# CVEs published 2019-03-28

60 CVEs were published on March 28, 2019: 0 critical, 9 high. Days are UTC.

- [CVE-2019-10262](https://cve.now/CVE-2019-10262.md): A SQL Injection issue was discovered in BlueCMS 1.6. (no CVSS)
- [CVE-2019-0212](https://cve.now/CVE-2019-0212.md): In all previously released Apache HBase 2.x versions (2.0.0-2.0.4, 2.1.0-2.1.3), authorization was incorrectly applied to users of the HBase (no CVSS, Apache HBase · org.apache.hbase:hbase)
- [CVE-2019-0222](https://cve.now/CVE-2019-0222.md): In Apache ActiveMQ 5.0.0 - 5.15.8, unmarshalling corrupt MQTT frame can lead to broker Out of Memory exception making it unresponsive. (no CVSS, Apache ActiveMQ · org.apache.activemq:activemq-client)
- [CVE-2019-0225](https://cve.now/CVE-2019-0225.md): A specially crafted url could be used to access files under the ROOT directory of the application on Apache JSPWiki 2.9.0 to 2.11.0.M2, whic (no CVSS, Apache JSPWiki · org.apache.jspwiki:jspwiki-war)
- [CVE-2019-0224](https://cve.now/CVE-2019-0224.md): In Apache JSPWiki 2.9.0 to 2.11.0.M2, a carefully crafted URL could execute javascript on another user's session. (no CVSS, Apache JSPWiki · org.apache.jspwiki:jspwiki-main)
- [CVE-2019-6608](https://cve.now/CVE-2019-6608.md): On BIG-IP 11.5.1-11.6.3, 12.1.0-12.1.3, 13.0.0-13.1.1.1, and 14.0.0-14.0.0.2, under certain conditions, the snmpd daemon may leak memory on (no CVSS, BIG-IP)
- [CVE-2019-6607](https://cve.now/CVE-2019-6607.md): On BIG-IP ASM 11.5.1-11.5.8, 11.6.1-11.6.3, 12.1.0-12.1.3, 13.0.0-13.1.1.3, and 14.0.0-14.0.0.2, there is a stored cross-site scripting vuln (no CVSS, BIG-IP)
- [CVE-2019-6606](https://cve.now/CVE-2019-6606.md): On BIG-IP 11.5.1-11.6.3.4, 12.1.0-12.1.3.7, 13.0.0-13.1.1.3, and 14.0.0-14.0.0.2, when processing certain SNMP requests with a request-id of (no CVSS, BIG-IP)
- [CVE-2019-6604](https://cve.now/CVE-2019-6604.md): On BIG-IP 11.5.1-11.5.8, 11.6.1-11.6.3, 12.1.0-12.1.3.6, 13.0.0-13.1.1.1, and 14.0.0-14.0.0.2, under certain conditions, hardware systems wi (no CVSS, BIG-IP)
- [CVE-2019-6605](https://cve.now/CVE-2019-6605.md): On BIG-IP 11.5.1-11.5.8, 11.6.1-11.6.3, and 12.0.x, an undisclosed sequence of packets received by an SSL virtual server and processed by an (no CVSS, BIG-IP)
- [CVE-2019-6603](https://cve.now/CVE-2019-6603.md): In BIG-IP 11.5.1-11.5.8, 11.6.1-11.6.3, 12.1.0-12.1.3, and 13.0.0-13.0.1, malformed TCP packets sent to a self IP address or a FastL4 virtua (no CVSS, BIG-IP)
- [CVE-2019-6602](https://cve.now/CVE-2019-6602.md): In BIG-IP 11.5.1-11.5.8 and 11.6.1-11.6.3, the Configuration Utility login page may not follow best security practices when handling a malic (no CVSS, BIG-IP)
- [CVE-2019-9167](https://cve.now/CVE-2019-9167.md): Cross-site scripting (XSS) vulnerability in Nagios XI before 5.5.11 allows attackers to inject arbitrary web script or HTML via the xiwindow (no CVSS)
- [CVE-2019-9166](https://cve.now/CVE-2019-9166.md): Privilege escalation in Nagios XI before 5.5.11 allows local attackers to elevate privileges to root via write access to config.inc.php and (no CVSS)
