# CVEs published 2019-02-20 25 CVEs were published on February 20, 2019: 0 critical, 2 high. Days are UTC. - [CVE-2018-15380](https://cve.now/CVE-2018-15380.md): Cisco HyperFlex Software Command Injection Vulnerability (CVSS 8.8, Cisco HyperFlex HX-Series) - [CVE-2019-3474](https://cve.now/CVE-2019-3474.md): Path traversal vulnerability in Filr web application (CVSS 6.5, Micro Focus Filr) - [CVE-2019-3475](https://cve.now/CVE-2019-3475.md): Local privilege escalation in Filr famtd (CVSS 7.8, Micro Focus Filr) - [CVE-2019-1003024](https://cve.now/CVE-2019-1003024.md): A sandbox bypass vulnerability exists in Jenkins Script Security Plugin 1.52 and earlier in RejectASTTransformsCustomizer.java that allows a (no CVSS, Jenkins project Jenkins Script Security Plugin · org.jenkin…) - [CVE-2019-1003025](https://cve.now/CVE-2019-1003025.md): A exposure of sensitive information vulnerability exists in Jenkins Cloud Foundry Plugin 2.3.1 and earlier in AbstractCloudFoundryPushDescri (no CVSS, Jenkins project Jenkins Cloud Foundry Plugin · org.jenkins-…) - [CVE-2019-1003026](https://cve.now/CVE-2019-1003026.md): A server-side request forgery vulnerability exists in Jenkins Mattermost Notification Plugin 2.6.2 and earlier in MattermostNotifier.java th (no CVSS, Jenkins project Jenkins Mattermost Notification Plugin · or…) - [CVE-2019-1003027](https://cve.now/CVE-2019-1003027.md): A server-side request forgery vulnerability exists in Jenkins OctopusDeploy Plugin 1.8.1 and earlier in OctopusDeployPlugin.java that allows (no CVSS, Jenkins project Jenkins OctopusDeploy Plugin · hudson.plugi…) - [CVE-2019-1003028](https://cve.now/CVE-2019-1003028.md): A server-side request forgery vulnerability exists in Jenkins JMS Messaging Plugin 1.1.1 and earlier in SSLCertificateAuthenticationMethod.j (no CVSS, Jenkins project Jenkins JMS Messaging Plugin · org.jenkins-…) - [CVE-2019-3924](https://cve.now/CVE-2019-3924.md): MikroTik RouterOS before 6.43.12 (stable) and 6.42.12 (long-term) is vulnerable to an intermediary vulnerability. (no CVSS, Tenable MikroTik RouterOS) - [CVE-2018-5817](https://cve.now/CVE-2018-5817.md): A type confusion error within the "unpacked\_load\_raw()" function within LibRaw versions prior to 0.19.1 (internal/dcraw\_common.cpp) can be e (no CVSS, Flexera Software LibRaw) - [CVE-2018-5818](https://cve.now/CVE-2018-5818.md): An error within the "parse\_rollei()" function (internal/dcraw\_common.cpp) within LibRaw versions prior to 0.19.1 can be exploited to trigger (no CVSS) - [CVE-2018-5819](https://cve.now/CVE-2018-5819.md): An error within the "parse\_sinar\_ia()" function (internal/dcraw\_common.cpp) within LibRaw versions prior to 0.19.1 can be exploited to exhau (no CVSS, Flexera Software LibRaw) - [CVE-2018-20030](https://cve.now/CVE-2018-20030.md): An error when processing the EXIF\_IFD\_INTEROPERABILITY and EXIF\_IFD\_EXIF tags within libexif version 0.6.21 can be exploited to exhaust avai (no CVSS, Flexera Software libexif) - [CVE-2019-8954](https://cve.now/CVE-2019-8954.md): In Indexhibit 2.1.5, remote attackers can execute arbitrary code via the v parameter (in conjunction with the id parameter) in a upd\_jxcode= (no CVSS) - [CVE-2019-8331](https://cve.now/CVE-2019-8331.md): In Bootstrap before 3.4.1 and 4.3.x before 4.3.1, XSS is possible in the tooltip or popover data-template attribute. (no CVSS, bootstrap · bootstrap-sass +5) - [CVE-2019-8953](https://cve.now/CVE-2019-8953.md): The HAProxy package before 0.59\_16 for pfSense has XSS via the desc (aka Description) or table\_actionsaclN parameter, related to haproxy\_lis (no CVSS) - [CVE-2018-20240](https://cve.now/CVE-2018-20240.md): The administrative linker functionality in Atlassian Fisheye and Crucible before version 4.7.0 allows remote attackers to inject arbitrary H (no CVSS, Atlassian Fisheye and Crucible) - [CVE-2018-20241](https://cve.now/CVE-2018-20241.md): The Edit upload resource for a review in Atlassian Fisheye and Crucible before version 4.7.0 allows remote attackers to inject arbitrary HTM (no CVSS, Atlassian Fisheye and Crucible) - [CVE-2019-8948](https://cve.now/CVE-2019-8948.md): PaperCut MF before 18.3.6 and PaperCut NG before 18.3.6 allow script injection via the user interface, aka PC-15163. (no CVSS) - [CVE-2019-8950](https://cve.now/CVE-2019-8950.md): The backdoor account dnsekakf2$$ in /bin/login on DASAN H665 devices with firmware 1.46p1-0028 allows an attacker to login to the admin acco (no CVSS) - [CVE-2019-8942](https://cve.now/CVE-2019-8942.md): WordPress before 4.9.9 and 5.x before 5.0.1 allows remote code execution because an \_wp\_attached\_file Post Meta entry can be changed to an a (no CVSS) - [CVE-2019-8943](https://cve.now/CVE-2019-8943.md): WordPress through 5.0.3 allows Path Traversal in wp\_crop\_image(). (no CVSS) - [CVE-2019-8944](https://cve.now/CVE-2019-8944.md): An Information Exposure issue in the Terraform deployment step in Octopus Deploy before 2019.1.8 (and before 2018.10.4 LTS) allows remote au (no CVSS) - [CVE-2018-19106](https://cve.now/CVE-2018-19106.md): Avi Vantage before 17.2.13 uses an invalid URL encoding during a redirect operation, aka AV-33959. (no CVSS) - [CVE-2019-7164](https://cve.now/CVE-2019-7164.md): SQLAlchemy through 1.2.17 and 1.3.x through 1.3.0b2 allows SQL Injection via the order\_by parameter. (no CVSS, sqlalchemy) --- Source: cve.now, built and run by Sazabi (AI-native observability and security) Page: https://cve.now/daily/2019-02-20 Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.