CVEs published February 20, 2019
25 CVEs were published on February 20, 2019: 0 critical, 2 high.
- Published
- 25
- Critical
- 0
- High
- 2
- Medium
- 1
- Low
- 0
- Unrated
- 22
- Now in CISA KEV
- 0
- Fix available
- 12
Most affected products
- Atlassian Fisheye and Crucible
- 2
- Flexera Software LibRaw
- 2
- Micro Focus Filr
- 2
- bootstrap · bootstrap-sass +5
- 1
- Cisco HyperFlex HX-Series
- 1
- Flexera Software libexif
- 1
- Jenkins project Jenkins Cloud Foundry Plugin · org.jenkins-…
- 1
- Jenkins project Jenkins JMS Messaging Plugin · org.jenkins-…
- 1
- Jenkins project Jenkins Mattermost Notification Plugin · or…
- 1
- Jenkins project Jenkins OctopusDeploy Plugin · hudson.plugi…
- 1
High 2
Medium, low and unrated 23
- CVE-2019-3474Path traversal vulnerability in Filr web applicationMicro Focus Filr
- CVE-2019-1003024A sandbox bypass vulnerability exists in Jenkins Script Security Plugin 1.52 and earlier in RejectASTTransformsCustomizer.java that allows aJenkins project Jenkins Script Security Plugin · org.jenkin…
- CVE-2019-1003025A exposure of sensitive information vulnerability exists in Jenkins Cloud Foundry Plugin 2.3.1 and earlier in AbstractCloudFoundryPushDescriJenkins project Jenkins Cloud Foundry Plugin · org.jenkins-…
- CVE-2019-1003026A server-side request forgery vulnerability exists in Jenkins Mattermost Notification Plugin 2.6.2 and earlier in MattermostNotifier.java thJenkins project Jenkins Mattermost Notification Plugin · or…
- CVE-2019-1003027A server-side request forgery vulnerability exists in Jenkins OctopusDeploy Plugin 1.8.1 and earlier in OctopusDeployPlugin.java that allowsJenkins project Jenkins OctopusDeploy Plugin · hudson.plugi…
- CVE-2019-1003028A server-side request forgery vulnerability exists in Jenkins JMS Messaging Plugin 1.1.1 and earlier in SSLCertificateAuthenticationMethod.jJenkins project Jenkins JMS Messaging Plugin · org.jenkins-…
- CVE-2019-3924MikroTik RouterOS before 6.43.12 (stable) and 6.42.12 (long-term) is vulnerable to an intermediary vulnerability.Tenable MikroTik RouterOS
- CVE-2018-5817A type confusion error within the "unpacked_load_raw()" function within LibRaw versions prior to 0.19.1 (internal/dcraw_common.cpp) can be eFlexera Software LibRaw
- CVE-2018-5818An error within the "parse_rollei()" function (internal/dcraw_common.cpp) within LibRaw versions prior to 0.19.1 can be exploited to trigger
- CVE-2018-5819An error within the "parse_sinar_ia()" function (internal/dcraw_common.cpp) within LibRaw versions prior to 0.19.1 can be exploited to exhauFlexera Software LibRaw
- CVE-2018-20030An error when processing the EXIF_IFD_INTEROPERABILITY and EXIF_IFD_EXIF tags within libexif version 0.6.21 can be exploited to exhaust avaiFlexera Software libexif
- CVE-2019-8954In Indexhibit 2.1.5, remote attackers can execute arbitrary code via the v parameter (in conjunction with the id parameter) in a upd_jxcode=
- CVE-2019-8331In Bootstrap before 3.4.1 and 4.3.x before 4.3.1, XSS is possible in the tooltip or popover data-template attribute.bootstrap · bootstrap-sass +5
- CVE-2019-8953The HAProxy package before 0.59_16 for pfSense has XSS via the desc (aka Description) or table_actionsaclN parameter, related to haproxy_lis
- CVE-2018-20240The administrative linker functionality in Atlassian Fisheye and Crucible before version 4.7.0 allows remote attackers to inject arbitrary HAtlassian Fisheye and Crucible
- CVE-2018-20241The Edit upload resource for a review in Atlassian Fisheye and Crucible before version 4.7.0 allows remote attackers to inject arbitrary HTMAtlassian Fisheye and Crucible
- CVE-2019-8948PaperCut MF before 18.3.6 and PaperCut NG before 18.3.6 allow script injection via the user interface, aka PC-15163.
- CVE-2019-8950The backdoor account dnsekakf2$$ in /bin/login on DASAN H665 devices with firmware 1.46p1-0028 allows an attacker to login to the admin acco
- CVE-2019-8942WordPress before 4.9.9 and 5.x before 5.0.1 allows remote code execution because an _wp_attached_file Post Meta entry can be changed to an a
- CVE-2019-8943WordPress through 5.0.3 allows Path Traversal in wp_crop_image().
- CVE-2019-8944An Information Exposure issue in the Terraform deployment step in Octopus Deploy before 2019.1.8 (and before 2018.10.4 LTS) allows remote au
- CVE-2018-19106Avi Vantage before 17.2.13 uses an invalid URL encoding during a redirect operation, aka AV-33959.
- CVE-2019-7164SQLAlchemy through 1.2.17 and 1.3.x through 1.3.0b2 allows SQL Injection via the order_by parameter.sqlalchemy