CVEs published March 17, 2019
95 CVEs were published on March 17, 2019: 1 critical, 0 high.
- Published
- 95
- Critical
- 1
- High
- 0
- Medium
- 1
- Low
- 0
- Unrated
- 93
- Now in CISA KEV
- 0
- Fix available
- 8
Most affected products
- com.fasterxml.jackson.core:jackson-databind
- 2
- serve
- 2
- DotNetNuke.Core
- 1
- kill-port
- 1
- localhost-now
- 1
- microweber/microweber
- 1
- morgan
- 1
- Puppet Chloride · chloride
- 1
- Puppet Discovery
- 1
- python-gnupg
- 1
Critical 1
Medium, low and unrated 94
- CVE-2018-19514In Webgalamb through 7.0, an arbitrary code execution vulnerability could be exploited remotely without authentication.
- CVE-2018-19513In Webgalamb through 7.0, log files are exposed to the internet with predictable files/logs/sql_error_log/YYYY-MM-DD-sql_error_log.log filen
- CVE-2018-19512In Webgalamb through 7.0, a system/ajax.php "wgmfile restore" directory traversal vulnerability could lead to arbitrary code execution by au
- CVE-2018-19511wg7.php in Webgalamb 7.0 lacks security measures to prevent CSRF attacks, as demonstrated by wg7.php?options=1 to change the administrator p
- CVE-2018-19510subscriber.php in Webgalamb through 7.0 is vulnerable to SQL injection via the Client-IP HTTP request header.
- CVE-2018-19509wg7.php in Webgalamb 7.0 makes opportunistic calls to htmlspecialchars() instead of using a templating engine with proper contextual encodin
- CVE-2018-19498The Simplenia Pages plugin 2.6.0 for Atlassian Bitbucket Server has XSS.
- CVE-2018-16519COYO 9.0.8, 10.0.11 and 12.0.4 has cross-site scripting (XSS) via URLs used by "iFrame" widgets.
- CVE-2018-20323www/soap/application/MCSoap/Logs.php in MailCleaner Community Edition 2018.08 allows remote attackers to execute arbitrary OS commands.
- CVE-2018-19488The WP-jobhunt plugin before version 2.4 for WordPress does not control AJAX requests sent to the cs_reset_pass() function through the admin
- CVE-2018-19487The WP-jobhunt plugin before version 2.4 for WordPress does not control AJAX requests sent to the cs_employer_ajax_profile() function throug
- CVE-2018-15906SolarWinds Serv-U FTP Server 15.1.6 allows remote authenticated users to execute arbitrary code by leveraging the Import feature and modifyi
- CVE-2018-15818An issue was discovered in Repute ARForms 3.5.1 and prior.
- CVE-2018-19191Webmin 1.890 has XSS via /config.cgi?webmin, the /shell/index.cgi history parameter, /shell/index.cgi?stripped=1, or the /webminlog/search.c
- CVE-2018-15532SynTP.sys in Synaptics Touchpad drivers before 2018-06-06 allows local users to obtain sensitive information about freed kernel addresses.
- CVE-2018-19158ColossusCoinXT through 1.0.5 (a chain-based proof-of-stake cryptocurrency) allows a remote denial of service, exploitable by an attacker who
- CVE-2018-14575Trash Bin plugin 1.1.3 for MyBB has cross-site scripting (XSS) via a thread subject and a cross-site request forgery (CSRF) via a post subje
- CVE-2018-18898The email-ingestion feature in Best Practical Request Tracker 4.1.13 through 4.4 allows denial of service by remote attackers via an algorit
- CVE-2018-14486DNN (formerly DotNetNuke) 9.1.1 allows cross-site scripting (XSS) via XML.DotNetNuke.Core
- CVE-2018-18882A stored cross-site scripting (XSS) issue was discovered in ControlByWeb X-320M-I Web-Enabled Instrumentation-Grade Data Acquisition module
- CVE-2018-18881A Denial of Service (DOS) issue was discovered in ControlByWeb X-320M-I Web-Enabled Instrumentation-Grade Data Acquisition module 1.05 with
- CVE-2018-20221Secure/SAService.rem in Deltek Ajera Timesheets 9.10.16 and prior are vulnerable to remote code execution via deserialization of untrusted u
- CVE-2018-20220An issue was discovered on Teracue ENC-400 devices with firmware 2.56 and below.
- CVE-2018-20219An issue was discovered on Teracue ENC-400 devices with firmware 2.56 and below.
- CVE-2018-20218An issue was discovered on Teracue ENC-400 devices with firmware 2.56 and below.
- CVE-2018-20212bin/statistics in TWiki 6.0.2 allows cross-site scripting (XSS) via the webs parameter.
- CVE-2018-18862BMC Remedy Mid-Tier 7.1.00 and 9.1.02.003 for BMC Remedy AR System has Incorrect Access Control in ITAM forms, as demonstrated by TLS%3APLR-
- CVE-2018-20162Digi TransPort LR54 4.4.0.26 and possible earlier devices have Improper Input Validation that allows users with 'super' CLI access privilege
- CVE-2019-7425XSS exists in Zoho ManageEngine Netflow Analyzer Professional v7.0.0.2 in the Administration zone "/netflow/jspui/linkdownalertConfig.jsp" f
- CVE-2018-20340Yubico libu2f-host 1.1.6 contains unchecked buffers in devs.c, which could enable a malicious token to exploit a buffer overflow.
