CVEs published March 21, 2019
53 CVEs were published on March 21, 2019: 2 critical, 10 high. 1 is now in CISA KEV.
- Published
- 53
- Critical
- 2
- High
- 10
- Medium
- 7
- Low
- 0
- Unrated
- 34
- Now in CISA KEV
- 1
- Fix available
- 2
Most affected products
- CUJO
- 6
- Flexera Software FlexNet Publisher
- 3
- Insteon
- 3
- Moxa SoftCMS
- 2
- Schneider Electric Modicon PLC
- 2
- Talos coTURN
- 2
- The libssh2 Project libssh2
- 2
- BlackBerry AtHoc
- 1
- CleanMyMac X
- 1
- Das U-Boot
- 1
Critical 2
High 10
- CVE-2019-3855An integer overflow flaw which could lead to an out of bounds write was discovered in libssh2 before 1.8.1 in the way packets are read from The libssh2 Project libssh2
- CVE-2017-16255An exploitable buffer overflow vulnerability exists in the PubNub message handler Insteon Hub 2245-222 - Firmware version 1012.Insteon
- CVE-2017-16254An exploitable buffer overflow vulnerability exists in the PubNub message handler Insteon Hub 2245-222 - Firmware version 1012.Insteon
- CVE-2017-16253An exploitable buffer overflow vulnerability exists in the PubNub message handler Insteon Hub 2245-222 - Firmware version 1012 for the cc chInsteon
- CVE-2018-3968An exploitable vulnerability exists in the verified boot protection of the Das U-Boot from version 2013.07-rc1 to 2014.07-rc2.Das U-Boot
- CVE-2018-3985An exploitable double free vulnerability exists in the mdnscap binary of the CUJO Smart Firewall.CUJO
- CVE-2018-3969An exploitable vulnerability exists in the verified boot protection of the CUJO Smart Firewall.CUJO
- CVE-2018-4003An exploitable heap overflow vulnerability exists in the mdnscap binary of the CUJO Smart Firewall running firmware 7003.CUJO
- CVE-2019-5011An exploitable privilege escalation vulnerability exists in the helper service CleanMyMac X, version 4.20, due to improper updating.CleanMyMac X
- CVE-2018-4058An exploitable unsafe default configuration vulnerability exists in the TURN server functionality of coTURN prior to 4.5.0.9.Talos coTURN
Medium, low and unrated 41
- CVE-2019-9915GetSimpleCMS 3.3.13 has an Open Redirect via the admin/index.php redirect parameter.
- CVE-2019-9914The yop-poll plugin before 6.0.3 for WordPress has wp-admin/admin.php?page=yop-polls&action=view-votes poll_id XSS.
- CVE-2019-9913The wp-live-chat-support plugin before 8.0.18 for WordPress has wp-admin/admin.php?page=wplivechat-menu-gdpr-page term XSS.
- CVE-2019-9912The wp-google-maps plugin before 7.10.43 for WordPress has XSS via the wp-admin/admin.php PATH_INFO.
- CVE-2019-9911The social-networks-auto-poster-facebook-twitter-g plugin before 4.2.8 for WordPress has wp-admin/admin.php?page=nxssnap-reposter&action=edi
- CVE-2019-9910The kingcomposer plugin 2.7.6 for WordPress has wp-admin/admin.php?page=kc-mapper id XSS.
- CVE-2019-9909The "Donation Plugin and Fundraising Platform" plugin before 2.3.1 for WordPress has wp-admin/edit.php csv XSS.
- CVE-2019-9908The font-organizer plugin 2.1.1 for WordPress has wp-admin/options-general.php manage_font_id XSS.
