# CVEs published 2019-03-21

53 CVEs were published on March 21, 2019: 2 critical, 10 high. 1 is now in CISA KEV. Days are UTC.

- [CVE-2019-9915](https://cve.now/CVE-2019-9915.md): GetSimpleCMS 3.3.13 has an Open Redirect via the admin/index.php redirect parameter. (no CVSS)
- [CVE-2019-9914](https://cve.now/CVE-2019-9914.md): The yop-poll plugin before 6.0.3 for WordPress has wp-admin/admin.php?page=yop-polls&action=view-votes poll\_id XSS. (no CVSS)
- [CVE-2019-9913](https://cve.now/CVE-2019-9913.md): The wp-live-chat-support plugin before 8.0.18 for WordPress has wp-admin/admin.php?page=wplivechat-menu-gdpr-page term XSS. (no CVSS)
- [CVE-2019-9912](https://cve.now/CVE-2019-9912.md): The wp-google-maps plugin before 7.10.43 for WordPress has XSS via the wp-admin/admin.php PATH\_INFO. (no CVSS)
- [CVE-2019-9911](https://cve.now/CVE-2019-9911.md): The social-networks-auto-poster-facebook-twitter-g plugin before 4.2.8 for WordPress has wp-admin/admin.php?page=nxssnap-reposter&action=edi (no CVSS)
- [CVE-2019-9910](https://cve.now/CVE-2019-9910.md): The kingcomposer plugin 2.7.6 for WordPress has wp-admin/admin.php?page=kc-mapper id XSS. (no CVSS)
- [CVE-2019-9909](https://cve.now/CVE-2019-9909.md): The "Donation Plugin and Fundraising Platform" plugin before 2.3.1 for WordPress has wp-admin/edit.php csv XSS. (no CVSS)
- [CVE-2019-9908](https://cve.now/CVE-2019-9908.md): The font-organizer plugin 2.1.1 for WordPress has wp-admin/options-general.php manage\_font\_id XSS. (no CVSS)
- [CVE-2018-18913](https://cve.now/CVE-2018-18913.md): Opera before 57.0.3098.106 is vulnerable to a DLL Search Order hijacking attack where an attacker can send a ZIP archive composed of an HTML (no CVSS)
- [CVE-2018-20034](https://cve.now/CVE-2018-20034.md): A Denial of Service vulnerability related to adding an item to a list in lmgrd and vendor daemon components of FlexNet Publisher version 11. (no CVSS, Flexera Software FlexNet Publisher)
- [CVE-2019-7539](https://cve.now/CVE-2019-7539.md): A code injection issue was discovered in ipycache through 2016-05-31. (no CVSS, ipycache)
- [CVE-2018-20032](https://cve.now/CVE-2018-20032.md): A Denial of Service vulnerability related to message decoding in lmgrd and vendor daemon components of FlexNet Publisher version 11.16.1.0 a (no CVSS, Flexera Software FlexNet Publisher)
- [CVE-2018-20031](https://cve.now/CVE-2018-20031.md): A Denial of Service vulnerability related to preemptive item deletion in lmgrd and vendor daemon components of FlexNet Publisher version 11. (no CVSS, Flexera Software FlexNet Publisher)
- [CVE-2019-3871](https://cve.now/CVE-2019-3871.md): A vulnerability was found in PowerDNS Authoritative Server before 4.0.7 and before 4.1.7. (CVSS 6.5, The PowerDNS Project pdns)
- [CVE-2019-8351](https://cve.now/CVE-2019-8351.md): Heimdal Thor Agent 2.5.17x before 2.5.173 does not verify X.509 certificates from TLS servers, which allows remote attackers to spoof server (no CVSS)
- [CVE-2019-3858](https://cve.now/CVE-2019-3858.md): An out of bounds read flaw was discovered in libssh2 before 1.8.1 when a specially crafted SFTP packet is received from the server. (CVSS 5.0, The libssh2 Project libssh2)
- [CVE-2019-3855](https://cve.now/CVE-2019-3855.md): An integer overflow flaw which could lead to an out of bounds write was discovered in libssh2 before 1.8.1 in the way packets are read from (CVSS 7.5, The libssh2 Project libssh2)
- [CVE-2019-7537](https://cve.now/CVE-2019-7537.md): An issue was discovered in Donfig 0.3.0. (no CVSS, donfig)
