CVEs published March 5, 2019
78 CVEs were published on March 5, 2019: 0 critical, 3 high. 1 is now in CISA KEV.
- Published
- 78
- Critical
- 0
- High
- 3
- Medium
- 11
- Low
- 2
- Unrated
- 62
- Now in CISA KEV
- 1
- Fix available
- 35
Most affected products
- ICS-CERT Moxa IKS, EDS
- 9
- Apple iOS · Apple macOS +1
- 7
- Apple iOS · Apple macOS +2
- 7
- Tenable Alcatel Lucent I-240W-Q GPON ONT
- 6
- UltraVNC
- 6
- Apple iOS · Apple tvOS +3
- 5
- SUSE supportutils
- 5
- Apple iOS · Apple tvOS +4
- 4
- IBM Sterling B2B Integrator
- 4
- Apple iOS · Apple macOS
- 3
High 3
- CVE-2018-1875IBM InfoSphere Information Governance Catalog 11.3, 11.5, and 11.7 could allow a remote attacker to conduct phishing attacks, using an open IBM InfoSphere Information Governance Catalog · IBM InfoSph…
- CVE-2018-19636Local root exploit via inclusion of attacker controlled shell scriptSUSE supportutils
- CVE-2019-6223A logic issue existed in the handling of Group FaceTime calls.Apple iOS · Apple macOS
Medium, low and unrated 75
- CVE-2019-8336HashiCorp Consul (and Consul Enterprise) 1.4.x before 1.4.3 allows a client to bypass intended access restrictions and obtain the privilegesgithub.com/hashicorp/consul
- CVE-2019-9555Sagemcom F@st 5260 routers using firmware version 0.4.39, in WPA mode, default to using a PSK that is generated from a 2-part wordlist of kn
- CVE-2019-9578In devs.c in Yubico libu2f-host before 1.1.8, the response to init is misparsed, leaking uninitialized stack memory back to the device.
- CVE-2019-9213In the Linux kernel before 4.20.14, expand_downwards in mm/mmap.c lacks a check for the mmap minimum address, which makes it easier for atta
- CVE-2018-11793When parsing a JSON payload with deeply nested JSON structures, the parser in Apache Mesos versions pre-1.4.x, 1.4.0 to 1.4.2, 1.5.0 to 1.5.Apache Software Foundation Apache Mesos · org.apache.mesos:…
- CVE-2019-3917The Alcatel Lucent I-240W-Q GPON ONT using firmware version 3FE54567BOZJ19 allows a remote, unauthenticated attacker to enable telnetd on thTenable Alcatel Lucent I-240W-Q GPON ONT
- CVE-2019-3918The Alcatel Lucent I-240W-Q GPON ONT using firmware version 3FE54567BOZJ19 contains multiple hard coded credentials for the Telnet and SSH iTenable Alcatel Lucent I-240W-Q GPON ONT
- CVE-2019-3919The Alcatel Lucent I-240W-Q GPON ONT using firmware version 3FE54567BOZJ19 is vulnerable to command injection via crafted HTTP request sent Tenable Alcatel Lucent I-240W-Q GPON ONT
- CVE-2019-3920The Alcatel Lucent I-240W-Q GPON ONT using firmware version 3FE54567BOZJ19 is vulnerable to authenticated command injection via crafted HTTPTenable Alcatel Lucent I-240W-Q GPON ONT
- CVE-2019-3921The Alcatel Lucent I-240W-Q GPON ONT using firmware version 3FE54567BOZJ19 is vulnerable to a stack buffer overflow via crafted HTTP POST reTenable Alcatel Lucent I-240W-Q GPON ONT
- CVE-2019-3922The Alcatel Lucent I-240W-Q GPON ONT using firmware version 3FE54567BOZJ19 is vulnerable to a stack buffer overflow via crafted HTTP POST reTenable Alcatel Lucent I-240W-Q GPON ONT
- CVE-2019-6518Moxa IKS and EDS store plaintext passwords, which may allow sensitive information to be read by someone with access to the device.ICS-CERT Moxa IKS, EDS
- CVE-2019-6520Moxa IKS and EDS does not properly check authority on server side, which results in a read-only user being able to perform arbitrary configuICS-CERT Moxa IKS, EDS
- CVE-2019-6522Moxa IKS and EDS fails to properly check array bounds which may allow an attacker to read device memory on arbitrary addresses, and may alloICS-CERT Moxa IKS, EDS
- CVE-2019-6524Moxa IKS and EDS do not implement sufficient measures to prevent multiple failed authentication attempts, which may allow an attacker to disICS-CERT Moxa IKS, EDS
