# CVEs published 2019-03-20

43 CVEs were published on March 20, 2019: 0 critical, 1 high. Days are UTC.

- [CVE-2019-9889](https://cve.now/CVE-2019-9889.md): In Vanilla before 2.6.4, a flaw exists within the getSingleIndex function of the AddonManager class. (no CVSS)
- [CVE-2019-3862](https://cve.now/CVE-2019-3862.md): An out of bounds read flaw was discovered in libssh2 before 1.8.1 in the way SSH\_MSG\_CHANNEL\_REQUEST packets with an exit status message and (CVSS 7.3, The libssh2 Project libssh2)
- [CVE-2019-3859](https://cve.now/CVE-2019-3859.md): An out of bounds read flaw was discovered in libssh2 before 1.8.1 in the \_libssh2\_packet\_require and \_libssh2\_packet\_requirev functions. (CVSS 5.0, The libssh2 Project libssh2)
- [CVE-2017-2659](https://cve.now/CVE-2017-2659.md): It was found that dropbear before version 2013.59 with GSSAPI leaks whether given username is valid or invalid. (CVSS 5.3, \[UNKNOWN\] dropbear)
- [CVE-2018-17167](https://cve.now/CVE-2018-17167.md): PrinterOn Enterprise 4.1.4 suffers from multiple authenticated stored XSS vulnerabilities via the (1) "Machine Host Name" or "Server Serial (no CVSS)
- [CVE-2019-7441](https://cve.now/CVE-2019-7441.md): cgi-bin/webscr?cmd=\_cart in the WooCommerce PayPal Checkout Payment Gateway plugin 1.6.8 for WordPress allows Parameter Tampering in an amou (no CVSS)
- [CVE-2019-7440](https://cve.now/CVE-2019-7440.md): JioFi 4G M2S 1.0.2 devices have CSRF via the SSID name and Security Key field under Edit Wi-Fi Settings (aka a SetWiFi\_Setting request to cg (no CVSS)
- [CVE-2019-7439](https://cve.now/CVE-2019-7439.md): cgi-bin/qcmap\_web\_cgi on JioFi 4G M2S 1.0.2 devices allows a DoS (Hang) via the mask POST parameter. (no CVSS)
- [CVE-2019-7438](https://cve.now/CVE-2019-7438.md): cgi-bin/qcmap\_web\_cgi on JioFi 4G M2S 1.0.2 devices has XSS and HTML injection via the mask POST parameter. (no CVSS)
- [CVE-2019-3832](https://cve.now/CVE-2019-3832.md): It was discovered the fix for CVE-2018-19758 (libsndfile) was not complete and still allows a read beyond the limits of a buffer in wav\_writ (CVSS 3.3, \[UNKNOWN\] libsndfile)
- [CVE-2019-7437](https://cve.now/CVE-2019-7437.md): PHP Scripts Mall Opensource Classified Ads Script 3.2.2 has reflected Cross-Site Scripting (XSS) via the Search field. (no CVSS)
- [CVE-2019-7436](https://cve.now/CVE-2019-7436.md): PHP Scripts Mall Opensource Classified Ads Script 3.2.2 has directory traversal via a direct request for a listing of an uploads directory. (no CVSS)
- [CVE-2019-7435](https://cve.now/CVE-2019-7435.md): PHP Scripts Mall Opensource Classified Ads Script 3.2.2 has reflected HTML injection via the Search Form. (no CVSS)
- [CVE-2019-7434](https://cve.now/CVE-2019-7434.md): PHP Scripts Mall Rental Bike Script 2.0.3 has directory traversal via a direct request for a listing of an uploads directory. (no CVSS)
- [CVE-2019-7433](https://cve.now/CVE-2019-7433.md): PHP Scripts Mall Rental Bike Script 2.0.3 has Cross-Site Request Forgery (CSRF) via the Edit Profile feature. (no CVSS)
- [CVE-2019-7432](https://cve.now/CVE-2019-7432.md): PHP Scripts Mall Rental Bike Script 2.0.3 has HTML injection via the STREET field in the Profile Edit section. (no CVSS)
- [CVE-2019-7431](https://cve.now/CVE-2019-7431.md): PHP Scripts Mall Image Sharing Script 1.3.4 has directory traversal via a direct request for a listing of an uploads directory. (no CVSS)
- [CVE-2019-7430](https://cve.now/CVE-2019-7430.md): PHP Scripts Mall Image Sharing Script 1.3.4 has HTML injection via the Search Bar. (no CVSS)
- [CVE-2019-7429](https://cve.now/CVE-2019-7429.md): PHP Scripts Mall Property Rental Software 2.1.4 has directory traversal via a direct request for a listing of an uploads directory such as t (no CVSS)
- [CVE-2018-20648](https://cve.now/CVE-2018-20648.md): PHP Scripts Mall Car Rental Script 2.0.8 has Cross-Site Request Forgery (CSRF) via accountedit.php. (no CVSS)
- [CVE-2018-20647](https://cve.now/CVE-2018-20647.md): PHP Scripts Mall Car Rental Script 2.0.8 has directory traversal via a direct request for a listing of an image directory such as an images/ (no CVSS)
- [CVE-2018-20646](https://cve.now/CVE-2018-20646.md): PHP Scripts Mall Basic B2B Script 2.0.9 has has directory traversal via a direct request for a listing of an image directory such as an uplo (no CVSS)
