# CVEs published 2019-03-17

95 CVEs were published on March 17, 2019: 1 critical, 0 high. Days are UTC.

- [CVE-2018-19514](https://cve.now/CVE-2018-19514.md): In Webgalamb through 7.0, an arbitrary code execution vulnerability could be exploited remotely without authentication. (no CVSS)
- [CVE-2018-19513](https://cve.now/CVE-2018-19513.md): In Webgalamb through 7.0, log files are exposed to the internet with predictable files/logs/sql\_error\_log/YYYY-MM-DD-sql\_error\_log.log filen (no CVSS)
- [CVE-2018-19512](https://cve.now/CVE-2018-19512.md): In Webgalamb through 7.0, a system/ajax.php "wgmfile restore" directory traversal vulnerability could lead to arbitrary code execution by au (no CVSS)
- [CVE-2018-19511](https://cve.now/CVE-2018-19511.md): wg7.php in Webgalamb 7.0 lacks security measures to prevent CSRF attacks, as demonstrated by wg7.php?options=1 to change the administrator p (no CVSS)
- [CVE-2018-19510](https://cve.now/CVE-2018-19510.md): subscriber.php in Webgalamb through 7.0 is vulnerable to SQL injection via the Client-IP HTTP request header. (no CVSS)
- [CVE-2018-19509](https://cve.now/CVE-2018-19509.md): wg7.php in Webgalamb 7.0 makes opportunistic calls to htmlspecialchars() instead of using a templating engine with proper contextual encodin (no CVSS)
- [CVE-2018-19498](https://cve.now/CVE-2018-19498.md): The Simplenia Pages plugin 2.6.0 for Atlassian Bitbucket Server has XSS. (no CVSS)
- [CVE-2018-16519](https://cve.now/CVE-2018-16519.md): COYO 9.0.8, 10.0.11 and 12.0.4 has cross-site scripting (XSS) via URLs used by "iFrame" widgets. (no CVSS)
- [CVE-2018-20323](https://cve.now/CVE-2018-20323.md): www/soap/application/MCSoap/Logs.php in MailCleaner Community Edition 2018.08 allows remote attackers to execute arbitrary OS commands. (no CVSS)
- [CVE-2018-19488](https://cve.now/CVE-2018-19488.md): The WP-jobhunt plugin before version 2.4 for WordPress does not control AJAX requests sent to the cs\_reset\_pass() function through the admin (no CVSS)
- [CVE-2018-19487](https://cve.now/CVE-2018-19487.md): The WP-jobhunt plugin before version 2.4 for WordPress does not control AJAX requests sent to the cs\_employer\_ajax\_profile() function throug (no CVSS)
- [CVE-2018-15906](https://cve.now/CVE-2018-15906.md): SolarWinds Serv-U FTP Server 15.1.6 allows remote authenticated users to execute arbitrary code by leveraging the Import feature and modifyi (no CVSS)
- [CVE-2018-15818](https://cve.now/CVE-2018-15818.md): An issue was discovered in Repute ARForms 3.5.1 and prior. (no CVSS)
- [CVE-2018-19276](https://cve.now/CVE-2018-19276.md): OpenMRS before 2.24.0 is affected by an Insecure Object Deserialization vulnerability that allows an unauthenticated user to execute arbitra (CVSS 10.0)
- [CVE-2018-19191](https://cve.now/CVE-2018-19191.md): Webmin 1.890 has XSS via /config.cgi?webmin, the /shell/index.cgi history parameter, /shell/index.cgi?stripped=1, or the /webminlog/search.c (no CVSS)
- [CVE-2018-15532](https://cve.now/CVE-2018-15532.md): SynTP.sys in Synaptics Touchpad drivers before 2018-06-06 allows local users to obtain sensitive information about freed kernel addresses. (no CVSS)
- [CVE-2018-19158](https://cve.now/CVE-2018-19158.md): ColossusCoinXT through 1.0.5 (a chain-based proof-of-stake cryptocurrency) allows a remote denial of service, exploitable by an attacker who (no CVSS)
- [CVE-2018-14575](https://cve.now/CVE-2018-14575.md): Trash Bin plugin 1.1.3 for MyBB has cross-site scripting (XSS) via a thread subject and a cross-site request forgery (CSRF) via a post subje (no CVSS)
