# CVEs published 2019-03-12

34 CVEs were published on March 12, 2019: 0 critical, 0 high. Days are UTC.

- [CVE-2019-0268](https://cve.now/CVE-2019-0268.md): SAP BusinessObjects Business Intelligence Platform (CMC Module), versions 4.10, 4.20 and 4.30, does not sufficiently validate an XML documen (no CVSS, SAP SE SAP BusinessObjects Business Intelligence Platform)
- [CVE-2019-0269](https://cve.now/CVE-2019-0269.md): SAP BusinessObjects Business Intelligence Platform (BI Workspace), versions 4.10 and 4.20, does not sufficiently encode user-controlled inpu (no CVSS, SAP SE SAP BusinessObjects Business Intelligence Platform)
- [CVE-2019-0270](https://cve.now/CVE-2019-0270.md): ABAP Server of SAP NetWeaver and ABAP Platform fail to perform necessary authorization checks for an authenticated user, resulting in escala (no CVSS, SAP SE ABAP Platform & Server)
- [CVE-2019-0271](https://cve.now/CVE-2019-0271.md): ABAP Server (used in NetWeaver and Suite/ERP) and ABAP Platform does not sufficiently validate an XML document accepted from an untrusted so (no CVSS, SAP SE ABAP Server)
- [CVE-2019-0274](https://cve.now/CVE-2019-0274.md): SAP Mobile Platform SDK allows an attacker to prevent legitimate users from accessing a service, either by crashing or flooding the service (no CVSS, SAP SE SAP Mobile Platform SDK)
- [CVE-2019-0275](https://cve.now/CVE-2019-0275.md): SAML 1.1 SSO Demo Application in SAP NetWeaver Java Application Server (J2EE-APPS), versions 7.10 to 7.11, 7.20, 7.30, 7.31, 7.40 and 7.50, (no CVSS, SAP SE SAP NetWeaver Java Application Server)
- [CVE-2019-0276](https://cve.now/CVE-2019-0276.md): Banking services from SAP 9.0 (FSAPPL version 5) and SAP S/4HANA Financial Products Subledger (S4FPSL, version 1) performs an inadequate aut (no CVSS, SAP SE Banking services from SAP · SAP SE SAP S/4HANA Finan…)
- [CVE-2019-0277](https://cve.now/CVE-2019-0277.md): SAP HANA extended application services, version 1, advanced does not sufficiently validate an XML document accepted from an authenticated de (no CVSS, SAP SE SAP HANA Extended Application Services)
- [CVE-2019-3615](https://cve.now/CVE-2019-3615.md): Data Leakage Vulnerability in McAfee Database Security web interface (CVSS 5.3, McAfee, LCC McAfee Database Security)
- [CVE-2019-9729](https://cve.now/CVE-2019-9729.md): In Shanda MapleStory Online V160, the SdoKeyCrypt.sys driver allows privilege escalation to NT AUTHORITY\\SYSTEM because of not validating th (no CVSS)
- [CVE-2019-5917](https://cve.now/CVE-2019-5917.md): azure-umqtt-c (available through GitHub prior to 2017 October 6) allows remote attackers to cause a denial of service via unspecified vector (no CVSS, Microsoft azure-umqtt-c)
- [CVE-2019-5918](https://cve.now/CVE-2019-5918.md): Nablarch 5 (5, and 5u1 to 5u13) allows remote attackers to conduct XML External Entity (XXE) attacks via unspecified vectors. (no CVSS, TIS Nablarch)
- [CVE-2019-5919](https://cve.now/CVE-2019-5919.md): An incomplete cryptography of the data store function by using hidden tag in Nablarch 5 (5, and 5u1 to 5u13) allows remote attackers to obta (no CVSS, TIS Nablarch · com.nablarch.framework:nablarch-fw-web)
- [CVE-2019-5920](https://cve.now/CVE-2019-5920.md): Cross-site request forgery (CSRF) vulnerability in FormCraft 1.2.1 and earlier allows remote attackers to hijack the authentication of admin (no CVSS, nCrafts FormCraft)
- [CVE-2019-5921](https://cve.now/CVE-2019-5921.md): Untrusted search path vulnerability in Windows 7 allows an attacker to gain privileges via a Trojan horse DLL in an unspecified directory. (no CVSS, Microsoft Windows)
