# CVEs published 2019-02-18

43 CVEs were published on February 18, 2019: 0 critical, 0 high. Days are UTC.

- [CVE-2019-7629](https://cve.now/CVE-2019-7629.md): Stack-based buffer overflow in the strip\_vt102\_codes function in TinTin++ 2.01.6 and WinTin++ 2.01.6 allows remote attackers to execute arbi (no CVSS)
- [CVE-2019-8919](https://cve.now/CVE-2019-8919.md): The seadroid (aka Seafile Android Client) application through 2.2.13 for Android always uses the same Initialization Vector (IV) with Cipher (no CVSS)
- [CVE-2019-8917](https://cve.now/CVE-2019-8917.md): SolarWinds Orion NPM before 12.4 suffers from a SYSTEM remote code execution vulnerability in the OrionModuleEngine service. (no CVSS)
- [CVE-2019-8908](https://cve.now/CVE-2019-8908.md): An issue was discovered in WTCMS 1.0. (no CVSS)
- [CVE-2019-8909](https://cve.now/CVE-2019-8909.md): An issue was discovered in WTCMS 1.0. (no CVSS)
- [CVE-2019-8910](https://cve.now/CVE-2019-8910.md): An issue was discovered in WTCMS 1.0. (no CVSS)
- [CVE-2019-8911](https://cve.now/CVE-2019-8911.md): An issue was discovered in WTCMS 1.0. (no CVSS)
- [CVE-2019-8912](https://cve.now/CVE-2019-8912.md): In the Linux kernel through 4.20.11, af\_alg\_release() in crypto/af\_alg.c neglects to set a NULL value for a certain structure member, which (no CVSS)
- [CVE-2018-12159](https://cve.now/CVE-2018-12159.md): Buffer overflow in the command-line interface for Intel(R) PROSet Wireless v20.50 and before may allow an authenticated user to potentially (no CVSS)
- [CVE-2018-3700](https://cve.now/CVE-2018-3700.md): Code injection vulnerability in the installer for Intel(R) USB 3.0 eXtensible Host Controller Driver for Microsoft Windows 7 before version (no CVSS)
- [CVE-2019-0101](https://cve.now/CVE-2019-0101.md): Authentication bypass in the Intel Unite(R) solution versions 3.2 through 3.3 may allow an unauthenticated user to potentially enable escala (no CVSS)
- [CVE-2019-0102](https://cve.now/CVE-2019-0102.md): Insufficient session authentication in web server for Intel(R) Data Center Manager SDK before version 5.0.2 may allow an unauthenticated use (no CVSS)
- [CVE-2019-0103](https://cve.now/CVE-2019-0103.md): Insufficient file protection in install routine for Intel(R) Data Center Manager SDK before version 5.0.2 may allow an authenticated user to (no CVSS)
- [CVE-2019-0104](https://cve.now/CVE-2019-0104.md): Insufficient file protection in uninstall routine for Intel(R) Data Center Manager SDK before version 5.0.2 may allow an authenticated user (no CVSS)
- [CVE-2019-0105](https://cve.now/CVE-2019-0105.md): Insufficient file permissions checking in install routine for Intel(R) Data Center Manager SDK before version 5.0.2 may allow authenticated (no CVSS)
- [CVE-2019-0106](https://cve.now/CVE-2019-0106.md): Insufficient run protection in install routine for Intel(R) Data Center Manager SDK before version 5.0.2 may allow a privileged user to pote (no CVSS)
- [CVE-2019-0107](https://cve.now/CVE-2019-0107.md): Insufficient user prompt in install routine for Intel(R) Data Center Manager SDK before version 5.0.2 may allow a privileged user to potenti (no CVSS)
- [CVE-2019-0108](https://cve.now/CVE-2019-0108.md): Improper file permissions for Intel(R) Data Center Manager SDK before version 5.0.2 may allow an authenticated user to potentially enable di (no CVSS)
- [CVE-2019-0109](https://cve.now/CVE-2019-0109.md): Improper folder permissions in Intel(R) Data Center Manager SDK before version 5.0.2 may allow an authenticated user to potentially enable e (no CVSS)
- [CVE-2019-0110](https://cve.now/CVE-2019-0110.md): Insufficient key management for Intel(R) Data Center Manager SDK before version 5.0.2 may allow an authenticated user to potentially enable (no CVSS)
- [CVE-2019-0111](https://cve.now/CVE-2019-0111.md): Improper file permissions for Intel(R) Data Center Manager SDK before version 5.0.2 may allow an authenticated user to potentially enable in (no CVSS)
