# CVEs published 2019-03-26

60 CVEs were published on March 26, 2019: 1 critical, 4 high. 1 is now in CISA KEV. Days are UTC.

- [CVE-2019-1571](https://cve.now/CVE-2019-1571.md): The Expedition Migration tool 1.1.8 and earlier may allow an authenticated attacker to run arbitrary JavaScript or HTML in the RADIUS server (no CVSS, Palo Alto Networks Expedition Migration Tool)
- [CVE-2019-10107](https://cve.now/CVE-2019-10107.md): CMS Made Simple 2.2.10 has XSS via the myaccount.php "Email Address" field, which is reachable via the "My Preferences -\> My Account" sectio (no CVSS)
- [CVE-2019-10106](https://cve.now/CVE-2019-10106.md): CMS Made Simple 2.2.10 has XSS via the 'moduleinterface.php' Name field, which is reachable via an "Add Category" action to the "Site Admin (no CVSS)
- [CVE-2019-10105](https://cve.now/CVE-2019-10105.md): CMS Made Simple 2.2.10 has a Self-XSS vulnerability via the Layout Design Manager "Name" field, which is reachable via a "Create a new Templ (no CVSS)
- [CVE-2019-1572](https://cve.now/CVE-2019-1572.md): PAN-OS 9.0.0 may allow an unauthenticated remote user to access php files. (no CVSS, Palo Alto Networks PAN-OS)
- [CVE-2019-1570](https://cve.now/CVE-2019-1570.md): The Expedition Migration tool 1.1.8 and earlier may allow an authenticated attacker to run arbitrary JavaScript or HTML in the LDAP server s (no CVSS, Palo Alto Networks Expedition Migration Tool)
- [CVE-2019-1569](https://cve.now/CVE-2019-1569.md): The Expedition Migration tool 1.1.8 and earlier may allow an authenticated attacker to run arbitrary JavaScript or HTML in the User Mapping (no CVSS, Palo Alto Networks Expedition Migration Tool)
- [CVE-2019-6569](https://cve.now/CVE-2019-6569.md): The monitor barrier of the affected products insufficiently blocks data from being forwarded over the mirror port into the mirrored network. (no CVSS, Siemens SCALANCE X204-2 · Siemens SCALANCE X204-2FM +63)
- [CVE-2019-9743](https://cve.now/CVE-2019-9743.md): An issue was discovered on PHOENIX CONTACT RAD-80211-XD and RAD-80211-XD/HP-BUS devices. (no CVSS)
- [CVE-2019-9744](https://cve.now/CVE-2019-9744.md): An issue was discovered on PHOENIX CONTACT FL NAT SMCS 8TX, FL NAT SMN 8TX, FL NAT SMN 8TX-M, and FL NAT SMN 8TX-M-DMG devices. (no CVSS)
- [CVE-2018-15817](https://cve.now/CVE-2018-15817.md): FastStone Image Viewer 6.5 has a Read Access Violation on Block Data Move starting at image00400000+0x0000000000002d63 via a crafted image f (no CVSS)
- [CVE-2018-15816](https://cve.now/CVE-2018-15816.md): FastStone Image Viewer 6.5 has a Read Access Violation on Block Data Move starting at image00400000+0x0000000000002d7d via a crafted image f (no CVSS)
- [CVE-2018-15815](https://cve.now/CVE-2018-15815.md): FastStone Image Viewer 6.5 has an Exception Handler Chain Corrupted issue starting at image00400000+0x00000000003ef68a via a crafted image f (no CVSS)
- [CVE-2018-15814](https://cve.now/CVE-2018-15814.md): FastStone Image Viewer 6.5 has a User Mode Write AV starting at image00400000+0x00000000001cb509 via a crafted image file. (no CVSS)
- [CVE-2018-15813](https://cve.now/CVE-2018-15813.md): FastStone Image Viewer 6.5 has a User Mode Write AV starting at image00400000+0x00000000000e1237 via a crafted image file. (no CVSS)
- [CVE-2019-9961](https://cve.now/CVE-2019-9961.md): A cross-site scripting (XSS) vulnerability in ressource view in core/modules/resource/RESOURCEVIEW.php in Wikindx prior to version 5.7.0 all (no CVSS)
- [CVE-2019-6341](https://cve.now/CVE-2019-6341.md): Drupal core - Moderately critical - Cross Site Scripting - SA-CORE-2019-004 (no CVSS, Drupal core · drupal/core +1)
- [CVE-2019-3830](https://cve.now/CVE-2019-3830.md): A vulnerability was found in ceilometer before version 12.0.0.0rc1. (CVSS 4.0, \[UNKNOWN\] openstack-ceilometer · ceilometer)