- [CVE-2018-18898](https://cve.now/CVE-2018-18898.md): The email-ingestion feature in Best Practical Request Tracker 4.1.13 through 4.4 allows denial of service by remote attackers via an algorit (no CVSS)
- [CVE-2018-14486](https://cve.now/CVE-2018-14486.md): DNN (formerly DotNetNuke) 9.1.1 allows cross-site scripting (XSS) via XML. (no CVSS, DotNetNuke.Core)
- [CVE-2018-18882](https://cve.now/CVE-2018-18882.md): A stored cross-site scripting (XSS) issue was discovered in ControlByWeb X-320M-I Web-Enabled Instrumentation-Grade Data Acquisition module (no CVSS)
- [CVE-2018-18881](https://cve.now/CVE-2018-18881.md): A Denial of Service (DOS) issue was discovered in ControlByWeb X-320M-I Web-Enabled Instrumentation-Grade Data Acquisition module 1.05 with (no CVSS)
- [CVE-2018-20221](https://cve.now/CVE-2018-20221.md): Secure/SAService.rem in Deltek Ajera Timesheets 9.10.16 and prior are vulnerable to remote code execution via deserialization of untrusted u (no CVSS)
- [CVE-2018-20220](https://cve.now/CVE-2018-20220.md): An issue was discovered on Teracue ENC-400 devices with firmware 2.56 and below. (no CVSS)
- [CVE-2018-20219](https://cve.now/CVE-2018-20219.md): An issue was discovered on Teracue ENC-400 devices with firmware 2.56 and below. (no CVSS)
- [CVE-2018-20218](https://cve.now/CVE-2018-20218.md): An issue was discovered on Teracue ENC-400 devices with firmware 2.56 and below. (no CVSS)
- [CVE-2018-20212](https://cve.now/CVE-2018-20212.md): bin/statistics in TWiki 6.0.2 allows cross-site scripting (XSS) via the webs parameter. (no CVSS)
- [CVE-2018-18862](https://cve.now/CVE-2018-18862.md): BMC Remedy Mid-Tier 7.1.00 and 9.1.02.003 for BMC Remedy AR System has Incorrect Access Control in ITAM forms, as demonstrated by TLS%3APLR- (no CVSS)
- [CVE-2018-20162](https://cve.now/CVE-2018-20162.md): Digi TransPort LR54 4.4.0.26 and possible earlier devices have Improper Input Validation that allows users with 'super' CLI access privilege (no CVSS)
- [CVE-2019-7425](https://cve.now/CVE-2019-7425.md): XSS exists in Zoho ManageEngine Netflow Analyzer Professional v7.0.0.2 in the Administration zone "/netflow/jspui/linkdownalertConfig.jsp" f (no CVSS)
- [CVE-2018-20340](https://cve.now/CVE-2018-20340.md): Yubico libu2f-host 1.1.6 contains unchecked buffers in devs.c, which could enable a malicious token to exploit a buffer overflow. (no CVSS)
- [CVE-2019-7424](https://cve.now/CVE-2019-7424.md): XSS exists in Zoho ManageEngine Netflow Analyzer Professional v7.0.0.2 in the Administration zone "/netflow/jspui/index.jsp" file in the vie (no CVSS)
- [CVE-2018-20141](https://cve.now/CVE-2018-20141.md): AbanteCart 1.2.12 has reflected cross-site scripting (XSS) via the sort parameter, as demonstrated by a /apparel--accessories?sort= substrin (no CVSS)
- [CVE-2019-7423](https://cve.now/CVE-2019-7423.md): XSS exists in Zoho ManageEngine Netflow Analyzer Professional v7.0.0.2 in the Administration zone "/netflow/jspui/editProfile.jsp" file in t (no CVSS)
- [CVE-2019-7422](https://cve.now/CVE-2019-7422.md): XSS exists in Zoho ManageEngine Netflow Analyzer Professional v7.0.0.2 in the Administration zone "/netflow/jspui/addMailSettings.jsp" file (no CVSS)
- [CVE-2018-20140](https://cve.now/CVE-2018-20140.md): Zenphoto 1.4.14 has multiple cross-site scripting (XSS) vulnerabilities via different URL parameters. (no CVSS)