- [CVE-2019-9165](https://cve.now/CVE-2019-9165.md): SQL injection vulnerability in Nagios XI before 5.5.11 allows attackers to execute arbitrary SQL commands via the API when using fusekeys an (no CVSS)
- [CVE-2019-9202](https://cve.now/CVE-2019-9202.md): Nagios IM (component of Nagios XI) before 2.2.7 allows authenticated users to execute arbitrary code via API key issues. (no CVSS)
- [CVE-2019-9203](https://cve.now/CVE-2019-9203.md): Authorization bypass in Nagios IM (component of Nagios XI) before 2.2.7 allows closing incidents in IM via the API. (no CVSS)
- [CVE-2019-9204](https://cve.now/CVE-2019-9204.md): SQL injection vulnerability in Nagios IM (component of Nagios XI) before 2.2.7 allows attackers to execute arbitrary SQL commands. (no CVSS)
- [CVE-2019-1003048](https://cve.now/CVE-2019-1003048.md): A vulnerability in Jenkins PRQA Plugin 3.1.0 and earlier allows attackers with local file system access to the Jenkins home directory to obt (no CVSS, Jenkins project Jenkins PRQA Plugin · com.programmingresear…)
- [CVE-2019-1003040](https://cve.now/CVE-2019-1003040.md): A sandbox bypass vulnerability in Jenkins Script Security Plugin 1.55 and earlier allows attackers to invoke arbitrary constructors in sandb (no CVSS, Jenkins project Jenkins Script Security Plugin · org.jenkin…)
- [CVE-2019-1003041](https://cve.now/CVE-2019-1003041.md): A sandbox bypass vulnerability in Jenkins Pipeline: Groovy Plugin 2.64 and earlier allows attackers to invoke arbitrary constructors in sand (no CVSS, Jenkins project Jenkins Pipeline: Groovy Plugin · org.jenki…)
- [CVE-2019-1003042](https://cve.now/CVE-2019-1003042.md): A cross site scripting vulnerability in Jenkins Lockable Resources Plugin 2.4 and earlier allows attackers able to control resource names to (no CVSS, Jenkins project Jenkins Lockable Resources Plugin · org.6wi…)
- [CVE-2019-1003043](https://cve.now/CVE-2019-1003043.md): A missing permission check in Jenkins Slack Notification Plugin 2.19 and earlier allows attackers with Overall/Read permission to connect to (no CVSS, Jenkins project Jenkins Slack Notification Plugin · org.jen…)
- [CVE-2019-1003044](https://cve.now/CVE-2019-1003044.md): A cross-site request forgery vulnerability in Jenkins Slack Notification Plugin 2.19 and earlier allows attackers to connect to an attacker- (no CVSS, Jenkins project Jenkins Slack Notification Plugin · org.jen…)
- [CVE-2019-1003045](https://cve.now/CVE-2019-1003045.md): A vulnerability in Jenkins ECS Publisher Plugin 1.0.0 and earlier allows attackers with Item/Extended Read permission, or local file system (no CVSS, Jenkins project Jenkins ECS Publisher Plugin · de.eacg:ecs-…)
- [CVE-2019-1003046](https://cve.now/CVE-2019-1003046.md): A cross-site request forgery vulnerability in Jenkins Fortify on Demand Uploader Plugin 3.0.10 and earlier allows attackers to initiate a co (no CVSS, Jenkins project Jenkins Fortify on Demand Uploader Plugin ·…)
- [CVE-2019-1003047](https://cve.now/CVE-2019-1003047.md): A missing permission check in Jenkins Fortify on Demand Uploader Plugin 3.0.10 and earlier allows attackers with Overall/Read permission to (no CVSS, Jenkins project Jenkins Fortify on Demand Uploader Plugin ·…)
