CVEs published February 17, 2019
30 CVEs were published on February 17, 2019: 0 critical, 1 high. 1 is now in CISA KEV.
- Published
- 30
- Critical
- 0
- High
- 1
- Medium
- 0
- Low
- 0
- Unrated
- 29
- Now in CISA KEV
- 1
- Fix available
- 1
Most affected products
- github.com/ory/hydra
- 1
High 1
Medium, low and unrated 29
- CVE-2019-8419VNote 2.2 has XSS via a new text note.
- CVE-2019-8421upload/protected/modules/admini/views/post/index.php in BageCMS through 3.1.4 allows SQL Injection via the title or titleAlias parameter.
- CVE-2019-8422A SQL Injection vulnerability exists in PbootCMS v1.3.2 via the description parameter in apps\admin\controller\content\ContentController.php
- CVE-2019-7649global.encryptPassword in bootstrap/global.js in CMSWing 1.3.7 relies on multiple MD5 operations for password hashing.
- CVE-2019-8418SeaCMS 7.2 mishandles member.php?mod=repsw4 requests.
- CVE-2019-8411admin/dl_data.php in zzcms 2018 (2018-10-19) allows remote attackers to delete arbitrary files via action=del&filename=../ directory travers
- CVE-2019-8412FeiFeiCms 4.0.181010 on Windows allows remote attackers to read or delete arbitrary files via index.php?s=Admin-Data-Down-id-..\ or index.ph
- CVE-2019-8413On Xiaomi MIX 2 devices with the 4.4.78 kernel, a NULL pointer dereference in the ioctl interface of the device file /dev/elliptic1 or /dev/
- CVE-2018-20782The GloBee plugin before 1.1.2 for WooCommerce mishandles IPN messages.
- CVE-2019-8407HongCMS 3.0.0 allows arbitrary file read and write operations via a ../ in the filename parameter to the admin/index.php/language/edit URI.
- CVE-2019-8408OneFileCMS 3.6.13 allows remote attackers to modify onefilecms.php by clicking the Copy button twice.
- CVE-2016-10742Zabbix before 2.2.21rc1, 3.x before 3.0.13rc1, 3.1.x and 3.2.x before 3.2.10rc1, and 3.3.x and 3.4.x before 3.4.4rc1 allows open redirect vi
- CVE-2019-8393Hotels_Server through 2018-11-05 has SQL Injection via the API because the controller/api/login.php telephone parameter is mishandled.
- CVE-2019-8396A buffer overflow in H5O__layout_encode in H5Olayout.c in the HDF HDF5 through 1.10.4 library allows attackers to cause a denial of service
- CVE-2019-8397An issue was discovered in the HDF HDF5 1.10.4 library.
- CVE-2019-8398An issue was discovered in the HDF HDF5 1.10.4 library.
- CVE-2019-8400ORY Hydra before v1.0.0-rc.3+oryOS.9 has Reflected XSS via the oauth2/fallbacks/error error_hint parameter.github.com/ory/hydra
- CVE-2019-7399Amazon Fire OS before 5.3.6.4 allows a man-in-the-middle attack against HTTP requests for "Terms of Use" and Privacy pages.
- CVE-2019-8392An issue was discovered on D-Link DIR-823G devices with firmware 1.02B03.
- CVE-2019-8395An Insecure Direct Object Reference (IDOR) vulnerability exists in Zoho ManageEngine ServiceDesk Plus (SDP) before 10.0 build 10007 via an a
- CVE-2019-8389A file-read vulnerability was identified in the Wi-Fi transfer feature of Musicloud 1.6.
- CVE-2019-8376An issue was discovered in Tcpreplay 4.3.1.
- CVE-2019-8377An issue was discovered in Tcpreplay 4.3.1.
- CVE-2019-8378An issue was discovered in Bento4 1.5.1-628.
- CVE-2019-8379An issue was discovered in AdvanceCOMP through 2.1.
- CVE-2019-8380An issue was discovered in Bento4 1.5.1-628.
- CVE-2019-8381An issue was discovered in Tcpreplay 4.3.1.
- CVE-2019-8382An issue was discovered in Bento4 1.5.1-628.
- CVE-2019-8383An issue was discovered in AdvanceCOMP through 2.1.