# CVEs published 2019-02-12

35 CVEs were published on February 12, 2019: 0 critical, 1 high. Days are UTC.

- [CVE-2019-8308](https://cve.now/CVE-2019-8308.md): Flatpak before 1.0.7, and 1.1.x and 1.2.x before 1.2.3, exposes /proc in the apply\_extra script sandbox, which allows attackers to modify a (no CVSS)
- [CVE-2017-0938](https://cve.now/CVE-2017-0938.md): Denial of Service attack in airMAX \< 8.3.2 , airMAX \< 6.0.7 and EdgeMAX \< 1.9.7 allow attackers to use the Discovery Protocol in amplificati (no CVSS, HackerOne airMAX, EdgeMAX)
- [CVE-2018-19018](https://cve.now/CVE-2018-19018.md): An access of uninitialized pointer vulnerability in CX-Supervisor (Versions 3.42 and prior) could lead to type confusion when processing pro (no CVSS, ICS-CERT CX-Supervisor)
- [CVE-2018-19020](https://cve.now/CVE-2018-19020.md): When CX-Supervisor (Versions 3.42 and prior) processes project files and tampers with the value of an offset, an attacker can force the appl (no CVSS, ICS-CERT CX-Supervisor)
- [CVE-2018-19645](https://cve.now/CVE-2018-19645.md): Solutions Business Manager (SBM) Authentication Bypass Issue in Version prior to 11.5 (no CVSS, NetIQ eDirectory NetIQ Access Manager)
- [CVE-2018-5499](https://cve.now/CVE-2018-5499.md): ATTO FibreBridge 7500N firmware version 2.95 is susceptible to a vulnerability which allows attackers to cause a Denial of Service (DoS). (no CVSS, NetApp ATTO FibreBridge)
- [CVE-2019-1688](https://cve.now/CVE-2019-1688.md): Cisco Network Assurance Engine CLI Access with Default Password Vulnerability (CVSS 7.7, Cisco Network Assurance Engine)
- [CVE-2019-7550](https://cve.now/CVE-2019-7550.md): In JForum 2.1.8, an unauthenticated, remote attacker can enumerate whether a user exists by using the "create user" function. (no CVSS)
- [CVE-2019-6549](https://cve.now/CVE-2019-6549.md): An attacker could retrieve plain-text credentials stored in a XML file on PR100088 Modbus gateway versions prior to Release R02 (or Software (no CVSS, ICS-CERT PR100088 Modbus gateway)
- [CVE-2019-7739](https://cve.now/CVE-2019-7739.md): An issue was discovered in Joomla! before 3.9.3. (no CVSS)
- [CVE-2019-7740](https://cve.now/CVE-2019-7740.md): An issue was discovered in Joomla! before 3.9.3. (no CVSS)
- [CVE-2019-7741](https://cve.now/CVE-2019-7741.md): An issue was discovered in Joomla! before 3.9.3. (no CVSS)
- [CVE-2019-7742](https://cve.now/CVE-2019-7742.md): An issue was discovered in Joomla! before 3.9.3. (no CVSS)
- [CVE-2019-7743](https://cve.now/CVE-2019-7743.md): An issue was discovered in Joomla! before 3.9.3. (no CVSS, joomla/joomla-cms)
- [CVE-2019-7744](https://cve.now/CVE-2019-7744.md): An issue was discovered in Joomla! before 3.9.3. (no CVSS)
- [CVE-2018-20781](https://cve.now/CVE-2018-20781.md): In pam/gkr-pam-module.c in GNOME Keyring before 3.27.2, the user's password is kept in a session-child process spawned from the LightDM daem (no CVSS)
- [CVE-2019-6527](https://cve.now/CVE-2019-6527.md): PR100088 Modbus gateway versions prior to Release R02 (or Software Version 1.1.13166) may allow an attacker to be able to change the passwor (no CVSS, ICS-CERT PR100088 Modbus gateway)
- [CVE-2019-6533](https://cve.now/CVE-2019-6533.md): Registers used to store Modbus values can be read and written from the web interface without authentication in the PR100088 Modbus gateway v (no CVSS, ICS-CERT PR100088 Modbus gateway)
- [CVE-2019-7753](https://cve.now/CVE-2019-7753.md): Verydows 2.0 has XSS via the index.php?m=api&c=stats&a=count referrer parameter. (no CVSS)
