# CVEs published 2019-03-27

75 CVEs were published on March 27, 2019: 0 critical, 19 high. 1 is now in CISA KEV. Days are UTC.

- [CVE-2019-1749](https://cve.now/CVE-2019-1749.md): Cisco Aggregation Services Router 900 Route Switch Processor 3 OSPFv2 Denial of Service Vulnerability (CVSS 7.4, Cisco IOS XE Software)
- [CVE-2019-1750](https://cve.now/CVE-2019-1750.md): Cisco IOS XE Software Catalyst 4500 Cisco Discovery Protocol Denial of Service Vulnerability (CVSS 7.4, Cisco IOS XE Software)
- [CVE-2019-1747](https://cve.now/CVE-2019-1747.md): Cisco IOS and IOS XE Software Short Message Service Denial of Service Vulnerability (CVSS 8.6, Cisco IOS and IOS XE Software)
- [CVE-2019-1748](https://cve.now/CVE-2019-1748.md): Cisco IOS and IOS XE Software Network Plug-and-Play Agent Certificate Validation Vulnerability (CVSS 7.4, Cisco IOS and IOS XE Software)
- [CVE-2019-1746](https://cve.now/CVE-2019-1746.md): Cisco IOS and IOS XE Software Cluster Management Protocol Denial of Service Vulnerability (CVSS 7.4, Cisco IOS and IOS XE Software)
- [CVE-2019-1745](https://cve.now/CVE-2019-1745.md): Cisco IOS XE Software Command Injection Vulnerability (CVSS 8.8, Cisco IOS XE Software)
- [CVE-2019-1742](https://cve.now/CVE-2019-1742.md): Cisco IOS XE Software Information Disclosure Vulnerability (CVSS 7.5, Cisco IOS XE Software)
- [CVE-2019-1743](https://cve.now/CVE-2019-1743.md): Cisco IOS XE Software Arbitrary File Upload Vulnerability (CVSS 8.8, Cisco IOS XE Software)
- [CVE-2019-1740](https://cve.now/CVE-2019-1740.md): Cisco IOS and IOS XE Software Network-Based Application Recognition Denial of Service Vulnerabilities (CVSS 8.6, Cisco IOS and Cisco IOS-XE Software)
- [CVE-2019-1741](https://cve.now/CVE-2019-1741.md): Cisco IOS XE Software Encrypted Traffic Analytics Denial of Service Vulnerability (CVSS 8.6, Cisco IOS XE Software)
- [CVE-2019-1739](https://cve.now/CVE-2019-1739.md): Cisco IOS and IOS XE Software Network-Based Application Recognition Denial of Service Vulnerabilities (CVSS 8.6, Cisco IOS and Cisco IOS-XE Software)
- [CVE-2019-1738](https://cve.now/CVE-2019-1738.md): Cisco IOS and IOS XE Software Network-Based Application Recognition Denial of Service Vulnerability (CVSS 8.6, Cisco IOS and IOS-XE Software)
- [CVE-2019-1737](https://cve.now/CVE-2019-1737.md): Cisco IOS and IOS XE Software IP Service Level Agreement Denial of Service Vulnerability (CVSS 8.6, Cisco IOS and IOS-XE Software)
- [CVE-2018-19648](https://cve.now/CVE-2018-19648.md): An issue was discovered in ADTRAN PMAA 1.6.2-1, 1.6.3, and 1.6.4. (no CVSS)
- [CVE-2018-14814](https://cve.now/CVE-2018-14814.md): WECON Technology PI Studio HMI versions 4.1.9 and prior and PI Studio versions 4.2.34 and prior lacks proper validation of user-supplied dat (no CVSS, WECON Technology PI Studio HMI)
- [CVE-2017-9626](https://cve.now/CVE-2017-9626.md): Systems using the Marel Food Processing Systems Pluto platform do not restrict remote access. (no CVSS, Marel Food Processing Systems Pluto platform)
- [CVE-2019-0161](https://cve.now/CVE-2019-0161.md): Stack overflow in XHCI for EDK II may allow an unauthenticated user to potentially enable denial of service via local access. (no CVSS, Extensible Firmware Interface Development Kit)
- [CVE-2018-12181](https://cve.now/CVE-2018-12181.md): Stack overflow in corrupted bmp for EDK II may allow unprivileged user to potentially enable denial of service or elevation of privilege via (no CVSS, Extensible Firmware Interface Development Kit)
- [CVE-2018-12180](https://cve.now/CVE-2018-12180.md): Buffer overflow in BlockIo service for EDK II may allow an unauthenticated user to potentially enable escalation of privilege, information d (no CVSS, Extensible Firmware Interface Development Kit)
- [CVE-2018-12545](https://cve.now/CVE-2018-12545.md): In Eclipse Jetty version 9.3.x and 9.4.x, the server is vulnerable to Denial of Service conditions if a remote client sends either large SET (no CVSS, The Eclipse Foundation Eclipse Jetty · org.eclipse.jetty:je…)
