# CVEs published 2019-02-21

35 CVEs were published on February 21, 2019: 0 critical, 5 high. 1 is now in CISA KEV. Days are UTC.

- [CVE-2019-8955](https://cve.now/CVE-2019-8955.md): In Tor before 0.3.3.12, 0.3.4.x before 0.3.4.11, 0.3.5.x before 0.3.5.8, and 0.4.x before 0.4.0.2-alpha, remote denial of service against To (no CVSS)
- [CVE-2019-1691](https://cve.now/CVE-2019-1691.md): Cisco Firepower Threat Defense Software SSL or TLS Denial of Service Vulnerability (CVSS 5.8, Cisco Firepower Threat Defense Software)
- [CVE-2019-1698](https://cve.now/CVE-2019-1698.md): Cisco IoT Field Network Director XML External Entity Vulnerability (CVSS 4.9, Cisco IoT Field Network Director)
- [CVE-2019-1700](https://cve.now/CVE-2019-1700.md): Cisco Firepower 9000 Series Firepower 2-Port 100G Double-Width Network Module Queue Wedge Denial of Service Vulnerability (CVSS 6.1, Cisco Firepower Extensible Operating System)
- [CVE-2019-6340](https://cve.now/CVE-2019-6340.md): Drupal core - Highly critical - Remote Code Execution (CVSS 8.1, KEV, Drupal Core · drupal/core +1)
- [CVE-2019-1667](https://cve.now/CVE-2019-1667.md): Cisco HyperFlex Arbitrary Statistics Write Vulnerability (CVSS 4.0, Cisco HyperFlex HX-Series)
- [CVE-2019-1681](https://cve.now/CVE-2019-1681.md): Cisco Network Convergence System 1000 Series TFTP Directory Traversal Vulnerability (CVSS 7.5, Cisco Network Convergence System 1000 Series)
- [CVE-2019-1684](https://cve.now/CVE-2019-1684.md): Cisco IP Phone 7800 and 8800 Series Cisco Discovery Protocol and Link Layer Discovery Protocol Denial of Service Vulnerability (CVSS 6.5, Cisco IP Phone 8800 Series Software)
- [CVE-2019-1685](https://cve.now/CVE-2019-1685.md): Cisco Unity Connection Reflected Cross-Site Scripting Vulnerability (CVSS 6.1, Cisco Unity Connection)
- [CVE-2018-20783](https://cve.now/CVE-2018-20783.md): In PHP before 5.6.39, 7.x before 7.0.33, 7.1.x before 7.1.25, and 7.2.x before 7.2.13, a buffer over-read in PHAR reading functions may allo (no CVSS)
- [CVE-2019-1664](https://cve.now/CVE-2019-1664.md): Cisco HyperFlex Software Unauthenticated Root Access Vulnerability (CVSS 8.1, Cisco HyperFlex HX-Series)
- [CVE-2019-1665](https://cve.now/CVE-2019-1665.md): Cisco Hyperflex Stored Cross-Site Scripting Vulnerability (CVSS 4.7, Cisco HyperFlex HX-Series)
- [CVE-2019-1666](https://cve.now/CVE-2019-1666.md): Cisco HyperFlex Unauthenticated Statistics Retrieval Vulnerability (CVSS 5.3, Cisco HyperFlex HX-Series)
- [CVE-2019-8985](https://cve.now/CVE-2019-8985.md): On Netis WF2411 with firmware 2.1.36123 and other Netis WF2xxx devices (possibly WF2411 through WF2880), there is a stack-based buffer overf (no CVSS)
- [CVE-2018-1944](https://cve.now/CVE-2018-1944.md): IBM Security Identity Governance and Intelligence 5.2 through 5.2.4.1 Virtual Appliance contains hard-coded credentials, such as a password (CVSS 5.1, IBM Security Identity Governance and Intelligence)
- [CVE-2018-1945](https://cve.now/CVE-2018-1945.md): IBM Security Identity Governance and Intelligence 5.2 through 5.2.4.1 Virtual Appliance could allow a remote attacker to hijack the clicking (CVSS 6.1, IBM Security Identity Governance and Intelligence)
- [CVE-2018-1946](https://cve.now/CVE-2018-1946.md): IBM Security Identity Governance and Intelligence 5.2 through 5.2.4.1 Virtual Appliance supports interaction between multiple actors and all (CVSS 5.9, IBM Security Identity Governance and Intelligence)