- CVE-2019-7424XSS exists in Zoho ManageEngine Netflow Analyzer Professional v7.0.0.2 in the Administration zone "/netflow/jspui/index.jsp" file in the vie
- CVE-2018-20141AbanteCart 1.2.12 has reflected cross-site scripting (XSS) via the sort parameter, as demonstrated by a /apparel--accessories?sort= substrin
- CVE-2019-7423XSS exists in Zoho ManageEngine Netflow Analyzer Professional v7.0.0.2 in the Administration zone "/netflow/jspui/editProfile.jsp" file in t
- CVE-2019-7422XSS exists in Zoho ManageEngine Netflow Analyzer Professional v7.0.0.2 in the Administration zone "/netflow/jspui/addMailSettings.jsp" file
- CVE-2018-20140Zenphoto 1.4.14 has multiple cross-site scripting (XSS) vulnerabilities via different URL parameters.
- CVE-2019-7421XSS exists in SAMSUNG X7400GX SyncThru Web Service V6.A6.25 V11.01.05.25_08-21-2015 in "/sws.login/gnb/loginView.sws" in multiple parameters
- CVE-2019-7420XSS exists in SAMSUNG X7400GX SyncThru Web Service V6.A6.25 V11.01.05.25_08-21-2015 in "/sws.application/information/networkinformationView.
- CVE-2018-18849In Qemu 3.0.0, lsi_do_msgin in hw/scsi/lsi53c895a.c allows out-of-bounds access by triggering an invalid msg_len value.
- CVE-2018-20121Podcast Generator 2.7 has stored cross-site scripting (XSS) via the URL addcategory parameter.
- CVE-2019-7419XSS exists in SAMSUNG X7400GX SyncThru Web Service V6.A6.25 V11.01.05.25_08-21-2015 in "/sws/leftmenu.sws" in multiple parameters: ruiFw_id,
- CVE-2018-19985The function hso_get_config_data in drivers/net/usb/hso.c in the Linux kernel through 4.19.8 reads if_num from the USB device (as a u8) and
- CVE-2018-18845internal/advanced_comment_system/index.php and internal/advanced_comment_system/admin.php in Advanced Comment System, version 1.0, contain a
- CVE-2019-7418XSS exists in SAMSUNG X7400GX SyncThru Web Service V6.A6.25 V11.01.05.25_08-21-2015 in "/sws/swsAlert.sws" in multiple parameters: flag, fra
- CVE-2019-5414If an attacker can control the port, which in itself is a very sensitive value, they can inject arbitrary OS commands due to the usage of thkill-port
- CVE-2019-7417XSS exists in Ericsson Active Library Explorer (ALEX) 14.3 in multiple parameters in the "/cgi-bin/alexserv" servlet, as demonstrated by the
- CVE-2019-7416XSS and/or a Client Side URL Redirect exists in OpenText Documentum Webtop 5.3 SP2.
- CVE-2019-5413An attacker can use the format parameter to inject arbitrary commands in the npm package morgan < 1.9.1.morgan
- CVE-2018-19934SolarWinds Serv-U FTP Server 15.1.6.25 has reflected cross-site scripting (XSS) in the Web management interface via URL path and HTTP POST p
- CVE-2019-5416A path traversal vulnerability in localhost-now npm package version 1.0.2 allows the attackers to read content of arbitrary files on the remlocalhost-now
- CVE-2018-18798Attendance Monitoring System 1.0 has SQL Injection via the 'id' parameter to student/index.php?view=view, event/index.php?view=view, and use
- CVE-2019-7391ZyXEL VMG3312-B10B DSL-491HNU-B1B v2 devices allow login/login-page.cgi CSRF.
- CVE-2019-5415A bug in handling the ignore files and directories feature in serve 6.5.3 allows an attacker to read a file or list the directory that the vserve
- CVE-2019-5417A path traversal vulnerability in serve npm package version 7.0.1 allows the attackers to read content of arbitrary files on the remote servserve
- CVE-2019-7386A Denial of Service issue has been discovered in the Gecko component of KaiOS 2.5 10.05 (platform 48.0.a2) on Nokia 8810 4G devices.
- CVE-2018-19917Microweber 1.0.8 has reflected cross-site scripting (XSS) vulnerabilities.microweber/microweber
- CVE-2018-18762SaltOS 3.1 r8126 contains a database download vulnerability.
