CVEs published February 26, 2019
19 CVEs were published on February 26, 2019: 1 critical, 0 high.
- Published
- 19
- Critical
- 1
- High
- 0
- Medium
- 0
- Low
- 0
- Unrated
- 18
- Now in CISA KEV
- 0
- Fix available
- 1
Most affected products
- F5 Networks BIG-IP
- 4
- studio-42/elfinder
- 1
Critical 1
Medium, low and unrated 18
- CVE-2019-9200A heap-based buffer underwrite exists in ImageStream::getLine() located at Stream.cc in Poppler 0.74.0 that can (for example) be triggered b
- CVE-2019-9194elFinder before 2.1.48 has a command injection vulnerability in the PHP connector.studio-42/elfinder
- CVE-2019-9195util/src/zip.rs in Grin before 1.0.2 mishandles suspicious files.
- CVE-2019-7392An improper authentication vulnerability in CA Privileged Access Manager 3.x Web-UI jk-manager and jk-status allows a remote attacker to gai
- CVE-2019-9191The ETSI Enterprise Transport Security (ETS, formerly known as eTLS) protocol does not provide per-session forward secrecy.
- CVE-2019-9192In the GNU C Library (aka glibc or libc6) through 2.29, check_dst_limits_calc_pos_1 in posix/regexec.c has Uncontrolled Recursion, as demons
- CVE-2019-6592On BIG-IP 14.1.0-14.1.0.1, TMM may restart and produce a core file when validating SSL certificates in client SSL or server SSL profiles.F5 Networks BIG-IP
- CVE-2019-6593On BIG-IP 11.5.1-11.5.4, 11.6.1, and 12.1.0, a virtual server configured with a Client SSL profile may be vulnerable to a chosen ciphertext F5 Networks BIG-IP
- CVE-2019-6594On BIG-IP 11.5.1-11.6.3.2, 12.1.3.4-12.1.3.7, 13.0.0 HF1-13.1.1.1, and 14.0.0-14.0.0.2, Multi-Path TCP (MPTCP) does not protect against multF5 Networks BIG-IP
- CVE-2019-6595Cross-site scripting (XSS) vulnerability in F5 BIG-IP Access Policy Manager (APM) 11.5.x and 11.6.x Admin Web UI.F5 Networks BIG-IP
- CVE-2019-9184SQL injection vulnerability in the J2Store plugin 3.x before 3.3.7 for Joomla! allows remote attackers to execute arbitrary SQL commands via
- CVE-2019-9181SchoolCMS version 2.3.1 allows file upload via the logo upload feature at admin.php?m=admin&c=site&a=save by using the .jpg extension, chang
- CVE-2019-9182There is a CSRF in ZZZCMS zzzphp V1.6.1 via a /admin015/save.php?act=editfile request.
- CVE-2009-5155In the GNU C Library (aka glibc or libc6) before 2.28, parse_reg_exp in posix/regcomp.c misparses alternatives, which allows attackers to ca
- CVE-2018-20796In the GNU C Library (aka glibc or libc6) through 2.29, check_dst_limits_calc_pos_1 in posix/regexec.c has Uncontrolled Recursion, as demons
- CVE-2019-9169In the GNU C Library (aka glibc or libc6) through 2.29, proceed_next_node in posix/regexec.c has a heap-based buffer over-read via an attemp
- CVE-2019-9168WooCommerce before 3.5.5 allows XSS via a Photoswipe caption.
- CVE-2019-9199PoDoFo::Impose::PdfTranslator::setSource() in pdftranslator.cpp in PoDoFo 0.9.6 has a NULL pointer dereference that can (for example) be tri