- [CVE-2015-6458](https://cve.now/CVE-2015-6458.md): Moxa SoftCMS 1.3 and prior is susceptible to a buffer overflow condition that may crash or allow remote code execution. (no CVSS, Moxa SoftCMS)
- [CVE-2015-6457](https://cve.now/CVE-2015-6457.md): Moxa SoftCMS 1.3 and prior is susceptible to a buffer overflow condition that may crash or allow remote code execution. (no CVSS, Moxa SoftCMS)
- [CVE-2018-13798](https://cve.now/CVE-2018-13798.md): A vulnerability has been identified in SICAM A8000 CP-8000 (All versions \< V14), SICAM A8000 CP-802X (All versions \< V14), SICAM A8000 CP-80 (no CVSS, Siemens AG SICAM A8000 CP-8000, SICAM A8000 CP-802X, SIC… +1)
- [CVE-2015-6462](https://cve.now/CVE-2015-6462.md): Reflected Cross-Site Scripting (nonpersistent) allows an attacker to craft a specific URL, which contains Java script that will be executed (no CVSS, Schneider Electric Modicon PLC)
- [CVE-2019-5490](https://cve.now/CVE-2019-5490.md): Certain versions between 2.x to 5.x (refer to advisory) of the NetApp Service Processor firmware were shipped with a default account enabled (no CVSS, NetApp Service Processor)
- [CVE-2015-6461](https://cve.now/CVE-2015-6461.md): Remote file inclusion allows an attacker to craft a specific URL referencing the Schneider Electric Modicon BMXNOC0401, BMXNOE0100, BMXNOE01 (no CVSS, Schneider Electric Modicon PLC)
- [CVE-2019-9904](https://cve.now/CVE-2019-9904.md): An issue was discovered in lib\\cdt\\dttree.c in libcdt.a in graphviz 2.40.1. (no CVSS)
- [CVE-2019-9903](https://cve.now/CVE-2019-9903.md): PDFDoc::markObject in PDFDoc.cc in Poppler 0.74.0 mishandles dict marking, leading to stack consumption in the function Dict::find() located (no CVSS)
- [CVE-2019-8997](https://cve.now/CVE-2019-8997.md): An XML External Entity Injection (XXE) vulnerability in the Management System (console) of BlackBerry AtHoc versions earlier than 7.6 HF-567 (no CVSS, BlackBerry AtHoc)
- [CVE-2017-16255](https://cve.now/CVE-2017-16255.md): An exploitable buffer overflow vulnerability exists in the PubNub message handler Insteon Hub 2245-222 - Firmware version 1012. (CVSS 8.5, Insteon)
- [CVE-2017-16254](https://cve.now/CVE-2017-16254.md): An exploitable buffer overflow vulnerability exists in the PubNub message handler Insteon Hub 2245-222 - Firmware version 1012. (CVSS 8.5, Insteon)
- [CVE-2017-16253](https://cve.now/CVE-2017-16253.md): An exploitable buffer overflow vulnerability exists in the PubNub message handler Insteon Hub 2245-222 - Firmware version 1012 for the cc ch (CVSS 8.5, Insteon)
- [CVE-2019-7238](https://cve.now/CVE-2019-7238.md): Sonatype Nexus Repository Manager before 3.15.0 has Incorrect Access Control. (CVSS 9.8, KEV)
- [CVE-2018-3968](https://cve.now/CVE-2018-3968.md): An exploitable vulnerability exists in the verified boot protection of the Das U-Boot from version 2013.07-rc1 to 2014.07-rc2. (CVSS 8.2, Das U-Boot)
- [CVE-2018-3963](https://cve.now/CVE-2018-3963.md): An exploitable command injection vulnerability exists in the DHCP daemon configuration of the CUJO Smart Firewall. (CVSS 9.0, CUJO)
- [CVE-2018-4030](https://cve.now/CVE-2018-4030.md): An exploitable vulnerability exists the safe browsing function of the CUJO Smart Firewall, version 7003. (CVSS 5.3, CUJO)
- [CVE-2018-4011](https://cve.now/CVE-2018-4011.md): An exploitable integer underflow vulnerability exists in the mdnscap binary of the CUJO Smart Firewall, version 7003. (CVSS 6.5, CUJO)
- [CVE-2019-6491](https://cve.now/CVE-2019-6491.md): RISI Gestao de Horarios v3201.09.08 rev.23 allows SQL Injection. (no CVSS)
