CVEs published March 6, 2019
114 CVEs were published on March 6, 2019: 1 critical, 4 high. 2 are now in CISA KEV.
- Published
- 114
- Critical
- 1
- High
- 4
- Medium
- 6
- Low
- 0
- Unrated
- 103
- Now in CISA KEV
- 2
- Fix available
- 9
Most affected products
- Microsoft Windows
- 28
- Microsoft Edge · Microsoft ChakraCore
- 13
- Microsoft Edge
- 5
- Microsoft Office
- 5
- Cisco NX-OS Software for Nexus 9000 Series Fabric Switches…
- 3
- Microsoft Windows · Microsoft PowerShell Core
- 3
- IBM Rational DOORS Next Generation
- 2
- Microsoft Exchange Server
- 2
- Microsoft Java SDK for Azure IoT
- 2
- Microsoft SharePoint Server · Microsoft SharePoint Found… +1
- 2
Critical 1
High 4
- CVE-2019-1591Cisco Nexus 9000 Series Fabric Switches Application Centric Infrastructure Mode Shell Escape VulnerabilityCisco NX-OS Software for Nexus 9000 Series Fabric Switches…
- CVE-2019-1593Cisco NX-OS Software Bash Shell Role-Based Access Control Bypass Privilege Escalation VulnerabilityCisco Nexus 3000 Series Switches · Cisco Nexus 3500 Plat… +4
- CVE-2019-1594Cisco NX-OS Software 802.1X Extensible Authentication Protocol over LAN Denial of Service VulnerabilityCisco Nexus 1000V Switch for VMware vSphere · Cisco Nexu… +5
- CVE-2019-1595Cisco Nexus 5600 and 6000 Series Switches Fibre Channel over Ethernet Denial of Service VulnerabilityCisco NX-OS Software
Medium, low and unrated 109
- CVE-2019-1588Cisco Nexus 9000 Series Fabric Switches Application-Centric Infrastructure Mode Arbitrary File Read VulnerabilityCisco NX-OS Software for Nexus 9000 Series Fabric Switches…
- CVE-2019-9606PHP Scripts Mall Personal Video Collection Script 4.0.4 has Stored XSS via the "Update profile" feature.
- CVE-2019-9607PHP Scripts Mall Medical Store Script 3.0.3 allows Path Traversal by navigating to the parent directory of a jpg or png file.
- CVE-2019-9608An issue was discovered in OFCMS before 1.1.3.
- CVE-2019-9609An issue was discovered in OFCMS before 1.1.3.
- CVE-2019-9610An issue was discovered in OFCMS before 1.1.3.
- CVE-2019-9611An issue was discovered in OFCMS before 1.1.3.
- CVE-2019-9612An issue was discovered in OFCMS before 1.1.3.
- CVE-2019-9613An issue was discovered in OFCMS before 1.1.3.
- CVE-2019-9614An issue was discovered in OFCMS before 1.1.3.
- CVE-2019-9615An issue was discovered in OFCMS before 1.1.3.
- CVE-2019-9616An issue was discovered in OFCMS before 1.1.3.
- CVE-2019-9617An issue was discovered in OFCMS before 1.1.3.
- CVE-2019-1543ChaCha20-Poly1305 with long noncesOpenSSL
- CVE-2019-1585Cisco Nexus 9000 Series Fabric Switches Application-Centric Infrastructure Mode Privilege Escalation VulnerabilityCisco NX-OS Software for Nexus 9000 Series Fabric Switches…
- CVE-2018-1911IBM DOORS Next Generation (DNG/RRC) 5.0 through 5.0.2 and 6.0 through 6.0.6 is vulnerable to cross-site scripting.IBM Rational DOORS Next Generation
- CVE-2018-1912IBM DOORS Next Generation (DNG/RRC) 6.0.2 through 6.0.6 is vulnerable to cross-site scripting.IBM Rational DOORS Next Generation
- CVE-2019-4030IBM WebSphere Application Server 8.5 and 9.0 is vulnerable to cross-site scripting.IBM WebSphere Application Server
- CVE-2019-9603MiniCMS 1.10 allows mc-admin/post.php?state=publish&delete= CSRF to delete articles, a different vulnerability than CVE-2018-18891.
- CVE-2019-0200A Denial of Service vulnerability was found in Apache Qpid Broker-J versions 6.0.0-7.0.6 (inclusive) and 7.1.0 which allows an unauthenticatApache Software Foundation Apache Qpid Broker-J · org.apach…
- CVE-2019-9599The AirDroid application through 4.2.1.6 for Android allows remote attackers to cause a denial of service (service crash) via many simultane
- CVE-2019-9600The Olive Tree FTP Server (aka com.theolivetree.ftpserver) application through 1.32 for Android allows remote attackers to cause a denial of
- CVE-2019-9601The ApowerManager application through 3.1.7 for Android allows remote attackers to cause a denial of service via many simultaneous /?Key=Pho
- CVE-2019-0187Unauthenticated RCE is possible when JMeter is used in distributed mode (-r or -R command line options).Apache Software Foundation Apache JMeter · org.apache.jmete…
- CVE-2019-9590An issue was discovered on TENGCONTROL T-920 PLC v5.5 devices.
