# CVEs published 2019-03-11

38 CVEs were published on March 11, 2019: 0 critical, 12 high. Days are UTC.

- [CVE-2018-1890](https://cve.now/CVE-2018-1890.md): IBM SDK, Java Technology Edition Version 8 on the AIX platform uses absolute RPATHs which may facilitate code injection and privilege elevat (CVSS 5.6, IBM WebSphere Application Server Patterns · IBM WebSpher… +1)
- [CVE-2018-1902](https://cve.now/CVE-2018-1902.md): IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 could allow a remote attacker to spoof connection information which could be used to (CVSS 3.1, IBM WebSphere Application Server)
- [CVE-2018-1922](https://cve.now/CVE-2018-1922.md): IBM DB2 for Linux, UNIX and Windows (includes DB2 Connect Server) 9.7, 10.1, 10.5, and 11.1 is affected by buffer overflow vulnerability tha (CVSS 8.4, IBM DB2 for Linux, UNIX and Windows)
- [CVE-2018-1923](https://cve.now/CVE-2018-1923.md): IBM DB2 for Linux, UNIX and Windows (includes DB2 Connect Server) 9.7, 10.1, 10.5, and 11.1 is affected by buffer overflow vulnerability tha (CVSS 8.4, IBM DB2 for Linux, UNIX and Windows)
- [CVE-2018-1974](https://cve.now/CVE-2018-1974.md): IBM WebSphere 8.0.0.0 through 9.1.1 could allow an authenticated attacker to escalate their privileges when using multiplexed channels. (CVSS 7.5, IBM MQ)
- [CVE-2018-1978](https://cve.now/CVE-2018-1978.md): IBM DB2 for Linux, UNIX and Windows (includes DB2 Connect Server) 9.7, 10.1, 10.5, and 11.1 is vulnerable to a buffer overflow, which could (CVSS 8.4, IBM DB2 for Linux, UNIX and Windows)
- [CVE-2018-1980](https://cve.now/CVE-2018-1980.md): IBM DB2 for Linux, UNIX and Windows (includes DB2 Connect Server) 9.7, 10.1, 10.5, and 11.1 is vulnerable to a buffer overflow, which could (CVSS 8.4, IBM DB2 for Linux, UNIX and Windows)
- [CVE-2018-1998](https://cve.now/CVE-2018-1998.md): IBM WebSphere MQ 8.0.0.0 through 9.1.1 could allow a local user to inject code that could be executed with root privileges. (CVSS 8.8, IBM MQ)
- [CVE-2018-2009](https://cve.now/CVE-2018-2009.md): IBM API Connect v2018.1 and 2018.4.1 is affected by an information disclosure vulnerability in the consumer API. (CVSS 6.5, IBM API Connect)
- [CVE-2019-1610](https://cve.now/CVE-2019-1610.md): Cisco NX-OS Software CLI Command Injection Vulnerability (CVE-2019-1610) (CVSS 4.2, Cisco Nexus 3500 Platform Switches · Cisco Nexus 3000 Serie…)
- [CVE-2019-1611](https://cve.now/CVE-2019-1611.md): Cisco FXOS and NX-OS Software CLI Command Injection Vulnerability (CVE-2019-1611) (CVSS 4.2, Cisco Firepower 4100 Series Next-Generation Firewalls ·… +8)
- [CVE-2019-1612](https://cve.now/CVE-2019-1612.md): Cisco NX-OS Software CLI Command Injection Vulnerability (CVE-2019-1612) (CVSS 4.2, Cisco Nexus 3000 Series Switches · Cisco Nexus 3500 Plat… +3)
- [CVE-2019-1613](https://cve.now/CVE-2019-1613.md): Cisco NX-OS Software CLI Command Injection Vulnerability (CVE-2019-1613) (CVSS 4.2, Cisco MDS 9000 Series Multilayer Switches · Cisco Nexus… +5)
- [CVE-2019-1614](https://cve.now/CVE-2019-1614.md): Cisco NX-OS Software NX-API Command Injection Vulnerability (CVSS 8.8, Cisco MDS 9000 Series Multilayer Switches · Cisco Nexus… +4)
- [CVE-2019-1615](https://cve.now/CVE-2019-1615.md): Cisco NX-OS Software Image Signature Verification Vulnerability (CVSS 6.7, Cisco Nexus 3000 Series Switches · Cisco Nexus 9000 Seri… +2)
- [CVE-2019-1616](https://cve.now/CVE-2019-1616.md): Cisco NX-OS Software Cisco Fabric Services Denial of Service Vulnerability (CVSS 8.6, Cisco MDS 9000 Series Multilayer Switches · Cisco Nexus… +6)
- [CVE-2019-1617](https://cve.now/CVE-2019-1617.md): Cisco Nexus 9000 Series Switches Standalone NX-OS Mode Fibre Channel over Ethernet NPV Denial of Service Vulnerability (CVSS 7.4, Cisco Nexus 9000 Series Switches in Standalone NX-OS Mode)
