# CVEs published 2019-03-07 65 CVEs were published on March 7, 2019: 2 critical, 15 high. 1 is now in CISA KEV. Days are UTC. - [CVE-2013-7466](https://cve.now/CVE-2013-7466.md): Simple Machines Forum (SMF) 2.0.4 allows local file inclusion, with resultant remote code execution, in install.php via ../ directory traver (no CVSS) - [CVE-2013-7467](https://cve.now/CVE-2013-7467.md): Simple Machines Forum (SMF) 2.0.4 allows XSS via the index.php?action=pm;sa=settings;save sa parameter. (no CVSS) - [CVE-2013-7468](https://cve.now/CVE-2013-7468.md): Simple Machines Forum (SMF) 2.0.4 allows PHP Code Injection via the index.php?action=admin;area=languages;sa=editlang dictionary parameter. (no CVSS) - [CVE-2017-12447](https://cve.now/CVE-2017-12447.md): GdkPixBuf (aka gdk-pixbuf), possibly 2.32.2, as used by GNOME Nautilus 3.14.3 on Ubuntu 16.04, allows attackers to cause a denial of service (no CVSS) - [CVE-2018-14498](https://cve.now/CVE-2018-14498.md): get\_8bit\_row in rdbmp.c in libjpeg-turbo through 1.5.90 and MozJPEG through 3.3.1 allows attackers to cause a denial of service (heap-based (no CVSS) - [CVE-2018-14499](https://cve.now/CVE-2018-14499.md): An issue was found in HYBBS through 2016-03-08. (no CVSS) - [CVE-2018-16804](https://cve.now/CVE-2018-16804.md): An issue was discovered in UCMS 1.4.6. (no CVSS) - [CVE-2018-16808](https://cve.now/CVE-2018-16808.md): An issue was discovered in Dolibarr through 7.0.0. (no CVSS, dolibarr/dolibarr) - [CVE-2018-16809](https://cve.now/CVE-2018-16809.md): An issue was discovered in Dolibarr through 7.0.0. (no CVSS, dolibarr/dolibarr) - [CVE-2018-17412](https://cve.now/CVE-2018-17412.md): zzcms v8.3 contains a SQL Injection vulnerability in /user/logincheck.php via an X-Forwarded-For HTTP header. (no CVSS) - [CVE-2018-17413](https://cve.now/CVE-2018-17413.md): XSS exists in zzcms v8.3 via the /uploadimg\_form.php noshuiyin parameter. (no CVSS) - [CVE-2018-17414](https://cve.now/CVE-2018-17414.md): zzcms v8.3 has a SQL injection in /user/jobmanage.php via the bigclass parameter. (no CVSS) - [CVE-2018-17415](https://cve.now/CVE-2018-17415.md): zzcms V8.3 has a SQL injection in /user/zs\_elite.php via the id parameter. (no CVSS) - [CVE-2018-17416](https://cve.now/CVE-2018-17416.md): A SQL injection vulnerability exists in zzcms v8.3 via the /admin/adclass.php bigclassid parameter. (no CVSS) - [CVE-2018-17418](https://cve.now/CVE-2018-17418.md): Monstra CMS 3.0.4 allows remote attackers to execute arbitrary PHP code via a mixed-case file extension, as demonstrated by the 123.PhP file (no CVSS) - [CVE-2018-17419](https://cve.now/CVE-2018-17419.md): An issue was discovered in setTA in scan\_rr.go in the Miek Gieben DNS library before 1.0.10 for Go. (no CVSS, github.com/miekg/dns) - [CVE-2018-17420](https://cve.now/CVE-2018-17420.md): An issue was discovered in ZrLog 2.0.3. (no CVSS) - [CVE-2018-17421](https://cve.now/CVE-2018-17421.md): An issue was discovered in ZrLog 2.0.3. (no CVSS) - [CVE-2018-17422](https://cve.now/CVE-2018-17422.md): dotCMS before 5.0.2 has open redirects via the html/common/forward\_js.jsp FORWARD\_URL parameter or the html/portlet/ext/common/page\_preview\_ (no CVSS) - [CVE-2018-17425](https://cve.now/CVE-2018-17425.md): WUZHI CMS 4.1.0 has stored XSS via the "Membership Center" "I want to ask" "detailed description" field under the index.php?m=member URI. (no CVSS) - [CVE-2018-17426](https://cve.now/CVE-2018-17426.md): WUZHI CMS 4.1.0 has stored XSS via the "Extension module" "SMS in station" field under the index.php?m=core URI. (no