# CVEs published 2019-03-08

41 CVEs were published on March 8, 2019: 5 critical, 7 high. 2 are now in CISA KEV. Days are UTC.

- [CVE-2019-9637](https://cve.now/CVE-2019-9637.md): An issue was discovered in PHP before 7.1.27, 7.2.x before 7.2.16, and 7.3.x before 7.3.3. (no CVSS)
- [CVE-2019-9638](https://cve.now/CVE-2019-9638.md): An issue was discovered in the EXIF component in PHP before 7.1.27, 7.2.x before 7.2.16, and 7.3.x before 7.3.3. (no CVSS)
- [CVE-2019-9639](https://cve.now/CVE-2019-9639.md): An issue was discovered in the EXIF component in PHP before 7.1.27, 7.2.x before 7.2.16, and 7.3.x before 7.3.3. (no CVSS)
- [CVE-2019-9640](https://cve.now/CVE-2019-9640.md): An issue was discovered in the EXIF component in PHP before 7.1.27, 7.2.x before 7.2.16, and 7.3.x before 7.3.3. (no CVSS)
- [CVE-2019-9641](https://cve.now/CVE-2019-9641.md): An issue was discovered in the EXIF component in PHP before 7.1.27, 7.2.x before 7.2.16, and 7.3.x before 7.3.3. (no CVSS)
- [CVE-2017-3164](https://cve.now/CVE-2017-3164.md): Server Side Request Forgery in Apache Solr, versions 1.3 until 7.6 (inclusive). (no CVSS, Apache Software Foundation Apache Solr · org.apache.solr:so…)
- [CVE-2019-1003029](https://cve.now/CVE-2019-1003029.md): A sandbox bypass vulnerability exists in Jenkins Script Security Plugin 1.53 and earlier in src/main/java/org/jenkinsci/plugins/scriptsecuri (CVSS 9.9, KEV, Jenkins project Jenkins Script Security Plugin · org.jenkin…)
- [CVE-2019-1003030](https://cve.now/CVE-2019-1003030.md): A sandbox bypass vulnerability exists in Jenkins Pipeline: Groovy Plugin 2.63 and earlier in pom.xml, src/main/java/org/jenkinsci/plugins/wo (CVSS 9.9, KEV, Jenkins project Jenkins Pipeline: Groovy Plugin · org.jenki…)
- [CVE-2019-1003031](https://cve.now/CVE-2019-1003031.md): A sandbox bypass vulnerability exists in Jenkins Matrix Project Plugin 1.13 and earlier in pom.xml, src/main/java/hudson/matrix/FilterScript (no CVSS, Jenkins project Jenkins Matrix Project Plugin · org.jenkins…)
- [CVE-2019-1003032](https://cve.now/CVE-2019-1003032.md): A sandbox bypass vulnerability exists in Jenkins Email Extension Plugin 2.64 and earlier in pom.xml, src/main/java/hudson/plugins/emailext/E (no CVSS, Jenkins project Jenkins Email Extension Plugin · org.jenkin…)
- [CVE-2019-1003033](https://cve.now/CVE-2019-1003033.md): A sandbox bypass vulnerability exists in Jenkins Groovy Plugin 2.1 and earlier in pom.xml, src/main/java/hudson/plugins/groovy/StringScriptS (no CVSS, Jenkins project Jenkins Groovy Plugin · org.jenkins-ci.plug…)
- [CVE-2019-1003034](https://cve.now/CVE-2019-1003034.md): A sandbox bypass vulnerability exists in Jenkins Job DSL Plugin 1.71 and earlier in job-dsl-core/src/main/groovy/javaposse/jobdsl/dsl/Abstra (no CVSS, Jenkins project Jenkins Job DSL Plugin · org.jenkins-ci.plu…)
- [CVE-2019-1003035](https://cve.now/CVE-2019-1003035.md): An information exposure vulnerability exists in Jenkins Azure VM Agents Plugin 0.8.0 and earlier in src/main/java/com/microsoft/azure/vmagen (no CVSS, Jenkins project Jenkins Azure VM Agents Plugin · org.jenkin…)
- [CVE-2019-1003036](https://cve.now/CVE-2019-1003036.md): A data modification vulnerability exists in Jenkins Azure VM Agents Plugin 0.8.0 and earlier in src/main/java/com/microsoft/azure/vmagent/Az (no CVSS, Jenkins project Jenkins Azure VM Agents Plugin · org.jenkin…)
- [CVE-2019-1003037](https://cve.now/CVE-2019-1003037.md): An information exposure vulnerability exists in Jenkins Azure VM Agents Plugin 0.8.0 and earlier in src/main/java/com/microsoft/azure/vmagen (no CVSS, Jenkins project Jenkins Azure VM Agents Plugin · org.jenkin…)
- [CVE-2019-1003038](https://cve.now/CVE-2019-1003038.md): An insufficiently protected credentials vulnerability exists in Jenkins Repository Connector Plugin 1.2.4 and earlier in src/main/java/org/j (no CVSS, Jenkins project Jenkins Repository Connector Plugin · org.j…)
- [CVE-2019-1003039](https://cve.now/CVE-2019-1003039.md): An insufficiently protected credentials vulnerability exists in JenkinsAppDynamics Dashboard Plugin 1.0.14 and earlier in src/main/java/nl/c (no CVSS, Jenkins project JenkinsAppDynamics Dashboard Plugin · org.j…)
- [CVE-2019-9636](https://cve.now/CVE-2019-9636.md): Python 2.7.x through 2.7.16 and 3.x through 3.7.2 is affected by: Improper Handling of Unicode Encoding (with an incorrect netloc) during NF (CVSS 5.3)