- CVE-2019-6528PSI GridConnect GmbH Telecontrol Gateway and Smart Telecontrol Unit family, IEC104 Security Proxy versions Telecontrol Gateway 3G Versions 4ICS-CERT PSI GridConnect GmbH (formerly known as PSI Nentec…
- CVE-2019-6557Several buffer overflow vulnerabilities have been identified in Moxa IKS and EDS, which may allow remote code execution.ICS-CERT Moxa IKS, EDS
- CVE-2019-6559Moxa IKS and EDS allow remote authenticated users to cause a denial of service via a specially crafted packet, which may cause the switch toICS-CERT Moxa IKS, EDS
- CVE-2019-6561Cross-site request forgery has been identified in Moxa IKS and EDS, which may allow for the execution of unauthorized actions on the device.ICS-CERT Moxa IKS, EDS
- CVE-2019-6563Moxa IKS and EDS generate a predictable cookie calculated with an MD5 hash, allowing an attacker to capture the administrator's password, whICS-CERT Moxa IKS, EDS
- CVE-2019-6565Moxa IKS and EDS fails to properly validate user input, giving unauthenticated and authenticated attackers the ability to perform XSS attackICS-CERT Moxa IKS, EDS
- CVE-2019-9573The WP Human Resource Management plugin before 2.2.6 for WordPress mishandles leave applications.
- CVE-2019-9574The WP Human Resource Management plugin before 2.2.6 for WordPress does not ensure that a leave modification occurs in the context of the Ad
- CVE-2019-9575The Quiz And Survey Master plugin 6.0.4 for WordPress allows wp-admin/admin.php?page=mlw_quiz_results quiz_id XSS.
- CVE-2019-9576The Blog2Social plugin before 5.0.3 for WordPress allows wp-admin/admin.php?page=blog2social-ship XSS.
- CVE-2018-19725Adobe Acrobat and Reader versions 2019.010.20069 and earlier, 2017.011.30113 and earlier version, and 2015.006.30464 and earlier have a secuAdobe Acrobat and Reader
- CVE-2018-1899IBM InfoSphere Information Server 11.3, 11.5, and 11.7 could allow an attacker to change one of the settings related to InfoSphere Business IBM InfoSphere Information Server
- CVE-2018-1937IBM Cloud Private 3.1.1 could alllow a local user with administrator privileges to intercept highly sensitive unencrypted data.IBM Cloud Private
- CVE-2018-1938IBM Cloud Private 3.1.1 could alllow a local user with administrator privileges to intercept highly sensitive unencrypted data.IBM Cloud Private
- CVE-2018-1939IBM Cloud Private 3.1.1 could allow a remote attacker to conduct phishing attacks, using an open redirect attack.IBM Cloud Private
- CVE-2019-4027IBM Sterling B2B Integrator 5.2.0.1 through 6.0.0.0 is vulnerable to cross-site scripting.IBM Sterling B2B Integrator
- CVE-2019-4028IBM Sterling B2B Integrator 5.2.0.1 through 6.0.0.0 is vulnerable to cross-site scripting.IBM Sterling B2B Integrator
- CVE-2019-4029IBM Sterling B2B Integrator 5.2.0.1 through 6.0.0.0 is vulnerable to cross-site scripting.IBM Sterling B2B Integrator
- CVE-2019-4032IBM Financial Transaction Manager for Digital Payments for Multi-Platform 3.1.0 is vulnerable to SQL injection.IBM Financial Transaction Manager
- CVE-2019-4063IBM Sterling B2B Integrator 5.2.0.1 through 6.0.0.0 Standard Edition could allow highly sensitive information to be transmitted in plain texIBM Sterling B2B Integrator
- CVE-2018-19637Static temporary filename allows overwriting of filesSUSE supportutils
- CVE-2018-19638User can overwrite arbitrary log files in support tarSUSE supportutils
- CVE-2018-19639Code execution if run with command line switch -vSUSE supportutils
- CVE-2018-19640Code execution if run with command line switch -vSUSE supportutils
- CVE-2019-6200An out-of-bounds read was addressed with improved input validation.Apple iOS · Apple macOS
- CVE-2019-6202An out-of-bounds read was addressed with improved bounds checking.Apple iOS · Apple macOS +1
- CVE-2019-6205A memory corruption issue was addressed with improved lock state checking.Apple iOS · Apple macOS +1
- CVE-2019-6208A memory initialization issue was addressed with improved memory handling.Apple iOS · Apple macOS +1
