# CVEs published 2019-02-15

31 CVEs were published on February 15, 2019: 0 critical, 3 high. Days are UTC.

- [CVE-2019-8354](https://cve.now/CVE-2019-8354.md): An issue was discovered in SoX 14.4.2. (no CVSS)
- [CVE-2019-8355](https://cve.now/CVE-2019-8355.md): An issue was discovered in SoX 14.4.2. (no CVSS)
- [CVE-2019-8356](https://cve.now/CVE-2019-8356.md): An issue was discovered in SoX 14.4.2. (no CVSS)
- [CVE-2019-8357](https://cve.now/CVE-2019-8357.md): An issue was discovered in SoX 14.4.2. (no CVSS)
- [CVE-2013-2516](https://cve.now/CVE-2013-2516.md): Vulnerability in FileUtils v0.7, Ruby Gem Fileutils \<= v0.7 Command Injection vulnerability in user supplied url variable that is passed to (no CVSS, Stefaan Colman FileUtils · fileutils)
- [CVE-2013-2565](https://cve.now/CVE-2013-2565.md): A vulnerability in Mambo CMS v4.6.5 where the scripts thumbs.php, editorFrame.php, editor.php, images.php, manager.php discloses the root pa (no CVSS, Mambo CMS)
- [CVE-2013-5654](https://cve.now/CVE-2013-5654.md): Vulnerability in YingZhi Python Programming Language v1.9 allows arbitrary anonymous uploads to the phone's storage (no CVSS, YingZhi Python Programming Language)
- [CVE-2015-4615](https://cve.now/CVE-2015-4615.md): Vulnerability in Easy2map-photos WordPress Plugin v1.09 allows SQL Injection via unsanitized mapTemplateName, mapName, mapSettingsXML, paren (no CVSS, Steven Ellis Easy2map-photos WordPress Plugin)
- [CVE-2015-4617](https://cve.now/CVE-2015-4617.md): Vulnerability in Easy2map-photos WordPress Plugin v1.09 MapPinImageUpload.php and MapPinIconSave.php allows path traversal when specifying f (no CVSS, Steven Ellis Easy2map-photos WordPress Plugin)
- [CVE-2017-1695](https://cve.now/CVE-2017-1695.md): IBM QRadar SIEM 7.2 and 7.3 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive info (CVSS 5.9, IBM QRadar SIEM)
- [CVE-2018-1701](https://cve.now/CVE-2018-1701.md): IBM InfoSphere Information Server 11.7 could allow an authenciated user under specialized conditions to inject commands into the installatio (CVSS 8.5, IBM InfoSphere Information Server)
- [CVE-2018-1727](https://cve.now/CVE-2018-1727.md): IBM InfoSphere Information Server 9.1, 11.3, 11.5, and 11.7 is vulnerable to a XML External Entity Injection (XXE) attack when processing XM (CVSS 7.1, IBM InfoSphere Information Server)
- [CVE-2018-1895](https://cve.now/CVE-2018-1895.md): IBM InfoSphere Information Server 11.3, 11.5, and 11.7 is vulnerable to cross-site scripting. (CVSS 5.4, IBM InfoSphere Information Server)
- [CVE-2019-4059](https://cve.now/CVE-2019-4059.md): IBM Rational ClearCase 1.0.0.0 GIT connector does not sufficiently protect the document database password. (CVSS 7.5, IBM Rational ClearCase)
- [CVE-2019-0251](https://cve.now/CVE-2019-0251.md): The Fiori Launchpad of SAP BusinessObjects, before versions 4.2 and 4.3, does not sufficiently encode user-controlled inputs, resulting in C (no CVSS, SAP SE SAP BusinessObjects Business Intelligence Platform)
- [CVE-2019-0254](https://cve.now/CVE-2019-0254.md): SAP Disclosure Management (before version 10.1 Stack 1301) does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scri (no CVSS, SAP SE SAP Disclosure Management)
- [CVE-2019-0255](https://cve.now/CVE-2019-0255.md): SAP NetWeaver AS ABAP Platform, Krnl64nuc 7.74, krnl64UC 7.73, 7.74, Kernel 7.73, 7.74, 7.75, fails to validate type of installation for an (no CVSS)
