# CVEs published 2019-02-28

54 CVEs were published on February 28, 2019: 1 critical, 2 high. Days are UTC.

- [CVE-2019-6547](https://cve.now/CVE-2019-6547.md): Delta Industrial Automation CNCSoft, CNCSoft ScreenEditor Version 1.00.84 and prior. (no CVSS, ICS-CERT Delta Industrial Automation CNCSoft)
- [CVE-2019-6551](https://cve.now/CVE-2019-6551.md): Pangea Communications Internet FAX ATA all Versions 3.1.8 and prior allow an attacker to bypass user authentication using a specially crafte (no CVSS, ICS-CERT Pangea Communications Internet FAX ATA)
- [CVE-2019-6555](https://cve.now/CVE-2019-6555.md): Cscape, 9.80 SP4 and prior. (no CVSS, ICS-CERT Cscape)
- [CVE-2018-12388](https://cve.now/CVE-2018-12388.md): Mozilla developers and community members reported memory safety bugs present in Firefox 62. (no CVSS, Mozilla Firefox)
- [CVE-2018-12389](https://cve.now/CVE-2018-12389.md): Mozilla developers and community members reported memory safety bugs present in Firefox ESR 60.2. (no CVSS, Mozilla Firefox ESR · Mozilla Thunderbird)
- [CVE-2018-12390](https://cve.now/CVE-2018-12390.md): Mozilla developers and community members reported memory safety bugs present in Firefox 62 and Firefox ESR 60.2. (no CVSS, Mozilla Firefox · Mozilla Thunderbird)
- [CVE-2018-12391](https://cve.now/CVE-2018-12391.md): During HTTP Live Stream playback on Firefox for Android, audio data can be accessed across origins in violation of security policies. (no CVSS, Mozilla Firefox · Mozilla Thunderbird)
- [CVE-2018-12392](https://cve.now/CVE-2018-12392.md): When manipulating user events in nested loops while opening a document through script, it is possible to trigger a potentially exploitable c (no CVSS, Mozilla Firefox · Mozilla Thunderbird)
- [CVE-2018-12393](https://cve.now/CVE-2018-12393.md): A potential vulnerability was found in 32-bit builds where an integer overflow during the conversion of scripts to an internal UTF-16 repres (no CVSS, Mozilla Firefox · Mozilla Thunderbird)
- [CVE-2018-12395](https://cve.now/CVE-2018-12395.md): By rewriting the Host: request headers using the webRequest API, a WebExtension can bypass domain restrictions through domain fronting. (no CVSS, Mozilla Firefox ESR · Mozilla Firefox)
- [CVE-2018-12396](https://cve.now/CVE-2018-12396.md): A vulnerability where a WebExtension can run content scripts in disallowed contexts following navigation or other events. (no CVSS, Mozilla Firefox ESR · Mozilla Firefox)
- [CVE-2018-12397](https://cve.now/CVE-2018-12397.md): A WebExtension can request access to local files without the warning prompt stating that the extension will "Access your data for all websit (no CVSS, Mozilla Firefox ESR · Mozilla Firefox)
- [CVE-2018-12398](https://cve.now/CVE-2018-12398.md): By using the reflected URL in some special resource URIs, such as chrome:, it is possible to inject stylesheets and bypass Content Security (no CVSS, Mozilla Firefox)
- [CVE-2018-12399](https://cve.now/CVE-2018-12399.md): When a new protocol handler is registered, the API accepts a title argument which can be used to mislead users about which domain is registe (no CVSS, Mozilla Firefox)
- [CVE-2018-12400](https://cve.now/CVE-2018-12400.md): In private browsing mode on Firefox for Android, favicons are cached in the cache/icons folder as they are in non-private mode. (no CVSS, Mozilla Firefox)
- [CVE-2018-12401](https://cve.now/CVE-2018-12401.md): Some special resource URIs will cause a non-exploitable crash if loaded with optional parameters following a '?' in the parsed string. (no CVSS, Mozilla Firefox)
