# CVEs published 2019-03-05

78 CVEs were published on March 5, 2019: 0 critical, 3 high. 1 is now in CISA KEV. Days are UTC.

- [CVE-2019-8336](https://cve.now/CVE-2019-8336.md): HashiCorp Consul (and Consul Enterprise) 1.4.x before 1.4.3 allows a client to bypass intended access restrictions and obtain the privileges (no CVSS, github.com/hashicorp/consul)
- [CVE-2019-9555](https://cve.now/CVE-2019-9555.md): Sagemcom F@st 5260 routers using firmware version 0.4.39, in WPA mode, default to using a PSK that is generated from a 2-part wordlist of kn (no CVSS)
- [CVE-2019-9578](https://cve.now/CVE-2019-9578.md): In devs.c in Yubico libu2f-host before 1.1.8, the response to init is misparsed, leaking uninitialized stack memory back to the device. (no CVSS)
- [CVE-2019-9213](https://cve.now/CVE-2019-9213.md): In the Linux kernel before 4.20.14, expand\_downwards in mm/mmap.c lacks a check for the mmap minimum address, which makes it easier for atta (no CVSS)
- [CVE-2018-11793](https://cve.now/CVE-2018-11793.md): When parsing a JSON payload with deeply nested JSON structures, the parser in Apache Mesos versions pre-1.4.x, 1.4.0 to 1.4.2, 1.5.0 to 1.5. (no CVSS, Apache Software Foundation Apache Mesos · org.apache.mesos:…)
- [CVE-2019-3917](https://cve.now/CVE-2019-3917.md): The Alcatel Lucent I-240W-Q GPON ONT using firmware version 3FE54567BOZJ19 allows a remote, unauthenticated attacker to enable telnetd on th (no CVSS, Tenable Alcatel Lucent I-240W-Q GPON ONT)
- [CVE-2019-3918](https://cve.now/CVE-2019-3918.md): The Alcatel Lucent I-240W-Q GPON ONT using firmware version 3FE54567BOZJ19 contains multiple hard coded credentials for the Telnet and SSH i (no CVSS, Tenable Alcatel Lucent I-240W-Q GPON ONT)
- [CVE-2019-3919](https://cve.now/CVE-2019-3919.md): The Alcatel Lucent I-240W-Q GPON ONT using firmware version 3FE54567BOZJ19 is vulnerable to command injection via crafted HTTP request sent (no CVSS, Tenable Alcatel Lucent I-240W-Q GPON ONT)
- [CVE-2019-3920](https://cve.now/CVE-2019-3920.md): The Alcatel Lucent I-240W-Q GPON ONT using firmware version 3FE54567BOZJ19 is vulnerable to authenticated command injection via crafted HTTP (no CVSS, Tenable Alcatel Lucent I-240W-Q GPON ONT)
- [CVE-2019-3921](https://cve.now/CVE-2019-3921.md): The Alcatel Lucent I-240W-Q GPON ONT using firmware version 3FE54567BOZJ19 is vulnerable to a stack buffer overflow via crafted HTTP POST re (no CVSS, Tenable Alcatel Lucent I-240W-Q GPON ONT)
- [CVE-2019-3922](https://cve.now/CVE-2019-3922.md): The Alcatel Lucent I-240W-Q GPON ONT using firmware version 3FE54567BOZJ19 is vulnerable to a stack buffer overflow via crafted HTTP POST re (no CVSS, Tenable Alcatel Lucent I-240W-Q GPON ONT)
- [CVE-2019-6518](https://cve.now/CVE-2019-6518.md): Moxa IKS and EDS store plaintext passwords, which may allow sensitive information to be read by someone with access to the device. (no CVSS, ICS-CERT Moxa IKS, EDS)
- [CVE-2019-6520](https://cve.now/CVE-2019-6520.md): Moxa IKS and EDS does not properly check authority on server side, which results in a read-only user being able to perform arbitrary configu (no CVSS, ICS-CERT Moxa IKS, EDS)
- [CVE-2019-6522](https://cve.now/CVE-2019-6522.md): Moxa IKS and EDS fails to properly check array bounds which may allow an attacker to read device memory on arbitrary addresses, and may allo (no CVSS, ICS-CERT Moxa IKS, EDS)
- [CVE-2019-6524](https://cve.now/CVE-2019-6524.md): Moxa IKS and EDS do not implement sufficient measures to prevent multiple failed authentication attempts, which may allow an attacker to dis (no CVSS, ICS-CERT Moxa IKS, EDS)
- [CVE-2019-6528](https://cve.now/CVE-2019-6528.md): PSI GridConnect GmbH Telecontrol Gateway and Smart Telecontrol Unit family, IEC104 Security Proxy versions Telecontrol Gateway 3G Versions 4 (no CVSS, ICS-CERT PSI GridConnect GmbH (formerly known as PSI Nentec…)
