CVEs published March 15, 2019
39 CVEs were published on March 15, 2019: 0 critical, 0 high.
- Published
- 39
- Critical
- 0
- High
- 0
- Medium
- 3
- Low
- 2
- Unrated
- 34
- Now in CISA KEV
- 0
- Fix available
- 4
Most affected products
- com.diffplug.spotless:spotless-plugin-gradle · com.diffplug…
- 1
- doorkeeper-openid_connect
- 1
- simple-markdown
- 1
- SUSE yast2-multipath
- 1
- SUSE yast2-printer
- 1
- SUSE yast2-samba-provision
- 1
Medium, low and unrated 39
- CVE-2018-20806Phamm (aka PHP LDAP Virtual Hosting Manager) 0.6.8 allows XSS via the login page (the /public/main.php action parameter).
- CVE-2019-9837Doorkeeper::OpenidConnect (aka the OpenID Connect extension for Doorkeeper) 1.4.x and 1.5.x before 1.5.4 has an open redirect via the rediredoorkeeper-openid_connect
- CVE-2019-9843In DiffPlug Spotless before 1.20.0 (library and Maven plugin) and before 3.20.0 (Gradle plugin), the XML parser would resolve external entitcom.diffplug.spotless:spotless-plugin-gradle · com.diffplug…
- CVE-2019-9844simple-markdown.js in Khan Academy simple-markdown before 0.4.4 allows XSS via a data: or vbscript: URI.simple-markdown
- CVE-2018-14745Buffer overflow in prot_get_ring_space in the bcmdhd4358 Wi-Fi driver on the Samsung Galaxy S6 SM-G920F G920FXXU5EQH7 allows an attacker (wh
- CVE-2018-15508Five9 Agent Desktop Plus 10.0.70 has Incorrect Access Control allowing a remote attackers to cause a denial of service via opening a connect
- CVE-2018-15509Five9 Agent Desktop Plus 10.0.70 has Incorrect Access Control (issue 2 of 2).
- CVE-2018-19872An issue was discovered in Qt 5.11.
- CVE-2019-6149An unquoted search path vulnerability was identified in Lenovo Dynamic Power Reduction Utility prior to version 2.2.2.0 that could allow a m
- CVE-2019-5616CircuitWerkes Sicon-8 Client-Side Authentication Read-Only Bypass
- CVE-2018-17882An Integer overflow vulnerability exists in the batchTransfer function of a smart contract implementation for CryptoBotsBattle (CBTB), an Et
- CVE-2018-17955Static tempfile name allows overwriting of arbitrary filesSUSE yast2-multipath
- CVE-2018-17956Password exposed in process listingSUSE yast2-samba-provision
- CVE-2018-18205Topvision CC8800 CMTS C-E devices allow remote attackers to obtain sensitive information via a direct request for /WebContent/startup.tar.gz
- CVE-2018-20106SMB printer settings don't escape characters in passwords properlySUSE yast2-printer
- CVE-2018-20174rdesktop versions up to and including v1.8.3 contain an Out-Of-Bounds Read in the function ui_clip_handle_data() that results in an informat
- CVE-2018-20175rdesktop versions up to and including v1.8.3 contains several Integer Signedness errors that lead to Out-Of-Bounds Reads in the file mcs.c a
- CVE-2018-20176rdesktop versions up to and including v1.8.3 contain several Out-Of- Bounds Reads in the file secure.c that result in a Denial of Service (s
- CVE-2018-20177rdesktop versions up to and including v1.8.3 contain an Integer Overflow that leads to a Heap-Based Buffer Overflow in the function rdp_in_u
- CVE-2018-20178rdesktop versions up to and including v1.8.3 contain an Out-Of-Bounds Read in the function process_demand_active() that results in a Denial
- CVE-2018-20179rdesktop versions up to and including v1.8.3 contain an Integer Underflow that leads to a Heap-Based Buffer Overflow in the function lspci_p
- CVE-2018-20180rdesktop versions up to and including v1.8.3 contain an Integer Underflow that leads to a Heap-Based Buffer Overflow in the function rdpsndd
- CVE-2018-20181rdesktop versions up to and including v1.8.3 contain an Integer Underflow that leads to a Heap-Based Buffer Overflow in the function seamles
- CVE-2018-20182rdesktop versions up to and including v1.8.3 contain a Buffer Overflow over the global variables in the function seamless_process_line() tha
- CVE-2019-9835The receiver (aka bridge) component of Fujitsu Wireless Keyboard Set LX901 GK900 devices allows Keystroke Injection.
- CVE-2019-9831The AirMore application through 1.6.1 for Android allows remote attackers to cause a denial of service (system hang) via many simultaneous /
- CVE-2019-9832The AirDrop application through 2.0 for Android allows remote attackers to cause a denial of service via a client that makes many socket con
- CVE-2019-9833The Screen Stream application through 3.0.15 for Android allows remote attackers to cause a denial of service via many simultaneous /start-s
- CVE-2019-9834The Netdata web application through 1.13.0 allows remote attackers to inject their own malicious HTML code into an imported snapshot, aka HT
- CVE-2018-19391Cobham Satcom Sailor 250 and 500 devices before 1.25 contained persistent XSS, which could be exploited by an unauthenticated threat actor v
- CVE-2018-19392Cobham Satcom Sailor 250 and 500 devices before 1.25 contained an unauthenticated password reset vulnerability.
- CVE-2018-19393Cobham Satcom Sailor 800 and 900 devices contained a vulnerability that allowed for arbitrary writing of content to the system's configurati
- CVE-2018-19394Cobham Satcom Sailor 800 and 900 devices contained persistent XSS, which required administrative access to exploit.
- CVE-2018-18252An issue was discovered in CapMon Access Manager 5.4.1.1005.
- CVE-2018-18253An issue was discovered in CapMon Access Manager 5.4.1.1005.
- CVE-2018-18254An issue was discovered in CapMon Access Manager 5.4.1.1005.
- CVE-2018-18255An issue was discovered in CapMon Access Manager 5.4.1.1005.
- CVE-2018-18256An issue was discovered in CapMon Access Manager 5.4.1.1005.
- CVE-2019-9829Maccms 10 allows remote attackers to execute arbitrary PHP code by entering this code in a template/default_pc/html/art Edit action.