CVEs published February 28, 2019
54 CVEs were published on February 28, 2019: 1 critical, 2 high.
- Published
- 54
- Critical
- 1
- High
- 2
- Medium
- 2
- Low
- 0
- Unrated
- 49
- Now in CISA KEV
- 0
- Fix available
- 31
Most affected products
- Android
- 14
- Mozilla Firefox
- 12
- Mozilla Firefox · Mozilla Thunderbird
- 5
- Mozilla Thunderbird · Mozilla Firefox ESR +1
- 5
- Mozilla Firefox ESR · Mozilla Firefox
- 3
- McAfee Agent
- 2
- Cisco RV110W Wireless-N VPN Firewall · Cisco RV130W Wire… +1
- 1
- Cisco Webex Meetings Desktop App · Cisco Webex Productivity…
- 1
- ICS-CERT Cscape
- 1
- ICS-CERT Delta Industrial Automation CNCSoft
- 1
Critical 1
High 2
Medium, low and unrated 51
- CVE-2019-6547Delta Industrial Automation CNCSoft, CNCSoft ScreenEditor Version 1.00.84 and prior.ICS-CERT Delta Industrial Automation CNCSoft
- CVE-2019-6551Pangea Communications Internet FAX ATA all Versions 3.1.8 and prior allow an attacker to bypass user authentication using a specially crafteICS-CERT Pangea Communications Internet FAX ATA
- CVE-2019-6555Cscape, 9.80 SP4 and prior.ICS-CERT Cscape
- CVE-2018-12388Mozilla developers and community members reported memory safety bugs present in Firefox 62.Mozilla Firefox
- CVE-2018-12389Mozilla developers and community members reported memory safety bugs present in Firefox ESR 60.2.Mozilla Firefox ESR · Mozilla Thunderbird
- CVE-2018-12390Mozilla developers and community members reported memory safety bugs present in Firefox 62 and Firefox ESR 60.2.Mozilla Firefox · Mozilla Thunderbird
- CVE-2018-12391During HTTP Live Stream playback on Firefox for Android, audio data can be accessed across origins in violation of security policies.Mozilla Firefox · Mozilla Thunderbird
- CVE-2018-12392When manipulating user events in nested loops while opening a document through script, it is possible to trigger a potentially exploitable cMozilla Firefox · Mozilla Thunderbird
- CVE-2018-12393A potential vulnerability was found in 32-bit builds where an integer overflow during the conversion of scripts to an internal UTF-16 represMozilla Firefox · Mozilla Thunderbird
- CVE-2018-12395By rewriting the Host: request headers using the webRequest API, a WebExtension can bypass domain restrictions through domain fronting.Mozilla Firefox ESR · Mozilla Firefox
- CVE-2018-12396A vulnerability where a WebExtension can run content scripts in disallowed contexts following navigation or other events.Mozilla Firefox ESR · Mozilla Firefox
- CVE-2018-12397A WebExtension can request access to local files without the warning prompt stating that the extension will "Access your data for all websitMozilla Firefox ESR · Mozilla Firefox
- CVE-2018-12398By using the reflected URL in some special resource URIs, such as chrome:, it is possible to inject stylesheets and bypass Content Security Mozilla Firefox
- CVE-2018-12399When a new protocol handler is registered, the API accepts a title argument which can be used to mislead users about which domain is registeMozilla Firefox
- CVE-2018-12400In private browsing mode on Firefox for Android, favicons are cached in the cache/icons folder as they are in non-private mode.Mozilla Firefox
- CVE-2018-12401Some special resource URIs will cause a non-exploitable crash if loaded with optional parameters following a '?' in the parsed string.Mozilla Firefox
- CVE-2018-12402The internal WebBrowserPersist code does not use correct origin context for a resource being saved.Mozilla Firefox
- CVE-2018-12403If a site is loaded over a HTTPS connection but loads a favicon resource over HTTP, the mixed content warning is not displayed to users.Mozilla Firefox
- CVE-2018-12405Mozilla developers and community members reported memory safety bugs present in Firefox 63 and Firefox ESR 60.3.Mozilla Thunderbird · Mozilla Firefox ESR +1
- CVE-2018-12406Mozilla developers and community members reported memory safety bugs present in Firefox 63.Mozilla Firefox
- CVE-2018-12407A buffer overflow occurs when drawing and validating elements with the ANGLE graphics library, used for WebGL content, when working with theMozilla Firefox
