# CVEs published 2019-03-19

49 CVEs were published on March 19, 2019: 0 critical, 12 high. Days are UTC.

- [CVE-2018-15498](https://cve.now/CVE-2018-15498.md): YSoft SafeQ Server 6 allows a replay attack. (no CVSS)
- [CVE-2018-18473](https://cve.now/CVE-2018-18473.md): A hidden backdoor on PATLITE NH-FB Series devices with firmware version 1.45 or earlier, NH-FV Series devices with firmware version 1.10 or (no CVSS)
- [CVE-2019-6441](https://cve.now/CVE-2019-6441.md): An issue was discovered on Shenzhen Coship RT3050 4.0.0.40, RT3052 4.0.0.48, RT7620 10.0.0.49, WM3300 5.0.0.54, and WM3300 5.0.0.55 devices. (no CVSS)
- [CVE-2019-6282](https://cve.now/CVE-2019-6282.md): ChinaMobile PLC Wireless Router GPN2.4P21-C-CN devices with firmware W2001EN-00 have CSRF via the cgi-bin/webproc?getpage=html/index.html su (no CVSS)
- [CVE-2019-6279](https://cve.now/CVE-2019-6279.md): ChinaMobile PLC Wireless Router GPN2.4P21-C-CN devices with firmware W2001EN-00 have an Incorrect Access Control vulnerability via the cgi-b (no CVSS)
- [CVE-2019-6728](https://cve.now/CVE-2019-6728.md): This vulnerability allows remote attackers to disclose sensitive information on vulnerable installations of Foxit Reader. (no CVSS, Foxit Reader)
- [CVE-2019-6729](https://cve.now/CVE-2019-6729.md): This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader. (no CVSS, Foxit Reader)
- [CVE-2019-6730](https://cve.now/CVE-2019-6730.md): This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader. (no CVSS, Foxit Reader)
- [CVE-2019-6731](https://cve.now/CVE-2019-6731.md): This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit PhantomPDF. (no CVSS, Foxit PhantomPDF)
- [CVE-2019-6732](https://cve.now/CVE-2019-6732.md): This vulnerability allows remote attackers to disclose sensitive information on vulnerable installations of Foxit PhantomPDF. (no CVSS, Foxit PhantomPDF)
- [CVE-2019-6733](https://cve.now/CVE-2019-6733.md): This vulnerability allows remote attackers to disclose sensitive information on vulnerable installations of Foxit PhantomPDF. (no CVSS, Foxit PhantomPDF)
- [CVE-2019-6734](https://cve.now/CVE-2019-6734.md): This vulnerability allows remote attackers to disclose sensitive information on vulnerable installations of Foxit PhantomPDF. (no CVSS, Foxit PhantomPDF)
- [CVE-2019-6735](https://cve.now/CVE-2019-6735.md): This vulnerability allows remote attackers to disclose sensitive information on vulnerable installations of Foxit Reader. (no CVSS, Foxit Reader)
- [CVE-2019-6727](https://cve.now/CVE-2019-6727.md): This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader. (no CVSS, Foxit Reader)
- [CVE-2019-6275](https://cve.now/CVE-2019-6275.md): Command injection vulnerability in firmware\_cgi in GL.iNet GL-AR300M-Lite devices with firmware 2.27 allows remote attackers to execute arbi (no CVSS)
- [CVE-2019-6274](https://cve.now/CVE-2019-6274.md): Directory traversal vulnerability in storage\_cgi in GL.iNet GL-AR300M-Lite devices with firmware 2.27 allows remote attackers to have unspec (no CVSS)
- [CVE-2018-17502](https://cve.now/CVE-2018-17502.md): The Receptionist for iPad could allow a local attacker to obtain sensitive information, caused by an error in the contact.json file. (CVSS 4.0, Los Trigos The Receptionist for iPad)
- [CVE-2018-17500](https://cve.now/CVE-2018-17500.md): Envoy Passport for Android and Envoy Passport for iPhone could allow a local attacker to obtain sensitive information, caused by the storing (CVSS 2.9, Envoy Passport for iPhone · Envoy Passport for Android)
- [CVE-2018-17499](https://cve.now/CVE-2018-17499.md): Envoy Passport for Android and Envoy Passport for iPhone could allow a local attacker to obtain sensitive information, caused by the storing (CVSS 2.9, Envoy Passport for iPhone · Envoy Passport for Android)
- [CVE-2018-17497](https://cve.now/CVE-2018-17497.md): eVisitorPass contains default administrative credentials. (CVSS 8.4, eVisitorPass)
- [CVE-2018-17496](https://cve.now/CVE-2018-17496.md): eVisitorPass could allow a local attacker to gain elevated privileges on the system, caused by an error while in kiosk mode. (CVSS 8.4, eVisitorPass)
- [CVE-2018-17495](https://cve.now/CVE-2018-17495.md): eVisitorPass could allow a local attacker to gain elevated privileges on the system, caused by an error with the Virtual Keyboard Help Dialo (CVSS 8.4, eVisitorPass)
- [CVE-2018-17494](https://cve.now/CVE-2018-17494.md): eVisitorPass could allow a local attacker to gain elevated privileges on the system, caused by an error with the Virtual Keyboard Start Menu (CVSS 8.4, eVisitorPass)
- [CVE-2018-17493](https://cve.now/CVE-2018-17493.md): eVisitorPass could allow a local attacker to gain elevated privileges on the system, caused by an error with the Fullscreen button. (CVSS 8.4, eVisitorPass)
- [CVE-2018-17492](https://cve.now/CVE-2018-17492.md): EasyLobby Solo contains default administrative credentials. (CVSS 8.4, HID Global EasyLobby Solo)
