# CVEs published 2019-03-22

18 CVEs were published on March 22, 2019: 0 critical, 7 high. Days are UTC.

- [CVE-2019-1716](https://cve.now/CVE-2019-1716.md): Cisco IP Phone 7800 Series and 8800 Series Remote Code Execution Vulnerability (CVSS 7.5, Cisco Unified IP Conference Phone · Cisco Wireless IP Ph… +1)
- [CVE-2019-1763](https://cve.now/CVE-2019-1763.md): Cisco IP Phone 8800 Series Authorization Bypass Vulnerability (CVSS 7.5, Cisco Wireless IP Phone 8821 and 8821-EX · Cisco IP Confere…)
- [CVE-2019-1764](https://cve.now/CVE-2019-1764.md): Cisco IP Phone 8800 Series Cross-Site Request Forgery Vulnerability (CVSS 8.1, Cisco Wireless IP Phone 8821 and 8821-EX · Cisco IP Confere…)
- [CVE-2019-1765](https://cve.now/CVE-2019-1765.md): Cisco IP Phone 8800 Series Path Traversal Vulnerability (CVSS 8.1, Cisco Wireless IP Phone 8821 and 8821-EX · Cisco IP Confere…)
- [CVE-2019-1766](https://cve.now/CVE-2019-1766.md): Cisco IP Phone 8800 Series File Upload Denial of Service Vulnerability (CVSS 7.5, Cisco IP Phone 8800 Series Software)
- [CVE-2018-20165](https://cve.now/CVE-2018-20165.md): Cross-site scripting (XSS) vulnerability in OpenText Portal 7.4.4 allows remote attackers to inject arbitrary web script or HTML via the vgn (no CVSS)
- [CVE-2019-9649](https://cve.now/CVE-2019-9649.md): An issue was discovered in the SFTP Server component in Core FTP 2.0 Build 674. (no CVSS)
- [CVE-2019-4052](https://cve.now/CVE-2019-4052.md): IBM API Connect 2018.1 and 2018.4.1.2 apis can be leveraged by unauthenticated users to discover login ids of registered users. (CVSS 8.2, IBM API Connect)
- [CVE-2019-4035](https://cve.now/CVE-2019-4035.md): IBM Content Navigator 3.0CD could allow attackers to direct web traffic to a malicious site. (CVSS 6.3, IBM Content Navigator)
- [CVE-2019-9648](https://cve.now/CVE-2019-9648.md): An issue was discovered in the SFTP Server component in Core FTP 2.0 Build 674. (no CVSS, CoreFtp)
- [CVE-2019-9939](https://cve.now/CVE-2019-9939.md): The SHAREit application before 4.0.36 for Android allows a remote attacker (on the same network or joining public "open" Wi-Fi hotspots crea (no CVSS)
- [CVE-2019-9938](https://cve.now/CVE-2019-9938.md): The SHAREit application before 4.0.42 for Android allows a remote attacker (on the same network or joining public "open" Wi-Fi hotspots crea (no CVSS)
- [CVE-2019-9937](https://cve.now/CVE-2019-9937.md): In SQLite 3.27.2, interleaving reads and writes in a single transaction with an fts5 virtual table will lead to a NULL Pointer Dereference i (no CVSS)
- [CVE-2019-9936](https://cve.now/CVE-2019-9936.md): In SQLite 3.27.2, running fts5 prefix queries inside a transaction could trigger a heap-based buffer over-read in fts5HashEntrySort in sqlit (no CVSS)
- [CVE-2019-9923](https://cve.now/CVE-2019-9923.md): pax\_decode\_header in sparse.c in GNU Tar before 1.32 had a NULL pointer dereference when parsing certain archives that have malformed extend (CVSS 7.5)
- [CVE-2019-9927](https://cve.now/CVE-2019-9927.md): Caret before 2019-02-22 allows Remote Code Execution. (no CVSS)
- [CVE-2019-9925](https://cve.now/CVE-2019-9925.md): S-CMS PHP v1.0 has XSS in 4.edu.php via the S\_id parameter. (no CVSS)
- [CVE-2019-9924](https://cve.now/CVE-2019-9924.md): rbash in Bash before 4.4-beta2 did not prevent the shell user from modifying BASH\_CMDS, thus allowing the user to execute any command with t (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2019-03-22
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.