- [CVE-2019-7421](https://cve.now/CVE-2019-7421.md): XSS exists in SAMSUNG X7400GX SyncThru Web Service V6.A6.25 V11.01.05.25\_08-21-2015 in "/sws.login/gnb/loginView.sws" in multiple parameters (no CVSS)
- [CVE-2019-7420](https://cve.now/CVE-2019-7420.md): XSS exists in SAMSUNG X7400GX SyncThru Web Service V6.A6.25 V11.01.05.25\_08-21-2015 in "/sws.application/information/networkinformationView. (no CVSS)
- [CVE-2018-18849](https://cve.now/CVE-2018-18849.md): In Qemu 3.0.0, lsi\_do\_msgin in hw/scsi/lsi53c895a.c allows out-of-bounds access by triggering an invalid msg\_len value. (no CVSS)
- [CVE-2018-20121](https://cve.now/CVE-2018-20121.md): Podcast Generator 2.7 has stored cross-site scripting (XSS) via the URL addcategory parameter. (no CVSS)
- [CVE-2019-7419](https://cve.now/CVE-2019-7419.md): XSS exists in SAMSUNG X7400GX SyncThru Web Service V6.A6.25 V11.01.05.25\_08-21-2015 in "/sws/leftmenu.sws" in multiple parameters: ruiFw\_id, (no CVSS)
- [CVE-2018-19985](https://cve.now/CVE-2018-19985.md): The function hso\_get\_config\_data in drivers/net/usb/hso.c in the Linux kernel through 4.19.8 reads if\_num from the USB device (as a u8) and (no CVSS)
- [CVE-2018-18845](https://cve.now/CVE-2018-18845.md): internal/advanced\_comment\_system/index.php and internal/advanced\_comment\_system/admin.php in Advanced Comment System, version 1.0, contain a (no CVSS)
- [CVE-2019-7418](https://cve.now/CVE-2019-7418.md): XSS exists in SAMSUNG X7400GX SyncThru Web Service V6.A6.25 V11.01.05.25\_08-21-2015 in "/sws/swsAlert.sws" in multiple parameters: flag, fra (no CVSS)
- [CVE-2019-5414](https://cve.now/CVE-2019-5414.md): If an attacker can control the port, which in itself is a very sensitive value, they can inject arbitrary OS commands due to the usage of th (no CVSS, kill-port)
- [CVE-2019-7417](https://cve.now/CVE-2019-7417.md): XSS exists in Ericsson Active Library Explorer (ALEX) 14.3 in multiple parameters in the "/cgi-bin/alexserv" servlet, as demonstrated by the (no CVSS)
- [CVE-2019-7416](https://cve.now/CVE-2019-7416.md): XSS and/or a Client Side URL Redirect exists in OpenText Documentum Webtop 5.3 SP2. (no CVSS)
- [CVE-2019-5413](https://cve.now/CVE-2019-5413.md): An attacker can use the format parameter to inject arbitrary commands in the npm package morgan \< 1.9.1. (no CVSS, morgan)
- [CVE-2018-19934](https://cve.now/CVE-2018-19934.md): SolarWinds Serv-U FTP Server 15.1.6.25 has reflected cross-site scripting (XSS) in the Web management interface via URL path and HTTP POST p (no CVSS)
- [CVE-2019-5416](https://cve.now/CVE-2019-5416.md): A path traversal vulnerability in localhost-now npm package version 1.0.2 allows the attackers to read content of arbitrary files on the rem (no CVSS, localhost-now)
- [CVE-2018-18798](https://cve.now/CVE-2018-18798.md): Attendance Monitoring System 1.0 has SQL Injection via the 'id' parameter to student/index.php?view=view, event/index.php?view=view, and use (no CVSS)
- [CVE-2019-7391](https://cve.now/CVE-2019-7391.md): ZyXEL VMG3312-B10B DSL-491HNU-B1B v2 devices allow login/login-page.cgi CSRF. (no CVSS)
- [CVE-2019-5415](https://cve.now/CVE-2019-5415.md): A bug in handling the ignore files and directories feature in serve 6.5.3 allows an attacker to read a file or list the directory that the v (no CVSS, serve)
- [CVE-2019-5417](https://cve.now/CVE-2019-5417.md): A path traversal vulnerability in serve npm package version 7.0.1 allows the attackers to read content of arbitrary files on the remote serv (no CVSS, serve)