- [CVE-2018-4054](https://cve.now/CVE-2018-4054.md): A local privilege escalation vulnerability exists in the install helper tool of the Mac OS X version of Pixar Renderman, version 22.2.0. (CVSS 9.0, Talos Pixar Renderman)
- [CVE-2018-4055](https://cve.now/CVE-2018-4055.md): A local privilege escalation vulnerability exists in the install helper tool of the Mac OS X version of Pixar Renderman, version 22.2.0. (CVSS 7.1, Talos Pixar Renderman)
- [CVE-2019-1605](https://cve.now/CVE-2019-1605.md): Cisco NX-OS Software NX-API Arbitrary Code Execution Vulnerability (CVSS 7.8, Cisco MDS 9000 Series Multilayer Switches · Cisco Nexus… +6)
- [CVE-2019-1606](https://cve.now/CVE-2019-1606.md): Cisco NX-OS Software CLI Command Injection Vulnerability (CVE-2019-1606) (CVSS 5.3, Cisco Nexus 9000 Series Switches in Standalone NX-OS Mod… +1)
- [CVE-2019-1607](https://cve.now/CVE-2019-1607.md): Cisco NX-OS Software CLI Command Injection Vulnerability (CVE-2019-1607) (CVSS 4.2, Cisco Nexus 7000 and 7700 Series Switches)
- [CVE-2019-1608](https://cve.now/CVE-2019-1608.md): Cisco NX-OS Software CLI Command Injection Vulnerability (CVE-2019-1608) (CVSS 4.2, Cisco MDS 9000 Series Multilayer Switches · Cisco Nexus 700…)
- [CVE-2019-1609](https://cve.now/CVE-2019-1609.md): Cisco NX-OS Software CLI Command Injection Vulnerability (CVE-2019-1609) (CVSS 4.2, Cisco MDS 9000 Series Multilayer Switches · Cisco Nexus… +5)
- [CVE-2019-5015](https://cve.now/CVE-2019-5015.md): A local privilege escalation vulnerability exists in the Mac OS X version of Pixar Renderman 22.3.0's Install Helper helper tool. (CVSS 9.0, Talos Pixar Renderman)
- [CVE-2018-20187](https://cve.now/CVE-2018-20187.md): A side-channel issue was discovered in Botan before 2.9.0. (no CVSS)
- [CVE-2019-1602](https://cve.now/CVE-2019-1602.md): Cisco NX-OS Software Privilege Escalation Vulnerability (CVSS 7.8, Cisco Nexus 3000 Series Switches · Cisco Nexus 3500 Plat… +3)
- [CVE-2019-1603](https://cve.now/CVE-2019-1603.md): Cisco NX-OS Software Privilege Escalation Vulnerability (CVSS 7.8, Cisco Nexus 3000 Series Switches · Cisco Nexus 3500 Plat… +3)
- [CVE-2019-1604](https://cve.now/CVE-2019-1604.md): Cisco NX-OS Software Privilege Escalation Vulnerability (CVSS 7.3, Cisco Nexus 7000 and 7700 Series Switches · Cisco Nexus… +4)
- [CVE-2019-9627](https://cve.now/CVE-2019-9627.md): A buffer overflow in the kernel driver CybKernelTracker.sys in CyberArk Endpoint Privilege Manager versions prior to 10.7 allows an attacker (no CVSS)
- [CVE-2018-20234](https://cve.now/CVE-2018-20234.md): There was an argument injection vulnerability in Atlassian Sourcetree for macOS from version 1.2 before version 3.1.1 via filenames in Mercu (no CVSS, Atlassian Sourcetree for macOS)
- [CVE-2018-20235](https://cve.now/CVE-2018-20235.md): There was an argument injection vulnerability in Atlassian Sourcetree for Windows from version 0.5a before version 3.0.15 via filenames in M (no CVSS, Atlassian Sourcetree for Windows)
- [CVE-2018-20236](https://cve.now/CVE-2018-20236.md): There was an command injection vulnerability in Sourcetree for Windows from version 0.5a before version 3.0.10 via URI handling. (no CVSS, Atlassian Sourcetree for Windows)
- [CVE-2019-1601](https://cve.now/CVE-2019-1601.md): Cisco NX-OS Software Unauthorized Filesystem Access Vulnerability (CVSS 7.8, Cisco MDS 9000 Series Multilayer Switches · Cisco Nexus… +6)
- [CVE-2019-3779](https://cve.now/CVE-2019-3779.md): Cloud Foundry Container Runtime allows a user to bypass security policy when talking to ETCD (CVSS 8.8, Cloud Foundry Container Runtime)
- [CVE-2019-3780](https://cve.now/CVE-2019-3780.md): Cloud Foundry Container Runtime Leaks IAAS Credentials (CVSS 9.1, Cloud Foundry Container Runtime)
- [CVE-2019-9634](https://cve.now/CVE-2019-9634.md): Go through 1.12 on Windows misuses certain LoadLibrary functionality, leading to DLL injection. (no CVSS, stdlib)
- [CVE-2019-9633](https://cve.now/CVE-2019-9633.md): gio/gsocketclient.c in GNOME GLib 2.59.2 does not ensure that a parent GTask remains alive during the execution of a connection-attempting e (no CVSS)
- [CVE-2019-9632](https://cve.now/CVE-2019-9632.md): ESAFENET CDG V3 and V5 has an arbitrary file download vulnerability via the fileName parameter in download.jsp because the InstallationPack (no CVSS)
- [CVE-2019-9631](https://cve.now/CVE-2019-9631.md): Poppler 0.74.0 has a heap-based buffer over-read in the CairoRescaleBox.cc downsample\_row\_box\_filter function. (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2019-03-08
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.