- [CVE-2018-12402](https://cve.now/CVE-2018-12402.md): The internal WebBrowserPersist code does not use correct origin context for a resource being saved. (no CVSS, Mozilla Firefox)
- [CVE-2018-12403](https://cve.now/CVE-2018-12403.md): If a site is loaded over a HTTPS connection but loads a favicon resource over HTTP, the mixed content warning is not displayed to users. (no CVSS, Mozilla Firefox)
- [CVE-2018-12405](https://cve.now/CVE-2018-12405.md): Mozilla developers and community members reported memory safety bugs present in Firefox 63 and Firefox ESR 60.3. (no CVSS, Mozilla Thunderbird · Mozilla Firefox ESR +1)
- [CVE-2018-12406](https://cve.now/CVE-2018-12406.md): Mozilla developers and community members reported memory safety bugs present in Firefox 63. (no CVSS, Mozilla Firefox)
- [CVE-2018-12407](https://cve.now/CVE-2018-12407.md): A buffer overflow occurs when drawing and validating elements with the ANGLE graphics library, used for WebGL content, when working with the (no CVSS, Mozilla Firefox)
- [CVE-2018-18492](https://cve.now/CVE-2018-18492.md): A use-after-free vulnerability can occur after deleting a selection element due to a weak reference to the select element in the options col (no CVSS, Mozilla Thunderbird · Mozilla Firefox ESR +1)
- [CVE-2018-18493](https://cve.now/CVE-2018-18493.md): A buffer overflow can occur in the Skia library during buffer offset calculations with hardware accelerated canvas 2D actions due to the use (no CVSS, Mozilla Thunderbird · Mozilla Firefox ESR +1)
- [CVE-2018-18494](https://cve.now/CVE-2018-18494.md): A same-origin policy violation allowing the theft of cross-origin URL entries when using the Javascript location property to cause a redirec (no CVSS, Mozilla Thunderbird · Mozilla Firefox ESR +1)
- [CVE-2018-18495](https://cve.now/CVE-2018-18495.md): WebExtension content scripts can be loaded into about: pages in some circumstances, in violation of the permissions granted to extensions. (no CVSS, Mozilla Firefox)
- [CVE-2018-18496](https://cve.now/CVE-2018-18496.md): When the RSS Feed preview about:feeds page is framed within another page, it can be used in concert with scripted content for a clickjacking (no CVSS, Mozilla Firefox)
- [CVE-2018-18497](https://cve.now/CVE-2018-18497.md): Limitations on the URIs allowed to WebExtensions by the browser.windows.create API can be bypassed when a pipe in the URL field is used with (no CVSS, Mozilla Firefox)
- [CVE-2018-18498](https://cve.now/CVE-2018-18498.md): A potential vulnerability leading to an integer overflow can occur during buffer size calculations for images when a raw value is used inste (no CVSS, Mozilla Thunderbird · Mozilla Firefox ESR +1)
- [CVE-2018-18499](https://cve.now/CVE-2018-18499.md): A same-origin policy violation allowing the theft of cross-origin URL entries when using a meta http-equiv="refresh" on a page to cause a re (no CVSS, Mozilla Firefox · Mozilla Thunderbird)
- [CVE-2019-1663](https://cve.now/CVE-2019-1663.md): Cisco RV110W, RV130W, and RV215W Routers Management Interface Remote Command Execution Vulnerability (CVSS 9.8, Cisco RV110W Wireless-N VPN Firewall · Cisco RV130W Wire… +1)
- [CVE-2019-1674](https://cve.now/CVE-2019-1674.md): Cisco Webex Meetings Desktop App and Cisco Webex Productivity Tools Update Service Command Injection Vulnerability (CVSS 7.8, Cisco Webex Meetings Desktop App · Cisco Webex Productivity…)
- [CVE-2019-1986](https://cve.now/CVE-2019-1986.md): In SkSwizzler::onSetSampleX of SkSwizzler.cpp, there is a possible out of bounds write due to a missing bounds check. (no CVSS, Android)
- [CVE-2019-1987](https://cve.now/CVE-2019-1987.md): In onSetSampleX of SkSwizzler.cpp, there is a possible out of bounds write due to a missing bounds check. (no CVSS, Android)