- [CVE-2019-6557](https://cve.now/CVE-2019-6557.md): Several buffer overflow vulnerabilities have been identified in Moxa IKS and EDS, which may allow remote code execution. (no CVSS, ICS-CERT Moxa IKS, EDS)
- [CVE-2019-6559](https://cve.now/CVE-2019-6559.md): Moxa IKS and EDS allow remote authenticated users to cause a denial of service via a specially crafted packet, which may cause the switch to (no CVSS, ICS-CERT Moxa IKS, EDS)
- [CVE-2019-6561](https://cve.now/CVE-2019-6561.md): Cross-site request forgery has been identified in Moxa IKS and EDS, which may allow for the execution of unauthorized actions on the device. (no CVSS, ICS-CERT Moxa IKS, EDS)
- [CVE-2019-6563](https://cve.now/CVE-2019-6563.md): Moxa IKS and EDS generate a predictable cookie calculated with an MD5 hash, allowing an attacker to capture the administrator's password, wh (no CVSS, ICS-CERT Moxa IKS, EDS)
- [CVE-2019-6565](https://cve.now/CVE-2019-6565.md): Moxa IKS and EDS fails to properly validate user input, giving unauthenticated and authenticated attackers the ability to perform XSS attack (no CVSS, ICS-CERT Moxa IKS, EDS)
- [CVE-2019-9573](https://cve.now/CVE-2019-9573.md): The WP Human Resource Management plugin before 2.2.6 for WordPress mishandles leave applications. (no CVSS)
- [CVE-2019-9574](https://cve.now/CVE-2019-9574.md): The WP Human Resource Management plugin before 2.2.6 for WordPress does not ensure that a leave modification occurs in the context of the Ad (no CVSS)
- [CVE-2019-9575](https://cve.now/CVE-2019-9575.md): The Quiz And Survey Master plugin 6.0.4 for WordPress allows wp-admin/admin.php?page=mlw\_quiz\_results quiz\_id XSS. (no CVSS)
- [CVE-2019-9576](https://cve.now/CVE-2019-9576.md): The Blog2Social plugin before 5.0.3 for WordPress allows wp-admin/admin.php?page=blog2social-ship XSS. (no CVSS)
- [CVE-2018-19725](https://cve.now/CVE-2018-19725.md): Adobe Acrobat and Reader versions 2019.010.20069 and earlier, 2017.011.30113 and earlier version, and 2015.006.30464 and earlier have a secu (no CVSS, Adobe Acrobat and Reader)
- [CVE-2018-1875](https://cve.now/CVE-2018-1875.md): IBM InfoSphere Information Governance Catalog 11.3, 11.5, and 11.7 could allow a remote attacker to conduct phishing attacks, using an open (CVSS 7.4, IBM InfoSphere Information Governance Catalog · IBM InfoSph…)
- [CVE-2018-1899](https://cve.now/CVE-2018-1899.md): IBM InfoSphere Information Server 11.3, 11.5, and 11.7 could allow an attacker to change one of the settings related to InfoSphere Business (CVSS 4.3, IBM InfoSphere Information Server)
- [CVE-2018-1937](https://cve.now/CVE-2018-1937.md): IBM Cloud Private 3.1.1 could alllow a local user with administrator privileges to intercept highly sensitive unencrypted data. (CVSS 4.4, IBM Cloud Private)
- [CVE-2018-1938](https://cve.now/CVE-2018-1938.md): IBM Cloud Private 3.1.1 could alllow a local user with administrator privileges to intercept highly sensitive unencrypted data. (CVSS 4.4, IBM Cloud Private)
- [CVE-2018-1939](https://cve.now/CVE-2018-1939.md): IBM Cloud Private 3.1.1 could allow a remote attacker to conduct phishing attacks, using an open redirect attack. (CVSS 6.8, IBM Cloud Private)
- [CVE-2019-4027](https://cve.now/CVE-2019-4027.md): IBM Sterling B2B Integrator 5.2.0.1 through 6.0.0.0 is vulnerable to cross-site scripting. (CVSS 5.4, IBM Sterling B2B Integrator)
- [CVE-2019-4028](https://cve.now/CVE-2019-4028.md): IBM Sterling B2B Integrator 5.2.0.1 through 6.0.0.0 is vulnerable to cross-site scripting. (CVSS 5.4, IBM Sterling B2B Integrator)
- [CVE-2019-4029](https://cve.now/CVE-2019-4029.md): IBM Sterling B2B Integrator 5.2.0.1 through 6.0.0.0 is vulnerable to cross-site scripting. (CVSS 5.4, IBM Sterling B2B Integrator)