- CVE-2018-18913Opera before 57.0.3098.106 is vulnerable to a DLL Search Order hijacking attack where an attacker can send a ZIP archive composed of an HTML
- CVE-2018-20034A Denial of Service vulnerability related to adding an item to a list in lmgrd and vendor daemon components of FlexNet Publisher version 11.Flexera Software FlexNet Publisher
- CVE-2019-7539A code injection issue was discovered in ipycache through 2016-05-31.ipycache
- CVE-2018-20032A Denial of Service vulnerability related to message decoding in lmgrd and vendor daemon components of FlexNet Publisher version 11.16.1.0 aFlexera Software FlexNet Publisher
- CVE-2018-20031A Denial of Service vulnerability related to preemptive item deletion in lmgrd and vendor daemon components of FlexNet Publisher version 11.Flexera Software FlexNet Publisher
- CVE-2019-3871A vulnerability was found in PowerDNS Authoritative Server before 4.0.7 and before 4.1.7.The PowerDNS Project pdns
- CVE-2019-8351Heimdal Thor Agent 2.5.17x before 2.5.173 does not verify X.509 certificates from TLS servers, which allows remote attackers to spoof server
- CVE-2019-3858An out of bounds read flaw was discovered in libssh2 before 1.8.1 when a specially crafted SFTP packet is received from the server.The libssh2 Project libssh2
- CVE-2019-7537An issue was discovered in Donfig 0.3.0.donfig
- CVE-2015-6458Moxa SoftCMS 1.3 and prior is susceptible to a buffer overflow condition that may crash or allow remote code execution.Moxa SoftCMS
- CVE-2015-6457Moxa SoftCMS 1.3 and prior is susceptible to a buffer overflow condition that may crash or allow remote code execution.Moxa SoftCMS
- CVE-2018-13798A vulnerability has been identified in SICAM A8000 CP-8000 (All versions < V14), SICAM A8000 CP-802X (All versions < V14), SICAM A8000 CP-80Siemens AG SICAM A8000 CP-8000, SICAM A8000 CP-802X, SIC… +1
- CVE-2015-6462Reflected Cross-Site Scripting (nonpersistent) allows an attacker to craft a specific URL, which contains Java script that will be executed Schneider Electric Modicon PLC
- CVE-2019-5490Certain versions between 2.x to 5.x (refer to advisory) of the NetApp Service Processor firmware were shipped with a default account enabledNetApp Service Processor
- CVE-2015-6461Remote file inclusion allows an attacker to craft a specific URL referencing the Schneider Electric Modicon BMXNOC0401, BMXNOE0100, BMXNOE01Schneider Electric Modicon PLC
- CVE-2019-9904An issue was discovered in lib\cdt\dttree.c in libcdt.a in graphviz 2.40.1.
- CVE-2019-9903PDFDoc::markObject in PDFDoc.cc in Poppler 0.74.0 mishandles dict marking, leading to stack consumption in the function Dict::find() located
- CVE-2019-8997An XML External Entity Injection (XXE) vulnerability in the Management System (console) of BlackBerry AtHoc versions earlier than 7.6 HF-567BlackBerry AtHoc
- CVE-2018-4030An exploitable vulnerability exists the safe browsing function of the CUJO Smart Firewall, version 7003.CUJO
- CVE-2018-4011An exploitable integer underflow vulnerability exists in the mdnscap binary of the CUJO Smart Firewall, version 7003.CUJO
- CVE-2019-6491RISI Gestao de Horarios v3201.09.08 rev.23 allows SQL Injection.
- CVE-2018-16563A vulnerability has been identified in Firmware variant IEC 61850 for EN100 Ethernet module (All versions < V4.35), Firmware variant MODBUS Siemens Firmware variant IEC 61850 for EN100 Ethernet mo… +5
- CVE-2018-1992The IBM Power 9 OP910, OP920, and FW910 boot firmware's bootloader is responsible for loading and validating the initial boot firmware imageIBM Power 9 Systems
- CVE-2017-1713IBM InfoSphere Streams 4.2.1 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive infIBM Streams
- CVE-2018-4059An exploitable unsafe default configuration vulnerability exists in the TURN server function of coTURN prior to version 4.5.0.9.Talos coTURN
- CVE-2016-5800A malicious attacker can trigger a remote buffer overflow in the Communication Server in Fatek Automation PM Designer V3 Version 2.1.2.2, anFatek Automation PM Designer · Fatek Automation FV Designer
- CVE-2016-5819Moxa G3100V2 Series, editions prior to Version 2.8, and OnCell G3111/G3151/G3211/G3251 Series, editions prior to Version 1.7 allows a reflecMoxa OnCell G3100V2 Series · Moxa OnCell G3111/G3151/G3211/…
- CVE-2019-9898Potential recycling of random numbers used in cryptography exists within PuTTY before 0.71.
- CVE-2019-9897Multiple denial-of-service attacks that can be triggered by writing to the terminal exist in PuTTY versions before 0.71.
- CVE-2019-9896In PuTTY versions before 0.71 on Windows, local attackers could hijack the application by putting a malicious help file in the same director
- CVE-2019-9895In PuTTY versions before 0.71 on Unix, a remotely triggerable buffer overflow exists in any kind of server-to-client forwarding.
- CVE-2019-9894A remotely triggerable memory overwrite in RSA key exchange in PuTTY before 0.71 can occur before host key verification.
- CVE-2019-9893libseccomp before 2.4.0 did not correctly generate 64-bit syscall argument comparisons using the arithmetic operators (LT, GT, LE, GE), whic