- [CVE-2019-3710](https://cve.now/CVE-2019-3710.md): DSA-2019-034: Dell EMC Networking OS10 Undocumented Default Cryptographic Key Vulnerability (CVSS 8.3, Dell EMC Networking OS10)
- [CVE-2018-19879](https://cve.now/CVE-2018-19879.md): An issue was discovered in /cgi-bin/luci on Teltonika RTU9XX (e.g., RUT950) R\_31.04.89 before R\_00.05.00.5 devices. (CVSS 7.1)
- [CVE-2019-9164](https://cve.now/CVE-2019-9164.md): Command injection in Nagios XI before 5.5.11 allows an authenticated users to execute arbitrary remote commands via a new autodiscovery job. (no CVSS)
- [CVE-2019-5739](https://cve.now/CVE-2019-5739.md): Keep-alive HTTP and HTTPS connections can remain open and inactive for up to 2 minutes in Node.js 6.16.0 and earlier. (no CVSS, Node.js)
- [CVE-2019-10260](https://cve.now/CVE-2019-10260.md): Total.js CMS 12.0.0 has XSS related to themes/admin/views/index.html (item.message) and themes/admin/public/ui.js (column.format). (no CVSS, total.js)
- [CVE-2019-5737](https://cve.now/CVE-2019-5737.md): In Node.js including 6.x before 6.17.0, 8.x before 8.15.1, 10.x before 10.15.2, and 11.x before 11.10.1, an attacker can cause a Denial of S (no CVSS, Node.js)
- [CVE-2019-7251](https://cve.now/CVE-2019-7251.md): An Integer Signedness issue (for a return code) in the res\_pjsip\_sdp\_rtp module in Digium Asterisk versions 15.7.1 and earlier and 16.1.1 an (no CVSS)
- [CVE-2018-16529](https://cve.now/CVE-2018-16529.md): A password reset vulnerability has been discovered in Forcepoint Email Security 8.5.x. (no CVSS, Forcepoint Email Security)
- [CVE-2018-6330](https://cve.now/CVE-2018-6330.md): Laravel 5.4.15 is vulnerable to Error based SQL injection in save.php via dhx\_user and dhx\_version parameters. (no CVSS)
- [CVE-2019-10255](https://cve.now/CVE-2019-10255.md): An Open Redirect vulnerability for all browsers in Jupyter Notebook before 5.7.7 and some browsers (Chrome, Firefox) in JupyterHub before 0. (no CVSS, jupyterhub · notebook)
- [CVE-2018-20678](https://cve.now/CVE-2018-20678.md): LibreNMS through 1.47 allows SQL injection via the html/ajax\_table.php sort\[hostname\] parameter, exploitable by authenticated users during a (no CVSS, librenms/librenms)
- [CVE-2018-20144](https://cve.now/CVE-2018-20144.md): GitLab Community and Enterprise Edition 11.x before 11.3.13, 11.4.x before 11.4.11, and 11.5.x before 11.5.4 has Incorrect Access Control. (no CVSS)
- [CVE-2019-10254](https://cve.now/CVE-2019-10254.md): In MISP before 2.4.105, the app/View/Layouts/default.ctp default layout template has a Reflected XSS vulnerability. (no CVSS)
- [CVE-2019-9864](https://cve.now/CVE-2019-9864.md): PHP Scripts Mall Amazon Affiliate Store 2.1.6 allows Parameter Tampering of the payment amount. (no CVSS)
- [CVE-2019-5674](https://cve.now/CVE-2019-5674.md): NVIDIA GeForce Experience before 3.18 contains a vulnerability when ShadowPlay or GameStream is enabled. (no CVSS, NVIDIA GeForce Experience)
- [CVE-2019-10251](https://cve.now/CVE-2019-10251.md): The UCWeb UC Browser application through 2019-03-26 for Android uses HTTP to download certain modules associated with PDF and Microsoft Offi (no CVSS)