- CVE-2019-9591A reflected Cross-site scripting (XSS) vulnerability in ShoreTel Connect ONSITE before 19.49.1500.0 allows remote attackers to inject arbitr
- CVE-2019-9592A reflected Cross-site scripting (XSS) vulnerability in ShoreTel Connect ONSITE 19.45.1602.0 allows remote attackers to inject arbitrary web
- CVE-2019-9593A reflected Cross-site scripting (XSS) vulnerability in ShoreTel Connect ONSITE 18.82.2000.0 allows remote attackers to inject arbitrary web
- CVE-2019-9594BlueCMS 1.6 allows SQL Injection via the user_id parameter in an uploads/admin/user.php?act=edit request.
- CVE-2019-9595AppCMS 2.0.101 allows XSS via the upload/callback.php params parameter.
- CVE-2019-3824A flaw was found in the way an LDAP search expression could crash the shared LDAP server process of a samba AD DC in samba before version 4.
- CVE-2019-9587There is a stack consumption issue in md5Round1() located in Decrypt.cc in Xpdf 4.01.
- CVE-2019-9588There is an Invalid memory access in gAtomicIncrement() located at GMutex.h in Xpdf 4.01.
- CVE-2019-9589There is a NULL pointer dereference vulnerability in PSOutputDev::setupResources() located in PSOutputDev.cc in Xpdf 4.01.
- CVE-2019-0540A security feature bypass vulnerability exists when Microsoft Office does not validate URLs.An attacker could send a victim a specially crafMicrosoft Office · Microsoft Excel Viewer +1
- CVE-2019-0590A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Microsoft Edge, aka 'ScriptinMicrosoft Edge · Microsoft ChakraCore
- CVE-2019-0591A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Microsoft Edge, aka 'ScriptinMicrosoft Edge · Microsoft ChakraCore
- CVE-2019-0593A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Microsoft Edge, aka 'ScriptinMicrosoft Edge · Microsoft ChakraCore
- CVE-2019-0594A remote code execution vulnerability exists in Microsoft SharePoint when the software fails to check the source markup of an application paMicrosoft SharePoint Server · Microsoft SharePoint Found… +1
- CVE-2019-0595A remote code execution vulnerability exists when the Windows Jet Database Engine improperly handles objects in memory, aka 'Jet Database EnMicrosoft Windows
- CVE-2019-0596A remote code execution vulnerability exists when the Windows Jet Database Engine improperly handles objects in memory, aka 'Jet Database EnMicrosoft Windows
- CVE-2019-0597A remote code execution vulnerability exists when the Windows Jet Database Engine improperly handles objects in memory, aka 'Jet Database EnMicrosoft Windows
- CVE-2019-0598A remote code execution vulnerability exists when the Windows Jet Database Engine improperly handles objects in memory, aka 'Jet Database EnMicrosoft Windows
- CVE-2019-0599A remote code execution vulnerability exists when the Windows Jet Database Engine improperly handles objects in memory, aka 'Jet Database EnMicrosoft Windows
- CVE-2019-0600An information disclosure vulnerability exists when the Human Interface Devices (HID) component improperly handles objects in memory, aka 'HMicrosoft Windows
- CVE-2019-0601An information disclosure vulnerability exists when the Human Interface Devices (HID) component improperly handles objects in memory, aka 'HMicrosoft Windows
- CVE-2019-0602An information disclosure vulnerability exists when the Windows GDI component improperly discloses the contents of its memory, aka 'Windows Microsoft Windows
- CVE-2019-0605A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Microsoft Edge, aka 'ScriptinMicrosoft Edge · Microsoft ChakraCore
- CVE-2019-0606A remote code execution vulnerability exists when Internet Explorer improperly accesses objects in memory, aka 'Internet Explorer Memory Cor
- CVE-2019-0607A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Microsoft Edge, aka 'ScriptinMicrosoft Edge · Microsoft ChakraCore
- CVE-2019-0610A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Microsoft Edge, aka 'ScriptinMicrosoft Edge · Microsoft ChakraCore
- CVE-2019-0613A remote code execution vulnerability exists in .NET Framework and Visual Studio software when the software fails to check the source markupMicrosoft .NET Framework · Microsoft Visual Studio
- CVE-2019-0615An information disclosure vulnerability exists when the Windows GDI component improperly discloses the contents of its memory, aka 'Windows Microsoft Windows
- CVE-2019-0616An information disclosure vulnerability exists when the Windows GDI component improperly discloses the contents of its memory, aka 'Windows Microsoft Windows
- CVE-2019-0618A remote code execution vulnerability exists in the way that the Windows Graphics Device Interface (GDI) handles objects in the memory, aka Microsoft Windows
