# CVEs published 2019-03-25

63 CVEs were published on March 25, 2019: 3 critical, 8 high. 2 are now in CISA KEV. Days are UTC.

- [CVE-2019-10060](https://cve.now/CVE-2019-10060.md): The Verix Multi-app Conductor application 2.7 for Verifone Verix suffers from a buffer overflow vulnerability that allows attackers to execu (no CVSS)
- [CVE-2019-0204](https://cve.now/CVE-2019-0204.md): A specifically crafted Docker image running under the root user can overwrite the init helper binary of the container runtime and/or the com (no CVSS, Apache Mesos · org.apache.mesos:mesos)
- [CVE-2019-7642](https://cve.now/CVE-2019-7642.md): D-Link routers with the mydlink feature have some web interfaces without authentication requirements. (no CVSS)
- [CVE-2019-6538](https://cve.now/CVE-2019-6538.md): Medtronic Conexus Radio Frequency Telemetry Protocol Improper Access Control (CVSS 9.3, Medtronic Conexus Radio Frequency Telemetry Protocol ·… +22)
- [CVE-2017-7342](https://cve.now/CVE-2017-7342.md): A weak password recovery process vulnerability in Fortinet FortiPortal versions 4.0.0 and below allows an attacker to execute unauthorized c (no CVSS, Fortinet FortiPortal)
- [CVE-2017-7340](https://cve.now/CVE-2017-7340.md): A Cross-Site Scripting vulnerability in Fortinet FortiPortal versions 4.0.0 and below allows an attacker to execute unauthorized code or com (no CVSS, Fortinet FortiPortal)
- [CVE-2018-15583](https://cve.now/CVE-2018-15583.md): Cross-Site Scripting (XSS) vulnerability in point\_list.php in GNUBOARD5 before 5.3.1.6 allows remote attackers to inject arbitrary web scrip (no CVSS)
- [CVE-2019-10044](https://cve.now/CVE-2019-10044.md): Telegram Desktop before 1.5.12 on Windows, and the Telegram applications for Android, iOS, and Linux, is vulnerable to an IDN homograph atta (no CVSS)
- [CVE-2014-9187](https://cve.now/CVE-2014-9187.md): Multiple heap-based buffer overflow vulnerabilities exist in Honeywell Experion PKS all versions prior to R400.6, all versions prior to R410 (no CVSS, Honeywell Experion PKS)
- [CVE-2014-9189](https://cve.now/CVE-2014-9189.md): Multiple stack-based buffer overflow vulnerabilities were found in Honeywell Experion PKS all versions prior to R400.6, all versions prior t (no CVSS, Honeywell Experion PKS)
- [CVE-2015-1007](https://cve.now/CVE-2015-1007.md): A specially crafted configuration file could be used to cause a stack-based buffer overflow condition in the OPCTest.exe, which may allow re (no CVSS, Opto 22 PAC Project Professional · Opto 22 PAC Project B… +4)
- [CVE-2019-3396](https://cve.now/CVE-2019-3396.md): The Widget Connector macro in Atlassian Confluence Server before version 6.6.12 (the fixed version for 6.6.x), from version 6.7.0 before 6.1 (CVSS 9.8, KEV, Atlassian Confluence Server)
- [CVE-2019-3395](https://cve.now/CVE-2019-3395.md): The WebDAV endpoint in Atlassian Confluence Server and Data Center before version 6.6.7 (the fixed version for 6.6.x), from version 6.7.0 be (no CVSS, Atlassian Confluence Server)
- [CVE-2019-7608](https://cve.now/CVE-2019-7608.md): Kibana versions before 5.6.15 and 6.6.1 had a cross-site scripting (XSS) vulnerability that could allow an attacker to obtain sensitive info (no CVSS, Elastic Kibana)