- [CVE-2019-10250](https://cve.now/CVE-2019-10250.md): UCWeb UC Browser 7.0.185.1002 on Windows uses HTTP for downloading certain PDF modules, which allows MITM attacks. (no CVSS)
- [CVE-2019-6542](https://cve.now/CVE-2019-6542.md): ENTTEC Datagate MK2, Storm 24, Pixelator all firmware versions prior to (70044,70050,70060)\_update\_05032019-482 allows an unauthenticated us (no CVSS, ENTTEC Datagate MK2 · ENTTEC Storm +1)
- [CVE-2019-7524](https://cve.now/CVE-2019-7524.md): In Dovecot before 2.2.36.3 and 2.3.x before 2.3.5.1, a local attacker can cause a buffer overflow in the indexer-worker process, which can b (CVSS 8.8)
- [CVE-2019-3869](https://cve.now/CVE-2019-3869.md): When running Tower before 3.4.3 on OpenShift or Kubernetes, application credentials are exposed to playbook job runs via environment variabl (CVSS 7.2, Red Hat Tower)
- [CVE-2017-18365](https://cve.now/CVE-2017-18365.md): The Management Console in GitHub Enterprise 2.8.x before 2.8.7 has a deserialization issue that allows unauthenticated remote attackers to e (no CVSS)
- [CVE-2019-1762](https://cve.now/CVE-2019-1762.md): Cisco IOS and IOS XE Software Information Disclosure Vulnerability (CVSS 4.4, Cisco IOS and IOS XE Software)
- [CVE-2019-1759](https://cve.now/CVE-2019-1759.md): Cisco IOS XE Software Gigabit Ethernet Management Interface Access Control List Bypass Vulnerability (CVSS 5.3, Cisco IOS XE Software)
- [CVE-2019-1760](https://cve.now/CVE-2019-1760.md): Cisco IOS XE Software Performance Routing Version 3 Denial of Service Vulnerability (CVSS 6.8, Cisco IOS XE Software)
- [CVE-2019-1761](https://cve.now/CVE-2019-1761.md): Cisco IOS and IOS XE Software Hot Standby Router Protocol Information Leak Vulnerability (CVSS 4.3, Cisco IOS and IOS XE Software)
- [CVE-2019-1757](https://cve.now/CVE-2019-1757.md): Cisco IOS and IOS XE Software Smart Call Home Certificate Validation Vulnerability (no CVSS, Cisco IOS and IOS XE Software)
- [CVE-2019-1758](https://cve.now/CVE-2019-1758.md): Cisco IOS Software Catalyst 6500 Series 802.1x Authentication Bypass Vulnerability (CVSS 4.7, Cisco IOS Software)
- [CVE-2019-1754](https://cve.now/CVE-2019-1754.md): Cisco IOS XE Software Privilege Escalation Vulnerability (CVSS 8.8, Cisco IOS XE Software)
- [CVE-2019-1755](https://cve.now/CVE-2019-1755.md): Cisco IOS XE Software Command Injection Vulnerability (CVSS 6.5, Cisco IOS XE Software)
- [CVE-2019-1756](https://cve.now/CVE-2019-1756.md): Cisco IOS XE Software Command Injection Vulnerability (CVSS 7.2, Cisco IOS XE Software)
- [CVE-2019-1753](https://cve.now/CVE-2019-1753.md): Cisco IOS XE Software Privilege Escalation Vulnerability (CVSS 8.8, Cisco IOS XE Software)
- [CVE-2019-1752](https://cve.now/CVE-2019-1752.md): Cisco IOS and IOS XE Software ISDN Interface Denial of Service Vulnerability (CVSS 8.6, Cisco IOS and IOS XE Software)
- [CVE-2019-1751](https://cve.now/CVE-2019-1751.md): Cisco IOS Software NAT64 Denial of Service Vulnerability (CVSS 8.6, Cisco IOS Software)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2019-03-28
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.