- [CVE-2019-5595](https://cve.now/CVE-2019-5595.md): In FreeBSD before 11.2-STABLE(r343782), 11.2-RELEASE-p9, 12.0-STABLE(r343781), and 12.0-RELEASE-p3, kernel callee-save registers are not pro (no CVSS, FreeBSD)
- [CVE-2019-5596](https://cve.now/CVE-2019-5596.md): In FreeBSD 11.2-STABLE after r338618 and before r343786, 12.0-STABLE before r343781, and 12.0-RELEASE before 12.0-RELEASE-p3, a bug in the r (no CVSS, FreeBSD)
- [CVE-2019-3923](https://cve.now/CVE-2019-3923.md): Nessus versions 8.2.1 and earlier were found to contain a stored XSS vulnerability due to improper validation of user-supplied input. (no CVSS, Tenable Nessus)
- [CVE-2018-9582](https://cve.now/CVE-2018-9582.md): In package installer in Android-8.0, Android-8.1 and Android-9, there is a possible bypass of the unknown source warning due to a confused d (no CVSS, Android)
- [CVE-2018-9583](https://cve.now/CVE-2018-9583.md): In bta\_ag\_parse\_cmer of bta\_ag\_cmd.cc in Android-7.0, Android-7.1.1, Android-7.1.2, Android-8.0, Android-8.1 and Android-9, there is a possi (no CVSS, Android)
- [CVE-2018-9584](https://cve.now/CVE-2018-9584.md): In nfc\_ncif\_set\_config\_status of nfc\_ncif.cc in Android-7.0, Android-7.1.1, Android-7.1.2, Android-8.0, Android-8.1 and Android-9, there is (no CVSS, Android)
- [CVE-2018-9585](https://cve.now/CVE-2018-9585.md): In nfc\_ncif\_proc\_get\_routing of nfc\_ncif.cc in Android-7.0, Android-7.1.1, Android-7.1.2, Android-8.0, Android-8.1 and Android-9, there is a (no CVSS, Android)
- [CVE-2018-9586](https://cve.now/CVE-2018-9586.md): In run of InstallPackageTask.java in Android-7.0, Android-7.1.1, Android-7.1.2, Android-8.0, Android-8.1 and Android-9, it is possible that (no CVSS, Android)
- [CVE-2018-9587](https://cve.now/CVE-2018-9587.md): In savePhotoFromUriToUri of ContactPhotoUtils.java in Android-7.0, Android-7.1.1, Android-7.1.2, Android-8.0, Android-8.1 and Android-9, the (no CVSS, Android)
- [CVE-2018-9588](https://cve.now/CVE-2018-9588.md): In avdt\_scb\_hdl\_report of avdt\_scb\_act.cc in Android-7.0, Android-7.1.1, Android-7.1.2, Android-8.0, Android-8.1 and Android-9, there is a p (no CVSS, Android)
- [CVE-2018-9589](https://cve.now/CVE-2018-9589.md): In ieee802\_11\_rx\_wnmsleep\_req of wnm\_ap.c in Android-7.0, Android-7.1.1, Android-7.1.2, Android-8.0, Android-8.1 and Android-9, there is a p (no CVSS, Android)
- [CVE-2018-9590](https://cve.now/CVE-2018-9590.md): In add\_attr of sdp\_discovery.c in Android-7.0, Android-7.1.1, Android-7.1.2, Android-8.0, Android-8.1 and Android-9, there is a possible out (no CVSS, Android)
- [CVE-2018-9591](https://cve.now/CVE-2018-9591.md): In bta\_hh\_ctrl\_dat\_act of bta\_hh\_act.cc in Android-7.0, Android-7.1.1, Android-7.1.2, Android-8.0, Android-8.1 and Android-9, there is a pos (no CVSS, Android)
- [CVE-2018-9592](https://cve.now/CVE-2018-9592.md): In mca\_ccb\_hdl\_rsp of mca\_cact.cc in Android-7.0, Android-7.1.1, Android-7.1.2, Android-8.0, Android-8.1 and Android-9, there is a possible (no CVSS, Android)
- [CVE-2018-9593](https://cve.now/CVE-2018-9593.md): In llcp\_dlc\_proc\_i\_pdu of llcp\_dlc.cc in Android-7.0, Android-7.1.1, Android-7.1.2, Android-8.0, Android-8.1 and Android-9, there is a possi (no CVSS, Android)
- [CVE-2018-9594](https://cve.now/CVE-2018-9594.md): In llcp\_link\_proc\_agf\_pdu of llcp\_link.cc in Android-7.0, Android-7.1.1, Android-7.1.2, Android-8.0, Android-8.1 and Android-9, there is a p (no CVSS, \*\*\* n/a \*\*\* Android)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2019-02-12
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.