# CVEs published 2019-02-07 35 CVEs were published on February 7, 2019: 1 critical, 2 high. Days are UTC. - [CVE-2019-6139](https://cve.now/CVE-2019-6139.md): Forcepoint User ID (FUID) server versions up to 1.2 have a remote arbitrary file upload vulnerability on TCP port 5001. (no CVSS, Forcepoint . Forcepoint User ID (FUID) server) - [CVE-2018-1296](https://cve.now/CVE-2018-1296.md): In Apache Hadoop 3.0.0-alpha1 to 3.0.0, 2.9.0, 2.8.0 to 2.8.3, and 2.5.0 to 2.7.5, HDFS exposes extended attribute key/value pairs during li (no CVSS, Apache Software Foundation Apache Hadoop · org.apache.hadoo…) - [CVE-2018-1340](https://cve.now/CVE-2018-1340.md): Prior to 1.0.0, Apache Guacamole used a cookie for client-side storage of the user's session token. (no CVSS, Apache Software Foundation Apache Guacamole · org.apache.gu…) - [CVE-2019-1660](https://cve.now/CVE-2019-1660.md): Cisco TelePresence Management Suite Simple Object Access Protocol Vulnerability (CVSS 5.3, Cisco TelePresence Management Suite) - [CVE-2019-1661](https://cve.now/CVE-2019-1661.md): Cisco TelePresence Management Suite Cross-Site Scripting Vulnerability (CVSS 6.1, Cisco TelePresence Management Suite) - [CVE-2019-1670](https://cve.now/CVE-2019-1670.md): Cisco Unified Intelligence Center Software Cross-Site Scripting Vulnerability (CVSS 6.1, Cisco Unified Contact Center Express) - [CVE-2019-1671](https://cve.now/CVE-2019-1671.md): Cisco Firepower Management Center Cross-Site Scripting Vulnerability (CVSS 6.1, Cisco Firepower Management Center) - [CVE-2019-1678](https://cve.now/CVE-2019-1678.md): Cisco Meeting Server Denial of Service Vulnerability (CVSS 4.3, Cisco Meeting Server) - [CVE-2019-1679](https://cve.now/CVE-2019-1679.md): Cisco TelePresence Conductor, Cisco Expressway Series, and Cisco TelePresence Video Communication Server REST API Server-Side Request Forgery Vulnerability (CVSS 5.0, Cisco TelePresence Conductor · Cisco Expressway Series +1) - [CVE-2019-1680](https://cve.now/CVE-2019-1680.md): Cisco Webex Business Suite Content Injection Vulnerability (CVSS 4.3, Cisco Webex Business Suite) - [CVE-2019-1675](https://cve.now/CVE-2019-1675.md): Cisco Aironet Active Sensor Static Credentials Vulnerability (CVSS 7.5, Cisco Aironet Active Sensor) - [CVE-2019-1677](https://cve.now/CVE-2019-1677.md): Cisco Webex Meetings for Android Cross-Site Scripting Vulnerability (CVSS 5.0, Cisco WebEx Meetings for Android) - [CVE-2019-3704](https://cve.now/CVE-2019-3704.md): VNX Control Station in Dell EMC VNX2 OE for File versions prior to 8.1.9.236 contains OS command injection vulnerability. (CVSS 7.8, VNX Control Station in Dell EMC VNX2 OE for File) - [CVE-2019-7587](https://cve.now/CVE-2019-7587.md): Bo-blog Wind through 1.6.0-r allows SQL Injection via the admin.php/comments/batchdel/ comID parameter because this parameter is mishandled (no CVSS) - [CVE-2019-7581](https://cve.now/CVE-2019-7581.md): The parseSWF\_ACTIONRECORD function in util/parser.c in libming through 0.4.8 allows remote attackers to have unspecified impact via a crafte (no CVSS) - [CVE-2019-7582](https://cve.now/CVE-2019-7582.md): The readBytes function in util/read.c in libming through 0.4.8 allows remote attackers to have unspecified impact via a crafted swf file tha (no CVSS) - [CVE-2019-7585](https://cve.now/CVE-2019-7585.md): An issue was discovered in Waimai Super Cms 20150505. (no CVSS) - [CVE-2019-7580](https://cve.now/CVE-2019-7580.md): ThinkCMF 5.0.190111 allows remote