# CVEs published 2019-02-25

55 CVEs were published on February 25, 2019: 0 critical, 1 high. Days are UTC.

- [CVE-2018-11289](https://cve.now/CVE-2018-11289.md): Data truncation during higher to lower type conversion which causes less memory allocation than desired can lead to a buffer overflow in Sna (no CVSS, Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…)
- [CVE-2018-11820](https://cve.now/CVE-2018-11820.md): Use of non-time constant memcmp function creates side channel that leaks information and leads to cryptographic issues in Snapdragon Auto, S (no CVSS, Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…)
- [CVE-2018-11845](https://cve.now/CVE-2018-11845.md): Usage of non-time-constant comparison functions can lead to information leakage through side channel analysis in Snapdragon Auto, Snapdragon (no CVSS, Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…)
- [CVE-2018-11864](https://cve.now/CVE-2018-11864.md): Bytes can be written to fuses from Secure region which can be read later by HLOS in Snapdragon Auto, Snapdragon Compute, Snapdragon Connecti (no CVSS, Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…)
- [CVE-2018-11931](https://cve.now/CVE-2018-11931.md): Improper access to HLOS is possible while transferring memory to CPZ in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdr (no CVSS, Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…)
- [CVE-2018-11932](https://cve.now/CVE-2018-11932.md): Improper input validation can lead RW access to secure subsystem from HLOS in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, (no CVSS, Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…)
- [CVE-2018-11935](https://cve.now/CVE-2018-11935.md): Improper input validation might result in incorrect app id returned to the caller Instead of returning failure in Snapdragon Auto, Snapdrago (no CVSS, Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…)
- [CVE-2018-11938](https://cve.now/CVE-2018-11938.md): Improper input validation for argument received from HLOS can lead to buffer overflows and unexpected behavior in Snapdragon Auto, Snapdrago (no CVSS, Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…)
- [CVE-2018-11945](https://cve.now/CVE-2018-11945.md): Improper input validation in wireless service messaging module for data received from broadcast messages can lead to heap overflow in Snapdr (no CVSS, Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…)
- [CVE-2018-11948](https://cve.now/CVE-2018-11948.md): Exceeding the limit of usage entries are not tracked and the information will be lost causing the content to lose continuity in Snapdragon A (no CVSS, Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…)
- [CVE-2018-13900](https://cve.now/CVE-2018-13900.md): Use-after-free vulnerability will occur as there is no protection for the route table\`s rule in IPA driver in Snapdragon Auto, Snapdragon Co (no CVSS, Qualcomm Snapdragon Auto, Snapdragon Consumer IOT, Snapdrag…)
- [CVE-2018-13904](https://cve.now/CVE-2018-13904.md): Improper input validation in SCM handler to access storage in TZ can lead to unauthorized access in Snapdragon Auto, Snapdragon Compute, Sna (no CVSS, Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…)
- [CVE-2018-13905](https://cve.now/CVE-2018-13905.md): KGSL syncsource lock not handled properly during syncsource cleanup can lead to use after free issue in Snapdragon Auto, Snapdragon Consumer (no CVSS, Qualcomm Snapdragon Auto, Snapdragon Consumer IOT, Snapdrag…)
- [CVE-2018-13912](https://cve.now/CVE-2018-13912.md): Arbitrary write issue can occur when user provides kernel address in compat mode in Snapdragon Auto, Snapdragon Connectivity, Snapdragon Con (no CVSS, Qualcomm Snapdragon Auto, Snapdragon Connectivity, Snapdrag…)
