CVEs published March 26, 2019
60 CVEs were published on March 26, 2019: 1 critical, 4 high. 1 is now in CISA KEV.
- Published
- 60
- Critical
- 1
- High
- 4
- Medium
- 12
- Low
- 0
- Unrated
- 43
- Now in CISA KEV
- 1
- Fix available
- 12
Most affected products
- [UNKNOWN] moodle · moodle/moodle
- 5
- Baxter SIGMA Spectrum Infusion System
- 4
- Palo Alto Networks Expedition Migration Tool
- 3
- Rockwell Automation RSLinx Enterprise Software
- 3
- TIBCO Software TIBCO Data Science for AWS · TIBCO Software…
- 3
- McAfee Network Security Manager
- 2
- [UNKNOWN] cockpit
- 1
- [UNKNOWN] openstack-ceilometer · ceilometer
- 1
- [UNKNOWN] openstack-octavia · octavia
- 1
- [UNKNOWN] prometheus
- 1
Critical 1
High 4
- CVE-2019-8987TIBCO Spotfire Data Science Vulnerable to Persistent Cross-Site ScriptingTIBCO Software TIBCO Data Science for AWS · TIBCO Software…
- CVE-2019-3878A vulnerability was found in mod_auth_mellon before v0.14.2.uninett mod_auth_mellon
- CVE-2019-3606Data leakage when in an MDR pair by McAfee Network Security Manager 9.xMcAfee Network Security Manager
- CVE-2019-3804It was found that cockpit before version 184 used glib's base64 decode functionality incorrectly resulting in a denial of service attack.[UNKNOWN] cockpit
Medium, low and unrated 55
- CVE-2019-1571The Expedition Migration tool 1.1.8 and earlier may allow an authenticated attacker to run arbitrary JavaScript or HTML in the RADIUS serverPalo Alto Networks Expedition Migration Tool
- CVE-2019-10107CMS Made Simple 2.2.10 has XSS via the myaccount.php "Email Address" field, which is reachable via the "My Preferences -> My Account" sectio
- CVE-2019-10106CMS Made Simple 2.2.10 has XSS via the 'moduleinterface.php' Name field, which is reachable via an "Add Category" action to the "Site Admin
- CVE-2019-10105CMS Made Simple 2.2.10 has a Self-XSS vulnerability via the Layout Design Manager "Name" field, which is reachable via a "Create a new Templ
- CVE-2019-1572PAN-OS 9.0.0 may allow an unauthenticated remote user to access php files.Palo Alto Networks PAN-OS
- CVE-2019-1570The Expedition Migration tool 1.1.8 and earlier may allow an authenticated attacker to run arbitrary JavaScript or HTML in the LDAP server sPalo Alto Networks Expedition Migration Tool
- CVE-2019-1569The Expedition Migration tool 1.1.8 and earlier may allow an authenticated attacker to run arbitrary JavaScript or HTML in the User Mapping Palo Alto Networks Expedition Migration Tool
- CVE-2019-6569The monitor barrier of the affected products insufficiently blocks data from being forwarded over the mirror port into the mirrored network.Siemens SCALANCE X204-2 · Siemens SCALANCE X204-2FM +63
- CVE-2019-9743An issue was discovered on PHOENIX CONTACT RAD-80211-XD and RAD-80211-XD/HP-BUS devices.
- CVE-2019-9744An issue was discovered on PHOENIX CONTACT FL NAT SMCS 8TX, FL NAT SMN 8TX, FL NAT SMN 8TX-M, and FL NAT SMN 8TX-M-DMG devices.
- CVE-2018-15817FastStone Image Viewer 6.5 has a Read Access Violation on Block Data Move starting at image00400000+0x0000000000002d63 via a crafted image f
- CVE-2018-15816FastStone Image Viewer 6.5 has a Read Access Violation on Block Data Move starting at image00400000+0x0000000000002d7d via a crafted image f
- CVE-2018-15815FastStone Image Viewer 6.5 has an Exception Handler Chain Corrupted issue starting at image00400000+0x00000000003ef68a via a crafted image f
- CVE-2018-15814FastStone Image Viewer 6.5 has a User Mode Write AV starting at image00400000+0x00000000001cb509 via a crafted image file.
- CVE-2018-15813FastStone Image Viewer 6.5 has a User Mode Write AV starting at image00400000+0x00000000000e1237 via a crafted image file.