- CVE-2019-6209An out-of-bounds read issue existed that led to the disclosure of kernel memory.Apple iOS · Apple macOS +2
- CVE-2019-6210A memory corruption issue was addressed with improved input validation.Apple iOS · Apple macOS +2
- CVE-2019-6211A memory corruption issue was addressed with improved state management.Apple iOS · Apple macOS
- CVE-2019-6212Multiple memory corruption issues were addressed with improved memory handling.Apple iOS · Apple tvOS +3
- CVE-2019-6213A buffer overflow was addressed with improved bounds checking.Apple iOS · Apple macOS +2
- CVE-2019-6214A type confusion issue was addressed with improved memory handling.Apple iOS · Apple macOS +2
- CVE-2019-6215A type confusion issue was addressed with improved memory handling.Apple iOS · Apple tvOS +3
- CVE-2019-6216Multiple memory corruption issues were addressed with improved memory handling.Apple iOS · Apple tvOS +4
- CVE-2019-6217Multiple memory corruption issues were addressed with improved memory handling.Apple iOS · Apple tvOS +4
- CVE-2019-6218A memory corruption issue was addressed with improved input validation.Apple iOS · Apple macOS +1
- CVE-2019-6219A denial of service issue was addressed with improved validation.Apple iOS · Apple macOS +1
- CVE-2019-6220An out-of-bounds read was addressed with improved input validation.Apple macOS
- CVE-2019-6221An out-of-bounds read was addressed with improved bounds checking.Apple iOS · Apple macOS +1
- CVE-2019-6224A buffer overflow issue was addressed with improved memory handling.Apple iOS · Apple macOS +2
- CVE-2019-6225A memory corruption issue was addressed with improved validation.Apple iOS · Apple macOS +1
- CVE-2019-6226Multiple memory corruption issues were addressed with improved memory handling.Apple iOS · Apple tvOS +4
- CVE-2019-6227A memory corruption issue was addressed with improved memory handling.Apple iOS · Apple tvOS +4
- CVE-2019-6228A cross-site scripting issue existed in Safari.Apple iOS · Apple Safari
- CVE-2019-6229A logic issue was addressed with improved validation.Apple iOS · Apple tvOS +3
- CVE-2019-6230A memory initialization issue was addressed with improved memory handling.Apple iOS · Apple macOS +2
- CVE-2019-6231An out-of-bounds read was addressed with improved bounds checking.Apple iOS · Apple macOS +2
- CVE-2019-6233A memory corruption issue was addressed with improved memory handling.Apple iOS · Apple tvOS +3
- CVE-2019-6234A memory corruption issue was addressed with improved memory handling.Apple iOS · Apple tvOS +3
- CVE-2018-15361UltraVNC revision 1198 has a buffer underflow vulnerability in VNC client code, which can potentially result in code execution.UltraVNC
- CVE-2019-8258UltraVNC revision 1198 has a heap buffer overflow vulnerability in VNC client code which results code execution.UltraVNC
- CVE-2019-8259UltraVNC revision 1198 contains multiple memory leaks (CWE-655) in VNC client code, which allow an attacker to read stack memory and can be UltraVNC
- CVE-2019-8260UltraVNC revision 1199 has a out-of-bounds read vulnerability in VNC client RRE decoder code, caused by multiplication overflow.UltraVNC
- CVE-2019-8261UltraVNC revision 1199 has a out-of-bounds read vulnerability in VNC code inside client CoRRE decoder, caused by multiplication overflow.UltraVNC
- CVE-2019-8262UltraVNC revision 1203 has multiple heap buffer overflow vulnerabilities in VNC client code inside Ultra decoder, which results in code execUltraVNC
- CVE-2019-8263UltraVNC revision 1205 has stack-based buffer overflow vulnerability in VNC client code inside ShowConnInfo routine, which leads to a denialKaspersky Lab UltraVNC
- CVE-2019-9570An issue was discovered in YzmCMS 5.2.0.
- CVE-2019-9572SchoolCMS version 2.3.1 allows file upload via the theme upload feature at admin.php?m=admin&c=theme&a=upload by using the .zip extension al