# CVEs published 2019-03-15

39 CVEs were published on March 15, 2019: 0 critical, 0 high. Days are UTC.

- [CVE-2018-20806](https://cve.now/CVE-2018-20806.md): Phamm (aka PHP LDAP Virtual Hosting Manager) 0.6.8 allows XSS via the login page (the /public/main.php action parameter). (no CVSS)
- [CVE-2019-9837](https://cve.now/CVE-2019-9837.md): Doorkeeper::OpenidConnect (aka the OpenID Connect extension for Doorkeeper) 1.4.x and 1.5.x before 1.5.4 has an open redirect via the redire (no CVSS, doorkeeper-openid\_connect)
- [CVE-2019-9843](https://cve.now/CVE-2019-9843.md): In DiffPlug Spotless before 1.20.0 (library and Maven plugin) and before 3.20.0 (Gradle plugin), the XML parser would resolve external entit (no CVSS, com.diffplug.spotless:spotless-plugin-gradle · com.diffplug…)
- [CVE-2019-9844](https://cve.now/CVE-2019-9844.md): simple-markdown.js in Khan Academy simple-markdown before 0.4.4 allows XSS via a data: or vbscript: URI. (no CVSS, simple-markdown)
- [CVE-2018-14745](https://cve.now/CVE-2018-14745.md): Buffer overflow in prot\_get\_ring\_space in the bcmdhd4358 Wi-Fi driver on the Samsung Galaxy S6 SM-G920F G920FXXU5EQH7 allows an attacker (wh (no CVSS)
- [CVE-2018-15508](https://cve.now/CVE-2018-15508.md): Five9 Agent Desktop Plus 10.0.70 has Incorrect Access Control allowing a remote attackers to cause a denial of service via opening a connect (no CVSS)
- [CVE-2018-15509](https://cve.now/CVE-2018-15509.md): Five9 Agent Desktop Plus 10.0.70 has Incorrect Access Control (issue 2 of 2). (no CVSS)
- [CVE-2018-19872](https://cve.now/CVE-2018-19872.md): An issue was discovered in Qt 5.11. (no CVSS)
- [CVE-2019-6149](https://cve.now/CVE-2019-6149.md): An unquoted search path vulnerability was identified in Lenovo Dynamic Power Reduction Utility prior to version 2.2.2.0 that could allow a m (CVSS 6.7)
- [CVE-2019-5616](https://cve.now/CVE-2019-5616.md): CircuitWerkes Sicon-8 Client-Side Authentication Read-Only Bypass (CVSS 5.3)
- [CVE-2018-17882](https://cve.now/CVE-2018-17882.md): An Integer overflow vulnerability exists in the batchTransfer function of a smart contract implementation for CryptoBotsBattle (CBTB), an Et (no CVSS)
- [CVE-2018-17955](https://cve.now/CVE-2018-17955.md): Static tempfile name allows overwriting of arbitrary files (CVSS 2.2, SUSE yast2-multipath)
- [CVE-2018-17956](https://cve.now/CVE-2018-17956.md): Password exposed in process listing (CVSS 3.3, SUSE yast2-samba-provision)
- [CVE-2018-18205](https://cve.now/CVE-2018-18205.md): Topvision CC8800 CMTS C-E devices allow remote attackers to obtain sensitive information via a direct request for /WebContent/startup.tar.gz (no CVSS)
- [CVE-2018-20106](https://cve.now/CVE-2018-20106.md): SMB printer settings don't escape characters in passwords properly (CVSS 6.5, SUSE yast2-printer)
- [CVE-2018-20174](https://cve.now/CVE-2018-20174.md): rdesktop versions up to and including v1.8.3 contain an Out-Of-Bounds Read in the function ui\_clip\_handle\_data() that results in an informat (no CVSS)
- [CVE-2018-20175](https://cve.now/CVE-2018-20175.md): rdesktop versions up to and including v1.8.3 contains several Integer Signedness errors that lead to Out-Of-Bounds Reads in the file mcs.c a (no CVSS)
- [CVE-2018-20176](https://cve.now/CVE-2018-20176.md): rdesktop versions up to and including v1.8.3 contain several Out-Of- Bounds Reads in the file secure.c that result in a Denial of Service (s (no CVSS)
- [CVE-2018-20177](https://cve.now/CVE-2018-20177.md): rdesktop versions up to and including v1.8.3 contain an Integer Overflow that leads to a Heap-Based Buffer Overflow in the function rdp\_in\_u (no CVSS)