- [CVE-2019-4032](https://cve.now/CVE-2019-4032.md): IBM Financial Transaction Manager for Digital Payments for Multi-Platform 3.1.0 is vulnerable to SQL injection. (CVSS 6.3, IBM Financial Transaction Manager)
- [CVE-2019-4063](https://cve.now/CVE-2019-4063.md): IBM Sterling B2B Integrator 5.2.0.1 through 6.0.0.0 Standard Edition could allow highly sensitive information to be transmitted in plain tex (CVSS 5.9, IBM Sterling B2B Integrator)
- [CVE-2018-19636](https://cve.now/CVE-2018-19636.md): Local root exploit via inclusion of attacker controlled shell script (CVSS 7.3, SUSE supportutils)
- [CVE-2018-19637](https://cve.now/CVE-2018-19637.md): Static temporary filename allows overwriting of files (CVSS 2.8, SUSE supportutils)
- [CVE-2018-19638](https://cve.now/CVE-2018-19638.md): User can overwrite arbitrary log files in support tar (CVSS 2.2, SUSE supportutils)
- [CVE-2018-19639](https://cve.now/CVE-2018-19639.md): Code execution if run with command line switch -v (CVSS 6.7, SUSE supportutils)
- [CVE-2018-19640](https://cve.now/CVE-2018-19640.md): Code execution if run with command line switch -v (CVSS 4.4, SUSE supportutils)
- [CVE-2019-6200](https://cve.now/CVE-2019-6200.md): An out-of-bounds read was addressed with improved input validation. (no CVSS, Apple iOS · Apple macOS)
- [CVE-2019-6202](https://cve.now/CVE-2019-6202.md): An out-of-bounds read was addressed with improved bounds checking. (no CVSS, Apple iOS · Apple macOS +1)
- [CVE-2019-6205](https://cve.now/CVE-2019-6205.md): A memory corruption issue was addressed with improved lock state checking. (no CVSS, Apple iOS · Apple macOS +1)
- [CVE-2019-6208](https://cve.now/CVE-2019-6208.md): A memory initialization issue was addressed with improved memory handling. (no CVSS, Apple iOS · Apple macOS +1)
- [CVE-2019-6209](https://cve.now/CVE-2019-6209.md): An out-of-bounds read issue existed that led to the disclosure of kernel memory. (no CVSS, Apple iOS · Apple macOS +2)
- [CVE-2019-6210](https://cve.now/CVE-2019-6210.md): A memory corruption issue was addressed with improved input validation. (no CVSS, Apple iOS · Apple macOS +2)
- [CVE-2019-6211](https://cve.now/CVE-2019-6211.md): A memory corruption issue was addressed with improved state management. (no CVSS, Apple iOS · Apple macOS)
- [CVE-2019-6212](https://cve.now/CVE-2019-6212.md): Multiple memory corruption issues were addressed with improved memory handling. (no CVSS, Apple iOS · Apple tvOS +3)
- [CVE-2019-6213](https://cve.now/CVE-2019-6213.md): A buffer overflow was addressed with improved bounds checking. (no CVSS, Apple iOS · Apple macOS +2)
- [CVE-2019-6214](https://cve.now/CVE-2019-6214.md): A type confusion issue was addressed with improved memory handling. (no CVSS, Apple iOS · Apple macOS +2)
- [CVE-2019-6215](https://cve.now/CVE-2019-6215.md): A type confusion issue was addressed with improved memory handling. (no CVSS, Apple iOS · Apple tvOS +3)
- [CVE-2019-6216](https://cve.now/CVE-2019-6216.md): Multiple memory corruption issues were addressed with improved memory handling. (no CVSS, Apple iOS · Apple tvOS +4)
- [CVE-2019-6217](https://cve.now/CVE-2019-6217.md): Multiple memory corruption issues were addressed with improved memory handling. (no CVSS, Apple iOS · Apple tvOS +4)
- [CVE-2019-6218](https://cve.now/CVE-2019-6218.md): A memory corruption issue was addressed with improved input validation. (no CVSS, Apple iOS · Apple macOS +1)
- [CVE-2019-6219](https://cve.now/CVE-2019-6219.md): A denial of service issue was addressed with improved validation. (no CVSS, Apple iOS · Apple macOS +1)
- [CVE-2019-6220](https://cve.now/CVE-2019-6220.md): An out-of-bounds read was addressed with improved input validation. (no CVSS, Apple macOS)
