CVEs published March 25, 2019
63 CVEs were published on March 25, 2019: 3 critical, 8 high. 2 are now in CISA KEV.
- Published
- 63
- Critical
- 3
- High
- 8
- Medium
- 10
- Low
- 0
- Unrated
- 42
- Now in CISA KEV
- 2
- Fix available
- 8
Most affected products
- ArcSight Logger
- 6
- The libssh2 Project libssh2
- 5
- Hospira Plum A+ Infusion System · Hospira Plum A+3 Infus… +1
- 4
- [UNKNOWN] moodle · moodle/moodle
- 3
- Elastic Kibana
- 3
- Atlassian Confluence Server
- 2
- Elastic Logstash
- 2
- Fortinet FortiPortal
- 2
- Honeywell Experion PKS
- 2
- The ghostscript Project ghostscript
- 2
Critical 3
- CVE-2019-6538Medtronic Conexus Radio Frequency Telemetry Protocol Improper Access ControlMedtronic Conexus Radio Frequency Telemetry Protocol ·… +22
- CVE-2019-3396The Widget Connector macro in Atlassian Confluence Server before version 6.6.12 (the fixed version for 6.6.x), from version 6.7.0 before 6.1Atlassian Confluence Server
- CVE-2019-7609Kibana versions before 5.6.15 and 6.6.1 contain an arbitrary code execution flaw in the Timelion visualizer.Elastic Kibana
High 8
- CVE-2019-3856An integer overflow flaw, which could lead to an out of bounds write, was discovered in libssh2 before 1.8.1 in the way keyboard prompt requThe libssh2 Project libssh2
- CVE-2019-3857An integer overflow flaw which could lead to an out of bounds write was discovered in libssh2 before 1.8.1 in the way SSH_MSG_CHANNEL_REQUESThe libssh2 Project libssh2
- CVE-2019-3835It was found that the superexec operator was available in the internal dictionary in ghostscript before 9.27.The ghostscript Project ghostscript
- CVE-2019-3838It was found that the forceput operator could be extracted from the DefineResource method in ghostscript before 9.27.The ghostscript Project ghostscript
- CVE-2019-3863A flaw was found in libssh2 before 1.8.1 creating a vulnerability on the SSH client side.The libssh2 Project libssh2
- CVE-2019-3827An incorrect permission check in the admin backend in gvfs before version 1.39.4 was found that allows reading and modify arbitrary files by[UNKNOWN] gvfs
- CVE-2018-16858It was found that libreoffice before versions 6.0.7 and 6.1.3 was vulnerable to a directory traversal attack which could be used to execute [UNKNOWN] libreoffice
- CVE-2019-3841Kubevirt/virt-cdi-importer, versions 1.4.0 to 1.5.3 inclusive, were reported to disable TLS certificate validation when importing data into The Kubevirt project kubevirt/virt-cdi-importer
Medium, low and unrated 52
- CVE-2019-10060The Verix Multi-app Conductor application 2.7 for Verifone Verix suffers from a buffer overflow vulnerability that allows attackers to execu
- CVE-2019-0204A specifically crafted Docker image running under the root user can overwrite the init helper binary of the container runtime and/or the comApache Mesos · org.apache.mesos:mesos
- CVE-2019-7642D-Link routers with the mydlink feature have some web interfaces without authentication requirements.
