of-bounds write exists in the TIFF-parsing functionality of Canvas Draw version 5.0.0.Talos ACD Systems
- CVE-2019-3822libcurl versions from 7.36.0 to before 7.64.0 are vulnerable to a stack-based buffer overflow.The curl Project curl
Medium, low and unrated 47
- CVE-2018-20760In GPAC 0.7.1 and earlier, gf_text_get_utf8_line in media_tools/text_import.c in libgpac_static.a allows an out-of-bounds write because a ce
- CVE-2018-20761GPAC version 0.7.1 and earlier has a Buffer Overflow vulnerability in the gf_sm_load_init function in scene_manager.c in libgpac_static.a.
- CVE-2018-20762GPAC version 0.7.1 and earlier has a buffer overflow vulnerability in the cat_multiple_files function in applications/mp4box/fileimport.c wh
- CVE-2018-20763In GPAC 0.7.1 and earlier, gf_text_get_utf8_line in media_tools/text_import.c in libgpac_static.a allows an out-of-bounds write because of m
- CVE-2018-7813A Type Confusion (CWE-843) vulnerability exists in Eurotherm by Schneider Electric GUIcon V2.0 (Gold Build 683.0) on pcwin.dll which could cSchneider Electric SE Eurotherm by Schneider Electric GUIcon
- CVE-2018-7814A Stack-based Buffer Overflow (CWE-121) vulnerability exists in Eurotherm by Schneider Electric GUIcon V2.0 (Gold Build 683.0) which could cSchneider Electric SE Eurotherm by Schneider Electric GUIcon
- CVE-2018-7815A Type Confusion (CWE-843) vulnerability exists in Eurotherm by Schneider Electric GUIcon V2.0 (Gold Build 683.0) on c3core.dll which could Schneider Electric SE Eurotherm by Schneider Electric GUIcon
- CVE-2018-7817A Use After Free (CWE-416) vulnerability exists in Zelio Soft 2 v5.1 and prior versions which could cause remote code execution when openingSchneider Electric SE Zelio Soft 2 v5.1 and prior versions
- CVE-2018-7839A Cryptographic Issue (CWE-310) vulnerability exists in IIoT Monitor 3.1.38 which could allow information disclosure.Schneider Electric SE IIoT Monitor
- CVE-2019-6517BD FACSLyric Research Use Only, Windows 10 Professional Operating System, U.S.ICS-CERT BD FACSLyric
- CVE-2019-7543In KindEditor 4.1.11, the php/demo.php content1 parameter has a reflected Cross-site Scripting (XSS) vulnerability.
- CVE-2019-7544An issue was discovered in MyWebSQL 3.7.
- CVE-2019-7545In DbNinja 3.2.7, the Add Host function of the Manage Hosts pages has a Stored Cross-site Scripting (XSS) vulnerability in the User Name fie
- CVE-2019-7546An issue was discovered in SIDU 6.0.
- CVE-2019-7547An issue was discovered in SIDU 6.0.
- CVE-2019-7548SQLAlchemy 1.2.17 has SQL Injection when the group_by parameter can be controlled.sqlalchemy
- CVE-2018-16890libcurl versions from 7.36.0 to before 7.64.0 is vulnerable to a heap buffer out-of-bounds read.The curl Project curl
- CVE-2019-3820It was discovered that the gnome-shell lock screen since version 3.15.91 did not properly restrict all contextual actions.The Gnome Project gnome-shell
- CVE-2019-3823libcurl versions from 7.34.0 to before 7.64.0 are vulnerable to a heap out-of-bounds read in the code handling the end-of-response for SMTP.The curl Project curl
- CVE-2019-3825A vulnerability was discovered in gdm before 3.31.4.The Gnome Projectr gdm
- CVE-2015-9282The Pie Chart Panel plugin through 2019-01-02 for Grafana is vulnerable to XSS via legend data or tooltip data.