- [CVE-2019-6221](https://cve.now/CVE-2019-6221.md): An out-of-bounds read was addressed with improved bounds checking. (no CVSS, Apple iOS · Apple macOS +1)
- [CVE-2019-6223](https://cve.now/CVE-2019-6223.md): A logic issue existed in the handling of Group FaceTime calls. (CVSS 7.5, KEV, Apple iOS · Apple macOS)
- [CVE-2019-6224](https://cve.now/CVE-2019-6224.md): A buffer overflow issue was addressed with improved memory handling. (no CVSS, Apple iOS · Apple macOS +2)
- [CVE-2019-6225](https://cve.now/CVE-2019-6225.md): A memory corruption issue was addressed with improved validation. (no CVSS, Apple iOS · Apple macOS +1)
- [CVE-2019-6226](https://cve.now/CVE-2019-6226.md): Multiple memory corruption issues were addressed with improved memory handling. (no CVSS, Apple iOS · Apple tvOS +4)
- [CVE-2019-6227](https://cve.now/CVE-2019-6227.md): A memory corruption issue was addressed with improved memory handling. (no CVSS, Apple iOS · Apple tvOS +4)
- [CVE-2019-6228](https://cve.now/CVE-2019-6228.md): A cross-site scripting issue existed in Safari. (no CVSS, Apple iOS · Apple Safari)
- [CVE-2019-6229](https://cve.now/CVE-2019-6229.md): A logic issue was addressed with improved validation. (no CVSS, Apple iOS · Apple tvOS +3)
- [CVE-2019-6230](https://cve.now/CVE-2019-6230.md): A memory initialization issue was addressed with improved memory handling. (no CVSS, Apple iOS · Apple macOS +2)
- [CVE-2019-6231](https://cve.now/CVE-2019-6231.md): An out-of-bounds read was addressed with improved bounds checking. (no CVSS, Apple iOS · Apple macOS +2)
- [CVE-2019-6233](https://cve.now/CVE-2019-6233.md): A memory corruption issue was addressed with improved memory handling. (no CVSS, Apple iOS · Apple tvOS +3)
- [CVE-2019-6234](https://cve.now/CVE-2019-6234.md): A memory corruption issue was addressed with improved memory handling. (no CVSS, Apple iOS · Apple tvOS +3)
- [CVE-2018-15361](https://cve.now/CVE-2018-15361.md): UltraVNC revision 1198 has a buffer underflow vulnerability in VNC client code, which can potentially result in code execution. (no CVSS, UltraVNC)
- [CVE-2019-8258](https://cve.now/CVE-2019-8258.md): UltraVNC revision 1198 has a heap buffer overflow vulnerability in VNC client code which results code execution. (no CVSS, UltraVNC)
- [CVE-2019-8259](https://cve.now/CVE-2019-8259.md): UltraVNC revision 1198 contains multiple memory leaks (CWE-655) in VNC client code, which allow an attacker to read stack memory and can be (no CVSS, UltraVNC)
- [CVE-2019-8260](https://cve.now/CVE-2019-8260.md): UltraVNC revision 1199 has a out-of-bounds read vulnerability in VNC client RRE decoder code, caused by multiplication overflow. (no CVSS, UltraVNC)
- [CVE-2019-8261](https://cve.now/CVE-2019-8261.md): UltraVNC revision 1199 has a out-of-bounds read vulnerability in VNC code inside client CoRRE decoder, caused by multiplication overflow. (no CVSS, UltraVNC)
- [CVE-2019-8262](https://cve.now/CVE-2019-8262.md): UltraVNC revision 1203 has multiple heap buffer overflow vulnerabilities in VNC client code inside Ultra decoder, which results in code exec (no CVSS, UltraVNC)
- [CVE-2019-8263](https://cve.now/CVE-2019-8263.md): UltraVNC revision 1205 has stack-based buffer overflow vulnerability in VNC client code inside ShowConnInfo routine, which leads to a denial (no CVSS, Kaspersky Lab UltraVNC)
- [CVE-2019-9570](https://cve.now/CVE-2019-9570.md): An issue was discovered in YzmCMS 5.2.0. (no CVSS)
- [CVE-2019-9572](https://cve.now/CVE-2019-9572.md): SchoolCMS version 2.3.1 allows file upload via the theme upload feature at admin.php?m=admin&c=theme&a=upload by using the .zip extension al (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2019-03-05
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.