# CVEs published 2019-03-16

10 CVEs were published on March 16, 2019: 0 critical, 0 high. Days are UTC.

- [CVE-2019-7223](https://cve.now/CVE-2019-7223.md): InvoicePlane 1.5 has stored XSS via the index.php/invoices/ajax/save invoice\_password parameter, aka the "PDF password" field to the "Create (no CVSS)
- [CVE-2019-9846](https://cve.now/CVE-2019-9846.md): RockOA 1.8.7 allows remote attackers to obtain sensitive information because the webmain/webmainAction.php publictreestore method constructs (no CVSS)
- [CVE-2018-20807](https://cve.now/CVE-2018-20807.md): An XSS issue has been found in welcome.cgi in Pulse Secure Pulse Connect Secure (PCS) 8.1.x before 8.1R12, 8.2.x before 8.2R9, and 8.3.x bef (no CVSS)
- [CVE-2018-20808](https://cve.now/CVE-2018-20808.md): An XSS issue has been found with rd.cgi in Pulse Secure Pulse Connect Secure 8.3RX before 8.3R3 due to improper header sanitization. (no CVSS)
- [CVE-2018-20809](https://cve.now/CVE-2018-20809.md): A crafted message can cause the web server to crash with Pulse Secure Pulse Connect Secure (PCS) 8.3RX before 8.3R5 and Pulse Policy Secure (no CVSS)
- [CVE-2018-20810](https://cve.now/CVE-2018-20810.md): Session data between cluster nodes during cluster synchronization is not properly encrypted in Pulse Secure Pulse Connect Secure (PCS) 8.3RX (no CVSS)
- [CVE-2018-20811](https://cve.now/CVE-2018-20811.md): A hidden RPC service issue was found with Pulse Secure Pulse Connect Secure 8.3RX before 8.3R2 and 8.1RX before 8.1R12. (no CVSS)
- [CVE-2018-20812](https://cve.now/CVE-2018-20812.md): An information exposure issue where IPv6 DNS traffic would be sent outside of the VPN tunnel (when Traffic Enforcement was enabled) exists i (no CVSS)
- [CVE-2018-20813](https://cve.now/CVE-2018-20813.md): An input validation issue has been found with login\_meeting.cgi in Pulse Secure Pulse Connect Secure 8.3RX before 8.3R2. (no CVSS)
- [CVE-2018-20814](https://cve.now/CVE-2018-20814.md): An XSS issue was found with Psaldownload.cgi in Pulse Secure Pulse Connect Secure (PCS) 8.3R2 before 8.3R2 and Pulse Policy Secure (PPS) 5.4 (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2019-03-16
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.