attackers to execute arbitrary PHP code via the portal/admin\_category/addpost.html alias parameter because (no CVSS) - [CVE-2018-1666](https://cve.now/CVE-2018-1666.md): IBM DataPower Gateway 2018.4.1.0, 7.6.0.0 through 7.6.0.11, 7.5.2.0 through 7.5.2.18, 7.5.1.0 through 7.5.1.18, 7.5.0.0 through 7.5.0.19, an (CVSS 4.3, IBM DataPower Gateway) - [CVE-2019-4008](https://cve.now/CVE-2019-4008.md): API Connect V2018.1 through 2018.4.1.1 is impacted by access token leak. (CVSS 9.0, IBM API Connect) - [CVE-2019-7535](https://cve.now/CVE-2019-7535.md): index.php in Gurock TestRail 5.3.0.3603 returns potentially sensitive information for an invalid request, as demonstrated by full path discl (no CVSS) - [CVE-2019-7559](https://cve.now/CVE-2019-7559.md): In btor2parser/btor2parser.c in Boolector Btor2Tools before 2019-01-15, opening a specially crafted input file leads to an out of bounds wri (no CVSS) - [CVE-2019-7560](https://cve.now/CVE-2019-7560.md): In parser/btorsmt2.c in Boolector 3.0.0, opening a specially crafted input file leads to a use after free in get\_failed\_assumptions or btor\_ (no CVSS, pyboolector) - [CVE-2019-7566](https://cve.now/CVE-2019-7566.md): CSZ CMS 1.1.8 has CSRF via admin/users/new/add. (no CVSS) - [CVE-2019-7567](https://cve.now/CVE-2019-7567.md): An issue was discovered in Waimai Super Cms 20150505. (no CVSS) - [CVE-2019-7568](https://cve.now/CVE-2019-7568.md): An issue was discovered in baijiacms V4 that can result in time-based blind SQL injection to get data via the cate parameter in an index.php (no CVSS) - [CVE-2019-7569](https://cve.now/CVE-2019-7569.md): An issue was discovered in DOYO (aka doyocms) 2.3(20140425 update). (no CVSS) - [CVE-2019-7570](https://cve.now/CVE-2019-7570.md): A CSRF vulnerability was found in PbootCMS v1.3.6 that can delete users via an admin.php/User/del/ucode/ URI. (no CVSS) - [CVE-2019-7572](https://cve.now/CVE-2019-7572.md): SDL (Simple DirectMedia Layer) through 1.2.15 and 2.x through 2.0.9 has a buffer over-read in IMA\_ADPCM\_nibble in audio/SDL\_wave.c. (no CVSS) - [CVE-2019-7573](https://cve.now/CVE-2019-7573.md): SDL (Simple DirectMedia Layer) through 1.2.15 and 2.x through 2.0.9 has a heap-based buffer over-read in InitMS\_ADPCM in audio/SDL\_wave.c (i (no CVSS) - [CVE-2019-7574](https://cve.now/CVE-2019-7574.md): SDL (Simple DirectMedia Layer) through 1.2.15 and 2.x through 2.0.9 has a heap-based buffer over-read in IMA\_ADPCM\_decode in audio/SDL\_wave. (no CVSS) - [CVE-2019-7575](https://cve.now/CVE-2019-7575.md): SDL (Simple DirectMedia Layer) through 1.2.15 and 2.x through 2.0.9 has a heap-based buffer overflow in MS\_ADPCM\_decode in audio/SDL\_wave.c. (no CVSS) - [CVE-2019-7576](https://cve.now/CVE-2019-7576.md): SDL (Simple DirectMedia Layer) through 1.2.15 and 2.x through 2.0.9 has a heap-based buffer over-read in InitMS\_ADPCM in audio/SDL\_wave.c (o (no CVSS) - [CVE-2019-7577](https://cve.now/CVE-2019-7577.md): SDL (Simple DirectMedia Layer) through 1.2.15 and 2.x through 2.0.9 has a buffer over-read in SDL\_LoadWAV\_RW in audio/SDL\_wave.c. (no CVSS) - [CVE-2019-7578](https://cve.now/CVE-2019-7578.md): SDL (Simple DirectMedia Layer) through 1.2.15 and 2.x through 2.0.9 has a heap-based buffer over-read in InitIMA\_ADPCM in audio/SDL\_wave.c. (no CVSS) --- Source: cve.now, built and run by Sazabi (AI-native observability and security) Page: https://cve.now/daily/2019-02-07 Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.