- [CVE-2018-20645](https://cve.now/CVE-2018-20645.md): PHP Scripts Mall Basic B2B Script 2.0.9 has HTML injection via the First Name or Last Name field. (no CVSS)
- [CVE-2018-20644](https://cve.now/CVE-2018-20644.md): PHP Scripts Mall Basic B2B Script 2.0.9 has Cross-Site Request Forgery (CSRF) via the Edit profile feature. (no CVSS)
- [CVE-2018-20643](https://cve.now/CVE-2018-20643.md): PHP Scripts Mall Entrepreneur Job Portal Script 3.0.1 has directory traversal via a direct request for a listing of an image directory such (no CVSS)
- [CVE-2018-20642](https://cve.now/CVE-2018-20642.md): PHP Scripts Mall Entrepreneur Job Portal Script 3.0.1 allows remote attackers to cause a denial of service (outage of profile editing) via c (no CVSS)
- [CVE-2018-20641](https://cve.now/CVE-2018-20641.md): PHP Scripts Mall Entrepreneur Job Portal Script 3.0.1 has Cross-Site Request Forgery (CSRF) via the Edit Profile feature. (no CVSS)
- [CVE-2018-20640](https://cve.now/CVE-2018-20640.md): PHP Scripts Mall Entrepreneur Job Portal Script 3.0.1 has stored Cross-Site Scripting (XSS) via the Full Name field. (no CVSS)
- [CVE-2018-20639](https://cve.now/CVE-2018-20639.md): PHP Scripts Mall Entrepreneur Job Portal Script 3.0.1 has HTML injection via the Search Bar. (no CVSS)
- [CVE-2018-20638](https://cve.now/CVE-2018-20638.md): PHP Scripts Mall Chartered Accountant : Auditor Website 2.0.1 has directory traversal via a direct request for a listing of an image directo (no CVSS)
- [CVE-2018-20637](https://cve.now/CVE-2018-20637.md): PHP Scripts Mall Chartered Accountant : Auditor Website 2.0.1 allows remote attackers to cause a denial of service (unrecoverable blank prof (no CVSS)
- [CVE-2018-20636](https://cve.now/CVE-2018-20636.md): PHP Scripts Mall Chartered Accountant : Auditor Website 2.0.1 has HTML injection via the First Name field. (no CVSS)
- [CVE-2018-20635](https://cve.now/CVE-2018-20635.md): PHP Scripts Mall Advance B2B Script 2.1.4 has directory traversal via a direct request for a listing of an image directory such as an assets (no CVSS)
- [CVE-2018-20634](https://cve.now/CVE-2018-20634.md): PHP Scripts Mall Advance B2B Script 2.1.4 allows remote attackers to cause a denial of service (changed Page structure) via JavaScript code (no CVSS)
- [CVE-2018-20633](https://cve.now/CVE-2018-20633.md): PHP Scripts Mall Advance B2B Script 2.1.4 has Cross-Site Request Forgery (CSRF) via the Edit Profile feature. (no CVSS)
- [CVE-2018-20632](https://cve.now/CVE-2018-20632.md): PHP Scripts Mall Advance B2B Script 2.1.4 has stored Cross-Site Scripting (XSS) via the FIRST NAME or LAST NAME field. (no CVSS)
- [CVE-2018-20631](https://cve.now/CVE-2018-20631.md): PHP Scripts Mall Website Seller Script 2.0.5 allows full Path Disclosure via a request for an arbitrary image URL such as a .png file. (no CVSS)
- [CVE-2019-0191](https://cve.now/CVE-2019-0191.md): Apache Karaf kar deployer reads .kar archives and extracts the paths from the "repository/" and "resources/" entries in the zip file. (no CVSS, Apache Karaf · org.apache.karaf:karaf +1)
- [CVE-2018-20630](https://cve.now/CVE-2018-20630.md): PHP Scripts Mall Advance Crowdfunding Script 2.0.3 has directory traversal via a direct request for a listing of an uploads directory such a (no CVSS)
- [CVE-2018-20629](https://cve.now/CVE-2018-20629.md): PHP Scripts Mall Charity Donation Script readymadeb2bscript has directory traversal via a direct request for a listing of an uploads directo (no CVSS)
- [CVE-2018-20628](https://cve.now/CVE-2018-20628.md): PHP Scripts Mall Charity Foundation Script 1 through 3 allows directory traversal via a direct request for a listing of an uploads directory (no CVSS)
- [CVE-2018-20627](https://cve.now/CVE-2018-20627.md): PHP Scripts Mall Consumer Reviews Script 4.0.3 has HTML injection via the search box. (no CVSS)
- [CVE-2018-20626](https://cve.now/CVE-2018-20626.md): PHP Scripts Mall Consumer Reviews Script 4.0.3 has directory traversal via a direct request for a listing of an uploads directory such as th (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2019-03-20
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.