- CVE-2019-9961A cross-site scripting (XSS) vulnerability in ressource view in core/modules/resource/RESOURCEVIEW.php in Wikindx prior to version 5.7.0 all
- CVE-2019-6341Drupal core - Moderately critical - Cross Site Scripting - SA-CORE-2019-004Drupal core · drupal/core +1
- CVE-2019-3830A vulnerability was found in ceilometer before version 12.0.0.0rc1.[UNKNOWN] openstack-ceilometer · ceilometer
- CVE-2019-8989TIBCO Spotfire Data Science Spoofing VulnerabilityTIBCO Software TIBCO Data Science for AWS · TIBCO Software…
- CVE-2019-8988TIBCO Spotfire Data Science Privilege Escalation VulnerabilityTIBCO Software TIBCO Data Science for AWS · TIBCO Software…
- CVE-2019-3826A stored, DOM based, cross-site scripting (XSS) flaw was found in Prometheus before version 2.7.1.[UNKNOWN] prometheus
- CVE-2019-6540Medtronic Conexus Radio Frequency Telemetry Protocol Cleartext Transmission of Sensitive InformationMedtronic Conexus Radio Frequency Telemetry Protocol ·… +22
- CVE-2019-3852A vulnerability was found in moodle before version 3.6.3.[UNKNOWN] moodle · moodle/moodle
- CVE-2019-3851A vulnerability was found in moodle before versions 3.6.3 and 3.5.5.[UNKNOWN] moodle · moodle/moodle
- CVE-2019-3850A vulnerability was found in moodle before versions 3.6.3, 3.5.5, 3.4.8 and 3.1.17.[UNKNOWN] moodle · moodle/moodle
- CVE-2019-3849A vulnerability was found in moodle before versions 3.6.3, 3.5.5 and 3.4.8.[UNKNOWN] moodle · moodle/moodle
- CVE-2018-16856In a default Red Hat Openstack Platform Director installation, openstack-octavia before versions openstack-octavia 2.0.2-5 and openstack-oct[UNKNOWN] openstack-octavia · octavia
- CVE-2010-5305Rockwell PLC5/SLC5/0x/RSLogix Credentials managementRockwell Automation PLC5 · Rockwell Automation SLC5/0x +1
- CVE-2019-3597Authentication bypass in McAfee Network Security Manager 9.xMcAfee Network Security Manager
- CVE-2013-2805Rockwell Automation RSLinx Enterprise Software (LogReceiver.exe) CPR9, CPR9-SR1, CPR9-SR2, CPR9-SR3, CPR9-SR4, CPR9-SR5, CPR9-SR5.1, and CPRRockwell Automation RSLinx Enterprise Software
- CVE-2019-9061An issue was discovered in CMS Made Simple 2.2.8.
- CVE-2013-2806Rockwell Automation RSLinx Enterprise Software (LogReceiver.exe) CPR9, CPR9-SR1, CPR9-SR2, CPR9-SR3, CPR9-SR4, CPR9-SR5, CPR9-SR5.1, and CPRRockwell Automation RSLinx Enterprise Software
- CVE-2019-9059An issue was discovered in CMS Made Simple 2.2.8.
- CVE-2019-9058An issue was discovered in CMS Made Simple 2.2.8.
- CVE-2013-2807Rockwell Automation RSLinx Enterprise Software (LogReceiver.exe) CPR9, CPR9-SR1, CPR9-SR2, CPR9-SR3, CPR9-SR4, CPR9-SR5, CPR9-SR5.1, and CPRRockwell Automation RSLinx Enterprise Software
- CVE-2019-9057An issue was discovered in CMS Made Simple 2.2.8.
- CVE-2019-9055An issue was discovered in CMS Made Simple 2.2.8.
- CVE-2014-5401Hospira MedNet Code InjectionHospira MedNet
- CVE-2019-9053An issue was discovered in CMS Made Simple 2.2.8.
- CVE-2018-19856GitLab CE/EE before 11.3.12, 11.4.x before 11.4.10, and 11.5.x before 11.5.3 allows Directory Traversal in Templates API.
- CVE-2014-5431Baxter SIGMA Spectrum Infusion System version 6.05 (model 35700BAX) with wireless battery module (WBM) version 16 contains a hard-coded passBaxter SIGMA Spectrum Infusion System
- CVE-2014-5432Baxter SIGMA Spectrum Infusion System version 6.05 (model 35700BAX) with wireless battery module (WBM) version 16 is remotely accessible viaBaxter SIGMA Spectrum Infusion System
- CVE-2014-5433An unauthenticated remote attacker may be able to execute commands to view wireless account credentials that are stored in cleartext on BaxtBaxter SIGMA Spectrum Infusion System
- CVE-2019-7646CentOS-WebPanel.com (aka CWP) CentOS Web Panel through 0.9.8.763 is vulnerable to Stored/Persistent XSS for the "Package Name" field via the
- CVE-2014-5434Baxter SIGMA Spectrum Infusion System version 6.05 (model 35700BAX) with wireless battery module (WBM) version 16 has a default account withBaxter SIGMA Spectrum Infusion System
- CVE-2019-10063Flatpak before 1.0.8, 1.1.x and 1.2.x before 1.2.4, and 1.3.x before 1.3.1 allows a sandbox bypass.
- CVE-2019-9764HashiCorp Consul 1.4.3 lacks server hostname verification for agent-to-agent TLS communication.github.com/hashicorp/consul
- CVE-2019-8981tls1.c in Cameron Hamilton-Rich axTLS before 2.1.5 has a Buffer Overflow via a crafted sequence of TLS packets because the need_bytes value
- CVE-2019-7715An issue was discovered in the Interpeak IPCOMShell TELNET server on Green Hills INTEGRITY RTOS 5.0.4.
- CVE-2019-7714An issue was discovered in Interpeak IPWEBS on Green Hills INTEGRITY RTOS 5.0.4.
- CVE-2019-7713An issue was discovered in the Interpeak IPCOMShell TELNET server on Green Hills INTEGRITY RTOS 5.0.4.
- CVE-2019-7712An issue was discovered in handler_ipcom_shell_pwd in the Interpeak IPCOMShell TELNET server on Green Hills INTEGRITY RTOS 5.0.4.
- CVE-2019-7711An issue was discovered in the Interpeak IPCOMShell TELNET server on Green Hills INTEGRITY RTOS 5.0.4.
- CVE-2019-10061utils/find-opencv.js in node-opencv (aka OpenCV bindings for Node.js) prior to 6.1.0 is vulnerable to Command Injection.opencv
- CVE-2019-3848A vulnerability was found in moodle before versions 3.6.3, 3.5.5 and 3.4.8.[UNKNOWN] moodle · moodle/moodle