# CVEs published 2019-02-06

51 CVEs were published on February 6, 2019: 0 critical, 4 high. Days are UTC.

- [CVE-2018-20760](https://cve.now/CVE-2018-20760.md): In GPAC 0.7.1 and earlier, gf\_text\_get\_utf8\_line in media\_tools/text\_import.c in libgpac\_static.a allows an out-of-bounds write because a ce (no CVSS)
- [CVE-2018-20761](https://cve.now/CVE-2018-20761.md): GPAC version 0.7.1 and earlier has a Buffer Overflow vulnerability in the gf\_sm\_load\_init function in scene\_manager.c in libgpac\_static.a. (no CVSS)
- [CVE-2018-20762](https://cve.now/CVE-2018-20762.md): GPAC version 0.7.1 and earlier has a buffer overflow vulnerability in the cat\_multiple\_files function in applications/mp4box/fileimport.c wh (no CVSS)
- [CVE-2018-20763](https://cve.now/CVE-2018-20763.md): In GPAC 0.7.1 and earlier, gf\_text\_get\_utf8\_line in media\_tools/text\_import.c in libgpac\_static.a allows an out-of-bounds write because of m (no CVSS)
- [CVE-2018-7813](https://cve.now/CVE-2018-7813.md): A Type Confusion (CWE-843) vulnerability exists in Eurotherm by Schneider Electric GUIcon V2.0 (Gold Build 683.0) on pcwin.dll which could c (no CVSS, Schneider Electric SE Eurotherm by Schneider Electric GUIcon)
- [CVE-2018-7814](https://cve.now/CVE-2018-7814.md): A Stack-based Buffer Overflow (CWE-121) vulnerability exists in Eurotherm by Schneider Electric GUIcon V2.0 (Gold Build 683.0) which could c (no CVSS, Schneider Electric SE Eurotherm by Schneider Electric GUIcon)
- [CVE-2018-7815](https://cve.now/CVE-2018-7815.md): A Type Confusion (CWE-843) vulnerability exists in Eurotherm by Schneider Electric GUIcon V2.0 (Gold Build 683.0) on c3core.dll which could (no CVSS, Schneider Electric SE Eurotherm by Schneider Electric GUIcon)
- [CVE-2018-7817](https://cve.now/CVE-2018-7817.md): A Use After Free (CWE-416) vulnerability exists in Zelio Soft 2 v5.1 and prior versions which could cause remote code execution when opening (no CVSS, Schneider Electric SE Zelio Soft 2 v5.1 and prior versions)
- [CVE-2018-7839](https://cve.now/CVE-2018-7839.md): A Cryptographic Issue (CWE-310) vulnerability exists in IIoT Monitor 3.1.38 which could allow information disclosure. (no CVSS, Schneider Electric SE IIoT Monitor)
- [CVE-2018-3973](https://cve.now/CVE-2018-3973.md): An exploitable out of bounds write exists in the CAL parsing functionality of Canvas Draw version 5.0.0. (CVSS 8.8, Talos ACD Systems)
- [CVE-2018-3976](https://cve.now/CVE-2018-3976.md): An exploitable out-of-bounds write exists in the CALS Raster file format-parsing functionality of Canvas Draw version 5.0.0.28. (CVSS 8.8, Talos ACD Systems)
- [CVE-2018-3980](https://cve.now/CVE-2018-3980.md): An exploitable out-of-bounds write exists in the TIFF-parsing functionality of Canvas Draw version 5.0.0. (CVSS 8.8, Talos ACD Systems)
- [CVE-2019-6517](https://cve.now/CVE-2019-6517.md): BD FACSLyric Research Use Only, Windows 10 Professional Operating System, U.S. (no CVSS, ICS-CERT BD FACSLyric)
- [CVE-2019-7543](https://cve.now/CVE-2019-7543.md): In KindEditor 4.1.11, the php/demo.php content1 parameter has a reflected Cross-site Scripting (XSS) vulnerability. (no CVSS)
- [CVE-2019-7544](https://cve.now/CVE-2019-7544.md): An issue was discovered in MyWebSQL 3.7. (no CVSS)
- [CVE-2019-7545](https://cve.now/CVE-2019-7545.md): In DbNinja 3.2.7, the Add Host function of the Manage Hosts pages has a Stored Cross-site Scripting (XSS) vulnerability in the User Name fie (no CVSS)
- [CVE-2019-7546](https://cve.now/CVE-2019-7546.md): An issue was discovered in SIDU 6.0. (no CVSS)
- [CVE-2019-7547](https://cve.now/CVE-2019-7547.md): An issue was discovered in SIDU 6.0. (no CVSS)
- [CVE-2019-7548](https://cve.now/CVE-2019-7548.md): SQLAlchemy 1.2.17 has SQL Injection when the group\_by parameter can be controlled. (no CVSS, sqlalchemy)
