CVEs published March 28, 2019
60 CVEs were published on March 28, 2019: 0 critical, 9 high.
- Published
- 60
- Critical
- 0
- High
- 9
- Medium
- 6
- Low
- 0
- Unrated
- 45
- Now in CISA KEV
- 0
- Fix available
- 18
Most affected products
- BIG-IP
- 7
- Cisco IOS XE Software
- 6
- Cisco IOS and IOS XE Software
- 4
- Cisco IOS Software
- 2
- Jenkins project Jenkins Fortify on Demand Uploader Plugin ·…
- 2
- Jenkins project Jenkins Slack Notification Plugin · org.jen…
- 2
- Node.js
- 2
- Apache ActiveMQ · org.apache.activemq:activemq-client
- 1
- Apache HBase · org.apache.hbase:hbase
- 1
- Apache JSPWiki · org.apache.jspwiki:jspwiki-main
- 1
High 9
- CVE-2019-3710DSA-2019-034: Dell EMC Networking OS10 Undocumented Default Cryptographic Key VulnerabilityDell EMC Networking OS10
- CVE-2018-19879An issue was discovered in /cgi-bin/luci on Teltonika RTU9XX (e.g., RUT950) R_31.04.89 before R_00.05.00.5 devices.
- CVE-2019-7524In Dovecot before 2.2.36.3 and 2.3.x before 2.3.5.1, a local attacker can cause a buffer overflow in the indexer-worker process, which can b
- CVE-2019-3869When running Tower before 3.4.3 on OpenShift or Kubernetes, application credentials are exposed to playbook job runs via environment variablRed Hat Tower
- CVE-2019-1754Cisco IOS XE Software Privilege Escalation VulnerabilityCisco IOS XE Software
- CVE-2019-1756Cisco IOS XE Software Command Injection VulnerabilityCisco IOS XE Software
- CVE-2019-1753Cisco IOS XE Software Privilege Escalation VulnerabilityCisco IOS XE Software
- CVE-2019-1752Cisco IOS and IOS XE Software ISDN Interface Denial of Service VulnerabilityCisco IOS and IOS XE Software
- CVE-2019-1751Cisco IOS Software NAT64 Denial of Service VulnerabilityCisco IOS Software
Medium, low and unrated 51
- CVE-2019-10262A SQL Injection issue was discovered in BlueCMS 1.6.
- CVE-2019-0212In all previously released Apache HBase 2.x versions (2.0.0-2.0.4, 2.1.0-2.1.3), authorization was incorrectly applied to users of the HBaseApache HBase · org.apache.hbase:hbase
- CVE-2019-0222In Apache ActiveMQ 5.0.0 - 5.15.8, unmarshalling corrupt MQTT frame can lead to broker Out of Memory exception making it unresponsive.Apache ActiveMQ · org.apache.activemq:activemq-client
- CVE-2019-0225A specially crafted url could be used to access files under the ROOT directory of the application on Apache JSPWiki 2.9.0 to 2.11.0.M2, whicApache JSPWiki · org.apache.jspwiki:jspwiki-war
- CVE-2019-0224In Apache JSPWiki 2.9.0 to 2.11.0.M2, a carefully crafted URL could execute javascript on another user's session.Apache JSPWiki · org.apache.jspwiki:jspwiki-main
- CVE-2019-6608On BIG-IP 11.5.1-11.6.3, 12.1.0-12.1.3, 13.0.0-13.1.1.1, and 14.0.0-14.0.0.2, under certain conditions, the snmpd daemon may leak memory on BIG-IP
- CVE-2019-6607On BIG-IP ASM 11.5.1-11.5.8, 11.6.1-11.6.3, 12.1.0-12.1.3, 13.0.0-13.1.1.3, and 14.0.0-14.0.0.2, there is a stored cross-site scripting vulnBIG-IP
- CVE-2019-6606On BIG-IP 11.5.1-11.6.3.4, 12.1.0-12.1.3.7, 13.0.0-13.1.1.3, and 14.0.0-14.0.0.2, when processing certain SNMP requests with a request-id ofBIG-IP
- CVE-2019-6604On BIG-IP 11.5.1-11.5.8, 11.6.1-11.6.3, 12.1.0-12.1.3.6, 13.0.0-13.1.1.1, and 14.0.0-14.0.0.2, under certain conditions, hardware systems wiBIG-IP
- CVE-2019-6605On BIG-IP 11.5.1-11.5.8, 11.6.1-11.6.3, and 12.0.x, an undisclosed sequence of packets received by an SSL virtual server and processed by anBIG-IP