CVSS) - [CVE-2018-17429](https://cve.now/CVE-2018-17429.md): /console/account/manage.php?type=action&action=add in JTBC v3.0(C) has CSRF for adding an administrator account. (no CVSS) - [CVE-2018-17988](https://cve.now/CVE-2018-17988.md): LayerBB 1.1.1 and 1.1.3 has SQL Injection via the search.php search\_query parameter. (no CVSS) - [CVE-2018-18449](https://cve.now/CVE-2018-18449.md): EmpireCMS 7.5 allows CSRF for adding a user account via an enews=AddUser action to e/admin/user/ListUser.php, a similar issue to CVE-2018-16 (no CVSS) - [CVE-2018-18808](https://cve.now/CVE-2018-18808.md): TIBCO JasperReports Server Privilege Escalation Via Race Condition (CVSS 8.8, TIBCO Software TIBCO JasperReports Server · TIBCO Softwa… +1) - [CVE-2018-18809](https://cve.now/CVE-2018-18809.md): TIBCO JasperReports Library Directory Traversal Vulnerability (CVSS 9.9, KEV, TIBCO Software TIBCO JasperReports Library · TIBCO Softw… +2) - [CVE-2018-18815](https://cve.now/CVE-2018-18815.md): TIBCO JasperReports Server User Information Disclosure (CVSS 10.0, TIBCO Software TIBCO JasperReports Server · TIBCO Softwa… +1) - [CVE-2018-18816](https://cve.now/CVE-2018-18816.md): TIBCO JasperReports Persistent Cross Site Scripting Vulnerability (CVSS 8.0, TIBCO Software TIBCO JasperReports Server · TIBCO Softwa… +1) - [CVE-2019-6710](https://cve.now/CVE-2019-6710.md): Zyxel NBG-418N v2 v1.00(AAXM.4)C0 devices allow login.cgi CSRF. (no CVSS) - [CVE-2019-7175](https://cve.now/CVE-2019-7175.md): In ImageMagick before 7.0.8-25, some memory leaks exist in DecodeImage in coders/pcd.c. (no CVSS) - [CVE-2019-7660](https://cve.now/CVE-2019-7660.md): An issue was discovered in PHPMyWind 5.5. (no CVSS) - [CVE-2019-7661](https://cve.now/CVE-2019-7661.md): An issue was discovered in PHPMyWind 5.5. (no CVSS) - [CVE-2019-8437](https://cve.now/CVE-2019-8437.md): njiandan-cms through 2013-05-23 has index.php/admin/user\_new CSRF to add an administrator. (no CVSS) - [CVE-2019-8438](https://cve.now/CVE-2019-8438.md): An issue was discovered in DiliCMS 2.4.0. (no CVSS) - [CVE-2019-8439](https://cve.now/CVE-2019-8439.md): An issue was discovered in DiliCMS 2.4.0. (no CVSS) - [CVE-2019-8440](https://cve.now/CVE-2019-8440.md): An issue was discovered in DiliCMS 2.4.0. (no CVSS) - [CVE-2019-8986](https://cve.now/CVE-2019-8986.md): TIBCO JasperReports Server XML Entity Expansion Vulnerability (CVSS 7.7, TIBCO Software TIBCO JasperReports Server) - [CVE-2019-9117](https://cve.now/CVE-2019-9117.md): An issue was discovered on Motorola C1 and M2 devices with firmware 1.01 and 1.07 respectively. (no CVSS) - [CVE-2019-9118](https://cve.now/CVE-2019-9118.md): An issue was discovered on Motorola C1 and M2 devices with firmware 1.01 and 1.07 respectively. (no CVSS) - [CVE-2019-9119](https://cve.now/CVE-2019-9119.md): An issue was discovered on Motorola C1 and M2 devices with firmware 1.01 and 1.07 respectively. (no CVSS) - [CVE-2019-9120](https://cve.now/CVE-2019-9120.md): An issue was discovered on Motorola C1 and M2 devices with firmware 1.01 and 1.07 respectively. (no CVSS) - [CVE-2019-9121](https://cve.now/CVE-2019-9121.md): An issue was discovered on Motorola C1 and M2 devices with firmware 1.01 and 1.07 respectively. (no CVSS) - [CVE-2019-9185](https://cve.now/CVE-2019-9185.md): Controller/Async/FilesystemManager.php in the filemanager in Bolt before 3.6.5 allows remote attackers to execute arbitrary PHP code by rena (no CVSS, bolt/bolt) - [CVE-2019-9598](https://cve.now/CVE-2019-9598.md): An issue was discovered in Cscms 4.1.0. (no CVSS) - [CVE-2019-0192](https://cve.now/CVE-2019-0192.md): In Apache