CVEs published March 18, 2019
25 CVEs were published on March 18, 2019: 0 critical, 0 high.
- Published
- 25
- Critical
- 0
- High
- 0
- Medium
- 0
- Low
- 0
- Unrated
- 25
- Now in CISA KEV
- 0
- Fix available
- 2
Most affected products
- Apache Hadoop · org.apache.hadoop:hadoop-main
- 1
- Apache Incubator Heron
- 1
- moodle/moodle
- 1
- NetIQ eDirectory
- 1
Medium, low and unrated 25
- CVE-2019-9094A Reflected Cross Site Scripting (XSS) Vulnerability was discovered in /s/adada/cfiles/upload in Humhub 1.3.10 Community Edition.
- CVE-2019-9093A Reflected Cross Site Scripting (XSS) Vulnerability was discovered in file/file/upload in Humhub 1.3.10 Community Edition.
- CVE-2019-6492SmartDefragDriver.sys (2.0) in IObit Smart Defrag 6 never frees an executable kernel pool that is allocated with user defined bytes and size
- CVE-2019-7161An issue was discovered in Zoho ManageEngine ADSelfService Plus 5.x through build 5704.
- CVE-2019-6970Moodle 3.5.x before 3.5.4 allows SSRF.moodle/moodle
- CVE-2018-20736An issue was discovered in WSO2 API Manager 2.1.0 and 2.6.0.
- CVE-2018-20737An issue was discovered in WSO2 API Manager 2.1.0 and 2.6.0.
- CVE-2018-18466An issue was discovered in SecurEnvoy SecurAccess 9.3.502.
- CVE-2018-19365The REST API in Wowza Streaming Engine 4.7.4.01 allows traversal of the directory structure and retrieval of a file via a remote, specifical
- CVE-2019-7299A stored cross-site scripting (XSS) vulnerability in the submit_ticket.php module in the WP Support Plus Responsive Ticket System plugin 9.1
- CVE-2018-14724In the Ban List plugin 1.0 for MyBB, any forum user with mod privileges can ban users and input an XSS payload into the ban reason, which is
- CVE-2019-6724The barracudavpn component of the Barracuda VPN Client prior to version 5.0.2.7 for Linux, macOS, and OpenBSD runs as a privileged process a
- CVE-2019-3497An issue was discovered on Wifi-soft UniBox controller 0.x through 2.x devices.
- CVE-2019-3496An issue was discovered on Wifi-soft UniBox controller 3.x devices.
- CVE-2019-3495An issue was discovered on Wifi-soft UniBox controller 0.x through 2.x devices.
- CVE-2018-20669An issue where a provided address with access_ok() is not checked was discovered in i915_gem_execbuffer2_ioctl in drivers/gpu/drm/i915/i915_
- CVE-2018-20615An out-of-bounds read issue was discovered in the HTTP/2 protocol decoder in HAProxy 1.8.x and 1.9.x through 1.9.0 which can result in a cra
- CVE-2018-20556SQL injection vulnerability in Booking Calendar plugin 8.4.3 for WordPress allows remote attackers to execute arbitrary SQL commands via the
- CVE-2018-20555The Design Chemical Social Network Tabs plugin 1.7.1 for WordPress allows remote attackers to discover Twitter access_token, access_token_se
- CVE-2018-20526Roxy Fileman 1.4.5 allows unrestricted file upload in upload.php.
- CVE-2018-20525Roxy Fileman 1.4.5 allows Directory Traversal in copydir.php, copyfile.php, and fileslist.php.
- CVE-2019-9857In the Linux kernel through 5.0.2, the function inotify_update_existing_watch() in fs/notify/inotify/inotify_user.c neglects to call fsnotif
- CVE-2016-9166NetIQ eDirectory versions prior to 9.0.2, under some circumstances, could be susceptible to downgrade of communication security.NetIQ eDirectory
- CVE-2018-11789When accessing the heron-ui webpage, people can modify the file paths outside of the current container to access any file on the host.Apache Incubator Heron
- CVE-2018-11767In Apache Hadoop 2.9.0 to 2.9.1, 2.8.3 to 2.8.4, 2.7.5 to 2.7.6, KMS blocking users or granting access to users incorrectly, if the system uApache Hadoop · org.apache.hadoop:hadoop-main