- [CVE-2019-8989](https://cve.now/CVE-2019-8989.md): TIBCO Spotfire Data Science Spoofing Vulnerability (CVSS 5.0, TIBCO Software TIBCO Data Science for AWS · TIBCO Software…)
- [CVE-2019-8988](https://cve.now/CVE-2019-8988.md): TIBCO Spotfire Data Science Privilege Escalation Vulnerability (CVSS 6.5, TIBCO Software TIBCO Data Science for AWS · TIBCO Software…)
- [CVE-2019-8987](https://cve.now/CVE-2019-8987.md): TIBCO Spotfire Data Science Vulnerable to Persistent Cross-Site Scripting (CVSS 7.6, TIBCO Software TIBCO Data Science for AWS · TIBCO Software…)
- [CVE-2019-3826](https://cve.now/CVE-2019-3826.md): A stored, DOM based, cross-site scripting (XSS) flaw was found in Prometheus before version 2.7.1. (CVSS 6.1, \[UNKNOWN\] prometheus)
- [CVE-2019-6540](https://cve.now/CVE-2019-6540.md): Medtronic Conexus Radio Frequency Telemetry Protocol Cleartext Transmission of Sensitive Information (CVSS 6.5, Medtronic Conexus Radio Frequency Telemetry Protocol ·… +22)
- [CVE-2019-3852](https://cve.now/CVE-2019-3852.md): A vulnerability was found in moodle before version 3.6.3. (CVSS 4.3, \[UNKNOWN\] moodle · moodle/moodle)
- [CVE-2019-3851](https://cve.now/CVE-2019-3851.md): A vulnerability was found in moodle before versions 3.6.3 and 3.5.5. (CVSS 4.3, \[UNKNOWN\] moodle · moodle/moodle)
- [CVE-2019-3850](https://cve.now/CVE-2019-3850.md): A vulnerability was found in moodle before versions 3.6.3, 3.5.5, 3.4.8 and 3.1.17. (CVSS 4.3, \[UNKNOWN\] moodle · moodle/moodle)
- [CVE-2019-3849](https://cve.now/CVE-2019-3849.md): A vulnerability was found in moodle before versions 3.6.3, 3.5.5 and 3.4.8. (CVSS 6.3, \[UNKNOWN\] moodle · moodle/moodle)
- [CVE-2018-16856](https://cve.now/CVE-2018-16856.md): In a default Red Hat Openstack Platform Director installation, openstack-octavia before versions openstack-octavia 2.0.2-5 and openstack-oct (CVSS 5.5, \[UNKNOWN\] openstack-octavia · octavia)
- [CVE-2019-3878](https://cve.now/CVE-2019-3878.md): A vulnerability was found in mod\_auth\_mellon before v0.14.2. (CVSS 8.1, uninett mod\_auth\_mellon)
- [CVE-2019-10068](https://cve.now/CVE-2019-10068.md): An issue was discovered in Kentico 12.0.x before 12.0.15, 11.0.x before 11.0.48, 10.0.x before 10.0.52, and 9.x versions. (CVSS 9.8, KEV)
- [CVE-2010-5305](https://cve.now/CVE-2010-5305.md): Rockwell PLC5/SLC5/0x/RSLogix Credentials management (no CVSS, Rockwell Automation PLC5 · Rockwell Automation SLC5/0x +1)
- [CVE-2019-3606](https://cve.now/CVE-2019-3606.md): Data leakage when in an MDR pair by McAfee Network Security Manager 9.x (CVSS 7.7, McAfee Network Security Manager)
- [CVE-2019-3597](https://cve.now/CVE-2019-3597.md): Authentication bypass in McAfee Network Security Manager 9.x (CVSS 6.5, McAfee Network Security Manager)
- [CVE-2013-2805](https://cve.now/CVE-2013-2805.md): Rockwell Automation RSLinx Enterprise Software (LogReceiver.exe) CPR9, CPR9-SR1, CPR9-SR2, CPR9-SR3, CPR9-SR4, CPR9-SR5, CPR9-SR5.1, and CPR (no CVSS, Rockwell Automation RSLinx Enterprise Software)
- [CVE-2019-9061](https://cve.now/CVE-2019-9061.md): An issue was discovered in CMS Made Simple 2.2.8. (no CVSS)
- [CVE-2013-2806](https://cve.now/CVE-2013-2806.md): Rockwell Automation RSLinx Enterprise Software (LogReceiver.exe) CPR9, CPR9-SR1, CPR9-SR2, CPR9-SR3, CPR9-SR4, CPR9-SR5, CPR9-SR5.1, and CPR (no CVSS, Rockwell Automation RSLinx Enterprise Software)
- [CVE-2019-9059](https://cve.now/CVE-2019-9059.md): An issue was discovered in CMS Made Simple 2.2.8. (no CVSS)
- [CVE-2019-9058](https://cve.now/CVE-2019-9058.md): An issue was discovered in CMS Made Simple 2.2.8. (no CVSS)
- [CVE-2013-2807](https://cve.now/CVE-2013-2807.md): Rockwell Automation RSLinx Enterprise Software (LogReceiver.exe) CPR9, CPR9-SR1, CPR9-SR2, CPR9-SR3, CPR9-SR4, CPR9-SR5, CPR9-SR5.1, and CPR (no CVSS, Rockwell Automation RSLinx Enterprise Software)
