CVEs published March 7, 2019
65 CVEs were published on March 7, 2019: 2 critical, 15 high. 1 is now in CISA KEV.
- Published
- 65
- Critical
- 2
- High
- 15
- Medium
- 1
- Low
- 0
- Unrated
- 47
- Now in CISA KEV
- 1
- Fix available
- 16
Most affected products
- TIBCO Software TIBCO JasperReports Server · TIBCO Softwa… +1
- 3
- Cisco Firepower 4100 Series Next-Generation Firewalls ·… +6
- 2
- Cloud Foundry Stratos
- 2
- dolibarr/dolibarr
- 2
- Antenna House
- 1
- Apache Software Foundation Apache Solr · org.apache.solr:so…
- 1
- Apache Software Foundation Apache Traffic Server
- 1
- bolt/bolt
- 1
- Cisco Firepower 4100 Series Next-Generation Firewalls ·… +8
- 1
- Cisco Nexus 1000V Switch for Microsoft Hyper-V · Cisco N… +9
- 1
Critical 2
High 15
- CVE-2018-18808TIBCO JasperReports Server Privilege Escalation Via Race ConditionTIBCO Software TIBCO JasperReports Server · TIBCO Softwa… +1
- CVE-2018-18816TIBCO JasperReports Persistent Cross Site Scripting VulnerabilityTIBCO Software TIBCO JasperReports Server · TIBCO Softwa… +1
- CVE-2019-8986TIBCO JasperReports Server XML Entity Expansion VulnerabilityTIBCO Software TIBCO JasperReports Server
- CVE-2019-1598Cisco FXOS and NX-OS Lightweight Directory Access Protocol Denial of Service VulnerabilitiesCisco Firepower 4100 Series Next-Generation Firewalls ·… +6
- CVE-2019-1599Cisco NX-OS Software Netstack Denial of Service VulnerabilityCisco Nexus 1000V Switch for Microsoft Hyper-V · Cisco N… +9
- CVE-2019-5019A heap-based overflow vulnerability exists in the PowerPoint document conversion function of Rainbow PDF Office Server Document Converter V7Antenna House
- CVE-2019-1596Cisco NX-OS Software Bash Shell Privilege Escalation VulnerabilityCisco Nexus 3000 Series Switches · Cisco Nexus 3500 Plat… +3
- CVE-2019-1597Cisco FXOS and NX-OS Lightweight Directory Access Protocol Denial of Service VulnerabilitiesCisco Firepower 4100 Series Next-Generation Firewalls ·… +6
- CVE-2019-3712DSA-2019-039: Dell Wyse Device Agent Buffer Overflow VulnerabilityDell Wyse Device Agent · Dell Wyse ThinLinux HAgent
- CVE-2019-3775UAA allows users to modify their own email addressCloud Foundry UAA Release
- CVE-2019-3776Reflected XSS in Pivotal Operations ManagerPivotal Ops Manager
- CVE-2019-3777Apps Manager unverified SSL certs in Cloud Controller proxyPivotal Apps Manager · Pivotal Application Service
- CVE-2019-3781CF CLI does not sanitize user's password in verbose/trace/debugCloud Foundry CF CLI
- CVE-2019-3783Cloud Foundry Stratos Deploys With Public Default Session Store SecretCloud Foundry Stratos
- CVE-2019-3784Cloud Foundry Stratos contains a Session Collision VulnerabilityCloud Foundry Stratos
Medium, low and unrated 48
- CVE-2013-7466Simple Machines Forum (SMF) 2.0.4 allows local file inclusion, with resultant remote code execution, in install.php via ../ directory traver
- CVE-2013-7467Simple Machines Forum (SMF) 2.0.4 allows XSS via the index.php?action=pm;sa=settings;save sa parameter.
- CVE-2013-7468Simple Machines Forum (SMF) 2.0.4 allows PHP Code Injection via the index.php?action=admin;area=languages;sa=editlang dictionary parameter.
- CVE-2017-12447GdkPixBuf (aka gdk-pixbuf), possibly 2.32.2, as used by GNOME Nautilus 3.14.3 on Ubuntu 16.04, allows attackers to cause a denial of service
- CVE-2018-14498get_8bit_row in rdbmp.c in libjpeg-turbo through 1.5.90 and MozJPEG through 3.3.1 allows attackers to cause a denial of service (heap-based
- CVE-2018-14499An issue was found in HYBBS through 2016-03-08.
- CVE-2018-16804An issue was discovered in UCMS 1.4.6.
- CVE-2018-16808An issue was discovered in Dolibarr through 7.0.0.dolibarr/dolibarr
- CVE-2018-16809An issue was discovered in Dolibarr through 7.0.0.dolibarr/dolibarr
- CVE-2018-17412zzcms v8.3 contains a SQL Injection vulnerability in /user/logincheck.php via an X-Forwarded-For HTTP header.
- CVE-2018-17413XSS exists in zzcms v8.3 via the /uploadimg_form.php noshuiyin parameter.
