# CVEs published 2019-02-26

19 CVEs were published on February 26, 2019: 1 critical, 0 high. Days are UTC.

- [CVE-2019-9200](https://cve.now/CVE-2019-9200.md): A heap-based buffer underwrite exists in ImageStream::getLine() located at Stream.cc in Poppler 0.74.0 that can (for example) be triggered b (no CVSS)
- [CVE-2019-9201](https://cve.now/CVE-2019-9201.md): Multiple Phoenix Contact devices allow remote attackers to establish TCP sessions to port 1962 and obtain sensitive information or make chan (CVSS 9.8)
- [CVE-2019-9194](https://cve.now/CVE-2019-9194.md): elFinder before 2.1.48 has a command injection vulnerability in the PHP connector. (no CVSS, studio-42/elfinder)
- [CVE-2019-9195](https://cve.now/CVE-2019-9195.md): util/src/zip.rs in Grin before 1.0.2 mishandles suspicious files. (no CVSS)
- [CVE-2019-7392](https://cve.now/CVE-2019-7392.md): An improper authentication vulnerability in CA Privileged Access Manager 3.x Web-UI jk-manager and jk-status allows a remote attacker to gai (no CVSS)
- [CVE-2019-9191](https://cve.now/CVE-2019-9191.md): The ETSI Enterprise Transport Security (ETS, formerly known as eTLS) protocol does not provide per-session forward secrecy. (no CVSS)
- [CVE-2019-9192](https://cve.now/CVE-2019-9192.md): In the GNU C Library (aka glibc or libc6) through 2.29, check\_dst\_limits\_calc\_pos\_1 in posix/regexec.c has Uncontrolled Recursion, as demons (no CVSS)
- [CVE-2019-6592](https://cve.now/CVE-2019-6592.md): On BIG-IP 14.1.0-14.1.0.1, TMM may restart and produce a core file when validating SSL certificates in client SSL or server SSL profiles. (no CVSS, F5 Networks BIG-IP)
- [CVE-2019-6593](https://cve.now/CVE-2019-6593.md): On BIG-IP 11.5.1-11.5.4, 11.6.1, and 12.1.0, a virtual server configured with a Client SSL profile may be vulnerable to a chosen ciphertext (no CVSS, F5 Networks BIG-IP)
- [CVE-2019-6594](https://cve.now/CVE-2019-6594.md): On BIG-IP 11.5.1-11.6.3.2, 12.1.3.4-12.1.3.7, 13.0.0 HF1-13.1.1.1, and 14.0.0-14.0.0.2, Multi-Path TCP (MPTCP) does not protect against mult (no CVSS, F5 Networks BIG-IP)
- [CVE-2019-6595](https://cve.now/CVE-2019-6595.md): Cross-site scripting (XSS) vulnerability in F5 BIG-IP Access Policy Manager (APM) 11.5.x and 11.6.x Admin Web UI. (no CVSS, F5 Networks BIG-IP)
- [CVE-2019-9184](https://cve.now/CVE-2019-9184.md): SQL injection vulnerability in the J2Store plugin 3.x before 3.3.7 for Joomla! allows remote attackers to execute arbitrary SQL commands via (no CVSS)
- [CVE-2019-9181](https://cve.now/CVE-2019-9181.md): SchoolCMS version 2.3.1 allows file upload via the logo upload feature at admin.php?m=admin&c=site&a=save by using the .jpg extension, chang (no CVSS)
- [CVE-2019-9182](https://cve.now/CVE-2019-9182.md): There is a CSRF in ZZZCMS zzzphp V1.6.1 via a /admin015/save.php?act=editfile request. (no CVSS)
- [CVE-2009-5155](https://cve.now/CVE-2009-5155.md): In the GNU C Library (aka glibc or libc6) before 2.28, parse\_reg\_exp in posix/regcomp.c misparses alternatives, which allows attackers to ca (no CVSS)
- [CVE-2018-20796](https://cve.now/CVE-2018-20796.md): In the GNU C Library (aka glibc or libc6) through 2.29, check\_dst\_limits\_calc\_pos\_1 in posix/regexec.c has Uncontrolled Recursion, as demons (no CVSS)
- [CVE-2019-9169](https://cve.now/CVE-2019-9169.md): In the GNU C Library (aka glibc or libc6) through 2.29, proceed\_next\_node in posix/regexec.c has a heap-based buffer over-read via an attemp (no CVSS)
- [CVE-2019-9168](https://cve.now/CVE-2019-9168.md): WooCommerce before 3.5.5 allows XSS via a Photoswipe caption. (no CVSS)
- [CVE-2019-9199](https://cve.now/CVE-2019-9199.md): PoDoFo::Impose::PdfTranslator::setSource() in pdftranslator.cpp in PoDoFo 0.9.6 has a NULL pointer dereference that can (for example) be tri (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2019-02-26
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.