- [CVE-2019-0112](https://cve.now/CVE-2019-0112.md): Improper flow control in crypto routines for Intel(R) Data Center Manager SDK before version 5.0.2 may allow a privileged user to potentiall (no CVSS)
- [CVE-2019-0127](https://cve.now/CVE-2019-0127.md): Logic error in the installer for Intel(R) OpenVINO(TM) 2018 R3 and before for Linux may allow a privileged user to potentially enable inform (no CVSS)
- [CVE-2019-8904](https://cve.now/CVE-2019-8904.md): do\_bid\_note in readelf.c in libmagic.a in file 5.35 has a stack-based buffer over-read, related to file\_printf and file\_vprintf. (no CVSS)
- [CVE-2019-8905](https://cve.now/CVE-2019-8905.md): do\_core\_note in readelf.c in libmagic.a in file 5.35 has a stack-based buffer over-read, related to file\_printable, a different vulnerabilit (no CVSS)
- [CVE-2019-8906](https://cve.now/CVE-2019-8906.md): do\_core\_note in readelf.c in libmagic.a in file 5.35 has an out-of-bounds read because memcpy is misused. (no CVSS)
- [CVE-2019-8907](https://cve.now/CVE-2019-8907.md): do\_core\_note in readelf.c in libmagic.a in file 5.35 allows remote attackers to cause a denial of service (stack corruption and application (no CVSS)
- [CVE-2019-8903](https://cve.now/CVE-2019-8903.md): index.js in Total.js Platform before 3.2.3 allows path traversal. (no CVSS, total.js)
- [CVE-2019-6453](https://cve.now/CVE-2019-6453.md): mIRC before 7.55 allows remote command execution by using argument injection through custom URI protocol handlers. (no CVSS)
- [CVE-2019-8372](https://cve.now/CVE-2019-8372.md): The LHA.sys driver before 1.1.1811.2101 in LG Device Manager exposes functionality that allows low-privileged users to read and write arbitr (no CVSS)
- [CVE-2019-8902](https://cve.now/CVE-2019-8902.md): An issue was discovered in idreamsoft iCMS through 7.0.14. (no CVSS)
- [CVE-2019-8423](https://cve.now/CVE-2019-8423.md): ZoneMinder through 1.32.3 has SQL Injection via the skins/classic/views/events.php filter\[Query\]\[terms\]\[0\]\[cnj\] parameter. (no CVSS)
- [CVE-2019-8424](https://cve.now/CVE-2019-8424.md): ZoneMinder before 1.32.3 has SQL Injection via the ajax/status.php sort parameter. (no CVSS)
- [CVE-2019-8425](https://cve.now/CVE-2019-8425.md): includes/database.php in ZoneMinder before 1.32.3 has XSS in the construction of SQL-ERR messages. (no CVSS)
- [CVE-2019-8426](https://cve.now/CVE-2019-8426.md): skins/classic/views/controlcap.php in ZoneMinder before 1.32.3 has XSS via the newControl array, as demonstrated by the newControl\[MinTiltRa (no CVSS)
- [CVE-2019-8427](https://cve.now/CVE-2019-8427.md): daemonControl in includes/functions.php in ZoneMinder before 1.32.3 allows command injection via shell metacharacters. (no CVSS)
- [CVE-2019-8428](https://cve.now/CVE-2019-8428.md): ZoneMinder before 1.32.3 has SQL Injection via the skins/classic/views/control.php groupSql parameter, as demonstrated by a newGroup\[Monitor (no CVSS)
- [CVE-2019-8429](https://cve.now/CVE-2019-8429.md): ZoneMinder before 1.32.3 has SQL Injection via the ajax/status.php filter\[Query\]\[terms\]\[0\]\[cnj\] parameter. (no CVSS)
- [CVE-2019-8432](https://cve.now/CVE-2019-8432.md): In CmsEasy 7.0, there is XSS via the ckplayer.php url parameter. (no CVSS)
- [CVE-2019-8433](https://cve.now/CVE-2019-8433.md): JTBC(PHP) 3.0.1.8 allows Arbitrary File Upload via the console/#/console/file/manage.php?type=list URI, as demonstrated by a .php file. (no CVSS)
- [CVE-2019-8434](https://cve.now/CVE-2019-8434.md): In CmsEasy 7.0, there is XSS via the ckplayer.php autoplay parameter. (no CVSS)
- [CVE-2019-8435](https://cve.now/CVE-2019-8435.md): admin/default.php in PHPMyWind v5.5 has XSS via an HTTP Host header. (no CVSS)
- [CVE-2019-8436](https://cve.now/CVE-2019-8436.md): imcat 4.5 has Stored XSS via the root/run/adm.php fm\[instop\]\[note\] parameter. (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2019-02-18
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.