- [CVE-2019-7610](https://cve.now/CVE-2019-7610.md): Kibana versions before 6.6.1 contain an arbitrary code execution flaw in the security audit logger. (no CVSS, Elastic Kibana)
- [CVE-2019-7611](https://cve.now/CVE-2019-7611.md): A permission issue was found in Elasticsearch versions before 5.6.15 and 6.6.1 when Field Level Security and Document Level Security are dis (no CVSS, Elasticsearch · org.elasticsearch:elasticsearch)
- [CVE-2019-7612](https://cve.now/CVE-2019-7612.md): A sensitive data disclosure flaw was found in the way Logstash versions before 5.6.15 and 6.6.1 logs malformed URLs. (no CVSS, Elastic Logstash)
- [CVE-2019-7613](https://cve.now/CVE-2019-7613.md): Winlogbeat versions before 5.6.16 and 6.6.2 had an insufficient logging flaw. (no CVSS, Elastic Logstash)
- [CVE-2019-3856](https://cve.now/CVE-2019-3856.md): An integer overflow flaw, which could lead to an out of bounds write, was discovered in libssh2 before 1.8.1 in the way keyboard prompt requ (CVSS 7.5, The libssh2 Project libssh2)
- [CVE-2019-3857](https://cve.now/CVE-2019-3857.md): An integer overflow flaw which could lead to an out of bounds write was discovered in libssh2 before 1.8.1 in the way SSH\_MSG\_CHANNEL\_REQUES (CVSS 7.5, The libssh2 Project libssh2)
- [CVE-2019-3860](https://cve.now/CVE-2019-3860.md): An out of bounds read flaw was discovered in libssh2 before 1.8.1 in the way SFTP packets with empty payloads are parsed. (CVSS 5.0, The libssh2 Project libssh2)
- [CVE-2019-3861](https://cve.now/CVE-2019-3861.md): An out of bounds read flaw was discovered in libssh2 before 1.8.1 in the way SSH packets with a padding length value greater than the packet (CVSS 5.0, The libssh2 Project libssh2)
- [CVE-2019-3874](https://cve.now/CVE-2019-3874.md): The SCTP socket buffer used by a userspace application is not accounted by the cgroups subsystem. (CVSS 5.3, The Linux Foundation kernel)
- [CVE-2019-3835](https://cve.now/CVE-2019-3835.md): It was found that the superexec operator was available in the internal dictionary in ghostscript before 9.27. (CVSS 7.3, The ghostscript Project ghostscript)
- [CVE-2019-3838](https://cve.now/CVE-2019-3838.md): It was found that the forceput operator could be extracted from the DefineResource method in ghostscript before 9.27. (CVSS 7.3, The ghostscript Project ghostscript)
- [CVE-2019-3879](https://cve.now/CVE-2019-3879.md): It was discovered that in the ovirt's REST API before version 4.3.2.1, RemoveDiskCommand is triggered as an internal command, meaning the pe (CVSS 6.5, ovirt-engine)
- [CVE-2018-12653](https://cve.now/CVE-2018-12653.md): A Reflected Cross Site Scripting (XSS) vulnerability exists in Adrenalin HRMS 5.4.0. (no CVSS)
- [CVE-2018-12652](https://cve.now/CVE-2018-12652.md): A Reflected Cross Site Scripting (XSS) Vulnerability was discovered in Adrenalin 5.4 HRMS Software. (no CVSS)
- [CVE-2015-1012](https://cve.now/CVE-2015-1012.md): Wireless keys are stored in plain text on version 5 of the Hospira LifeCare PCA Infusion System. (no CVSS, Hospira LifeCare PCA Infusion System)
- [CVE-2019-4046](https://cve.now/CVE-2019-4046.md): IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 is vulnerable to a denial of service, caused by improper handling of request headers (CVSS 5.9, IBM WebSphere Application Server)