- CVE-2017-7342A weak password recovery process vulnerability in Fortinet FortiPortal versions 4.0.0 and below allows an attacker to execute unauthorized cFortinet FortiPortal
- CVE-2017-7340A Cross-Site Scripting vulnerability in Fortinet FortiPortal versions 4.0.0 and below allows an attacker to execute unauthorized code or comFortinet FortiPortal
- CVE-2018-15583Cross-Site Scripting (XSS) vulnerability in point_list.php in GNUBOARD5 before 5.3.1.6 allows remote attackers to inject arbitrary web scrip
- CVE-2019-10044Telegram Desktop before 1.5.12 on Windows, and the Telegram applications for Android, iOS, and Linux, is vulnerable to an IDN homograph atta
- CVE-2014-9187Multiple heap-based buffer overflow vulnerabilities exist in Honeywell Experion PKS all versions prior to R400.6, all versions prior to R410Honeywell Experion PKS
- CVE-2014-9189Multiple stack-based buffer overflow vulnerabilities were found in Honeywell Experion PKS all versions prior to R400.6, all versions prior tHoneywell Experion PKS
- CVE-2015-1007A specially crafted configuration file could be used to cause a stack-based buffer overflow condition in the OPCTest.exe, which may allow reOpto 22 PAC Project Professional · Opto 22 PAC Project B… +4
- CVE-2019-3395The WebDAV endpoint in Atlassian Confluence Server and Data Center before version 6.6.7 (the fixed version for 6.6.x), from version 6.7.0 beAtlassian Confluence Server
- CVE-2019-7608Kibana versions before 5.6.15 and 6.6.1 had a cross-site scripting (XSS) vulnerability that could allow an attacker to obtain sensitive infoElastic Kibana
- CVE-2019-7610Kibana versions before 6.6.1 contain an arbitrary code execution flaw in the security audit logger.Elastic Kibana
- CVE-2019-7611A permission issue was found in Elasticsearch versions before 5.6.15 and 6.6.1 when Field Level Security and Document Level Security are disElasticsearch · org.elasticsearch:elasticsearch
- CVE-2019-7612A sensitive data disclosure flaw was found in the way Logstash versions before 5.6.15 and 6.6.1 logs malformed URLs.Elastic Logstash
- CVE-2019-7613Winlogbeat versions before 5.6.16 and 6.6.2 had an insufficient logging flaw.Elastic Logstash
- CVE-2019-3860An out of bounds read flaw was discovered in libssh2 before 1.8.1 in the way SFTP packets with empty payloads are parsed.The libssh2 Project libssh2
- CVE-2019-3861An out of bounds read flaw was discovered in libssh2 before 1.8.1 in the way SSH packets with a padding length value greater than the packetThe libssh2 Project libssh2
- CVE-2019-3874The SCTP socket buffer used by a userspace application is not accounted by the cgroups subsystem.The Linux Foundation kernel
- CVE-2019-3879It was discovered that in the ovirt's REST API before version 4.3.2.1, RemoveDiskCommand is triggered as an internal command, meaning the peovirt-engine
- CVE-2018-12653A Reflected Cross Site Scripting (XSS) vulnerability exists in Adrenalin HRMS 5.4.0.
- CVE-2018-12652A Reflected Cross Site Scripting (XSS) Vulnerability was discovered in Adrenalin 5.4 HRMS Software.
- CVE-2015-1012Wireless keys are stored in plain text on version 5 of the Hospira LifeCare PCA Infusion System.Hospira LifeCare PCA Infusion System
- CVE-2019-4046IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 is vulnerable to a denial of service, caused by improper handling of request headersIBM WebSphere Application Server
- CVE-2015-1014A successful exploit of these vulnerabilities requires the local user to load a crafted DLL file in the system directory on servers running Schneider Electric OFS
- CVE-2019-10012Jenzabar JICS (aka Internet Campus Solution) before 9 allows remote attackers to upload and execute arbitrary .aspx code by placing it in a
- CVE-2019-10011ICS/StaticPages/AddTestUsers.aspx in Jenzabar JICS (aka Internet Campus Solution) before 2019-02-06 allows remote attackers to create an arb
- CVE-2019-10042The D-Link DIR-816 A2 1.11 router only checks the random token when authorizing a goform request.
- CVE-2019-10041The D-Link DIR-816 A2 1.11 router only checks the random token when authorizing a goform request.
- CVE-2019-10040The D-Link DIR-816 A2 1.11 router only checks the random token when authorizing a goform request.