- [CVE-2019-7386](https://cve.now/CVE-2019-7386.md): A Denial of Service issue has been discovered in the Gecko component of KaiOS 2.5 10.05 (platform 48.0.a2) on Nokia 8810 4G devices. (no CVSS)
- [CVE-2018-19917](https://cve.now/CVE-2018-19917.md): Microweber 1.0.8 has reflected cross-site scripting (XSS) vulnerabilities. (no CVSS, microweber/microweber)
- [CVE-2018-18762](https://cve.now/CVE-2018-18762.md): SaltOS 3.1 r8126 contains a database download vulnerability. (no CVSS)
- [CVE-2018-11747](https://cve.now/CVE-2018-11747.md): Previously, Puppet Discovery was shipped with a default generated TLS certificate in the nginx container. (no CVSS, Puppet Discovery)
- [CVE-2018-6517](https://cve.now/CVE-2018-6517.md): Prior to version 0.3.0, chloride's use of net-ssh resulted in host fingerprints for previously unknown hosts getting added to the user's kno (no CVSS, Puppet Chloride · chloride)
- [CVE-2019-7385](https://cve.now/CVE-2019-7385.md): An authenticated shell command injection issue has been discovered in Raisecom ISCOM HT803G-U, HT803G-W, HT803G-1GE, and HT803G GPON product (no CVSS)
- [CVE-2019-8934](https://cve.now/CVE-2019-8934.md): hw/ppc/spapr.c in QEMU through 3.1.0 allows Information Exposure because the hypervisor shares the /proc/device-tree/system-id and /proc/dev (no CVSS)
- [CVE-2018-18435](https://cve.now/CVE-2018-18435.md): KioWare Server version 4.9.6 and older installs by default to "C:\\kioware\_com" with weak folder permissions granting any user full permissio (no CVSS)
- [CVE-2018-19783](https://cve.now/CVE-2018-19783.md): Kentix MultiSensor-LAN 5.63.00 devices and previous allow Authentication Bypass via an Alternate Path or Channel. (no CVSS)
- [CVE-2019-7384](https://cve.now/CVE-2019-7384.md): An authenticated shell command injection issue has been discovered in Raisecom ISCOM HT803G-U, HT803G-W, HT803G-1GE, and HT803G GPON product (no CVSS)
- [CVE-2019-7383](https://cve.now/CVE-2019-7383.md): An issue was discovered on Systrome Cumilon ISG-600C, ISG-600H, and ISG-800W devices with firmware V1.1-R2.1\_TRUNK-20181105.bin. (no CVSS)
- [CVE-2018-17997](https://cve.now/CVE-2018-17997.md): LayerBB 1.1.1 allows XSS via the titles of conversations (PMs). (no CVSS)
- [CVE-2018-13104](https://cve.now/CVE-2018-13104.md): OX App Suite 7.8.4 and earlier allows XSS. (no CVSS)
- [CVE-2018-19694](https://cve.now/CVE-2018-19694.md): HMS Industrial Networks Netbiter WS100 3.30.5 devices and previous have reflected XSS in the login form. (no CVSS)
- [CVE-2018-17996](https://cve.now/CVE-2018-17996.md): LayerBB before 1.1.3 allows CSRF for adding a user via admin/new\_user.php, deleting a user via admin/members.php/delete\_user/, and deleting (no CVSS)
- [CVE-2018-13103](https://cve.now/CVE-2018-13103.md): OX App Suite 7.8.4 and earlier allows SSRF. (no CVSS)
- [CVE-2019-7222](https://cve.now/CVE-2019-7222.md): The KVM implementation in the Linux kernel through 4.20.5 has an Information Leak. (no CVSS)
- [CVE-2018-19525](https://cve.now/CVE-2018-19525.md): An issue was discovered on Systrome ISG-600C, ISG-600H, and ISG-800W 1.1-R2.1\_TRUNK-20180914.bin devices. (no CVSS)
- [CVE-2018-19524](https://cve.now/CVE-2018-19524.md): An issue was discovered on Shenzhen Skyworth DT741 Converged Intelligent Terminal (G/EPON+IPTV) SDOTBGN1, DT721-cb SDOTBGN1, and DT741-cb SD (no CVSS)
- [CVE-2019-8938](https://cve.now/CVE-2019-8938.md): VertrigoServ 2.17 allows XSS via the /inc/extensions.php ext parameter. (no CVSS)
- [CVE-2018-16789](https://cve.now/CVE-2018-16789.md): libhttp/url.c in shellinabox through 2.20 has an implementation flaw in the HTTP request parsing logic. (no CVSS)