- [CVE-2015-1014](https://cve.now/CVE-2015-1014.md): A successful exploit of these vulnerabilities requires the local user to load a crafted DLL file in the system directory on servers running (no CVSS, Schneider Electric OFS)
- [CVE-2019-10012](https://cve.now/CVE-2019-10012.md): Jenzabar JICS (aka Internet Campus Solution) before 9 allows remote attackers to upload and execute arbitrary .aspx code by placing it in a (no CVSS)
- [CVE-2019-10011](https://cve.now/CVE-2019-10011.md): ICS/StaticPages/AddTestUsers.aspx in Jenzabar JICS (aka Internet Campus Solution) before 2019-02-06 allows remote attackers to create an arb (no CVSS)
- [CVE-2019-10042](https://cve.now/CVE-2019-10042.md): The D-Link DIR-816 A2 1.11 router only checks the random token when authorizing a goform request. (no CVSS)
- [CVE-2019-10041](https://cve.now/CVE-2019-10041.md): The D-Link DIR-816 A2 1.11 router only checks the random token when authorizing a goform request. (no CVSS)
- [CVE-2019-10040](https://cve.now/CVE-2019-10040.md): The D-Link DIR-816 A2 1.11 router only checks the random token when authorizing a goform request. (no CVSS)
- [CVE-2019-10039](https://cve.now/CVE-2019-10039.md): The D-Link DIR-816 A2 1.11 router only checks the random token when authorizing a goform request. (no CVSS)
- [CVE-2019-3863](https://cve.now/CVE-2019-3863.md): A flaw was found in libssh2 before 1.8.1 creating a vulnerability on the SSH client side. (CVSS 7.5, The libssh2 Project libssh2)
- [CVE-2017-7510](https://cve.now/CVE-2017-7510.md): In ovirt-engine 4.1, if a host was provisioned with cloud-init, the root password could be revealed through the REST interface. (no CVSS, \[UNKNOWN\] RHV)
- [CVE-2019-3827](https://cve.now/CVE-2019-3827.md): An incorrect permission check in the admin backend in gvfs before version 1.39.4 was found that allows reading and modify arbitrary files by (CVSS 7.0, \[UNKNOWN\] gvfs)
- [CVE-2015-3956](https://cve.now/CVE-2015-3956.md): Hospira Plum A+ Infusion System version 13.4 and prior, Plum A+3 Infusion System version 13.6 and prior, and Symbiq Infusion System, version (no CVSS, Hospira Plum A+ Infusion System · Hospira Plum A+3 Infus… +1)
- [CVE-2018-16858](https://cve.now/CVE-2018-16858.md): It was found that libreoffice before versions 6.0.7 and 6.1.3 was vulnerable to a directory traversal attack which could be used to execute (CVSS 7.8, \[UNKNOWN\] libreoffice)
- [CVE-2018-16838](https://cve.now/CVE-2018-16838.md): A flaw was found in sssd Group Policy Objects implementation. (CVSS 5.4, \[UNKNOWN\] sssd)
- [CVE-2019-3809](https://cve.now/CVE-2019-3809.md): A flaw was found in Moodle versions 3.1 to 3.1.15 and earlier unsupported versions. (CVSS 6.5, \[UNKNOWN\] moodle · moodle/moodle)
- [CVE-2019-3808](https://cve.now/CVE-2019-3808.md): A flaw was found in Moodle versions 3.6 to 3.6.1, 3.5 to 3.5.3, 3.4 to 3.4.6, 3.1 to 3.1.15 and earlier unsupported versions. (CVSS 4.3, \[UNKNOWN\] moodle · moodle/moodle)
- [CVE-2019-3831](https://cve.now/CVE-2019-3831.md): A vulnerability was discovered in vdsm, version 4.19 through 4.30.3 and 4.30.5 through 4.30.8. (CVSS 6.4, \[UNKNOWN\] vdsm)
- [CVE-2019-3841](https://cve.now/CVE-2019-3841.md): Kubevirt/virt-cdi-importer, versions 1.4.0 to 1.5.3 inclusive, were reported to disable TLS certificate validation when importing data into (CVSS 7.4, The Kubevirt project kubevirt/virt-cdi-importer)