- [CVE-2018-16890](https://cve.now/CVE-2018-16890.md): libcurl versions from 7.36.0 to before 7.64.0 is vulnerable to a heap buffer out-of-bounds read. (CVSS 5.4, The curl Project curl)
- [CVE-2019-3820](https://cve.now/CVE-2019-3820.md): It was discovered that the gnome-shell lock screen since version 3.15.91 did not properly restrict all contextual actions. (CVSS 4.8, The Gnome Project gnome-shell)
- [CVE-2019-3822](https://cve.now/CVE-2019-3822.md): libcurl versions from 7.36.0 to before 7.64.0 are vulnerable to a stack-based buffer overflow. (CVSS 7.1, The curl Project curl)
- [CVE-2019-3823](https://cve.now/CVE-2019-3823.md): libcurl versions from 7.34.0 to before 7.64.0 are vulnerable to a heap out-of-bounds read in the code handling the end-of-response for SMTP. (CVSS 4.3, The curl Project curl)
- [CVE-2019-3825](https://cve.now/CVE-2019-3825.md): A vulnerability was discovered in gdm before 3.31.4. (CVSS 6.3, The Gnome Projectr gdm)
- [CVE-2015-9282](https://cve.now/CVE-2015-9282.md): The Pie Chart Panel plugin through 2019-01-02 for Grafana is vulnerable to XSS via legend data or tooltip data. (no CVSS)
- [CVE-2019-3463](https://cve.now/CVE-2019-3463.md): Insufficient sanitization of arguments passed to rsync can bypass the restrictions imposed by rssh, a restricted shell that should restrict (no CVSS, Debian GNU/Linux rssh)
- [CVE-2019-3464](https://cve.now/CVE-2019-3464.md): Insufficient sanitization of environment variables passed to rsync can bypass the restrictions imposed by rssh, a restricted shell that shou (no CVSS, Debian GNU/Linux rssh)
- [CVE-2018-20755](https://cve.now/CVE-2018-20755.md): MODX Revolution through v2.7.0-pl allows XSS via the User Photo field. (no CVSS, modx/revolution)
- [CVE-2018-20756](https://cve.now/CVE-2018-20756.md): MODX Revolution through v2.7.0-pl allows XSS via a document resource (such as pagetitle), which is mishandled during an Update action, a Qui (no CVSS, modx/revolution)
- [CVE-2018-20757](https://cve.now/CVE-2018-20757.md): MODX Revolution through v2.7.0-pl allows XSS via an extended user field such as Container name or Attribute name. (no CVSS, modx/revolution)
- [CVE-2018-20758](https://cve.now/CVE-2018-20758.md): MODX Revolution through v2.7.0-pl allows XSS via User Settings such as Description. (no CVSS, modx/revolution)
- [CVE-2019-1003005](https://cve.now/CVE-2019-1003005.md): A sandbox bypass vulnerability exists in Jenkins Script Security Plugin 1.50 and earlier in src/main/java/org/jenkinsci/plugins/scriptsecuri (no CVSS, Jenkins project Jenkins Script Security Plugin · org.jenkin…)
- [CVE-2019-1003006](https://cve.now/CVE-2019-1003006.md): A sandbox bypass vulnerability exists in Jenkins Groovy Plugin 2.0 and earlier in src/main/java/hudson/plugins/groovy/StringScriptSource.jav (no CVSS, Jenkins project Jenkins Groovy Plugin · org.jenkins-ci.plug…)
- [CVE-2019-1003007](https://cve.now/CVE-2019-1003007.md): A cross-site request forgery vulnerability exists in Jenkins Warnings Plugin 5.0.0 and earlier in src/main/java/hudson/plugins/warnings/Groo (no CVSS, Jenkins project Jenkins Warnings Plugin · org.jvnet.hudson.…)
- [CVE-2019-1003008](https://cve.now/CVE-2019-1003008.md): A cross-site request forgery vulnerability exists in Jenkins Warnings Next Generation Plugin 2.1.1 and earlier in src/main/java/io/jenkins/p (no CVSS, Jenkins project Jenkins Warnings Next Generation Plugin · i…)
- [CVE-2019-1003009](https://cve.now/CVE-2019-1003009.md): An improper certificate validation vulnerability exists in Jenkins Active Directory Plugin 2.10 and earlier in src/main/java/hudson/plugins/ (no CVSS, Jenkins project Jenkins Active Directory Plugin · org.jenki…)
- [CVE-2019-1003010](https://cve.now/CVE-2019-1003010.md): A cross-site request forgery vulnerability exists in Jenkins Git Plugin 3.9.1 and earlier in src/main/java/hudson/plugins/git/GitTagAction.j (no CVSS, org.jenkins-ci.plugins:git)