- CVE-2018-17414zzcms v8.3 has a SQL injection in /user/jobmanage.php via the bigclass parameter.
- CVE-2018-17415zzcms V8.3 has a SQL injection in /user/zs_elite.php via the id parameter.
- CVE-2018-17416A SQL injection vulnerability exists in zzcms v8.3 via the /admin/adclass.php bigclassid parameter.
- CVE-2018-17418Monstra CMS 3.0.4 allows remote attackers to execute arbitrary PHP code via a mixed-case file extension, as demonstrated by the 123.PhP file
- CVE-2018-17419An issue was discovered in setTA in scan_rr.go in the Miek Gieben DNS library before 1.0.10 for Go.github.com/miekg/dns
- CVE-2018-17420An issue was discovered in ZrLog 2.0.3.
- CVE-2018-17421An issue was discovered in ZrLog 2.0.3.
- CVE-2018-17422dotCMS before 5.0.2 has open redirects via the html/common/forward_js.jsp FORWARD_URL parameter or the html/portlet/ext/common/page_preview_
- CVE-2018-17425WUZHI CMS 4.1.0 has stored XSS via the "Membership Center" "I want to ask" "detailed description" field under the index.php?m=member URI.
- CVE-2018-17426WUZHI CMS 4.1.0 has stored XSS via the "Extension module" "SMS in station" field under the index.php?m=core URI.
- CVE-2018-17429/console/account/manage.php?type=action&action=add in JTBC v3.0(C) has CSRF for adding an administrator account.
- CVE-2018-17988LayerBB 1.1.1 and 1.1.3 has SQL Injection via the search.php search_query parameter.
- CVE-2018-18449EmpireCMS 7.5 allows CSRF for adding a user account via an enews=AddUser action to e/admin/user/ListUser.php, a similar issue to CVE-2018-16
- CVE-2019-6710Zyxel NBG-418N v2 v1.00(AAXM.4)C0 devices allow login.cgi CSRF.
- CVE-2019-7175In ImageMagick before 7.0.8-25, some memory leaks exist in DecodeImage in coders/pcd.c.
- CVE-2019-7660An issue was discovered in PHPMyWind 5.5.
- CVE-2019-7661An issue was discovered in PHPMyWind 5.5.
- CVE-2019-8437njiandan-cms through 2013-05-23 has index.php/admin/user_new CSRF to add an administrator.
- CVE-2019-8438An issue was discovered in DiliCMS 2.4.0.
- CVE-2019-8439An issue was discovered in DiliCMS 2.4.0.
- CVE-2019-8440An issue was discovered in DiliCMS 2.4.0.
- CVE-2019-9117An issue was discovered on Motorola C1 and M2 devices with firmware 1.01 and 1.07 respectively.
- CVE-2019-9118An issue was discovered on Motorola C1 and M2 devices with firmware 1.01 and 1.07 respectively.
- CVE-2019-9119An issue was discovered on Motorola C1 and M2 devices with firmware 1.01 and 1.07 respectively.
- CVE-2019-9120An issue was discovered on Motorola C1 and M2 devices with firmware 1.01 and 1.07 respectively.
- CVE-2019-9121An issue was discovered on Motorola C1 and M2 devices with firmware 1.01 and 1.07 respectively.
- CVE-2019-9185Controller/Async/FilesystemManager.php in the filemanager in Bolt before 3.6.5 allows remote attackers to execute arbitrary PHP code by renabolt/bolt
- CVE-2019-9598An issue was discovered in Cscms 4.1.0.
- CVE-2019-0192In Apache Solr versions 5.0.0 to 5.5.5 and 6.0.0 to 6.6.5, the Config API allows to configure the JMX server via an HTTP POST request.Apache Software Foundation Apache Solr · org.apache.solr:so…
- CVE-2019-1600Cisco FXOS and NX-OS Software Unauthorized Directory Access VulnerabilityCisco Firepower 4100 Series Next-Generation Firewalls ·… +8
- CVE-2019-3778Open Redirect in spring-security-oauth2Spring Security OAuth · org.springframework.security.oau… +1
- CVE-2018-11783sslheaders plugin extracts information from the client certificate and sets headers in the request based on the configuration of the plugin.Apache Software Foundation Apache Traffic Server
- CVE-2019-9625JBMC DirectAdmin 1.55 allows CSRF via the /CMD_ACCOUNT_ADMIN URI to create a new admin account.
- CVE-2019-9626PHPSHE 1.7 allows module/index/cart.php pintuan_id SQL Injection to index.php.
- CVE-2019-9622eBrigade through 4.5 allows Arbitrary File Download via ../ directory traversal in the showfile.php file parameter, as demonstrated by readi
- CVE-2019-9623Feng Office 3.7.0.5 allows remote attackers to execute arbitrary code via "<!--#exec cmd=" in a .shtml file to ck_upload_handler.php.
- CVE-2019-9624Webmin 1.900 allows remote attackers to execute arbitrary code by leveraging the "Java file manager" and "Upload and Download" privileges to