- CVE-2019-0619An information disclosure vulnerability exists when the Windows GDI component improperly discloses the contents of its memory, aka 'Windows Microsoft Windows
- CVE-2019-0621An information disclosure vulnerability exists when the Windows kernel improperly handles objects in memory, aka 'Windows Kernel InformationMicrosoft Windows
- CVE-2019-0623An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in memory, aka 'Win32k Microsoft Windows
- CVE-2019-0625A remote code execution vulnerability exists when the Windows Jet Database Engine improperly handles objects in memory, aka 'Jet Database EnMicrosoft Windows
- CVE-2019-0626A memory corruption vulnerability exists in the Windows Server DHCP service when an attacker sends specially crafted packets to a DHCP serveMicrosoft Windows
- CVE-2019-0627A security feature bypass vulnerability exists in Windows which could allow an attacker to bypass Device Guard, aka 'Windows Security FeaturMicrosoft Windows · Microsoft PowerShell Core
- CVE-2019-0628An information disclosure vulnerability exists when the win32k component improperly provides kernel information, aka 'Win32k Information DisMicrosoft Windows
- CVE-2019-0630A remote code execution vulnerability exists in the way that the Microsoft Server Message Block 2.0 (SMBv2) server handles certain requests,Microsoft Windows
- CVE-2019-0631A security feature bypass vulnerability exists in Windows which could allow an attacker to bypass Device Guard, aka 'Windows Security FeaturMicrosoft Windows · Microsoft PowerShell Core
- CVE-2019-0632A security feature bypass vulnerability exists in Windows which could allow an attacker to bypass Device Guard, aka 'Windows Security FeaturMicrosoft Windows · Microsoft PowerShell Core
- CVE-2019-0633A remote code execution vulnerability exists in the way that the Microsoft Server Message Block 2.0 (SMBv2) server handles certain requests,Microsoft Windows Server · Microsoft Windows
- CVE-2019-0634A remote code execution vulnerability exists when Microsoft Edge improperly accesses objects in memory, aka 'Microsoft Edge Memory CorruptioMicrosoft Edge
- CVE-2019-0635An information disclosure vulnerability exists when Windows Hyper-V on a host operating system fails to properly validate input from an authMicrosoft Windows
- CVE-2019-0636An information vulnerability exists when Windows improperly discloses file information, aka 'Windows Information Disclosure Vulnerability'.Microsoft Windows
- CVE-2019-0637A security feature bypass vulnerability exists when Windows Defender Firewall incorrectly applies firewall profiles to cellular network connMicrosoft Windows
- CVE-2019-0640A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Microsoft Edge, aka 'ScriptinMicrosoft Edge · Microsoft ChakraCore
- CVE-2019-0641A security feature bypass vulnerability exists in Microsoft Edge handles whitelisting, aka 'Microsoft Edge Security Feature Bypass VulnerabiMicrosoft Edge
- CVE-2019-0642A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Microsoft Edge, aka 'ScriptinMicrosoft Edge · Microsoft ChakraCore
- CVE-2019-0643An information disclosure vulnerability exists in the way that Microsoft Edge handles cross-origin requests, aka 'Microsoft Edge InformationMicrosoft Edge
- CVE-2019-0644A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Microsoft Edge, aka 'ScriptinMicrosoft Edge · Microsoft ChakraCore
- CVE-2019-0645A remote code execution vulnerability exists when Microsoft Edge improperly accesses objects in memory, aka 'Microsoft Edge Memory CorruptioMicrosoft Edge
- CVE-2019-0648An information disclosure vulnerability exists when Chakra improperly discloses the contents of its memory, which could provide an attacker Microsoft Edge · Microsoft.ChakraCore
- CVE-2019-0649A vulnerability exists in Microsoft Chakra JIT server, aka 'Scripting Engine Elevation of Privileged Vulnerability'.Microsoft Edge · Microsoft ChakraCore +1
- CVE-2019-0650A remote code execution vulnerability exists when Microsoft Edge improperly accesses objects in memory, aka 'Microsoft Edge Memory CorruptioMicrosoft Edge
- CVE-2019-0651A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Microsoft Edge, aka 'ScriptinMicrosoft Edge · Microsoft ChakraCore
- CVE-2019-0652A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Microsoft Edge, aka 'ScriptinMicrosoft Edge · Microsoft ChakraCore
- CVE-2019-0654A spoofing vulnerability exists when Microsoft browsers improperly handles specific redirects, aka 'Microsoft Browser Spoofing VulnerabilityMicrosoft Internet Explorer · Microsoft Edge
- CVE-2019-0655A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Microsoft Edge, aka 'ScriptinMicrosoft Edge · Microsoft ChakraCore
