CVEs published March 27, 2019
75 CVEs were published on March 27, 2019: 0 critical, 19 high. 1 is now in CISA KEV.
- Published
- 75
- Critical
- 0
- High
- 19
- Medium
- 10
- Low
- 0
- Unrated
- 46
- Now in CISA KEV
- 1
- Fix available
- 13
Most affected products
- Extensible Firmware Interface Development Kit
- 9
- Cisco IOS XE Software
- 6
- Micro Focus Solutions Business Manager
- 4
- The Eclipse Foundation Eclipse Mosquitto
- 4
- Cisco IOS and IOS XE Software
- 3
- article2pdf Wordpress plug-in
- 2
- Cisco IOS and Cisco IOS-XE Software
- 2
- Cisco IOS and IOS-XE Software
- 2
- https://github.com/rails/rails · actionview
- 2
- [UNKNOWN] ceph
- 1
High 19
- CVE-2019-1749Cisco Aggregation Services Router 900 Route Switch Processor 3 OSPFv2 Denial of Service VulnerabilityCisco IOS XE Software
- CVE-2019-1750Cisco IOS XE Software Catalyst 4500 Cisco Discovery Protocol Denial of Service VulnerabilityCisco IOS XE Software
- CVE-2019-1747Cisco IOS and IOS XE Software Short Message Service Denial of Service VulnerabilityCisco IOS and IOS XE Software
- CVE-2019-1748Cisco IOS and IOS XE Software Network Plug-and-Play Agent Certificate Validation VulnerabilityCisco IOS and IOS XE Software
- CVE-2019-1746Cisco IOS and IOS XE Software Cluster Management Protocol Denial of Service VulnerabilityCisco IOS and IOS XE Software
- CVE-2019-1745Cisco IOS XE Software Command Injection VulnerabilityCisco IOS XE Software
- CVE-2019-1742Cisco IOS XE Software Information Disclosure VulnerabilityCisco IOS XE Software
- CVE-2019-1743Cisco IOS XE Software Arbitrary File Upload VulnerabilityCisco IOS XE Software
- CVE-2019-1740Cisco IOS and IOS XE Software Network-Based Application Recognition Denial of Service VulnerabilitiesCisco IOS and Cisco IOS-XE Software
- CVE-2019-1741Cisco IOS XE Software Encrypted Traffic Analytics Denial of Service VulnerabilityCisco IOS XE Software
- CVE-2019-1739Cisco IOS and IOS XE Software Network-Based Application Recognition Denial of Service VulnerabilitiesCisco IOS and Cisco IOS-XE Software
- CVE-2019-1738Cisco IOS and IOS XE Software Network-Based Application Recognition Denial of Service VulnerabilityCisco IOS and IOS-XE Software
- CVE-2019-1737Cisco IOS and IOS XE Software IP Service Level Agreement Denial of Service VulnerabilityCisco IOS and IOS-XE Software
- CVE-2019-0160Buffer overflow in system firmware for EDK II may allow unauthenticated user to potentially enable escalation of privilege and/or denial of Extensible Firmware Interface Development Kit
- CVE-2017-18364phpFK lite has XSS via the faq.php, members.php, or search.php query string or the user.php user parameter.
- CVE-2019-5418There is a File Content Disclosure vulnerability in Action View <5.2.2.1, <5.1.6.2, <5.0.7.2, <4.2.11.1 and v3 where specially crafted accephttps://github.com/rails/rails · actionview
- CVE-2019-3817A use-after-free flaw has been discovered in libcomps before version 0.1.10 in the way ObjMRTrees are merged.libcomps
- CVE-2019-3821A flaw was found in the way civetweb frontend was handling requests for ceph RGW server with SSL enabled.[UNKNOWN] ceph
- CVE-2019-3814It was discovered that Dovecot before versions 2.2.36.1 and 2.3.4.1 incorrectly handled client certificates.dovecot
Medium, low and unrated 56
- CVE-2018-19648An issue was discovered in ADTRAN PMAA 1.6.2-1, 1.6.3, and 1.6.4.