- [CVE-2019-1618](https://cve.now/CVE-2019-1618.md): Cisco Nexus 9000 Series Switches Standalone NX-OS Mode Tetration Analytics Agent Arbitrary Code Execution Vulnerability (CVSS 7.8, Cisco Nexus 9000 Series Switches in Standalone NX-OS Mode)
- [CVE-2019-1690](https://cve.now/CVE-2019-1690.md): Cisco Application Policy Infrastructure Controller IPv6 Link-Local Address Vulnerability (CVSS 4.3, Cisco Application Policy Infrastructure Controller)
- [CVE-2019-1702](https://cve.now/CVE-2019-1702.md): Cisco Enterprise Chat and Email Cross-Site Scripting Vulnerabilities (CVSS 6.1, Cisco Enterprise Chat and Email)
- [CVE-2019-1707](https://cve.now/CVE-2019-1707.md): Cisco DNA Center Access Contract Stored Cross-Site Scripting Vulnerability (CVSS 5.4, Cisco Digital Network Architecture Center)
- [CVE-2019-4015](https://cve.now/CVE-2019-4015.md): IBM DB2 for Linux, UNIX and Windows (includes DB2 Connect Server) 9.7, 10.1, 10.5, and 11.1 is vulnerable to a buffer overflow, which could (CVSS 8.4, IBM DB2 for Linux, UNIX and Windows)
- [CVE-2019-4016](https://cve.now/CVE-2019-4016.md): IBM DB2 for Linux, UNIX and Windows (includes DB2 Connect Server) 9.7, 10.1, 10.5, and 11.1 is vulnerable to a buffer overflow, which could (CVSS 8.4, IBM DB2 for Linux, UNIX and Windows)
- [CVE-2019-9692](https://cve.now/CVE-2019-9692.md): class.showtime2\_image.php in CMS Made Simple (CMSMS) before 2.2.10 does not ensure that a watermark file has a standard image file extension (no CVSS)
- [CVE-2019-9693](https://cve.now/CVE-2019-9693.md): In CMS Made Simple (CMSMS) before 2.2.10, an authenticated user can achieve SQL Injection in class.showtime2\_data.php via the functions \_upd (no CVSS)
- [CVE-2019-9686](https://cve.now/CVE-2019-9686.md): pacman before 5.1.3 allows directory traversal when installing a remote package via a specified URL "pacman -U \<url\>" due to an unsanitized (no CVSS)
- [CVE-2019-9687](https://cve.now/CVE-2019-9687.md): PoDoFo 0.9.6 has a heap-based buffer overflow in PdfString::ConvertUTF16toUTF8 in base/PdfString.cpp. (no CVSS)
- [CVE-2019-9688](https://cve.now/CVE-2019-9688.md): sftnow through 2018-12-29 allows index.php?g=Admin&m=User&a=add\_post CSRF to add an admin account. (no CVSS)
- [CVE-2019-9659](https://cve.now/CVE-2019-9659.md): The Chuango 433 MHz burglar-alarm product line uses static codes in the RF remote control, allowing an attacker to arm, disarm, or trigger t (no CVSS)
- [CVE-2019-9675](https://cve.now/CVE-2019-9675.md): An issue was discovered in PHP 7.x before 7.1.27 and 7.3.x before 7.3.3. (no CVSS)
- [CVE-2019-9656](https://cve.now/CVE-2019-9656.md): An issue was discovered in LibOFX 0.9.14. (no CVSS)
- [CVE-2019-9658](https://cve.now/CVE-2019-9658.md): Checkstyle before 8.18 loads external DTDs by default. (no CVSS, com.puppycrawl.tools:checkstyle)
- [CVE-2019-9660](https://cve.now/CVE-2019-9660.md): Stored XSS exists in YzmCMS 5.2 via the admin/category/edit.html "catname" parameter. (no CVSS)
- [CVE-2019-9661](https://cve.now/CVE-2019-9661.md): Stored XSS exists in YzmCMS 5.2 via the admin/system\_manage/user\_config\_edit.html "value" parameter, (no CVSS)
- [CVE-2019-9662](https://cve.now/CVE-2019-9662.md): An issue was discovered in JTBC(PHP) 3.0.1.8. (no CVSS)
- [CVE-2019-9650](https://cve.now/CVE-2019-9650.md): An XSS issue was discovered in upcoming\_events.php in the Upcoming Events plugin before 1.33 for MyBB via a crafted name for an event. (no CVSS)
- [CVE-2019-9651](https://cve.now/CVE-2019-9651.md): An issue was discovered in SDCMS V1.7. (no CVSS)
- [CVE-2019-9652](https://cve.now/CVE-2019-9652.md): There is a CSRF in SDCMS V1.7 via an m=admin&c=theme&a=edit request. (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2019-03-11
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.