- CVE-2019-6603In BIG-IP 11.5.1-11.5.8, 11.6.1-11.6.3, 12.1.0-12.1.3, and 13.0.0-13.0.1, malformed TCP packets sent to a self IP address or a FastL4 virtuaBIG-IP
- CVE-2019-6602In BIG-IP 11.5.1-11.5.8 and 11.6.1-11.6.3, the Configuration Utility login page may not follow best security practices when handling a malicBIG-IP
- CVE-2019-9167Cross-site scripting (XSS) vulnerability in Nagios XI before 5.5.11 allows attackers to inject arbitrary web script or HTML via the xiwindow
- CVE-2019-9166Privilege escalation in Nagios XI before 5.5.11 allows local attackers to elevate privileges to root via write access to config.inc.php and
- CVE-2019-9165SQL injection vulnerability in Nagios XI before 5.5.11 allows attackers to execute arbitrary SQL commands via the API when using fusekeys an
- CVE-2019-9202Nagios IM (component of Nagios XI) before 2.2.7 allows authenticated users to execute arbitrary code via API key issues.
- CVE-2019-9203Authorization bypass in Nagios IM (component of Nagios XI) before 2.2.7 allows closing incidents in IM via the API.
- CVE-2019-9204SQL injection vulnerability in Nagios IM (component of Nagios XI) before 2.2.7 allows attackers to execute arbitrary SQL commands.
- CVE-2019-1003048A vulnerability in Jenkins PRQA Plugin 3.1.0 and earlier allows attackers with local file system access to the Jenkins home directory to obtJenkins project Jenkins PRQA Plugin · com.programmingresear…
- CVE-2019-1003040A sandbox bypass vulnerability in Jenkins Script Security Plugin 1.55 and earlier allows attackers to invoke arbitrary constructors in sandbJenkins project Jenkins Script Security Plugin · org.jenkin…
- CVE-2019-1003041A sandbox bypass vulnerability in Jenkins Pipeline: Groovy Plugin 2.64 and earlier allows attackers to invoke arbitrary constructors in sandJenkins project Jenkins Pipeline: Groovy Plugin · org.jenki…
- CVE-2019-1003042A cross site scripting vulnerability in Jenkins Lockable Resources Plugin 2.4 and earlier allows attackers able to control resource names toJenkins project Jenkins Lockable Resources Plugin · org.6wi…
- CVE-2019-1003043A missing permission check in Jenkins Slack Notification Plugin 2.19 and earlier allows attackers with Overall/Read permission to connect toJenkins project Jenkins Slack Notification Plugin · org.jen…
- CVE-2019-1003044A cross-site request forgery vulnerability in Jenkins Slack Notification Plugin 2.19 and earlier allows attackers to connect to an attacker-Jenkins project Jenkins Slack Notification Plugin · org.jen…
- CVE-2019-1003045A vulnerability in Jenkins ECS Publisher Plugin 1.0.0 and earlier allows attackers with Item/Extended Read permission, or local file system Jenkins project Jenkins ECS Publisher Plugin · de.eacg:ecs-…
- CVE-2019-1003046A cross-site request forgery vulnerability in Jenkins Fortify on Demand Uploader Plugin 3.0.10 and earlier allows attackers to initiate a coJenkins project Jenkins Fortify on Demand Uploader Plugin ·…
- CVE-2019-1003047A missing permission check in Jenkins Fortify on Demand Uploader Plugin 3.0.10 and earlier allows attackers with Overall/Read permission to Jenkins project Jenkins Fortify on Demand Uploader Plugin ·…
- CVE-2019-9164Command injection in Nagios XI before 5.5.11 allows an authenticated users to execute arbitrary remote commands via a new autodiscovery job.