- [CVE-2019-1988](https://cve.now/CVE-2019-1988.md): In sample6 of SkSwizzler.cpp, there is a possible out of bounds write due to improper input validation. (no CVSS, Android)
- [CVE-2019-1991](https://cve.now/CVE-2019-1991.md): In btif\_dm\_data\_copy of btif\_core.cc, there is a possible out of bounds write due to a buffer overflow. (no CVSS, Android)
- [CVE-2019-1992](https://cve.now/CVE-2019-1992.md): In bta\_hl\_sdp\_query\_results of bta\_hl\_main.cc, there is a possible use-after-free due to a race condition. (no CVSS, Android)
- [CVE-2019-1993](https://cve.now/CVE-2019-1993.md): In register\_app of btif\_hd.cc, there is a possible memory corruption due to an integer overflow. (no CVSS, Android)
- [CVE-2019-1994](https://cve.now/CVE-2019-1994.md): In refresh of DevelopmentTiles.java, there is the possibility of leaving development settings accessible due to an insecure default value. (no CVSS, Android)
- [CVE-2019-1995](https://cve.now/CVE-2019-1995.md): In ComposeActivityEmail of ComposeActivityEmail.java, there is a possible way to silently attach files to an email due to a confused deputy. (no CVSS, Android)
- [CVE-2019-1996](https://cve.now/CVE-2019-1996.md): In avrc\_pars\_browse\_rsp of avrc\_pars\_ct.cc, there is a possible out of bounds read due to a missing bounds check. (no CVSS, Android)
- [CVE-2019-1997](https://cve.now/CVE-2019-1997.md): In random\_get\_bytes of random.c, there is a possible degradation of randomness due to an insecure default value. (no CVSS, Android)
- [CVE-2019-1998](https://cve.now/CVE-2019-1998.md): In event\_handler of keymaster\_app.c, there is possible resource exhaustion due to a table being lost on reboot. (no CVSS, Android)
- [CVE-2019-1999](https://cve.now/CVE-2019-1999.md): In binder\_alloc\_free\_page of binder\_alloc.c, there is a possible double free due to improper locking. (no CVSS, Android)
- [CVE-2019-2000](https://cve.now/CVE-2019-2000.md): In several functions of binder.c, there is possible memory corruption due to a use after free. (no CVSS, Android)
- [CVE-2019-2001](https://cve.now/CVE-2019-2001.md): The permissions on /proc/iomem were world-readable. (no CVSS, Android)
- [CVE-2019-3582](https://cve.now/CVE-2019-3582.md): McAfee Endpoint Security updates fix a privilege escalation vulnerability (CVSS 8.6, McAfee Endpoint Security)
- [CVE-2019-3598](https://cve.now/CVE-2019-3598.md): McAfee Agent update fixes a vulnerability in handling UDP requests (CVSS 5.3, McAfee Agent)
- [CVE-2019-3599](https://cve.now/CVE-2019-3599.md): McAfee Agent update fixes an Information Disclosure vulnerability (CVSS 6.5, McAfee Agent)
- [CVE-2019-9226](https://cve.now/CVE-2019-9226.md): An issue was discovered in baigo CMS 2.1.1. (no CVSS)
- [CVE-2019-9227](https://cve.now/CVE-2019-9227.md): An issue was discovered in baigo CMS 2.1.1. (no CVSS)
- [CVE-2019-9208](https://cve.now/CVE-2019-9208.md): In Wireshark 2.4.0 to 2.4.12 and 2.6.0 to 2.6.6, the TCAP dissector could crash. (no CVSS)
- [CVE-2019-9209](https://cve.now/CVE-2019-9209.md): In Wireshark 2.4.0 to 2.4.12 and 2.6.0 to 2.6.6, the ASN.1 BER and related dissectors could crash. (no CVSS)
- [CVE-2019-9214](https://cve.now/CVE-2019-9214.md): In Wireshark 2.4.0 to 2.4.12 and 2.6.0 to 2.6.6, the RPCAP dissector could crash. (no CVSS)
- [CVE-2019-9215](https://cve.now/CVE-2019-9215.md): In Live555 before 2019.02.27, malformed headers lead to invalid memory access in the parseAuthorizationHeader function. (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2019-02-28
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.