- [CVE-2018-17491](https://cve.now/CVE-2018-17491.md): EasyLobby Solo could allow a local attacker to gain elevated privileges on the system. (CVSS 8.4, HID Global EasyLobby Solo)
- [CVE-2018-17490](https://cve.now/CVE-2018-17490.md): EasyLobby Solo is vulnerable to a denial of service. (CVSS 7.7, HID Global EasyLobby Solo)
- [CVE-2018-17489](https://cve.now/CVE-2018-17489.md): EasyLobby Solo could allow a local attacker to obtain sensitive information, caused by the storing of the social security number in plaintex (CVSS 2.9, HID Global EasyLobby Solo)
- [CVE-2018-17488](https://cve.now/CVE-2018-17488.md): Lobby Track Desktop could allow a local attacker to gain elevated privileges on the system, caused by an error in the printer dialog. (CVSS 8.4, Jolly Technologies Lobby Track Desktop)
- [CVE-2018-17487](https://cve.now/CVE-2018-17487.md): Lobby Track Desktop could allow a local attacker to gain elevated privileges on the system, caused by an error in the printer dialog. (CVSS 8.4, Jolly Technologies Lobby Track Desktop)
- [CVE-2018-17486](https://cve.now/CVE-2018-17486.md): Lobby Track Desktop could allow a local attacker to bypass security restrictions, caused by an error in the find visitor function while in k (CVSS 2.9, Jolly Technologies Lobby Track Desktop)
- [CVE-2018-17485](https://cve.now/CVE-2018-17485.md): Lobby Track Desktop contains default administrative credentials. (CVSS 8.4, Jolly Technologies Lobby Track Desktop)
- [CVE-2018-17484](https://cve.now/CVE-2018-17484.md): Lobby Track Desktop could allow a local attacker to obtain sensitive information, caused by an error in Sample Database.mdb database while i (CVSS 4.0, Jolly Technologies Lobby Track Desktop)
- [CVE-2018-17483](https://cve.now/CVE-2018-17483.md): Lobby Track Desktop could allow a local attacker to obtain sensitive information, caused by an error in Reports while in kiosk mode. (CVSS 2.9, Jolly Technologies Lobby Track Desktop)
- [CVE-2018-17482](https://cve.now/CVE-2018-17482.md): Lobby Track Desktop could allow a local attacker to obtain sensitive information, caused by an error in Reports while in kiosk mode. (CVSS 4.0, Jolly Technologies Lobby Track Desktop)
- [CVE-2019-6273](https://cve.now/CVE-2019-6273.md): download\_file in GL.iNet GL-AR300M-Lite devices with firmware 2.27 allows remote attackers to download arbitrary files. (no CVSS)
- [CVE-2019-6272](https://cve.now/CVE-2019-6272.md): Command injection vulnerability in login\_cgi in GL.iNet GL-AR300M-Lite devices with firmware 2.27 allows remote attackers to execute arbitra (no CVSS)
- [CVE-2019-6116](https://cve.now/CVE-2019-6116.md): In Artifex Ghostscript through 9.26, ephemeral or transient procedures can allow access to system operators, leading to remote code executio (no CVSS)
- [CVE-2019-9878](https://cve.now/CVE-2019-9878.md): There is an invalid memory access in the function GfxIndexedColorSpace::mapColorToBase() located in GfxState.cc in Xpdf 4.0.0, as used in pd (no CVSS)
- [CVE-2019-9877](https://cve.now/CVE-2019-9877.md): There is an invalid memory access vulnerability in the function TextPage::findGaps() located at TextOutputDev.c in Xpdf 4.01, which can (for (no CVSS)
- [CVE-2019-5885](https://cve.now/CVE-2019-5885.md): Matrix Synapse before 0.34.0.1, when the macaroon\_secret\_key authentication parameter is not set, uses a predictable value to derive a secre (no CVSS, matrix-synapse)
- [CVE-2019-5729](https://cve.now/CVE-2019-5729.md): Splunk-SDK-Python before 1.6.6 does not properly verify untrusted TLS server certificates, which could result in man-in-the-middle attacks. (no CVSS, splunk-sdk)
- [CVE-2019-5723](https://cve.now/CVE-2019-5723.md): An issue was discovered in portier vision 4.4.4.2 and 4.4.4.6. (no CVSS)
- [CVE-2019-5722](https://cve.now/CVE-2019-5722.md): An issue was discovered in portier vision 4.4.4.2 and 4.4.4.6. (no CVSS)
- [CVE-2019-9870](https://cve.now/CVE-2019-9870.md): plugin.js in the w8tcha oEmbed plugin before 2019-03-14 for CKEditor mishandles SCRIPT elements. (no CVSS)
- [CVE-2019-9868](https://cve.now/CVE-2019-9868.md): An issue was discovered in the Web Console in Veritas NetBackup Appliance through 3.1.2. (no CVSS)
- [CVE-2019-9867](https://cve.now/CVE-2019-9867.md): An issue was discovered in the Web Console in Veritas NetBackup Appliance through 3.1.2. (no CVSS)
- [CVE-2019-4094](https://cve.now/CVE-2019-4094.md): IBM DB2 for Linux, UNIX and Windows (includes DB2 Connect Server) 9.7, 10.1, 10.5, and 11.1 binaries load shared libraries from an untrusted (CVSS 8.4, IBM DB2 for Linux, UNIX and Windows)
- [CVE-2018-1836](https://cve.now/CVE-2018-1836.md): IBM WebSphere MQ 9.0.2, 9.0.3, 9.0.4, 9.0.5, 9.1.0.0, and 9.1.0.1 console is vulnerable to cross-site scripting. (CVSS 5.4, IBM MQ)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2019-03-19
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.