# CVEs published 2019-03-18

25 CVEs were published on March 18, 2019: 0 critical, 0 high. Days are UTC.

- [CVE-2019-9094](https://cve.now/CVE-2019-9094.md): A Reflected Cross Site Scripting (XSS) Vulnerability was discovered in /s/adada/cfiles/upload in Humhub 1.3.10 Community Edition. (no CVSS)
- [CVE-2019-9093](https://cve.now/CVE-2019-9093.md): A Reflected Cross Site Scripting (XSS) Vulnerability was discovered in file/file/upload in Humhub 1.3.10 Community Edition. (no CVSS)
- [CVE-2019-6492](https://cve.now/CVE-2019-6492.md): SmartDefragDriver.sys (2.0) in IObit Smart Defrag 6 never frees an executable kernel pool that is allocated with user defined bytes and size (no CVSS)
- [CVE-2019-7161](https://cve.now/CVE-2019-7161.md): An issue was discovered in Zoho ManageEngine ADSelfService Plus 5.x through build 5704. (no CVSS)
- [CVE-2019-6970](https://cve.now/CVE-2019-6970.md): Moodle 3.5.x before 3.5.4 allows SSRF. (no CVSS, moodle/moodle)
- [CVE-2018-20736](https://cve.now/CVE-2018-20736.md): An issue was discovered in WSO2 API Manager 2.1.0 and 2.6.0. (no CVSS)
- [CVE-2018-20737](https://cve.now/CVE-2018-20737.md): An issue was discovered in WSO2 API Manager 2.1.0 and 2.6.0. (no CVSS)
- [CVE-2018-18466](https://cve.now/CVE-2018-18466.md): An issue was discovered in SecurEnvoy SecurAccess 9.3.502. (no CVSS)
- [CVE-2018-19365](https://cve.now/CVE-2018-19365.md): The REST API in Wowza Streaming Engine 4.7.4.01 allows traversal of the directory structure and retrieval of a file via a remote, specifical (no CVSS)
- [CVE-2019-7299](https://cve.now/CVE-2019-7299.md): A stored cross-site scripting (XSS) vulnerability in the submit\_ticket.php module in the WP Support Plus Responsive Ticket System plugin 9.1 (no CVSS)
- [CVE-2018-14724](https://cve.now/CVE-2018-14724.md): In the Ban List plugin 1.0 for MyBB, any forum user with mod privileges can ban users and input an XSS payload into the ban reason, which is (no CVSS)
- [CVE-2019-6724](https://cve.now/CVE-2019-6724.md): The barracudavpn component of the Barracuda VPN Client prior to version 5.0.2.7 for Linux, macOS, and OpenBSD runs as a privileged process a (no CVSS)
- [CVE-2019-3497](https://cve.now/CVE-2019-3497.md): An issue was discovered on Wifi-soft UniBox controller 0.x through 2.x devices. (no CVSS)
- [CVE-2019-3496](https://cve.now/CVE-2019-3496.md): An issue was discovered on Wifi-soft UniBox controller 3.x devices. (no CVSS)
- [CVE-2019-3495](https://cve.now/CVE-2019-3495.md): An issue was discovered on Wifi-soft UniBox controller 0.x through 2.x devices. (no CVSS)
- [CVE-2018-20669](https://cve.now/CVE-2018-20669.md): An issue where a provided address with access\_ok() is not checked was discovered in i915\_gem\_execbuffer2\_ioctl in drivers/gpu/drm/i915/i915\_ (no CVSS)
- [CVE-2018-20615](https://cve.now/CVE-2018-20615.md): An out-of-bounds read issue was discovered in the HTTP/2 protocol decoder in HAProxy 1.8.x and 1.9.x through 1.9.0 which can result in a cra (no CVSS)
- [CVE-2018-20556](https://cve.now/CVE-2018-20556.md): SQL injection vulnerability in Booking Calendar plugin 8.4.3 for WordPress allows remote attackers to execute arbitrary SQL commands via the (no CVSS)
- [CVE-2018-20555](https://cve.now/CVE-2018-20555.md): The Design Chemical Social Network Tabs plugin 1.7.1 for WordPress allows remote attackers to discover Twitter access\_token, access\_token\_se (no CVSS)
- [CVE-2018-20526](https://cve.now/CVE-2018-20526.md): Roxy Fileman 1.4.5 allows unrestricted file upload in upload.php. (no CVSS)
- [CVE-2018-20525](https://cve.now/CVE-2018-20525.md): Roxy Fileman 1.4.5 allows Directory Traversal in copydir.php, copyfile.php, and fileslist.php. (no CVSS)
- [CVE-2019-9857](https://cve.now/CVE-2019-9857.md): In the Linux kernel through 5.0.2, the function inotify\_update\_existing\_watch() in fs/notify/inotify/inotify\_user.c neglects to call fsnotif (no CVSS)
- [CVE-2016-9166](https://cve.now/CVE-2016-9166.md): NetIQ eDirectory versions prior to 9.0.2, under some circumstances, could be susceptible to downgrade of communication security. (no CVSS, NetIQ eDirectory)
- [CVE-2018-11789](https://cve.now/CVE-2018-11789.md): When accessing the heron-ui webpage, people can modify the file paths outside of the current container to access any file on the host. (no CVSS, Apache Incubator Heron)
- [CVE-2018-11767](https://cve.now/CVE-2018-11767.md): In Apache Hadoop 2.9.0 to 2.9.1, 2.8.3 to 2.8.4, 2.7.5 to 2.7.6, KMS blocking users or granting access to users incorrectly, if the system u (no CVSS, Apache Hadoop · org.apache.hadoop:hadoop-main)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2019-03-18
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.