CVEs published March 12, 2019
34 CVEs were published on March 12, 2019: 0 critical, 0 high.
- Published
- 34
- Critical
- 0
- High
- 0
- Medium
- 1
- Low
- 0
- Unrated
- 33
- Now in CISA KEV
- 0
- Fix available
- 10
Most affected products
- SAP SE SAP BusinessObjects Business Intelligence Platform
- 2
- iChain Insurance Wallet App for iOS
- 1
- McAfee, LCC McAfee Database Security
- 1
- Microsoft azure-umqtt-c
- 1
- Microsoft Windows
- 1
- nCrafts FormCraft
- 1
- notebook · jupyter-notebook
- 1
- RedNao Smart Forms
- 1
- SAP SE ABAP Platform & Server
- 1
- SAP SE ABAP Server
- 1
Medium, low and unrated 34
- CVE-2019-0268SAP BusinessObjects Business Intelligence Platform (CMC Module), versions 4.10, 4.20 and 4.30, does not sufficiently validate an XML documenSAP SE SAP BusinessObjects Business Intelligence Platform
- CVE-2019-0269SAP BusinessObjects Business Intelligence Platform (BI Workspace), versions 4.10 and 4.20, does not sufficiently encode user-controlled inpuSAP SE SAP BusinessObjects Business Intelligence Platform
- CVE-2019-0270ABAP Server of SAP NetWeaver and ABAP Platform fail to perform necessary authorization checks for an authenticated user, resulting in escalaSAP SE ABAP Platform & Server
- CVE-2019-0271ABAP Server (used in NetWeaver and Suite/ERP) and ABAP Platform does not sufficiently validate an XML document accepted from an untrusted soSAP SE ABAP Server
- CVE-2019-0274SAP Mobile Platform SDK allows an attacker to prevent legitimate users from accessing a service, either by crashing or flooding the service SAP SE SAP Mobile Platform SDK
- CVE-2019-0275SAML 1.1 SSO Demo Application in SAP NetWeaver Java Application Server (J2EE-APPS), versions 7.10 to 7.11, 7.20, 7.30, 7.31, 7.40 and 7.50, SAP SE SAP NetWeaver Java Application Server
- CVE-2019-0276Banking services from SAP 9.0 (FSAPPL version 5) and SAP S/4HANA Financial Products Subledger (S4FPSL, version 1) performs an inadequate autSAP SE Banking services from SAP · SAP SE SAP S/4HANA Finan…
- CVE-2019-0277SAP HANA extended application services, version 1, advanced does not sufficiently validate an XML document accepted from an authenticated deSAP SE SAP HANA Extended Application Services
- CVE-2019-3615Data Leakage Vulnerability in McAfee Database Security web interfaceMcAfee, LCC McAfee Database Security
- CVE-2019-9729In Shanda MapleStory Online V160, the SdoKeyCrypt.sys driver allows privilege escalation to NT AUTHORITY\SYSTEM because of not validating th
- CVE-2019-5917azure-umqtt-c (available through GitHub prior to 2017 October 6) allows remote attackers to cause a denial of service via unspecified vectorMicrosoft azure-umqtt-c
- CVE-2019-5918Nablarch 5 (5, and 5u1 to 5u13) allows remote attackers to conduct XML External Entity (XXE) attacks via unspecified vectors.TIS Nablarch
- CVE-2019-5919An incomplete cryptography of the data store function by using hidden tag in Nablarch 5 (5, and 5u1 to 5u13) allows remote attackers to obtaTIS Nablarch · com.nablarch.framework:nablarch-fw-web
- CVE-2019-5920Cross-site request forgery (CSRF) vulnerability in FormCraft 1.2.1 and earlier allows remote attackers to hijack the authentication of adminnCrafts FormCraft
- CVE-2019-5921Untrusted search path vulnerability in Windows 7 allows an attacker to gain privileges via a Trojan horse DLL in an unspecified directory.Microsoft Windows
- CVE-2019-5922Untrusted search path vulnerability in The installer of Microsoft Teams allows an attacker to gain privileges via a Trojan horse DLL in an uThe installer of Microsoft Teams
- CVE-2019-5923Directory traversal vulnerability in iChain Insurance Wallet App for iOS Version 1.3.0 and earlier allows remote attackers to read arbitraryiChain Insurance Wallet App for iOS
- CVE-2019-5924Cross-site request forgery (CSRF) vulnerability in Smart Forms 2.6.15 and earlier allows remote attackers to hijack the authentication of adRedNao Smart Forms
- CVE-2019-5925Cross-site scripting vulnerability in Dradis Community Edition Dradis Community Edition v3.11 and earlier and Dradis Professional Edition v3Security Roots Dradis Community Edition and Dradis Professi…
- CVE-2019-9558Mailtraq WebMail version 2.17.7.3550 has Persistent Cross Site Scripting (XSS) via the body of an e-mail message.
- CVE-2019-9725The Web manager (aka Commander) on Korenix JetPort 5601 and 5601f devices has Persistent XSS via the Port Alias field under Serial Setting.
- CVE-2019-9557Ability Mail Server 4.2.6 has Persistent Cross Site Scripting (XSS) via the body e-mail body.
- CVE-2019-9711An issue was discovered in Joomla! before 3.9.4.
- CVE-2019-9712An issue was discovered in Joomla! before 3.9.4.
- CVE-2019-9713An issue was discovered in Joomla! before 3.9.4.
- CVE-2019-9714An issue was discovered in Joomla! before 3.9.4.
- CVE-2018-17944On certain Lexmark devices that communicate with an LDAP or SMTP server, a malicious administrator can discover LDAP or SMTP credentials by
- CVE-2019-9644An XSSI (cross-site inclusion) vulnerability in Jupyter Notebook before 5.7.6 allows inclusion of resources on malicious pages when visited notebook · jupyter-notebook
- CVE-2019-9718In FFmpeg 3.2 and 4.1, a denial of service in the subtitle decoder allows attackers to hog the CPU via a crafted video file in Matroska form
- CVE-2019-9721A denial of service in the subtitle decoder in FFmpeg 3.2 and 4.1 allows attackers to hog the CPU via a crafted video file in Matroska forma
- CVE-2019-9710An issue was discovered in webargs before 5.1.3, as used with marshmallow and other products.webargs
- CVE-2019-9704Vixie Cron before the 3.0pl1-133 Debian package allows local users to cause a denial of service (daemon crash) via a large crontab file beca
- CVE-2019-9705Vixie Cron before the 3.0pl1-133 Debian package allows local users to cause a denial of service (memory consumption) via a large crontab fil
- CVE-2019-9706Vixie Cron before the 3.0pl1-133 Debian package allows local users to cause a denial of service (use-after-free and daemon crash) because of