- [CVE-2018-13913](https://cve.now/CVE-2018-13913.md): Improper validation of array index can lead to unauthorized access while processing debugFS in Snapdragon Auto, Snapdragon Consumer IOT, Sna (no CVSS, Qualcomm Snapdragon Auto, Snapdragon Consumer IOT, Snapdrag…)
- [CVE-2018-13914](https://cve.now/CVE-2018-13914.md): Lack of input validation for data received from user space can lead to an out of bound array issue in Snapdragon Auto, Snapdragon Consumer I (no CVSS, Qualcomm Snapdragon Auto, Snapdragon Consumer IOT, Snapdrag…)
- [CVE-2018-20063](https://cve.now/CVE-2018-20063.md): An issue was discovered in Gurock TestRail 5.6.0.3853. (no CVSS)
- [CVE-2018-5839](https://cve.now/CVE-2018-5839.md): Improperly configured memory protection allows read/write access to modem image from HLOS kernel in Snapdragon Auto, Snapdragon Compute, Sna (no CVSS, Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…)
- [CVE-2019-6265](https://cve.now/CVE-2019-6265.md): The Scripting and AutoUpdate functionality in Cordaware bestinformed Microsoft Windows client versions before 6.2.1.0 are affected by insecu (no CVSS)
- [CVE-2019-6266](https://cve.now/CVE-2019-6266.md): Cordaware bestinformed Microsoft Windows client before 6.2.1.0 is affected by insecure SSL certificate verification and insecure access patt (no CVSS)
- [CVE-2019-9162](https://cve.now/CVE-2019-9162.md): In the Linux kernel before 4.20.12, net/ipv4/netfilter/nf\_nat\_snmp\_basic\_main.c in the SNMP NAT module has insufficient ASN.1 length checks (no CVSS)
- [CVE-2018-20033](https://cve.now/CVE-2018-20033.md): A Remote Code Execution vulnerability in lmgrd and vendor daemon components of FlexNet Publisher version 11.16.1.0 and earlier could allow a (no CVSS, Flexera Software FlexNet Publisher)
- [CVE-2019-9151](https://cve.now/CVE-2019-9151.md): An issue was discovered in the HDF HDF5 1.10.4 library. (no CVSS)
- [CVE-2019-9152](https://cve.now/CVE-2019-9152.md): An issue was discovered in the HDF HDF5 1.10.4 library. (no CVSS)
- [CVE-2019-1689](https://cve.now/CVE-2019-1689.md): Cisco Webex Teams for iOS Arbitrary File Upload Vulnerability (CVSS 7.3, Cisco Webex Teams)
- [CVE-2019-9146](https://cve.now/CVE-2019-9146.md): Jamf Self Service 10.9.0 allows man-in-the-middle attackers to obtain a root shell by leveraging the "publish Bash shell scripts" feature to (no CVSS)
- [CVE-2019-1683](https://cve.now/CVE-2019-1683.md): Cisco SPA112, SPA525, and SPA5x5 Series IP Phones Certificate Validation Vulnerability (CVSS 6.5, Cisco Small Business SPA500 Series IP Phones · Cisco Sma… +2)
- [CVE-2019-9145](https://cve.now/CVE-2019-9145.md): An issue was discovered in Hsycms V1.1. (no CVSS)
- [CVE-2019-9142](https://cve.now/CVE-2019-9142.md): An issue was discovered in b3log Symphony (aka Sym) before v3.4.7. (no CVSS, org.b3log:symphony)
- [CVE-2019-9143](https://cve.now/CVE-2019-9143.md): An issue was discovered in Exiv2 0.27. (no CVSS)
- [CVE-2019-9144](https://cve.now/CVE-2019-9144.md): An issue was discovered in Exiv2 0.27. (no CVSS)
- [CVE-2019-9116](https://cve.now/CVE-2019-9116.md): DLL hijacking is possible in Sublime Text 3 version 3.1.1 build 3176 on 32-bit Windows platforms because a Trojan horse api-ms-win-core-fibe (no CVSS)
- [CVE-2018-20789](https://cve.now/CVE-2018-20789.md): tecrail Responsive FileManager 9.13.4 allows remote attackers to delete an arbitrary directory as a consequence of a paths\[0\] path traversal (no CVSS)
- [CVE-2018-20790](https://cve.now/CVE-2018-20790.md): tecrail Responsive FileManager 9.13.4 allows remote attackers to delete an arbitrary file as a consequence of a paths\[0\] path traversal miti (no CVSS)
- [CVE-2018-20791](https://cve.now/CVE-2018-20791.md): tecrail Responsive FileManager 9.13.4 allows XSS via a media file upload with an XSS payload in the name, because of mishandling of the medi (no CVSS)