- [CVE-2018-19515](https://cve.now/CVE-2018-19515.md): In Webgalamb through 7.0, system/ajax.php functionality is supposed to be available only to the administrator. (no CVSS)
- [CVE-2018-12638](https://cve.now/CVE-2018-12638.md): An issue was discovered in the Bose Soundtouch app 18.1.4 for iOS. (no CVSS)
- [CVE-2019-7221](https://cve.now/CVE-2019-7221.md): The KVM implementation in the Linux kernel through 4.20.5 has a Use-after-Free. (no CVSS)
- [CVE-2018-12572](https://cve.now/CVE-2018-12572.md): Avast Free Antivirus prior to 19.1.2360 stores user credentials in memory upon login, which allows local users to obtain sensitive informati (no CVSS)
- [CVE-2018-12022](https://cve.now/CVE-2018-12022.md): An issue was discovered in FasterXML jackson-databind prior to 2.7.9.4, 2.8.11.2, and 2.9.6. (no CVSS, com.fasterxml.jackson.core:jackson-databind)
- [CVE-2019-6973](https://cve.now/CVE-2019-6973.md): Sricam IP CCTV cameras are vulnerable to denial of service via multiple incomplete HTTP requests because the web server (based on gSOAP 2.8. (no CVSS)
- [CVE-2019-6967](https://cve.now/CVE-2019-6967.md): AirTies Air5341 1.0.0.12 devices allow cgi-bin/login CSRF. (no CVSS)
- [CVE-2019-6778](https://cve.now/CVE-2019-6778.md): In QEMU 3.0.0, tcp\_emu in slirp/tcp\_subr.c has a heap-based buffer overflow. (no CVSS)
- [CVE-2018-12023](https://cve.now/CVE-2018-12023.md): An issue was discovered in FasterXML jackson-databind prior to 2.7.9.4, 2.8.11.2, and 2.9.6. (no CVSS, com.fasterxml.jackson.core:jackson-databind)
- [CVE-2019-6716](https://cve.now/CVE-2019-6716.md): An unauthenticated Insecure Direct Object Reference (IDOR) in Wicket Core in LogonBox Nervepoint Access Manager 2013 through 2017 allows a r (no CVSS)
- [CVE-2019-6714](https://cve.now/CVE-2019-6714.md): An issue was discovered in BlogEngine.NET through 3.3.6.0. (no CVSS)
- [CVE-2019-6702](https://cve.now/CVE-2019-6702.md): The MasterCard Qkr! app before 5.0.8 for iOS has Missing SSL Certificate Validation. (no CVSS)
- [CVE-2019-9083](https://cve.now/CVE-2019-9083.md): SQLiteManager 1.20 and 1.24 allows SQL injection via the /sqlitemanager/main.php dbsel parameter. (no CVSS)
- [CVE-2018-10093](https://cve.now/CVE-2018-10093.md): AudioCodes IP phone 420HD devices using firmware version 2.2.12.126 allow Remote Code Execution. (no CVSS)
- [CVE-2019-6690](https://cve.now/CVE-2019-6690.md): python-gnupg 0.4.3 allows context-dependent attackers to trick gnupg to decrypt other ciphertext than intended. (no CVSS, python-gnupg)
- [CVE-2018-10091](https://cve.now/CVE-2018-10091.md): AudioCodes IP phone 420HD devices using firmware version 2.2.12.126 allow XSS. (no CVSS)
- [CVE-2019-6501](https://cve.now/CVE-2019-6501.md): In QEMU 3.1, scsi\_handle\_inquiry\_reply in hw/scsi/scsi-generic.c allows out-of-bounds write and read operations. (no CVSS)
- [CVE-2017-16232](https://cve.now/CVE-2017-16232.md): LibTIFF 4.0.8 has multiple memory leak vulnerabilities, which allow attackers to cause a denial of service (memory consumption), as demonstr (no CVSS)
- [CVE-2019-6454](https://cve.now/CVE-2019-6454.md): An issue was discovered in sd-bus in systemd 239. (no CVSS)
- [CVE-2017-16231](https://cve.now/CVE-2017-16231.md): In PCRE 8.41, after compiling, a pcretest load test PoC produces a crash overflow in the function match() in pcre\_exec.c because of a self-r (CVSS 5.5)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2019-03-17
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.