- [CVE-2018-12179](https://cve.now/CVE-2018-12179.md): Improper configuration in system firmware for EDK II may allow unauthenticated user to potentially enable escalation of privilege, informati (no CVSS, Extensible Firmware Interface Development Kit)
- [CVE-2017-7655](https://cve.now/CVE-2017-7655.md): In Eclipse Mosquitto version from 1.0 to 1.4.15, a Null Dereference vulnerability was found in the Mosquitto library which could lead to cra (no CVSS, The Eclipse Foundation Eclipse Mosquitto)
- [CVE-2019-0160](https://cve.now/CVE-2019-0160.md): Buffer overflow in system firmware for EDK II may allow unauthenticated user to potentially enable escalation of privilege and/or denial of (CVSS 8.7, Extensible Firmware Interface Development Kit)
- [CVE-2018-12178](https://cve.now/CVE-2018-12178.md): Buffer overflow in network stack for EDK II may allow unprivileged user to potentially enable escalation of privilege and/or denial of servi (no CVSS, Extensible Firmware Interface Development Kit)
- [CVE-2018-12182](https://cve.now/CVE-2018-12182.md): Insufficient memory write check in SMM service for EDK II may allow an authenticated user to potentially enable escalation of privilege, inf (no CVSS, Extensible Firmware Interface Development Kit)
- [CVE-2018-12183](https://cve.now/CVE-2018-12183.md): Stack overflow in DxeCore for EDK II may allow an unauthenticated user to potentially enable escalation of privilege, information disclosure (no CVSS, Extensible Firmware Interface Development Kit)
- [CVE-2018-3613](https://cve.now/CVE-2018-3613.md): Logic issue in variable service module for EDK II/UDK2018/UDK2017/UDK2015 may allow an authenticated user to potentially enable escalation o (no CVSS, Extensible Firmware Interface Development Kit)
- [CVE-2018-15585](https://cve.now/CVE-2018-15585.md): Cross-Site Scripting (XSS) vulnerability in newwinform.php in GNUBOARD5 before 5.3.1.6 allows remote attackers to inject arbitrary web scrip (no CVSS)
- [CVE-2019-1010257](https://cve.now/CVE-2019-1010257.md): An Information Disclosure / Data Modification issue exists in article2pdf\_getfile.php in the article2pdf Wordpress plugin 0.24, 0.25, 0.26, (no CVSS, article2pdf Wordpress plug-in)
- [CVE-2019-1000031](https://cve.now/CVE-2019-1000031.md): A disk space or quota exhaustion issue exists in article2pdf\_getfile.php in the article2pdf Wordpress plugin 0.24, 0.25, 0.26, 0.27. (no CVSS, article2pdf Wordpress plug-in)
- [CVE-2019-10238](https://cve.now/CVE-2019-10238.md): Sitemagic CMS v4.4 has XSS in SMFiles/FrmUpload.class.php via the filename parameter. (no CVSS)
- [CVE-2019-10237](https://cve.now/CVE-2019-10237.md): S-CMS PHP v1.0 has a CSRF vulnerability to add a new admin user via the 4.edu.php/admin/ajax.php?type=admin&action=add&lang=0 URI, a related (no CVSS)
- [CVE-2018-18994](https://cve.now/CVE-2018-18994.md): LCDS Laquis SCADA prior to version 4.1.0.4150 allows an out of bounds read when opening a specially crafted project file, which may cause a (no CVSS, LCDS Laquis SCADA)
- [CVE-2018-12546](https://cve.now/CVE-2018-12546.md): In Eclipse Mosquitto version 1.0 to 1.5.5 (inclusive) when a client publishes a retained message to a topic, then has its access to that top (no CVSS, The Eclipse Foundation Eclipse Mosquitto)
- [CVE-2018-12550](https://cve.now/CVE-2018-12550.md): When Eclipse Mosquitto version 1.0 to 1.5.5 (inclusive) is configured to use an ACL file, and that ACL file is empty, or contains only comme (no CVSS, The Eclipse Foundation Eclipse Mosquitto)
- [CVE-2018-12551](https://cve.now/CVE-2018-12551.md): When Eclipse Mosquitto version 1.0 to 1.5.5 (inclusive) is configured to use a password file for authentication, any malformed data in the p (no CVSS, The Eclipse Foundation Eclipse Mosquitto)
- [CVE-2019-3829](https://cve.now/CVE-2019-3829.md): A vulnerability was found in gnutls versions from 3.5.8 before 3.6.7. (CVSS 5.3, gnutls)