- [CVE-2019-6240](https://cve.now/CVE-2019-6240.md): An issue was discovered in GitLab Community and Enterprise Edition before 11.4. (no CVSS)
- [CVE-2015-3954](https://cve.now/CVE-2015-3954.md): Hospira Plum A+ Infusion System version 13.4 and prior, Plum A+3 Infusion System version 13.6 and prior, and Symbiq Infusion System, version (no CVSS, Hospira Plum A+ Infusion System · Hospira Plum A+3 Infus… +1)
- [CVE-2019-3476](https://cve.now/CVE-2019-3476.md): Remote arbitrary code execution in Micro Focus Data Protector, version 10.03 this vulnerability could allow remote arbitrary code execution. (no CVSS, Micro Focus Data Protector)
- [CVE-2019-3484](https://cve.now/CVE-2019-3484.md): Mitigates a remote code execution issue in ArcSight Logger versions prior to 6.7. (no CVSS, ArcSight Logger)
- [CVE-2019-3483](https://cve.now/CVE-2019-3483.md): Mitigates a potential information leakage issue in ArcSight Logger versions prior to 6.7. (no CVSS, ArcSight Logger)
- [CVE-2019-3482](https://cve.now/CVE-2019-3482.md): Mitigates a directory traversal issue in ArcSight Logger versions prior to 6.7. (no CVSS, ArcSight Logger)
- [CVE-2019-3481](https://cve.now/CVE-2019-3481.md): Mitigates a XML External Entity Parsing issue in ArcSight Logger versions prior to 6.7. (no CVSS, ArcSight Logger)
- [CVE-2019-3480](https://cve.now/CVE-2019-3480.md): Mitigates a stored/reflected XSS issue in ArcSight Logger versions prior to 6.7. (no CVSS, ArcSight Logger)
- [CVE-2015-3953](https://cve.now/CVE-2015-3953.md): Hard-coded accounts may be used to access Hospira Plum A+ Infusion System version 13.4 and prior, Plum A+3 Infusion System version 13.6 and (no CVSS, Hospira Plum A+ Infusion System · Hospira Plum A+3 Infus… +1)
- [CVE-2019-3479](https://cve.now/CVE-2019-3479.md): Mitigates a potential remote code execution issue in ArcSight Logger versions prior to 6.7. (no CVSS, ArcSight Logger)
- [CVE-2017-9362](https://cve.now/CVE-2017-9362.md): ManageEngine ServiceDesk Plus before 9312 contains an XML injection at add Configuration items CMDB API. (no CVSS)
- [CVE-2017-9376](https://cve.now/CVE-2017-9376.md): ManageEngine ServiceDesk Plus before 9314 contains a local file inclusion vulnerability in the defModule parameter in DefaultConfigDef.do an (no CVSS)
- [CVE-2015-3952](https://cve.now/CVE-2015-3952.md): Wireless keys are stored in plain text on Hospira Plum A+ Infusion System version 13.4 and prior, Plum A+3 Infusion System version 13.6 and (no CVSS, Hospira Plum A+ Infusion System · Hospira Plum A+3 Infus… +1)
- [CVE-2019-10016](https://cve.now/CVE-2019-10016.md): GForge Advanced Server 6.4.4 allows XSS via the commonsearch.php words parameter, as demonstrated by a snippet/search/?words= substring. (no CVSS)
- [CVE-2019-3810](https://cve.now/CVE-2019-3810.md): A flaw was found in moodle versions 3.6 to 3.6.1, 3.5 to 3.5.3, 3.4 to 3.4.6, 3.1 to 3.1.15 and earlier unsupported versions. (CVSS 4.3, \[UNKNOWN\] moodle · moodle/moodle)
- [CVE-2019-7609](https://cve.now/CVE-2019-7609.md): Kibana versions before 5.6.15 and 6.6.1 contain an arbitrary code execution flaw in the Timelion visualizer. (CVSS 9.8, KEV, Elastic Kibana)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2019-03-25
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.