- CVE-2019-5739Keep-alive HTTP and HTTPS connections can remain open and inactive for up to 2 minutes in Node.js 6.16.0 and earlier.Node.js
- CVE-2019-10260Total.js CMS 12.0.0 has XSS related to themes/admin/views/index.html (item.message) and themes/admin/public/ui.js (column.format).total.js
- CVE-2019-5737In Node.js including 6.x before 6.17.0, 8.x before 8.15.1, 10.x before 10.15.2, and 11.x before 11.10.1, an attacker can cause a Denial of SNode.js
- CVE-2019-7251An Integer Signedness issue (for a return code) in the res_pjsip_sdp_rtp module in Digium Asterisk versions 15.7.1 and earlier and 16.1.1 an
- CVE-2018-16529A password reset vulnerability has been discovered in Forcepoint Email Security 8.5.x.Forcepoint Email Security
- CVE-2018-6330Laravel 5.4.15 is vulnerable to Error based SQL injection in save.php via dhx_user and dhx_version parameters.
- CVE-2019-10255An Open Redirect vulnerability for all browsers in Jupyter Notebook before 5.7.7 and some browsers (Chrome, Firefox) in JupyterHub before 0.jupyterhub · notebook
- CVE-2018-20678LibreNMS through 1.47 allows SQL injection via the html/ajax_table.php sort[hostname] parameter, exploitable by authenticated users during alibrenms/librenms
- CVE-2018-20144GitLab Community and Enterprise Edition 11.x before 11.3.13, 11.4.x before 11.4.11, and 11.5.x before 11.5.4 has Incorrect Access Control.
- CVE-2019-10254In MISP before 2.4.105, the app/View/Layouts/default.ctp default layout template has a Reflected XSS vulnerability.
- CVE-2019-9864PHP Scripts Mall Amazon Affiliate Store 2.1.6 allows Parameter Tampering of the payment amount.
- CVE-2019-5674NVIDIA GeForce Experience before 3.18 contains a vulnerability when ShadowPlay or GameStream is enabled.NVIDIA GeForce Experience
- CVE-2019-10251The UCWeb UC Browser application through 2019-03-26 for Android uses HTTP to download certain modules associated with PDF and Microsoft Offi
- CVE-2019-10250UCWeb UC Browser 7.0.185.1002 on Windows uses HTTP for downloading certain PDF modules, which allows MITM attacks.
- CVE-2019-6542ENTTEC Datagate MK2, Storm 24, Pixelator all firmware versions prior to (70044,70050,70060)_update_05032019-482 allows an unauthenticated usENTTEC Datagate MK2 · ENTTEC Storm +1
- CVE-2017-18365The Management Console in GitHub Enterprise 2.8.x before 2.8.7 has a deserialization issue that allows unauthenticated remote attackers to e
- CVE-2019-1762Cisco IOS and IOS XE Software Information Disclosure VulnerabilityCisco IOS and IOS XE Software
- CVE-2019-1759Cisco IOS XE Software Gigabit Ethernet Management Interface Access Control List Bypass VulnerabilityCisco IOS XE Software
- CVE-2019-1760Cisco IOS XE Software Performance Routing Version 3 Denial of Service VulnerabilityCisco IOS XE Software
- CVE-2019-1761Cisco IOS and IOS XE Software Hot Standby Router Protocol Information Leak VulnerabilityCisco IOS and IOS XE Software
- CVE-2019-1757Cisco IOS and IOS XE Software Smart Call Home Certificate Validation VulnerabilityCisco IOS and IOS XE Software
- CVE-2019-1758Cisco IOS Software Catalyst 6500 Series 802.1x Authentication Bypass VulnerabilityCisco IOS Software
- CVE-2019-1755Cisco IOS XE Software Command Injection VulnerabilityCisco IOS XE Software