- [CVE-2018-20178](https://cve.now/CVE-2018-20178.md): rdesktop versions up to and including v1.8.3 contain an Out-Of-Bounds Read in the function process\_demand\_active() that results in a Denial (no CVSS)
- [CVE-2018-20179](https://cve.now/CVE-2018-20179.md): rdesktop versions up to and including v1.8.3 contain an Integer Underflow that leads to a Heap-Based Buffer Overflow in the function lspci\_p (no CVSS)
- [CVE-2018-20180](https://cve.now/CVE-2018-20180.md): rdesktop versions up to and including v1.8.3 contain an Integer Underflow that leads to a Heap-Based Buffer Overflow in the function rdpsndd (no CVSS)
- [CVE-2018-20181](https://cve.now/CVE-2018-20181.md): rdesktop versions up to and including v1.8.3 contain an Integer Underflow that leads to a Heap-Based Buffer Overflow in the function seamles (no CVSS)
- [CVE-2018-20182](https://cve.now/CVE-2018-20182.md): rdesktop versions up to and including v1.8.3 contain a Buffer Overflow over the global variables in the function seamless\_process\_line() tha (no CVSS)
- [CVE-2019-9835](https://cve.now/CVE-2019-9835.md): The receiver (aka bridge) component of Fujitsu Wireless Keyboard Set LX901 GK900 devices allows Keystroke Injection. (no CVSS)
- [CVE-2019-9831](https://cve.now/CVE-2019-9831.md): The AirMore application through 1.6.1 for Android allows remote attackers to cause a denial of service (system hang) via many simultaneous / (no CVSS)
- [CVE-2019-9832](https://cve.now/CVE-2019-9832.md): The AirDrop application through 2.0 for Android allows remote attackers to cause a denial of service via a client that makes many socket con (no CVSS)
- [CVE-2019-9833](https://cve.now/CVE-2019-9833.md): The Screen Stream application through 3.0.15 for Android allows remote attackers to cause a denial of service via many simultaneous /start-s (no CVSS)
- [CVE-2019-9834](https://cve.now/CVE-2019-9834.md): The Netdata web application through 1.13.0 allows remote attackers to inject their own malicious HTML code into an imported snapshot, aka HT (no CVSS)
- [CVE-2018-19391](https://cve.now/CVE-2018-19391.md): Cobham Satcom Sailor 250 and 500 devices before 1.25 contained persistent XSS, which could be exploited by an unauthenticated threat actor v (no CVSS)
- [CVE-2018-19392](https://cve.now/CVE-2018-19392.md): Cobham Satcom Sailor 250 and 500 devices before 1.25 contained an unauthenticated password reset vulnerability. (no CVSS)
- [CVE-2018-19393](https://cve.now/CVE-2018-19393.md): Cobham Satcom Sailor 800 and 900 devices contained a vulnerability that allowed for arbitrary writing of content to the system's configurati (no CVSS)
- [CVE-2018-19394](https://cve.now/CVE-2018-19394.md): Cobham Satcom Sailor 800 and 900 devices contained persistent XSS, which required administrative access to exploit. (no CVSS)
- [CVE-2018-18252](https://cve.now/CVE-2018-18252.md): An issue was discovered in CapMon Access Manager 5.4.1.1005. (no CVSS)
- [CVE-2018-18253](https://cve.now/CVE-2018-18253.md): An issue was discovered in CapMon Access Manager 5.4.1.1005. (no CVSS)
- [CVE-2018-18254](https://cve.now/CVE-2018-18254.md): An issue was discovered in CapMon Access Manager 5.4.1.1005. (no CVSS)
- [CVE-2018-18255](https://cve.now/CVE-2018-18255.md): An issue was discovered in CapMon Access Manager 5.4.1.1005. (no CVSS)
- [CVE-2018-18256](https://cve.now/CVE-2018-18256.md): An issue was discovered in CapMon Access Manager 5.4.1.1005. (no CVSS)
- [CVE-2019-9829](https://cve.now/CVE-2019-9829.md): Maccms 10 allows remote attackers to execute arbitrary PHP code by entering this code in a template/default\_pc/html/art Edit action. (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2019-03-15
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.