- [CVE-2019-0256](https://cve.now/CVE-2019-0256.md): Under certain conditions SAP Business One Mobile Android App, version 1.2.12, allows an attacker to access information which would otherwise (no CVSS, SAP SE SAP Business One Mobile Android App)
- [CVE-2019-0257](https://cve.now/CVE-2019-0257.md): Customizing functionality of SAP NetWeaver AS ABAP Platform (fixed in versions from 7.0 to 7.02, from 7.10 to 7.11, 7.30, 7.31, 7.40, from 7 (no CVSS, SAP SE ABAP Platform)
- [CVE-2019-0258](https://cve.now/CVE-2019-0258.md): SAP Disclosure Management, version 10.01, does not perform necessary authorization checks for an authenticated user, resulting in escalation (no CVSS, SAP SE SAP Disclosure Management)
- [CVE-2019-0259](https://cve.now/CVE-2019-0259.md): SAP BusinessObjects, versions 4.2 and 4.3, (Visual Difference) allows an attacker to upload any file (including script files) without proper (no CVSS, SAP SE SAP BusinessObjects Business Intelligence Platform S…)
- [CVE-2019-0261](https://cve.now/CVE-2019-0261.md): Under certain circumstances, SAP HANA Extended Application Services, advanced model (XS advanced) does not perform authentication checks pro (no CVSS, SAP SE SAP HANA Extended Application Services)
- [CVE-2019-0262](https://cve.now/CVE-2019-0262.md): SAP WebIntelligence BILaunchPad, versions 4.10, 4.20, does not sufficiently encode user-controlled inputs in generated HTML reports, resulti (no CVSS, SAP SE SAP WebIntelligence BILaunchPad)
- [CVE-2019-0265](https://cve.now/CVE-2019-0265.md): SLD Registration of ABAP Platform allows an attacker to prevent legitimate users from accessing a service, either by crashing or flooding th (no CVSS, SAP SE ABAP Platform)
- [CVE-2019-0266](https://cve.now/CVE-2019-0266.md): Under certain conditions SAP HANA Extended Application Services, version 1.0, advanced model (XS advanced) writes credentials of platform us (no CVSS, SAP SE SAP HANA Extended Application Services, advanced mod…)
- [CVE-2019-0267](https://cve.now/CVE-2019-0267.md): SAP Manufacturing Integration and Intelligence, versions 15.0, 15.1 and 15.2, (Illuminator Servlet) currently does not provide Anti-XSRF tok (no CVSS, SAP SE SAP Manufacturing Integration and Intelligence)
- [CVE-2019-6974](https://cve.now/CVE-2019-6974.md): In the Linux kernel before 4.20.8, kvm\_ioctl\_create\_device in virt/kvm/kvm\_main.c mishandles reference counting because of a race condition, (no CVSS)
- [CVE-2019-8347](https://cve.now/CVE-2019-8347.md): BEESCMS 4.0 has a CSRF vulnerability to add arbitrary VIP accounts via the admin/admin\_member.php?action=add&nav=add\_web\_user&admin\_p\_nav=us (no CVSS)
- [CVE-2019-8345](https://cve.now/CVE-2019-8345.md): The Help feature in the ES File Explorer File Manager application 4.1.9.7.4 for Android allows session hijacking by a Man-in-the-middle atta (no CVSS)
- [CVE-2019-8341](https://cve.now/CVE-2019-8341.md): An issue was discovered in Jinja2 2.10. (no CVSS)
- [CVE-2019-8343](https://cve.now/CVE-2019-8343.md): In Netwide Assembler (NASM) 2.14.02, there is a use-after-free in paste\_tokens in asm/preproc.c. (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2019-02-15
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.