- [CVE-2018-19016](https://cve.now/CVE-2018-19016.md): Rockwell Automation EtherNet/IP Web Server Modules 1756-EWEB (includes 1756-EWEBK) Version 5.001 and earlier, and CompactLogix 1768-EWEB Ver (no CVSS, Rockwell Automation EtherNet/IP Web Server Modules 1756-EWE…)
- [CVE-2018-19643](https://cve.now/CVE-2018-19643.md): Solutions Business Manager (SBM) Information Leakage issue in version prior to 11.5 (CVSS 4.7, Micro Focus Solutions Business Manager)
- [CVE-2018-19644](https://cve.now/CVE-2018-19644.md): Solutions Business Manager (SBM) reflected cross site script issue in version prior to 11.5 (CVSS 5.0, Micro Focus Solutions Business Manager)
- [CVE-2017-18364](https://cve.now/CVE-2017-18364.md): phpFK lite has XSS via the faq.php, members.php, or search.php query string or the user.php user parameter. (CVSS 7.4)
- [CVE-2018-19466](https://cve.now/CVE-2018-19466.md): A vulnerability was found in Portainer before 1.20.0. (no CVSS)
- [CVE-2018-19642](https://cve.now/CVE-2018-19642.md): Solutions Business Manager (SBM) Denial of Service issue in version prior to 11.5 (CVSS 5.1, Micro Focus Solutions Business Manager)
- [CVE-2018-19641](https://cve.now/CVE-2018-19641.md): Solutions Business Manager (SBM) Unauthenticated remote code execution issue in version prior to 11.5 (CVSS 6.1, Micro Focus Solutions Business Manager)
- [CVE-2019-10233](https://cve.now/CVE-2019-10233.md): Teclib GLPI before 9.4.1.1 is affected by a timing attack associated with a cookie. (no CVSS)
- [CVE-2019-10232](https://cve.now/CVE-2019-10232.md): Teclib GLPI through 9.3.3 has SQL injection via the "cycle" parameter in /scripts/unlock\_tasks.php. (no CVSS)
- [CVE-2019-10231](https://cve.now/CVE-2019-10231.md): Teclib GLPI before 9.4.1.1 is affected by a PHP type juggling vulnerability allowing bypass of authentication. (no CVSS)
- [CVE-2017-2752](https://cve.now/CVE-2017-2752.md): A potential security vulnerability caused by incomplete obfuscation of application configuration information was discovered in Tommy Hilfige (no CVSS, Tommy Hilfiger TH24/7 Android app)
- [CVE-2017-2748](https://cve.now/CVE-2017-2748.md): A potential security vulnerability caused by the use of insecure (http) transactions during login has been identified with early versions of (no CVSS, Isaac Mizrahi Smartwatch Mobile App)
- [CVE-2018-5927](https://cve.now/CVE-2018-5927.md): HP Support Assistant before 8.7.50.3 allows an unauthorized person with local access to load arbitrary code. (no CVSS, HP Support Assistant)
- [CVE-2019-6536](https://cve.now/CVE-2019-6536.md): Opening a specially crafted LCDS LAquis SCADA before 4.3.1.71 ELS file may result in a write past the end of an allocated buffer, which may (no CVSS, LCDS - Leão Consultoria e Desenvolvimento de Sistemas Ltda…)
- [CVE-2018-5926](https://cve.now/CVE-2018-5926.md): A potential vulnerability has been identified in HP Remote Graphics Software’s certificate authentication process version 7.5.0 and earlier. (no CVSS, HP Remote Graphics Software)
- [CVE-2018-5923](https://cve.now/CVE-2018-5923.md): In HP LaserJet Enterprise, HP PageWide Enterprise, HP LaserJet Managed, and HP OfficeJet Enterprise Printers, solution application signature (no CVSS, HP LaserJet Enterprise, HP PageWide Enterprise, HP LaserJet…)
- [CVE-2019-9860](https://cve.now/CVE-2019-9860.md): Due to unencrypted signal communication and predictability of rolling codes, an attacker can "desynchronize" an ABUS Secvest wireless remote (no CVSS)
- [CVE-2019-9862](https://cve.now/CVE-2019-9862.md): An issue was discovered on ABUS Secvest wireless alarm system FUAA50000 3.01.01 in conjunction with Secvest remote control FUBE50014 or FUBE (no CVSS)
- [CVE-2019-5420](https://cve.now/CVE-2019-5420.md): A remote code execution vulnerability in development mode Rails \<5.2.2.1, \<6.0.0.beta3 can allow an attacker to guess the automatically gene (no CVSS, https://github.com/rails/rails · railties)