- CVE-2019-10039The D-Link DIR-816 A2 1.11 router only checks the random token when authorizing a goform request.
- CVE-2017-7510In ovirt-engine 4.1, if a host was provisioned with cloud-init, the root password could be revealed through the REST interface.[UNKNOWN] RHV
- CVE-2015-3956Hospira Plum A+ Infusion System version 13.4 and prior, Plum A+3 Infusion System version 13.6 and prior, and Symbiq Infusion System, versionHospira Plum A+ Infusion System · Hospira Plum A+3 Infus… +1
- CVE-2018-16838A flaw was found in sssd Group Policy Objects implementation.[UNKNOWN] sssd
- CVE-2019-3809A flaw was found in Moodle versions 3.1 to 3.1.15 and earlier unsupported versions.[UNKNOWN] moodle · moodle/moodle
- CVE-2019-3808A flaw was found in Moodle versions 3.6 to 3.6.1, 3.5 to 3.5.3, 3.4 to 3.4.6, 3.1 to 3.1.15 and earlier unsupported versions.[UNKNOWN] moodle · moodle/moodle
- CVE-2019-3831A vulnerability was discovered in vdsm, version 4.19 through 4.30.3 and 4.30.5 through 4.30.8.[UNKNOWN] vdsm
- CVE-2019-6240An issue was discovered in GitLab Community and Enterprise Edition before 11.4.
- CVE-2015-3954Hospira Plum A+ Infusion System version 13.4 and prior, Plum A+3 Infusion System version 13.6 and prior, and Symbiq Infusion System, versionHospira Plum A+ Infusion System · Hospira Plum A+3 Infus… +1
- CVE-2019-3476Remote arbitrary code execution in Micro Focus Data Protector, version 10.03 this vulnerability could allow remote arbitrary code execution.Micro Focus Data Protector
- CVE-2019-3484Mitigates a remote code execution issue in ArcSight Logger versions prior to 6.7.ArcSight Logger
- CVE-2019-3483Mitigates a potential information leakage issue in ArcSight Logger versions prior to 6.7.ArcSight Logger
- CVE-2019-3482Mitigates a directory traversal issue in ArcSight Logger versions prior to 6.7.ArcSight Logger
- CVE-2019-3481Mitigates a XML External Entity Parsing issue in ArcSight Logger versions prior to 6.7.ArcSight Logger
- CVE-2019-3480Mitigates a stored/reflected XSS issue in ArcSight Logger versions prior to 6.7.ArcSight Logger
- CVE-2015-3953Hard-coded accounts may be used to access Hospira Plum A+ Infusion System version 13.4 and prior, Plum A+3 Infusion System version 13.6 and Hospira Plum A+ Infusion System · Hospira Plum A+3 Infus… +1
- CVE-2019-3479Mitigates a potential remote code execution issue in ArcSight Logger versions prior to 6.7.ArcSight Logger
- CVE-2017-9362ManageEngine ServiceDesk Plus before 9312 contains an XML injection at add Configuration items CMDB API.
- CVE-2017-9376ManageEngine ServiceDesk Plus before 9314 contains a local file inclusion vulnerability in the defModule parameter in DefaultConfigDef.do an
- CVE-2015-3952Wireless keys are stored in plain text on Hospira Plum A+ Infusion System version 13.4 and prior, Plum A+3 Infusion System version 13.6 and Hospira Plum A+ Infusion System · Hospira Plum A+3 Infus… +1
- CVE-2019-10016GForge Advanced Server 6.4.4 allows XSS via the commonsearch.php words parameter, as demonstrated by a snippet/search/?words= substring.
- CVE-2019-3810A flaw was found in moodle versions 3.6 to 3.6.1, 3.5 to 3.5.3, 3.4 to 3.4.6, 3.1 to 3.1.15 and earlier unsupported versions.[UNKNOWN] moodle · moodle/moodle