- CVE-2018-14814WECON Technology PI Studio HMI versions 4.1.9 and prior and PI Studio versions 4.2.34 and prior lacks proper validation of user-supplied datWECON Technology PI Studio HMI
- CVE-2017-9626Systems using the Marel Food Processing Systems Pluto platform do not restrict remote access.Marel Food Processing Systems Pluto platform
- CVE-2019-0161Stack overflow in XHCI for EDK II may allow an unauthenticated user to potentially enable denial of service via local access.Extensible Firmware Interface Development Kit
- CVE-2018-12181Stack overflow in corrupted bmp for EDK II may allow unprivileged user to potentially enable denial of service or elevation of privilege viaExtensible Firmware Interface Development Kit
- CVE-2018-12180Buffer overflow in BlockIo service for EDK II may allow an unauthenticated user to potentially enable escalation of privilege, information dExtensible Firmware Interface Development Kit
- CVE-2018-12545In Eclipse Jetty version 9.3.x and 9.4.x, the server is vulnerable to Denial of Service conditions if a remote client sends either large SETThe Eclipse Foundation Eclipse Jetty · org.eclipse.jetty:je…
- CVE-2018-12179Improper configuration in system firmware for EDK II may allow unauthenticated user to potentially enable escalation of privilege, informatiExtensible Firmware Interface Development Kit
- CVE-2017-7655In Eclipse Mosquitto version from 1.0 to 1.4.15, a Null Dereference vulnerability was found in the Mosquitto library which could lead to craThe Eclipse Foundation Eclipse Mosquitto
- CVE-2018-12178Buffer overflow in network stack for EDK II may allow unprivileged user to potentially enable escalation of privilege and/or denial of serviExtensible Firmware Interface Development Kit
- CVE-2018-12182Insufficient memory write check in SMM service for EDK II may allow an authenticated user to potentially enable escalation of privilege, infExtensible Firmware Interface Development Kit
- CVE-2018-12183Stack overflow in DxeCore for EDK II may allow an unauthenticated user to potentially enable escalation of privilege, information disclosureExtensible Firmware Interface Development Kit
- CVE-2018-3613Logic issue in variable service module for EDK II/UDK2018/UDK2017/UDK2015 may allow an authenticated user to potentially enable escalation oExtensible Firmware Interface Development Kit
- CVE-2018-15585Cross-Site Scripting (XSS) vulnerability in newwinform.php in GNUBOARD5 before 5.3.1.6 allows remote attackers to inject arbitrary web scrip
- CVE-2019-1010257An Information Disclosure / Data Modification issue exists in article2pdf_getfile.php in the article2pdf Wordpress plugin 0.24, 0.25, 0.26, article2pdf Wordpress plug-in
- CVE-2019-1000031A disk space or quota exhaustion issue exists in article2pdf_getfile.php in the article2pdf Wordpress plugin 0.24, 0.25, 0.26, 0.27.article2pdf Wordpress plug-in
- CVE-2019-10238Sitemagic CMS v4.4 has XSS in SMFiles/FrmUpload.class.php via the filename parameter.
- CVE-2019-10237S-CMS PHP v1.0 has a CSRF vulnerability to add a new admin user via the 4.edu.php/admin/ajax.php?type=admin&action=add&lang=0 URI, a related
- CVE-2018-18994LCDS Laquis SCADA prior to version 4.1.0.4150 allows an out of bounds read when opening a specially crafted project file, which may cause a LCDS Laquis SCADA
- CVE-2018-12546In Eclipse Mosquitto version 1.0 to 1.5.5 (inclusive) when a client publishes a retained message to a topic, then has its access to that topThe Eclipse Foundation Eclipse Mosquitto
- CVE-2018-12550When Eclipse Mosquitto version 1.0 to 1.5.5 (inclusive) is configured to use an ACL file, and that ACL file is empty, or contains only commeThe Eclipse Foundation Eclipse Mosquitto
- CVE-2018-12551When Eclipse Mosquitto version 1.0 to 1.5.5 (inclusive) is configured to use a password file for authentication, any malformed data in the pThe Eclipse Foundation Eclipse Mosquitto
- CVE-2019-3829A vulnerability was found in gnutls versions from 3.5.8 before 3.6.7.gnutls
- CVE-2018-19016Rockwell Automation EtherNet/IP Web Server Modules 1756-EWEB (includes 1756-EWEBK) Version 5.001 and earlier, and CompactLogix 1768-EWEB VerRockwell Automation EtherNet/IP Web Server Modules 1756-EWE…
- CVE-2018-19643Solutions Business Manager (SBM) Information Leakage issue in version prior to 11.5Micro Focus Solutions Business Manager
- CVE-2018-19644Solutions Business Manager (SBM) reflected cross site script issue in version prior to 11.5Micro Focus Solutions Business Manager
- CVE-2018-19466A vulnerability was found in Portainer before 1.20.0.
- CVE-2018-19642Solutions Business Manager (SBM) Denial of Service issue in version prior to 11.5Micro Focus Solutions Business Manager
- CVE-2018-19641Solutions Business Manager (SBM) Unauthenticated remote code execution issue in version prior to 11.5Micro Focus Solutions Business Manager
- CVE-2019-10233Teclib GLPI before 9.4.1.1 is affected by a timing attack associated with a cookie.
