# CVEs published 2019-02-17 30 CVEs were published on February 17, 2019: 0 critical, 1 high. 1 is now in CISA KEV. Days are UTC. - [CVE-2019-8419](https://cve.now/CVE-2019-8419.md): VNote 2.2 has XSS via a new text note. (no CVSS) - [CVE-2019-8421](https://cve.now/CVE-2019-8421.md): upload/protected/modules/admini/views/post/index.php in BageCMS through 3.1.4 allows SQL Injection via the title or titleAlias parameter. (no CVSS) - [CVE-2019-8422](https://cve.now/CVE-2019-8422.md): A SQL Injection vulnerability exists in PbootCMS v1.3.2 via the description parameter in apps\\admin\\controller\\content\\ContentController.php (no CVSS) - [CVE-2019-7649](https://cve.now/CVE-2019-7649.md): global.encryptPassword in bootstrap/global.js in CMSWing 1.3.7 relies on multiple MD5 operations for password hashing. (no CVSS) - [CVE-2019-8418](https://cve.now/CVE-2019-8418.md): SeaCMS 7.2 mishandles member.php?mod=repsw4 requests. (no CVSS) - [CVE-2019-8411](https://cve.now/CVE-2019-8411.md): admin/dl\_data.php in zzcms 2018 (2018-10-19) allows remote attackers to delete arbitrary files via action=del&filename=../ directory travers (no CVSS) - [CVE-2019-8412](https://cve.now/CVE-2019-8412.md): FeiFeiCms 4.0.181010 on Windows allows remote attackers to read or delete arbitrary files via index.php?s=Admin-Data-Down-id-..\\ or index.ph (no CVSS) - [CVE-2019-8413](https://cve.now/CVE-2019-8413.md): On Xiaomi MIX 2 devices with the 4.4.78 kernel, a NULL pointer dereference in the ioctl interface of the device file /dev/elliptic1 or /dev/ (no CVSS) - [CVE-2018-20782](https://cve.now/CVE-2018-20782.md): The GloBee plugin before 1.1.2 for WooCommerce mishandles IPN messages. (no CVSS) - [CVE-2019-8407](https://cve.now/CVE-2019-8407.md): HongCMS 3.0.0 allows arbitrary file read and write operations via a ../ in the filename parameter to the admin/index.php/language/edit URI. (no CVSS) - [CVE-2019-8408](https://cve.now/CVE-2019-8408.md): OneFileCMS 3.6.13 allows remote attackers to modify onefilecms.php by clicking the Copy button twice. (no CVSS) - [CVE-2016-10742](https://cve.now/CVE-2016-10742.md): Zabbix before 2.2.21rc1, 3.x before 3.0.13rc1, 3.1.x and 3.2.x before 3.2.10rc1, and 3.3.x and 3.4.x before 3.4.4rc1 allows open redirect vi (no CVSS) - [CVE-2019-8393](https://cve.now/CVE-2019-8393.md): Hotels\_Server through 2018-11-05 has SQL Injection via the API because the controller/api/login.php telephone parameter is mishandled. (no CVSS) - [CVE-2019-8396](https://cve.now/CVE-2019-8396.md): A buffer overflow in H5O\_\_layout\_encode in H5Olayout.c in the HDF HDF5 through 1.10.4 library allows attackers to cause a denial of service (no CVSS) - [CVE-2019-8397](https://cve.now/CVE-2019-8397.md): An issue was discovered in the HDF HDF5 1.10.4 library. (no CVSS) - [CVE-2019-8398](https://cve.now/CVE-2019-8398.md): An issue was discovered in the HDF HDF5 1.10.4 library. (no CVSS) - [CVE-2019-8400](https://cve.now/CVE-2019-8400.md): ORY Hydra before v1.0.0-rc.3+oryOS.9 has Reflected XSS via the oauth2/fallbacks/error error\_hint parameter. (no CVSS, github.com/ory/hydra) - [CVE-2019-7399](https://cve.now/CVE-2019-7399.md): Amazon Fire OS before 5.3.6.4 allows a man-in-the-middle attack against HTTP requests for "Terms of Use" and Privacy pages. (no CVSS) - [CVE-2019-8392](https://cve.now/CVE-2019-8392.md): An issue was discovered on D-Link DIR-823G devices with firmware 1.02B03. (no CVSS) - [CVE-2019-8394](https://cve.now/CVE-2019-8394.md): Zoho ManageEngine ServiceDesk Plus (SDP) before 10.0 build 10012 allows remote attackers to upload arbitrary files via login page customizat (CVSS 7.5, KEV) - [CVE-2019-8395](https://cve.now/CVE-2019-8395.md): An Insecure Direct Object Reference (IDOR) vulnerability exists in Zoho ManageEngine ServiceDesk Plus (SDP) before 10.0 build 10007 via an a (no CVSS) - [CVE-2019-8389](https://cve.now/CVE-2019-8389.md): A file-read vulnerability was identified in the Wi-Fi transfer feature of Musicloud 1.6. (no CVSS) - [CVE-2019-8376](https://cve.now/CVE-2019-8376.md): An issue was discovered in Tcpreplay 4.3.1. (no CVSS) - [CVE-2019-8377](https://cve.now/CVE-2019-8377.md): An issue was discovered in Tcpreplay 4.3.1. (no CVSS) - [CVE-2019-8378](https://cve.now/CVE-2019-8378.md): An issue was discovered in Bento4 1.5.1-628. (no CVSS) - [CVE-2019-8379](https://cve.now/CVE-2019-8379.md): An issue was discovered in AdvanceCOMP through 2.1. (no CVSS) - [CVE-2019-8380](https://cve.now/CVE-2019-8380.md): An issue was discovered in Bento4 1.5.1-628. (no CVSS) - [CVE-2019-8381](https://cve.now/CVE-2019-8381.md): An issue was discovered in Tcpreplay 4.3.1. (no CVSS) - [CVE-2019-8382](https://cve.now/CVE-2019-8382.md): An issue was discovered in Bento4 1.5.1-628. (no CVSS) - [CVE-2019-8383](https://cve.now/CVE-2019-8383.md): An issue was discovered in AdvanceCOMP through 2.1. (no CVSS) --- Source: cve.now, built and run by Sazabi (AI-native observability and security) Page: https://cve.now/daily/2019-02-17 Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.