- [CVE-2019-5419](https://cve.now/CVE-2019-5419.md): There is a possible denial of service vulnerability in Action View (Rails) \<5.2.2.1, \<5.1.6.2, \<5.0.7.2, \<4.2.11.1 where specially crafted a (no CVSS, https://github.com/rails/rails · actionview)
- [CVE-2019-9863](https://cve.now/CVE-2019-9863.md): Due to the use of an insecure algorithm for rolling codes in the ABUS Secvest wireless alarm system FUAA50000 3.01.01 and its remote control (no CVSS)
- [CVE-2019-5418](https://cve.now/CVE-2019-5418.md): There is a File Content Disclosure vulnerability in Action View \<5.2.2.1, \<5.1.6.2, \<5.0.7.2, \<4.2.11.1 and v3 where specially crafted accep (CVSS 7.5, KEV, https://github.com/rails/rails · actionview)
- [CVE-2018-16207](https://cve.now/CVE-2018-16207.md): PowerAct Pro Master Agent for Windows Version 5.13 and earlier allows authenticated attackers to bypass access restriction to alter or edit (no CVSS, OMRON SOCIAL SOLUTIONS Co. PowerAct Pro Master Agent for Wi…)
- [CVE-2019-5926](https://cve.now/CVE-2019-5926.md): Cross-site scripting vulnerability in KinagaCMS versions prior to 6.5 allows remote authenticated attackers to inject arbitrary web script o (no CVSS, Project Kinaga KinagaCMS)
- [CVE-2019-5927](https://cve.now/CVE-2019-5927.md): Directory traversal vulnerability in 'an' App for iOS Version 3.2.0 and earlier allows remote attackers to read arbitrary files via unspecif (no CVSS, PERSOL CAREER CO. 'an' App for iOS)
- [CVE-2019-3817](https://cve.now/CVE-2019-3817.md): A use-after-free flaw has been discovered in libcomps before version 0.1.10 in the way ObjMRTrees are merged. (CVSS 7.5, libcomps)
- [CVE-2019-3840](https://cve.now/CVE-2019-3840.md): A NULL pointer dereference flaw was discovered in libvirt before version 5.0.0 in the way it gets interface information through the QEMU age (CVSS 5.8, The libvirt Project libvirt)
- [CVE-2019-3821](https://cve.now/CVE-2019-3821.md): A flaw was found in the way civetweb frontend was handling requests for ceph RGW server with SSL enabled. (CVSS 7.5, \[UNKNOWN\] ceph)
- [CVE-2019-3814](https://cve.now/CVE-2019-3814.md): It was discovered that Dovecot before versions 2.2.36.1 and 2.3.4.1 incorrectly handled client certificates. (CVSS 7.7, dovecot)
- [CVE-2018-10934](https://cve.now/CVE-2018-10934.md): A cross-site scripting (XSS) vulnerability was found in the JBoss Management Console versions before 7.1.6.CR1, 7.1.6.GA. (CVSS 5.4, Red Hat wildfly-core)
- [CVE-2019-3877](https://cve.now/CVE-2019-3877.md): A vulnerability was found in mod\_auth\_mellon before v0.14.2. (CVSS 5.8, uninett mod\_auth\_mellon)
- [CVE-2019-9917](https://cve.now/CVE-2019-9917.md): ZNC before 1.7.3-rc1 allows an existing remote user to cause a Denial of Service (crash) via invalid encoding. (no CVSS)
- [CVE-2019-10125](https://cve.now/CVE-2019-10125.md): An issue was discovered in aio\_poll() in fs/aio.c in the Linux kernel through 5.0.4. (no CVSS)
- [CVE-2016-10744](https://cve.now/CVE-2016-10744.md): In Select2 through 4.0.5, as used in Snipe-IT and other products, rich selectlists allow XSS. (no CVSS, select2)
- [CVE-2019-10118](https://cve.now/CVE-2019-10118.md): Snipe-IT before 4.6.14 has XSS, as demonstrated by log\_meta values and the user's last name in the API. (no CVSS, snipe/snipe-it)
- [CVE-2019-7167](https://cve.now/CVE-2019-7167.md): Zcash, before the Sapling network upgrade (2018-10-28), had a counterfeiting vulnerability. (no CVSS)
- [CVE-2019-3828](https://cve.now/CVE-2019-3828.md): Ansible fetch module before versions 2.5.15, 2.6.14, 2.7.8 has a path traversal vulnerability which allows copying and overwriting files out (CVSS 4.2, Red Hat Ansible · ansible)
- [CVE-2019-3847](https://cve.now/CVE-2019-3847.md): A vulnerability was found in moodle before versions 3.6.3, 3.5.5, 3.4.8 and 3.1.17. (CVSS 5.4, \[UNKNOWN\] Moodle · moodle/moodle)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2019-03-27
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.