- [CVE-2018-1947](https://cve.now/CVE-2018-1947.md): IBM Security Identity Governance and Intelligence 5.2 through 5.2.4.1 Virtual Appliance is vulnerable to cross-site scripting. (CVSS 6.1, IBM Security Identity Governance and Intelligence)
- [CVE-2018-1948](https://cve.now/CVE-2018-1948.md): IBM Security Identity Governance and Intelligence 5.2 through 5.2.4.1 Virtual Appliance does not set the secure attribute on authorization t (CVSS 4.3, IBM Security Identity Governance and Intelligence)
- [CVE-2018-1949](https://cve.now/CVE-2018-1949.md): IBM Security Identity Governance and Intelligence 5.2 through 5.2.4.1 Virtual Appliance discloses sensitive information to unauthorized user (CVSS 4.3, IBM Security Identity Governance and Intelligence)
- [CVE-2018-1950](https://cve.now/CVE-2018-1950.md): IBM Security Identity Governance and Intelligence 5.2 through 5.2.4.1 Virtual Appliance generates an error message that includes sensitive i (CVSS 4.3, IBM Security Identity Governance and Intelligence)
- [CVE-2018-2006](https://cve.now/CVE-2018-2006.md): IBM Robotic Process Automation with Automation Anywhere 11 could allow a remote attacker to traverse directories on the system. (CVSS 4.9, IBM Robotic Process Automation with Automation Anywhere)
- [CVE-2019-1662](https://cve.now/CVE-2019-1662.md): Cisco Prime Collaboration Assurance Software Unauthenticated Access Vulnerability (CVSS 8.2, Cisco Prime Collaboration Assurance)
- [CVE-2019-1659](https://cve.now/CVE-2019-1659.md): Cisco Prime Infrastructure Certificate Validation Vulnerability (CVSS 7.4, Cisco Prime Infrastructure)
- [CVE-2019-8983](https://cve.now/CVE-2019-8983.md): MDaemon Webmail 14.x through 18.x before 18.5.2 has XSS (issue 1 of 2). (no CVSS)
- [CVE-2019-8984](https://cve.now/CVE-2019-8984.md): MDaemon Webmail 14.x through 18.x before 18.5.2 has XSS (issue 2 of 2). (no CVSS)
- [CVE-2018-20122](https://cve.now/CVE-2018-20122.md): The web interface on FASTGate Fastweb devices with firmware through 0.00.47\_FW\_200\_Askey 2017-05-17 (software through 1.0.1b) exposed a CGI (no CVSS)
- [CVE-2018-6687](https://cve.now/CVE-2018-6687.md): GetSusp (a free McAfee tool) update fixes an infinite loop vulnerability (CVE-2018-6687) (CVSS 6.5, McAfee GetSusp)
- [CVE-2019-8982](https://cve.now/CVE-2019-8982.md): com/wavemaker/studio/StudioService.java in WaveMaker Studio 6.6 mishandles the studioService.download?method=getContent&inUrl= value, leadin (no CVSS)
- [CVE-2019-8979](https://cve.now/CVE-2019-8979.md): Kohana through 3.3.6 has SQL Injection when the order\_by() parameter can be controlled. (no CVSS)
- [CVE-2019-8980](https://cve.now/CVE-2019-8980.md): A memory leak in the kernel\_read\_file function in fs/exec.c in the Linux kernel through 4.20.11 allows attackers to cause a denial of servic (no CVSS)
- [CVE-2013-7469](https://cve.now/CVE-2013-7469.md): Seafile through 6.2.11 always uses the same Initialization Vector (IV) with Cipher Block Chaining (CBC) Mode to encrypt private data, making (no CVSS)
- [CVE-2018-20146](https://cve.now/CVE-2018-20146.md): An issue was discovered in Liquidware ProfileUnity before 6.8.0 with Liquidware FlexApp before 6.8.0. (no CVSS)
- [CVE-2019-5727](https://cve.now/CVE-2019-5727.md): Splunk Web in Splunk Enterprise 6.5.x before 6.5.5, 6.4.x before 6.4.9, 6.3.x before 6.3.12, 6.2.x before 6.2.14, 6.1.x before 6.1.14, and 6 (no CVSS)
- [CVE-2019-8996](https://cve.now/CVE-2019-8996.md): In Signiant Manager+Agents before 13.5, the implementation of the set command has a Buffer Overflow. (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2019-02-21
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.