- [CVE-2018-3985](https://cve.now/CVE-2018-3985.md): An exploitable double free vulnerability exists in the mdnscap binary of the CUJO Smart Firewall. (CVSS 8.3, CUJO)
- [CVE-2018-3969](https://cve.now/CVE-2018-3969.md): An exploitable vulnerability exists in the verified boot protection of the CUJO Smart Firewall. (CVSS 8.2, CUJO)
- [CVE-2018-4003](https://cve.now/CVE-2018-4003.md): An exploitable heap overflow vulnerability exists in the mdnscap binary of the CUJO Smart Firewall running firmware 7003. (CVSS 8.3, CUJO)
- [CVE-2018-16563](https://cve.now/CVE-2018-16563.md): A vulnerability has been identified in Firmware variant IEC 61850 for EN100 Ethernet module (All versions \< V4.35), Firmware variant MODBUS (no CVSS, Siemens Firmware variant IEC 61850 for EN100 Ethernet mo… +5)
- [CVE-2019-5011](https://cve.now/CVE-2019-5011.md): An exploitable privilege escalation vulnerability exists in the helper service CleanMyMac X, version 4.20, due to improper updating. (CVSS 7.1, CleanMyMac X)
- [CVE-2018-1992](https://cve.now/CVE-2018-1992.md): The IBM Power 9 OP910, OP920, and FW910 boot firmware's bootloader is responsible for loading and validating the initial boot firmware image (CVSS 6.4, IBM Power 9 Systems)
- [CVE-2017-1713](https://cve.now/CVE-2017-1713.md): IBM InfoSphere Streams 4.2.1 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive inf (CVSS 5.9, IBM Streams)
- [CVE-2018-4059](https://cve.now/CVE-2018-4059.md): An exploitable unsafe default configuration vulnerability exists in the TURN server function of coTURN prior to version 4.5.0.9. (CVSS 6.5, Talos coTURN)
- [CVE-2018-4058](https://cve.now/CVE-2018-4058.md): An exploitable unsafe default configuration vulnerability exists in the TURN server functionality of coTURN prior to 4.5.0.9. (CVSS 7.7, Talos coTURN)
- [CVE-2016-5800](https://cve.now/CVE-2016-5800.md): A malicious attacker can trigger a remote buffer overflow in the Communication Server in Fatek Automation PM Designer V3 Version 2.1.2.2, an (no CVSS, Fatek Automation PM Designer · Fatek Automation FV Designer)
- [CVE-2016-5819](https://cve.now/CVE-2016-5819.md): Moxa G3100V2 Series, editions prior to Version 2.8, and OnCell G3111/G3151/G3211/G3251 Series, editions prior to Version 1.7 allows a reflec (no CVSS, Moxa OnCell G3100V2 Series · Moxa OnCell G3111/G3151/G3211/…)
- [CVE-2019-9898](https://cve.now/CVE-2019-9898.md): Potential recycling of random numbers used in cryptography exists within PuTTY before 0.71. (no CVSS)
- [CVE-2019-9897](https://cve.now/CVE-2019-9897.md): Multiple denial-of-service attacks that can be triggered by writing to the terminal exist in PuTTY versions before 0.71. (no CVSS)
- [CVE-2019-9896](https://cve.now/CVE-2019-9896.md): In PuTTY versions before 0.71 on Windows, local attackers could hijack the application by putting a malicious help file in the same director (no CVSS)
- [CVE-2019-9895](https://cve.now/CVE-2019-9895.md): In PuTTY versions before 0.71 on Unix, a remotely triggerable buffer overflow exists in any kind of server-to-client forwarding. (no CVSS)
- [CVE-2019-9894](https://cve.now/CVE-2019-9894.md): A remotely triggerable memory overwrite in RSA key exchange in PuTTY before 0.71 can occur before host key verification. (no CVSS)
- [CVE-2019-9893](https://cve.now/CVE-2019-9893.md): libseccomp before 2.4.0 did not correctly generate 64-bit syscall argument comparisons using the arithmetic operators (LT, GT, LE, GE), whic (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2019-03-21
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.