- CVE-2018-11747Previously, Puppet Discovery was shipped with a default generated TLS certificate in the nginx container.Puppet Discovery
- CVE-2018-6517Prior to version 0.3.0, chloride's use of net-ssh resulted in host fingerprints for previously unknown hosts getting added to the user's knoPuppet Chloride · chloride
- CVE-2019-7385An authenticated shell command injection issue has been discovered in Raisecom ISCOM HT803G-U, HT803G-W, HT803G-1GE, and HT803G GPON product
- CVE-2019-8934hw/ppc/spapr.c in QEMU through 3.1.0 allows Information Exposure because the hypervisor shares the /proc/device-tree/system-id and /proc/dev
- CVE-2018-18435KioWare Server version 4.9.6 and older installs by default to "C:\kioware_com" with weak folder permissions granting any user full permissio
- CVE-2018-19783Kentix MultiSensor-LAN 5.63.00 devices and previous allow Authentication Bypass via an Alternate Path or Channel.
- CVE-2019-7384An authenticated shell command injection issue has been discovered in Raisecom ISCOM HT803G-U, HT803G-W, HT803G-1GE, and HT803G GPON product
- CVE-2019-7383An issue was discovered on Systrome Cumilon ISG-600C, ISG-600H, and ISG-800W devices with firmware V1.1-R2.1_TRUNK-20181105.bin.
- CVE-2018-17997LayerBB 1.1.1 allows XSS via the titles of conversations (PMs).
- CVE-2018-13104OX App Suite 7.8.4 and earlier allows XSS.
- CVE-2018-19694HMS Industrial Networks Netbiter WS100 3.30.5 devices and previous have reflected XSS in the login form.
- CVE-2018-17996LayerBB before 1.1.3 allows CSRF for adding a user via admin/new_user.php, deleting a user via admin/members.php/delete_user/, and deleting
- CVE-2018-13103OX App Suite 7.8.4 and earlier allows SSRF.
- CVE-2019-7222The KVM implementation in the Linux kernel through 4.20.5 has an Information Leak.
- CVE-2018-19525An issue was discovered on Systrome ISG-600C, ISG-600H, and ISG-800W 1.1-R2.1_TRUNK-20180914.bin devices.
- CVE-2018-19524An issue was discovered on Shenzhen Skyworth DT741 Converged Intelligent Terminal (G/EPON+IPTV) SDOTBGN1, DT721-cb SDOTBGN1, and DT741-cb SD
- CVE-2019-8938VertrigoServ 2.17 allows XSS via the /inc/extensions.php ext parameter.
- CVE-2018-16789libhttp/url.c in shellinabox through 2.20 has an implementation flaw in the HTTP request parsing logic.
- CVE-2018-19515In Webgalamb through 7.0, system/ajax.php functionality is supposed to be available only to the administrator.
- CVE-2018-12638An issue was discovered in the Bose Soundtouch app 18.1.4 for iOS.
- CVE-2019-7221The KVM implementation in the Linux kernel through 4.20.5 has a Use-after-Free.
- CVE-2018-12572Avast Free Antivirus prior to 19.1.2360 stores user credentials in memory upon login, which allows local users to obtain sensitive informati
- CVE-2018-12022An issue was discovered in FasterXML jackson-databind prior to 2.7.9.4, 2.8.11.2, and 2.9.6.com.fasterxml.jackson.core:jackson-databind
- CVE-2019-6973Sricam IP CCTV cameras are vulnerable to denial of service via multiple incomplete HTTP requests because the web server (based on gSOAP 2.8.
- CVE-2019-6967AirTies Air5341 1.0.0.12 devices allow cgi-bin/login CSRF.
- CVE-2019-6778In QEMU 3.0.0, tcp_emu in slirp/tcp_subr.c has a heap-based buffer overflow.
- CVE-2018-12023An issue was discovered in FasterXML jackson-databind prior to 2.7.9.4, 2.8.11.2, and 2.9.6.com.fasterxml.jackson.core:jackson-databind
- CVE-2019-6716An unauthenticated Insecure Direct Object Reference (IDOR) in Wicket Core in LogonBox Nervepoint Access Manager 2013 through 2017 allows a r
- CVE-2019-6714An issue was discovered in BlogEngine.NET through 3.3.6.0.
- CVE-2019-6702The MasterCard Qkr! app before 5.0.8 for iOS has Missing SSL Certificate Validation.
- CVE-2019-9083SQLiteManager 1.20 and 1.24 allows SQL injection via the /sqlitemanager/main.php dbsel parameter.
- CVE-2018-10093AudioCodes IP phone 420HD devices using firmware version 2.2.12.126 allow Remote Code Execution.
- CVE-2019-6690python-gnupg 0.4.3 allows context-dependent attackers to trick gnupg to decrypt other ciphertext than intended.python-gnupg
- CVE-2018-10091AudioCodes IP phone 420HD devices using firmware version 2.2.12.126 allow XSS.
- CVE-2019-6501In QEMU 3.1, scsi_handle_inquiry_reply in hw/scsi/scsi-generic.c allows out-of-bounds write and read operations.
- CVE-2017-16232LibTIFF 4.0.8 has multiple memory leak vulnerabilities, which allow attackers to cause a denial of service (memory consumption), as demonstr
- CVE-2019-6454An issue was discovered in sd-bus in systemd 239.
- CVE-2017-16231In PCRE 8.41, after compiling, a pcretest load test PoC produces a crash overflow in the function match() in pcre_exec.c because of a self-r