- [CVE-2019-9057](https://cve.now/CVE-2019-9057.md): An issue was discovered in CMS Made Simple 2.2.8. (no CVSS)
- [CVE-2019-9055](https://cve.now/CVE-2019-9055.md): An issue was discovered in CMS Made Simple 2.2.8. (no CVSS)
- [CVE-2014-5401](https://cve.now/CVE-2014-5401.md): Hospira MedNet Code Injection (no CVSS, Hospira MedNet)
- [CVE-2019-9053](https://cve.now/CVE-2019-9053.md): An issue was discovered in CMS Made Simple 2.2.8. (no CVSS)
- [CVE-2018-19856](https://cve.now/CVE-2018-19856.md): GitLab CE/EE before 11.3.12, 11.4.x before 11.4.10, and 11.5.x before 11.5.3 allows Directory Traversal in Templates API. (no CVSS)
- [CVE-2014-5431](https://cve.now/CVE-2014-5431.md): Baxter SIGMA Spectrum Infusion System version 6.05 (model 35700BAX) with wireless battery module (WBM) version 16 contains a hard-coded pass (no CVSS, Baxter SIGMA Spectrum Infusion System)
- [CVE-2014-5432](https://cve.now/CVE-2014-5432.md): Baxter SIGMA Spectrum Infusion System version 6.05 (model 35700BAX) with wireless battery module (WBM) version 16 is remotely accessible via (no CVSS, Baxter SIGMA Spectrum Infusion System)
- [CVE-2014-5433](https://cve.now/CVE-2014-5433.md): An unauthenticated remote attacker may be able to execute commands to view wireless account credentials that are stored in cleartext on Baxt (no CVSS, Baxter SIGMA Spectrum Infusion System)
- [CVE-2019-7646](https://cve.now/CVE-2019-7646.md): CentOS-WebPanel.com (aka CWP) CentOS Web Panel through 0.9.8.763 is vulnerable to Stored/Persistent XSS for the "Package Name" field via the (no CVSS)
- [CVE-2014-5434](https://cve.now/CVE-2014-5434.md): Baxter SIGMA Spectrum Infusion System version 6.05 (model 35700BAX) with wireless battery module (WBM) version 16 has a default account with (no CVSS, Baxter SIGMA Spectrum Infusion System)
- [CVE-2019-10063](https://cve.now/CVE-2019-10063.md): Flatpak before 1.0.8, 1.1.x and 1.2.x before 1.2.4, and 1.3.x before 1.3.1 allows a sandbox bypass. (no CVSS)
- [CVE-2019-9764](https://cve.now/CVE-2019-9764.md): HashiCorp Consul 1.4.3 lacks server hostname verification for agent-to-agent TLS communication. (no CVSS, github.com/hashicorp/consul)
- [CVE-2019-8981](https://cve.now/CVE-2019-8981.md): tls1.c in Cameron Hamilton-Rich axTLS before 2.1.5 has a Buffer Overflow via a crafted sequence of TLS packets because the need\_bytes value (no CVSS)
- [CVE-2019-7715](https://cve.now/CVE-2019-7715.md): An issue was discovered in the Interpeak IPCOMShell TELNET server on Green Hills INTEGRITY RTOS 5.0.4. (no CVSS)
- [CVE-2019-7714](https://cve.now/CVE-2019-7714.md): An issue was discovered in Interpeak IPWEBS on Green Hills INTEGRITY RTOS 5.0.4. (no CVSS)
- [CVE-2019-7713](https://cve.now/CVE-2019-7713.md): An issue was discovered in the Interpeak IPCOMShell TELNET server on Green Hills INTEGRITY RTOS 5.0.4. (no CVSS)
- [CVE-2019-7712](https://cve.now/CVE-2019-7712.md): An issue was discovered in handler\_ipcom\_shell\_pwd in the Interpeak IPCOMShell TELNET server on Green Hills INTEGRITY RTOS 5.0.4. (no CVSS)
- [CVE-2019-7711](https://cve.now/CVE-2019-7711.md): An issue was discovered in the Interpeak IPCOMShell TELNET server on Green Hills INTEGRITY RTOS 5.0.4. (no CVSS)
- [CVE-2019-10061](https://cve.now/CVE-2019-10061.md): utils/find-opencv.js in node-opencv (aka OpenCV bindings for Node.js) prior to 6.1.0 is vulnerable to Command Injection. (no CVSS, opencv)
- [CVE-2019-3804](https://cve.now/CVE-2019-3804.md): It was found that cockpit before version 184 used glib's base64 decode functionality incorrectly resulting in a denial of service attack. (CVSS 7.5, \[UNKNOWN\] cockpit)
- [CVE-2019-3848](https://cve.now/CVE-2019-3848.md): A vulnerability was found in moodle before versions 3.6.3, 3.5.5 and 3.4.8. (CVSS 4.3, \[UNKNOWN\] moodle · moodle/moodle)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2019-03-26
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.