- CVE-2019-10232Teclib GLPI through 9.3.3 has SQL injection via the "cycle" parameter in /scripts/unlock_tasks.php.
- CVE-2019-10231Teclib GLPI before 9.4.1.1 is affected by a PHP type juggling vulnerability allowing bypass of authentication.
- CVE-2017-2752A potential security vulnerability caused by incomplete obfuscation of application configuration information was discovered in Tommy HilfigeTommy Hilfiger TH24/7 Android app
- CVE-2017-2748A potential security vulnerability caused by the use of insecure (http) transactions during login has been identified with early versions ofIsaac Mizrahi Smartwatch Mobile App
- CVE-2018-5927HP Support Assistant before 8.7.50.3 allows an unauthorized person with local access to load arbitrary code.HP Support Assistant
- CVE-2019-6536Opening a specially crafted LCDS LAquis SCADA before 4.3.1.71 ELS file may result in a write past the end of an allocated buffer, which may LCDS - Leão Consultoria e Desenvolvimento de Sistemas Ltda…
- CVE-2018-5926A potential vulnerability has been identified in HP Remote Graphics Software’s certificate authentication process version 7.5.0 and earlier.HP Remote Graphics Software
- CVE-2018-5923In HP LaserJet Enterprise, HP PageWide Enterprise, HP LaserJet Managed, and HP OfficeJet Enterprise Printers, solution application signatureHP LaserJet Enterprise, HP PageWide Enterprise, HP LaserJet…
- CVE-2019-9860Due to unencrypted signal communication and predictability of rolling codes, an attacker can "desynchronize" an ABUS Secvest wireless remote
- CVE-2019-9862An issue was discovered on ABUS Secvest wireless alarm system FUAA50000 3.01.01 in conjunction with Secvest remote control FUBE50014 or FUBE
- CVE-2019-5420A remote code execution vulnerability in development mode Rails <5.2.2.1, <6.0.0.beta3 can allow an attacker to guess the automatically genehttps://github.com/rails/rails · railties
- CVE-2019-5419There is a possible denial of service vulnerability in Action View (Rails) <5.2.2.1, <5.1.6.2, <5.0.7.2, <4.2.11.1 where specially crafted ahttps://github.com/rails/rails · actionview
- CVE-2019-9863Due to the use of an insecure algorithm for rolling codes in the ABUS Secvest wireless alarm system FUAA50000 3.01.01 and its remote control
- CVE-2018-16207PowerAct Pro Master Agent for Windows Version 5.13 and earlier allows authenticated attackers to bypass access restriction to alter or edit OMRON SOCIAL SOLUTIONS Co. PowerAct Pro Master Agent for Wi…
- CVE-2019-5926Cross-site scripting vulnerability in KinagaCMS versions prior to 6.5 allows remote authenticated attackers to inject arbitrary web script oProject Kinaga KinagaCMS
- CVE-2019-5927Directory traversal vulnerability in 'an' App for iOS Version 3.2.0 and earlier allows remote attackers to read arbitrary files via unspecifPERSOL CAREER CO. 'an' App for iOS
- CVE-2019-3840A NULL pointer dereference flaw was discovered in libvirt before version 5.0.0 in the way it gets interface information through the QEMU ageThe libvirt Project libvirt
- CVE-2018-10934A cross-site scripting (XSS) vulnerability was found in the JBoss Management Console versions before 7.1.6.CR1, 7.1.6.GA.Red Hat wildfly-core
- CVE-2019-3877A vulnerability was found in mod_auth_mellon before v0.14.2.uninett mod_auth_mellon
- CVE-2019-9917ZNC before 1.7.3-rc1 allows an existing remote user to cause a Denial of Service (crash) via invalid encoding.
- CVE-2019-10125An issue was discovered in aio_poll() in fs/aio.c in the Linux kernel through 5.0.4.
- CVE-2016-10744In Select2 through 4.0.5, as used in Snipe-IT and other products, rich selectlists allow XSS.select2
- CVE-2019-10118Snipe-IT before 4.6.14 has XSS, as demonstrated by log_meta values and the user's last name in the API.snipe/snipe-it
- CVE-2019-7167Zcash, before the Sapling network upgrade (2018-10-28), had a counterfeiting vulnerability.
- CVE-2019-3828Ansible fetch module before versions 2.5.15, 2.6.14, 2.7.8 has a path traversal vulnerability which allows copying and overwriting files outRed Hat Ansible · ansible
- CVE-2019-3847A vulnerability was found in moodle before versions 3.6.3, 3.5.5, 3.4.8 and 3.1.17.[UNKNOWN] Moodle · moodle/moodle