- CVE-2018-18492A use-after-free vulnerability can occur after deleting a selection element due to a weak reference to the select element in the options colMozilla Thunderbird · Mozilla Firefox ESR +1
- CVE-2018-18493A buffer overflow can occur in the Skia library during buffer offset calculations with hardware accelerated canvas 2D actions due to the useMozilla Thunderbird · Mozilla Firefox ESR +1
- CVE-2018-18494A same-origin policy violation allowing the theft of cross-origin URL entries when using the Javascript location property to cause a redirecMozilla Thunderbird · Mozilla Firefox ESR +1
- CVE-2018-18495WebExtension content scripts can be loaded into about: pages in some circumstances, in violation of the permissions granted to extensions.Mozilla Firefox
- CVE-2018-18496When the RSS Feed preview about:feeds page is framed within another page, it can be used in concert with scripted content for a clickjackingMozilla Firefox
- CVE-2018-18497Limitations on the URIs allowed to WebExtensions by the browser.windows.create API can be bypassed when a pipe in the URL field is used withMozilla Firefox
- CVE-2018-18498A potential vulnerability leading to an integer overflow can occur during buffer size calculations for images when a raw value is used insteMozilla Thunderbird · Mozilla Firefox ESR +1
- CVE-2018-18499A same-origin policy violation allowing the theft of cross-origin URL entries when using a meta http-equiv="refresh" on a page to cause a reMozilla Firefox · Mozilla Thunderbird
- CVE-2019-1986In SkSwizzler::onSetSampleX of SkSwizzler.cpp, there is a possible out of bounds write due to a missing bounds check.Android
- CVE-2019-1987In onSetSampleX of SkSwizzler.cpp, there is a possible out of bounds write due to a missing bounds check.Android
- CVE-2019-1988In sample6 of SkSwizzler.cpp, there is a possible out of bounds write due to improper input validation.Android
- CVE-2019-1991In btif_dm_data_copy of btif_core.cc, there is a possible out of bounds write due to a buffer overflow.Android
- CVE-2019-1992In bta_hl_sdp_query_results of bta_hl_main.cc, there is a possible use-after-free due to a race condition.Android
- CVE-2019-1993In register_app of btif_hd.cc, there is a possible memory corruption due to an integer overflow.Android
- CVE-2019-1994In refresh of DevelopmentTiles.java, there is the possibility of leaving development settings accessible due to an insecure default value.Android
- CVE-2019-1995In ComposeActivityEmail of ComposeActivityEmail.java, there is a possible way to silently attach files to an email due to a confused deputy.Android
- CVE-2019-1996In avrc_pars_browse_rsp of avrc_pars_ct.cc, there is a possible out of bounds read due to a missing bounds check.Android
- CVE-2019-1997In random_get_bytes of random.c, there is a possible degradation of randomness due to an insecure default value.Android
- CVE-2019-1998In event_handler of keymaster_app.c, there is possible resource exhaustion due to a table being lost on reboot.Android
- CVE-2019-1999In binder_alloc_free_page of binder_alloc.c, there is a possible double free due to improper locking.Android
- CVE-2019-2000In several functions of binder.c, there is possible memory corruption due to a use after free.Android
- CVE-2019-2001The permissions on /proc/iomem were world-readable.Android
- CVE-2019-3598McAfee Agent update fixes a vulnerability in handling UDP requestsMcAfee Agent
- CVE-2019-3599McAfee Agent update fixes an Information Disclosure vulnerabilityMcAfee Agent
- CVE-2019-9226An issue was discovered in baigo CMS 2.1.1.
- CVE-2019-9227An issue was discovered in baigo CMS 2.1.1.
- CVE-2019-9208In Wireshark 2.4.0 to 2.4.12 and 2.6.0 to 2.6.6, the TCAP dissector could crash.
- CVE-2019-9209In Wireshark 2.4.0 to 2.4.12 and 2.6.0 to 2.6.6, the ASN.1 BER and related dissectors could crash.
- CVE-2019-9214In Wireshark 2.4.0 to 2.4.12 and 2.6.0 to 2.6.6, the RPCAP dissector could crash.
- CVE-2019-9215In Live555 before 2019.02.27, malformed headers lead to invalid memory access in the parseAuthorizationHeader function.