- [CVE-2019-5922](https://cve.now/CVE-2019-5922.md): Untrusted search path vulnerability in The installer of Microsoft Teams allows an attacker to gain privileges via a Trojan horse DLL in an u (no CVSS, The installer of Microsoft Teams)
- [CVE-2019-5923](https://cve.now/CVE-2019-5923.md): Directory traversal vulnerability in iChain Insurance Wallet App for iOS Version 1.3.0 and earlier allows remote attackers to read arbitrary (no CVSS, iChain Insurance Wallet App for iOS)
- [CVE-2019-5924](https://cve.now/CVE-2019-5924.md): Cross-site request forgery (CSRF) vulnerability in Smart Forms 2.6.15 and earlier allows remote attackers to hijack the authentication of ad (no CVSS, RedNao Smart Forms)
- [CVE-2019-5925](https://cve.now/CVE-2019-5925.md): Cross-site scripting vulnerability in Dradis Community Edition Dradis Community Edition v3.11 and earlier and Dradis Professional Edition v3 (no CVSS, Security Roots Dradis Community Edition and Dradis Professi…)
- [CVE-2019-9558](https://cve.now/CVE-2019-9558.md): Mailtraq WebMail version 2.17.7.3550 has Persistent Cross Site Scripting (XSS) via the body of an e-mail message. (no CVSS)
- [CVE-2019-9725](https://cve.now/CVE-2019-9725.md): The Web manager (aka Commander) on Korenix JetPort 5601 and 5601f devices has Persistent XSS via the Port Alias field under Serial Setting. (no CVSS)
- [CVE-2019-9557](https://cve.now/CVE-2019-9557.md): Ability Mail Server 4.2.6 has Persistent Cross Site Scripting (XSS) via the body e-mail body. (no CVSS)
- [CVE-2019-9711](https://cve.now/CVE-2019-9711.md): An issue was discovered in Joomla! before 3.9.4. (no CVSS)
- [CVE-2019-9712](https://cve.now/CVE-2019-9712.md): An issue was discovered in Joomla! before 3.9.4. (no CVSS)
- [CVE-2019-9713](https://cve.now/CVE-2019-9713.md): An issue was discovered in Joomla! before 3.9.4. (no CVSS)
- [CVE-2019-9714](https://cve.now/CVE-2019-9714.md): An issue was discovered in Joomla! before 3.9.4. (no CVSS)
- [CVE-2018-17944](https://cve.now/CVE-2018-17944.md): On certain Lexmark devices that communicate with an LDAP or SMTP server, a malicious administrator can discover LDAP or SMTP credentials by (no CVSS)
- [CVE-2019-9644](https://cve.now/CVE-2019-9644.md): An XSSI (cross-site inclusion) vulnerability in Jupyter Notebook before 5.7.6 allows inclusion of resources on malicious pages when visited (no CVSS, notebook · jupyter-notebook)
- [CVE-2019-9718](https://cve.now/CVE-2019-9718.md): In FFmpeg 3.2 and 4.1, a denial of service in the subtitle decoder allows attackers to hog the CPU via a crafted video file in Matroska form (no CVSS)
- [CVE-2019-9721](https://cve.now/CVE-2019-9721.md): A denial of service in the subtitle decoder in FFmpeg 3.2 and 4.1 allows attackers to hog the CPU via a crafted video file in Matroska forma (no CVSS)
- [CVE-2019-9710](https://cve.now/CVE-2019-9710.md): An issue was discovered in webargs before 5.1.3, as used with marshmallow and other products. (no CVSS, webargs)
- [CVE-2019-9704](https://cve.now/CVE-2019-9704.md): Vixie Cron before the 3.0pl1-133 Debian package allows local users to cause a denial of service (daemon crash) via a large crontab file beca (no CVSS)
- [CVE-2019-9705](https://cve.now/CVE-2019-9705.md): Vixie Cron before the 3.0pl1-133 Debian package allows local users to cause a denial of service (memory consumption) via a large crontab fil (no CVSS)
- [CVE-2019-9706](https://cve.now/CVE-2019-9706.md): Vixie Cron before the 3.0pl1-133 Debian package allows local users to cause a denial of service (use-after-free and daemon crash) because of (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2019-03-12
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.