# CVEs published 2019-03-24 26 CVEs were published on March 24, 2019: 0 critical, 0 high. 1 is now in CISA KEV. Days are UTC. - [CVE-2019-10027](https://cve.now/CVE-2019-10027.md): PHPCMS 9.6.x through 9.6.3 has XSS via the mailbox (aka E-mail) field on the personal information screen. (no CVSS) - [CVE-2019-10026](https://cve.now/CVE-2019-10026.md): An issue was discovered in Xpdf 4.01.01. (no CVSS) - [CVE-2019-10025](https://cve.now/CVE-2019-10025.md): An issue was discovered in Xpdf 4.01.01. (no CVSS) - [CVE-2019-10024](https://cve.now/CVE-2019-10024.md): An issue was discovered in Xpdf 4.01.01. (no CVSS) - [CVE-2019-10023](https://cve.now/CVE-2019-10023.md): An issue was discovered in Xpdf 4.01.01. (no CVSS) - [CVE-2019-10022](https://cve.now/CVE-2019-10022.md): An issue was discovered in Xpdf 4.01.01. (no CVSS) - [CVE-2019-10021](https://cve.now/CVE-2019-10021.md): An issue was discovered in Xpdf 4.01.01. (no CVSS) - [CVE-2019-10020](https://cve.now/CVE-2019-10020.md): An issue was discovered in Xpdf 4.01.01. (no CVSS) - [CVE-2019-10019](https://cve.now/CVE-2019-10019.md): An issue was discovered in Xpdf 4.01.01. (no CVSS) - [CVE-2019-10018](https://cve.now/CVE-2019-10018.md): An issue was discovered in Xpdf 4.01.01. (no CVSS) - [CVE-2019-10017](https://cve.now/CVE-2019-10017.md): CMS Made Simple 2.2.10 has XSS via the moduleinterface.php Name field, which is reachable via an "Add a new Profile" action to the File Pick (no CVSS) - [CVE-2019-10015](https://cve.now/CVE-2019-10015.md): baigoStudio baigoSSO v3.0.1 allows remote attackers to execute arbitrary PHP code via the first form field of a configuration screen, becaus (no CVSS) - [CVE-2019-10014](https://cve.now/CVE-2019-10014.md): In DedeCMS 5.7SP2, member/resetpassword.php allows remote authenticated users to reset the passwords of arbitrary users via a modified id pa (no CVSS) - [CVE-2019-10010](https://cve.now/CVE-2019-10010.md): Cross-site scripting (XSS) vulnerability in the PHP League CommonMark library before 0.18.3 allows remote attackers to insert unsafe links i (no CVSS, league/commonmark) - [CVE-2019-9978](https://cve.now/CVE-2019-9978.md): The social-warfare plugin before 3.5.3 for WordPress has stored XSS via the wp-admin/admin-post.php?swp\_debug=load\_options swp\_url parameter (CVSS 6.1, KEV) - [CVE-2019-9977](https://cve.now/CVE-2019-9977.md): The renderer process in the entertainment system on Tesla Model 3 vehicles mishandles JIT compilation, which allows attackers to trigger fir (no CVSS) - [CVE-2019-9970](https://cve.now/CVE-2019-9970.md): Open Whisper Signal (aka Signal-Desktop) through 1.23.1 and the Signal Private Messenger application through 4.35.3 for Android are vulnerab (no CVSS) - [CVE-2019-9969](https://cve.now/CVE-2019-9969.md): XnView Classic 2.48 on Windows allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other i (no CVSS) - [CVE-2019-9968](https://cve.now/CVE-2019-9968.md): XnView Classic 2.48 on Windows allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other i (no CVSS) - [CVE-2019-9967](https://cve.now/CVE-2019-9967.md): XnView Classic 2.48 on Windows allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other i (no CVSS) - [CVE-2019-9966](https://cve.now/CVE-2019-9966.md): XnView Classic 2.48 on Windows allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other i (no CVSS) - [CVE-2019-9965](https://cve.now/CVE-2019-9965.md): XnView MP 0.93.1 on Windows allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impa (no CVSS) - [CVE-2019-9964](https://cve.now/CVE-2019-9964.md): XnView MP 0.93.1 on Windows allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impa (no CVSS) - [CVE-2019-9963](https://cve.now/CVE-2019-9963.md): XnView MP 0.93.1 on Windows allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impa (no CVSS) - [CVE-2019-9962](https://cve.now/CVE-2019-9962.md): XnView MP 0.93.1 on Windows allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impa (no CVSS) - [CVE-2019-9960](https://cve.now/CVE-2019-9960.md): The downloadZip function in application/controllers/admin/export.php in LimeSurvey through 3.16.1+190225 allows a relative path. (no CVSS) --- Source: cve.now, built and run by Sazabi (AI-native observability and security) Page: https://cve.now/daily/2019-03-24 Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.