Solr versions 5.0.0 to 5.5.5 and 6.0.0 to 6.6.5, the Config API allows to configure the JMX server via an HTTP POST request. (no CVSS, Apache Software Foundation Apache Solr · org.apache.solr:so…) - [CVE-2019-1598](https://cve.now/CVE-2019-1598.md): Cisco FXOS and NX-OS Lightweight Directory Access Protocol Denial of Service Vulnerabilities (CVSS 8.6, Cisco Firepower 4100 Series Next-Generation Firewalls ·… +6) - [CVE-2019-1599](https://cve.now/CVE-2019-1599.md): Cisco NX-OS Software Netstack Denial of Service Vulnerability (CVSS 8.6, Cisco Nexus 1000V Switch for Microsoft Hyper-V · Cisco N… +9) - [CVE-2019-1600](https://cve.now/CVE-2019-1600.md): Cisco FXOS and NX-OS Software Unauthorized Directory Access Vulnerability (CVSS 6.7, Cisco Firepower 4100 Series Next-Generation Firewalls ·… +8) - [CVE-2019-5019](https://cve.now/CVE-2019-5019.md): A heap-based overflow vulnerability exists in the PowerPoint document conversion function of Rainbow PDF Office Server Document Converter V7 (CVSS 8.8, Antenna House) - [CVE-2019-1596](https://cve.now/CVE-2019-1596.md): Cisco NX-OS Software Bash Shell Privilege Escalation Vulnerability (CVSS 7.8, Cisco Nexus 3000 Series Switches · Cisco Nexus 3500 Plat… +3) - [CVE-2019-1597](https://cve.now/CVE-2019-1597.md): Cisco FXOS and NX-OS Lightweight Directory Access Protocol Denial of Service Vulnerabilities (CVSS 8.6, Cisco Firepower 4100 Series Next-Generation Firewalls ·… +6) - [CVE-2019-3712](https://cve.now/CVE-2019-3712.md): DSA-2019-039: Dell Wyse Device Agent Buffer Overflow Vulnerability (CVSS 8.2, Dell Wyse Device Agent · Dell Wyse ThinLinux HAgent) - [CVE-2019-3775](https://cve.now/CVE-2019-3775.md): UAA allows users to modify their own email address (CVSS 7.1, Cloud Foundry UAA Release) - [CVE-2019-3776](https://cve.now/CVE-2019-3776.md): Reflected XSS in Pivotal Operations Manager (CVSS 7.2, Pivotal Ops Manager) - [CVE-2019-3777](https://cve.now/CVE-2019-3777.md): Apps Manager unverified SSL certs in Cloud Controller proxy (CVSS 8.0, Pivotal Apps Manager · Pivotal Application Service) - [CVE-2019-3778](https://cve.now/CVE-2019-3778.md): Open Redirect in spring-security-oauth2 (no CVSS, Spring Security OAuth · org.springframework.security.oau… +1) - [CVE-2019-3781](https://cve.now/CVE-2019-3781.md): CF CLI does not sanitize user's password in verbose/trace/debug (CVSS 8.2, Cloud Foundry CF CLI) - [CVE-2019-3783](https://cve.now/CVE-2019-3783.md): Cloud Foundry Stratos Deploys With Public Default Session Store Secret (CVSS 8.7, Cloud Foundry Stratos) - [CVE-2019-3784](https://cve.now/CVE-2019-3784.md): Cloud Foundry Stratos contains a Session Collision Vulnerability (CVSS 8.2, Cloud Foundry Stratos) - [CVE-2018-11783](https://cve.now/CVE-2018-11783.md): sslheaders plugin extracts information from the client certificate and sets headers in the request based on the configuration of the plugin. (no CVSS, Apache Software Foundation Apache Traffic Server) - [CVE-2019-9625](https://cve.now/CVE-2019-9625.md): JBMC DirectAdmin 1.55 allows CSRF via the /CMD\_ACCOUNT\_ADMIN URI to create a new admin account. (no CVSS) - [CVE-2019-9626](https://cve.now/CVE-2019-9626.md): PHPSHE 1.7 allows module/index/cart.php pintuan\_id SQL Injection to index.php. (no CVSS) - [CVE-2019-9622](https://cve.now/CVE-2019-9622.md): eBrigade through 4.5 allows Arbitrary File Download via ../ directory traversal in the showfile.php file parameter, as demonstrated by readi (no CVSS) - [CVE-2019-9623](https://cve.now/CVE-2019-9623.md): Feng Office 3.7.0.5 allows remote attackers to execute arbitrary code via "\