- [CVE-2019-1003011](https://cve.now/CVE-2019-1003011.md): An information exposure and denial of service vulnerability exists in Jenkins Token Macro Plugin 2.5 and earlier in src/main/java/org/jenkin (no CVSS, Jenkins project Jenkins Token Macro Plugin · org.jenkins-ci…)
- [CVE-2019-1003012](https://cve.now/CVE-2019-1003012.md): A data modification vulnerability exists in Jenkins Blue Ocean Plugins 1.10.1 and earlier in blueocean-core-js/src/js/bundleStartup.js, blue (no CVSS, Jenkins project Jenkins Blue Ocean Plugins · io.jenkins.blu…)
- [CVE-2019-1003013](https://cve.now/CVE-2019-1003013.md): An cross-site scripting vulnerability exists in Jenkins Blue Ocean Plugins 1.10.1 and earlier in blueocean-commons/src/main/java/io/jenkins/ (no CVSS, Jenkins project Jenkins Blue Ocean Plugins · io.jenkins.blu…)
- [CVE-2019-1003014](https://cve.now/CVE-2019-1003014.md): An cross-site scripting vulnerability exists in Jenkins Config File Provider Plugin 3.4.1 and earlier in src/main/resources/lib/configfiles/ (no CVSS, Jenkins project Jenkins Config File Provider Plugin · org.j…)
- [CVE-2019-1003015](https://cve.now/CVE-2019-1003015.md): An XML external entity processing vulnerability exists in Jenkins Job Import Plugin 2.1 and earlier in src/main/java/org/jenkins/ci/plugins/ (no CVSS, Jenkins project Jenkins Job Import Plugin · org.jenkins-ci.…)
- [CVE-2019-1003016](https://cve.now/CVE-2019-1003016.md): An exposure of sensitive information vulnerability exists in Jenkins Job Import Plugin 2.1 and earlier in src/main/java/org/jenkins/ci/plugi (no CVSS, Jenkins project Jenkins Job Import Plugin · org.jenkins-ci.…)
- [CVE-2019-1003017](https://cve.now/CVE-2019-1003017.md): A data modification vulnerability exists in Jenkins Job Import Plugin 3.0 and earlier in JobImportAction.java that allows attackers to copy (no CVSS, Jenkins project Jenkins Job Import Plugin · org.jenkins-ci.…)
- [CVE-2019-1003018](https://cve.now/CVE-2019-1003018.md): An exposure of sensitive information vulnerability exists in Jenkins GitHub Authentication Plugin 0.29 and earlier in GithubSecurityRealm/co (no CVSS, Jenkins project Jenkins GitHub Authentication Plugin · org.…)
- [CVE-2019-1003019](https://cve.now/CVE-2019-1003019.md): An session fixation vulnerability exists in Jenkins GitHub Authentication Plugin 0.29 and earlier in GithubSecurityRealm.java that allows un (no CVSS, Jenkins project Jenkins GitHub Authentication Plugin · org.…)
- [CVE-2019-1003020](https://cve.now/CVE-2019-1003020.md): A server-side request forgery vulnerability exists in Jenkins Kanboard Plugin 1.5.10 and earlier in KanboardGlobalConfiguration.java that al (no CVSS, Jenkins project Jenkins Kanboard Plugin · org.jenkins-ci.pl…)
- [CVE-2019-1003021](https://cve.now/CVE-2019-1003021.md): An exposure of sensitive information vulnerability exists in Jenkins OpenId Connect Authentication Plugin 1.4 and earlier in OicSecurityReal (no CVSS, Jenkins project Jenkins OpenId Connect Authentication Plugi…)
- [CVE-2019-1003022](https://cve.now/CVE-2019-1003022.md): A denial of service vulnerability exists in Jenkins Monitoring Plugin 1.74.0 and earlier in PluginImpl.java that allows attackers to kill th (no CVSS, Jenkins project Jenkins Monitoring Plugin · org.jvnet.hudso…)
- [CVE-2019-1003023](https://cve.now/CVE-2019-1003023.md): A cross-site scripting vulnerability exists in Jenkins Warnings Next Generation Plugin 1.0.1 and earlier in src/main/java/io/jenkins/plugins (no CVSS, Jenkins project Jenkins Warnings Next Generation Plugin · i…)
- [CVE-2019-6504](https://cve.now/CVE-2019-6504.md): Insufficient output sanitization in the Automic Web Interface (AWI), in CA Automic Workload Automation 12.0 to 12.2, allow attackers to pote (no CVSS, CA Technologies - A Broadcom Company CA Automic Workload Au…)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2019-02-06
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.