- CVE-2019-3463Insufficient sanitization of arguments passed to rsync can bypass the restrictions imposed by rssh, a restricted shell that should restrict Debian GNU/Linux rssh
- CVE-2019-3464Insufficient sanitization of environment variables passed to rsync can bypass the restrictions imposed by rssh, a restricted shell that shouDebian GNU/Linux rssh
- CVE-2018-20755MODX Revolution through v2.7.0-pl allows XSS via the User Photo field.modx/revolution
- CVE-2018-20756MODX Revolution through v2.7.0-pl allows XSS via a document resource (such as pagetitle), which is mishandled during an Update action, a Quimodx/revolution
- CVE-2018-20757MODX Revolution through v2.7.0-pl allows XSS via an extended user field such as Container name or Attribute name.modx/revolution
- CVE-2018-20758MODX Revolution through v2.7.0-pl allows XSS via User Settings such as Description.modx/revolution
- CVE-2019-1003005A sandbox bypass vulnerability exists in Jenkins Script Security Plugin 1.50 and earlier in src/main/java/org/jenkinsci/plugins/scriptsecuriJenkins project Jenkins Script Security Plugin · org.jenkin…
- CVE-2019-1003006A sandbox bypass vulnerability exists in Jenkins Groovy Plugin 2.0 and earlier in src/main/java/hudson/plugins/groovy/StringScriptSource.javJenkins project Jenkins Groovy Plugin · org.jenkins-ci.plug…
- CVE-2019-1003007A cross-site request forgery vulnerability exists in Jenkins Warnings Plugin 5.0.0 and earlier in src/main/java/hudson/plugins/warnings/GrooJenkins project Jenkins Warnings Plugin · org.jvnet.hudson.…
- CVE-2019-1003008A cross-site request forgery vulnerability exists in Jenkins Warnings Next Generation Plugin 2.1.1 and earlier in src/main/java/io/jenkins/pJenkins project Jenkins Warnings Next Generation Plugin · i…
- CVE-2019-1003009An improper certificate validation vulnerability exists in Jenkins Active Directory Plugin 2.10 and earlier in src/main/java/hudson/plugins/Jenkins project Jenkins Active Directory Plugin · org.jenki…
- CVE-2019-1003010A cross-site request forgery vulnerability exists in Jenkins Git Plugin 3.9.1 and earlier in src/main/java/hudson/plugins/git/GitTagAction.jorg.jenkins-ci.plugins:git
- CVE-2019-1003011An information exposure and denial of service vulnerability exists in Jenkins Token Macro Plugin 2.5 and earlier in src/main/java/org/jenkinJenkins project Jenkins Token Macro Plugin · org.jenkins-ci…
- CVE-2019-1003012A data modification vulnerability exists in Jenkins Blue Ocean Plugins 1.10.1 and earlier in blueocean-core-js/src/js/bundleStartup.js, blueJenkins project Jenkins Blue Ocean Plugins · io.jenkins.blu…
- CVE-2019-1003013An cross-site scripting vulnerability exists in Jenkins Blue Ocean Plugins 1.10.1 and earlier in blueocean-commons/src/main/java/io/jenkins/Jenkins project Jenkins Blue Ocean Plugins · io.jenkins.blu…
- CVE-2019-1003014An cross-site scripting vulnerability exists in Jenkins Config File Provider Plugin 3.4.1 and earlier in src/main/resources/lib/configfiles/Jenkins project Jenkins Config File Provider Plugin · org.j…
- CVE-2019-1003015An XML external entity processing vulnerability exists in Jenkins Job Import Plugin 2.1 and earlier in src/main/java/org/jenkins/ci/plugins/Jenkins project Jenkins Job Import Plugin · org.jenkins-ci.…
- CVE-2019-1003016An exposure of sensitive information vulnerability exists in Jenkins Job Import Plugin 2.1 and earlier in src/main/java/org/jenkins/ci/plugiJenkins project Jenkins Job Import Plugin · org.jenkins-ci.…
- CVE-2019-1003017A data modification vulnerability exists in Jenkins Job Import Plugin 3.0 and earlier in JobImportAction.java that allows attackers to copy Jenkins project Jenkins Job Import Plugin · org.jenkins-ci.…
- CVE-2019-1003018An exposure of sensitive information vulnerability exists in Jenkins GitHub Authentication Plugin 0.29 and earlier in GithubSecurityRealm/coJenkins project Jenkins GitHub Authentication Plugin · org.…
- CVE-2019-1003019An session fixation vulnerability exists in Jenkins GitHub Authentication Plugin 0.29 and earlier in GithubSecurityRealm.java that allows unJenkins project Jenkins GitHub Authentication Plugin · org.…
- CVE-2019-1003020A server-side request forgery vulnerability exists in Jenkins Kanboard Plugin 1.5.10 and earlier in KanboardGlobalConfiguration.java that alJenkins project Jenkins Kanboard Plugin · org.jenkins-ci.pl…
- CVE-2019-1003021An exposure of sensitive information vulnerability exists in Jenkins OpenId Connect Authentication Plugin 1.4 and earlier in OicSecurityRealJenkins project Jenkins OpenId Connect Authentication Plugi…
- CVE-2019-1003022A denial of service vulnerability exists in Jenkins Monitoring Plugin 1.74.0 and earlier in PluginImpl.java that allows attackers to kill thJenkins project Jenkins Monitoring Plugin · org.jvnet.hudso…
- CVE-2019-1003023A cross-site scripting vulnerability exists in Jenkins Warnings Next Generation Plugin 1.0.1 and earlier in src/main/java/io/jenkins/pluginsJenkins project Jenkins Warnings Next Generation Plugin · i…
- CVE-2019-6504Insufficient output sanitization in the Automic Web Interface (AWI), in CA Automic Workload Automation 12.0 to 12.2, allow attackers to poteCA Technologies - A Broadcom Company CA Automic Workload Au…