- CVE-2019-0656An elevation of privilege vulnerability exists when the Windows kernel fails to properly handle objects in memory, aka 'Windows Kernel ElevaMicrosoft Windows
- CVE-2019-0657A vulnerability exists in certain .Net Framework API's and Visual Studio in the way they parse URL's, aka '.NET Framework and Visual Studio Microsoft .NET Framework · Microsoft .NET Core +4
- CVE-2019-0658An information disclosure vulnerability exists when the scripting engine does not properly handle objects in memory in Microsoft Edge, aka 'Microsoft Edge · Microsoft ChakraCore
- CVE-2019-0659An elevation of privilege vulnerability exists when the Storage Service improperly handles file operations, aka 'Windows Storage Service EleMicrosoft Windows
- CVE-2019-0660An information disclosure vulnerability exists when the Windows GDI component improperly discloses the contents of its memory, aka 'Windows Microsoft Windows
- CVE-2019-0661An information disclosure vulnerability exists when the Windows kernel improperly handles objects in memory, aka 'Windows Kernel InformationMicrosoft Windows
- CVE-2019-0662A remote code execution vulnerability exists in the way that the Windows Graphics Device Interface (GDI) handles objects in the memory, aka Microsoft Windows
- CVE-2019-0663An information disclosure vulnerability exists when the Windows kernel improperly initializes objects in memory.To exploit this vulnerabilitMicrosoft Windows
- CVE-2019-0664An information disclosure vulnerability exists when the Windows GDI component improperly discloses the contents of its memory, aka 'Windows Microsoft Windows
- CVE-2019-0668An elevation of privilege vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request tMicrosoft SharePoint Enterprise Server
- CVE-2019-0669An information disclosure vulnerability exists when Microsoft Excel improperly discloses the contents of its memory, aka 'Microsoft Excel InMicrosoft Excel · Microsoft Office
- CVE-2019-0670A spoofing vulnerability exists in Microsoft SharePoint when the application does not properly parse HTTP content, aka 'Microsoft SharePointMicrosoft SharePoint Foundation · Microsoft SharePoint Ente…
- CVE-2019-0671A remote code execution vulnerability exists when the Microsoft Office Access Connectivity Engine improperly handles objects in memory, aka Microsoft Office
- CVE-2019-0672A remote code execution vulnerability exists when the Microsoft Office Access Connectivity Engine improperly handles objects in memory, aka Microsoft Office
- CVE-2019-0673A remote code execution vulnerability exists when the Microsoft Office Access Connectivity Engine improperly handles objects in memory, aka Microsoft Office
- CVE-2019-0674A remote code execution vulnerability exists when the Microsoft Office Access Connectivity Engine improperly handles objects in memory, aka Microsoft Office
- CVE-2019-0675A remote code execution vulnerability exists when the Microsoft Office Access Connectivity Engine improperly handles objects in memory, aka Microsoft Office
- CVE-2019-0676An information disclosure vulnerability exists when Internet Explorer improperly handles objects in memory.An attacker who successfully explMicrosoft Internet Explorer
- CVE-2019-0686An elevation of privilege vulnerability exists in Microsoft Exchange Server, aka 'Microsoft Exchange Server Elevation of Privilege VulnerabiMicrosoft Exchange Server
- CVE-2019-0724An elevation of privilege vulnerability exists in Microsoft Exchange Server, aka 'Microsoft Exchange Server Elevation of Privilege VulnerabiMicrosoft Exchange Server
- CVE-2019-0728A remote code execution vulnerability exists in Visual Studio Code when it process environment variables after opening a project, aka 'VisuaMicrosoft Visual Studio Code
- CVE-2019-0729An Elevation of Privilege vulnerability exists in the way Azure IoT Java SDK generates symmetric keys for encryption, allowing an attacker tMicrosoft Java SDK for Azure IoT
- CVE-2019-0741An information disclosure vulnerability exists in the way Azure IoT Java SDK logs sensitive information, aka 'Azure IoT Java SDK InformationMicrosoft Java SDK for Azure IoT
- CVE-2019-0742A Cross-site Scripting (XSS) vulnerability exists when Team Foundation Server does not properly sanitize user provided input, aka 'Team FounMicrosoft Team Foundation Server
- CVE-2019-0743A Cross-site Scripting (XSS) vulnerability exists when Team Foundation Server does not properly sanitize user provided input, aka 'Team FounMicrosoft Team Foundation Server
- CVE-2019-9581phpscheduleit Booked Scheduler 2.7.5 allows arbitrary file upload via the Favicon field, leading to execution of arbitrary Web/custom-favico