- [CVE-2018-20792](https://cve.now/CVE-2018-20792.md): tecrail Responsive FileManager 9.13.4 allows remote attackers to read arbitrary file via path traversal with the path parameter, through the (no CVSS)
- [CVE-2018-20793](https://cve.now/CVE-2018-20793.md): tecrail Responsive FileManager 9.13.4 allows remote attackers to write to an arbitrary file as a consequence of a paths\[0\] path traversal mi (no CVSS)
- [CVE-2018-20794](https://cve.now/CVE-2018-20794.md): tecrail Responsive FileManager 9.13.4 allows remote attackers to write to an arbitrary image file (jpg/jpeg/png) via path traversal with the (no CVSS)
- [CVE-2018-20795](https://cve.now/CVE-2018-20795.md): tecrail Responsive FileManager 9.13.4 allows remote attackers to read arbitrary files via path traversal with the path parameter, through th (no CVSS)
- [CVE-2019-9122](https://cve.now/CVE-2019-9122.md): An issue was discovered on D-Link DIR-825 Rev.B 2.10 devices. (no CVSS)
- [CVE-2019-9123](https://cve.now/CVE-2019-9123.md): An issue was discovered on D-Link DIR-825 Rev.B 2.10 devices. (no CVSS)
- [CVE-2019-9124](https://cve.now/CVE-2019-9124.md): An issue was discovered on D-Link DIR-878 1.12B01 devices. (no CVSS)
- [CVE-2019-9125](https://cve.now/CVE-2019-9125.md): An issue was discovered on D-Link DIR-878 1.12B01 devices. (no CVSS)
- [CVE-2019-9126](https://cve.now/CVE-2019-9126.md): An issue was discovered on D-Link DIR-825 Rev.B 2.10 devices. (no CVSS)
- [CVE-2018-20787](https://cve.now/CVE-2018-20787.md): The ft5x46 touchscreen driver for custom Linux kernels on the Xiaomi perseus-p-oss MIX 3 device through 2018-11-26 has an integer overflow a (no CVSS)
- [CVE-2018-20788](https://cve.now/CVE-2018-20788.md): drivers/leds/leds-aw2023.c in the led driver for custom Linux kernels on the Xiaomi Redmi 6pro daisy-o-oss phone has several integer overflo (no CVSS)
- [CVE-2019-9111](https://cve.now/CVE-2019-9111.md): The msm gpu driver for custom Linux kernels on the Xiaomi perseus-p-oss MIX 3 device through 2018-11-26 has an integer overflow and OOPS bec (no CVSS)
- [CVE-2019-9112](https://cve.now/CVE-2019-9112.md): The msm gpu driver for custom Linux kernels on the Xiaomi perseus-p-oss MIX 3 device through 2018-11-26 has an integer overflow and OOPS bec (no CVSS)
- [CVE-2019-9113](https://cve.now/CVE-2019-9113.md): Ming (aka libming) 0.4.8 has a NULL pointer dereference in the function getString() in the decompile.c file in libutil.a. (no CVSS)
- [CVE-2019-9114](https://cve.now/CVE-2019-9114.md): Ming (aka libming) 0.4.8 has an out of bounds write vulnerability in the function strcpyext() in the decompile.c file in libutil.a. (no CVSS)
- [CVE-2019-9115](https://cve.now/CVE-2019-9115.md): In irisnet-crypto before 1.1.7 for IRISnet, the util/utils.js file allows code execution because of unsafe eval usage. (no CVSS, irisnet-crypto)
- [CVE-2019-9107](https://cve.now/CVE-2019-9107.md): XSS exists in WUZHI CMS 4.1.0 via index.php?m=attachment&f=imagecut&v=init&imgurl=\[XSS\] to coreframe/app/attachment/imagecut.php. (no CVSS)
- [CVE-2019-9108](https://cve.now/CVE-2019-9108.md): XSS exists in WUZHI CMS 4.1.0 via index.php?m=core&f=map&v=baidumap&x=\[XSS\]&y=\[XSS\] to coreframe/app/core/map.php. (no CVSS)
- [CVE-2019-9109](https://cve.now/CVE-2019-9109.md): XSS exists in WUZHI CMS 4.1.0 via index.php?m=message&f=message&v=add&username=\[XSS\] to coreframe/app/message/message.php. (no CVSS)
- [CVE-2019-9110](https://cve.now/CVE-2019-9110.md): XSS exists in WUZHI CMS 4.1.0 via index.php?m=content&f=postinfo&v=listing&set\_iframe=\[XSS\] to coreframe/app/content/postinfo.php. (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2019-02-25
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.