# CVEs published 2019-03-29

22 CVEs were published on March 29, 2019: 0 critical, 3 high. Days are UTC.

- [CVE-2018-18766](https://cve.now/CVE-2018-18766.md): An elevation of privilege vulnerability exists in the Call Dispatcher in Provisio SiteKiosk before 9.7.4905. (no CVSS)
- [CVE-2018-19201](https://cve.now/CVE-2018-19201.md): A reflected XSS vulnerability in the ModCP Profile Editor in MyBB before 1.8.20 allows remote attackers to inject JavaScript via the 'userna (no CVSS)
- [CVE-2018-15840](https://cve.now/CVE-2018-15840.md): TP-Link TL-WR840N devices allow remote attackers to cause a denial of service (networking outage) via fragmented packets, as demonstrated by (no CVSS)
- [CVE-2018-20378](https://cve.now/CVE-2018-20378.md): The L2CAP signaling channel implementation and SDP server implementation in OpenSynergy Blue SDK 3.2 through 6.0 allow remote, unauthenticat (no CVSS)
- [CVE-2019-9922](https://cve.now/CVE-2019-9922.md): An issue was discovered in the Harmis JE Messenger component 1.2.2 for Joomla!. (CVSS 5.8)
- [CVE-2019-9921](https://cve.now/CVE-2019-9921.md): An issue was discovered in the Harmis JE Messenger component 1.2.2 for Joomla!. (CVSS 7.7)
- [CVE-2019-9920](https://cve.now/CVE-2019-9920.md): An issue was discovered in the Harmis JE Messenger component 1.2.2 for Joomla!. (CVSS 7.7)
- [CVE-2019-9919](https://cve.now/CVE-2019-9919.md): An issue was discovered in the Harmis JE Messenger component 1.2.2 for Joomla!. (CVSS 5.4)
- [CVE-2019-9918](https://cve.now/CVE-2019-9918.md): An issue was discovered in the Harmis JE Messenger component 1.2.2 for Joomla!. (CVSS 8.5)
- [CVE-2017-18111](https://cve.now/CVE-2017-18111.md): The OAuthHelper in Atlassian Application Links before version 5.0.10, from version 5.1.0 before version 5.1.3, and from version 5.2.0 before (no CVSS, Atlassian Application Links)
- [CVE-2017-18110](https://cve.now/CVE-2017-18110.md): The administration backup restore resource in Atlassian Crowd before version 3.0.2 and from version 3.1.0 before version 3.1.1 allows remote (no CVSS, Atlassian Crowd)
- [CVE-2017-18109](https://cve.now/CVE-2017-18109.md): The login resource of CrowdId in Atlassian Crowd before version 3.0.2 and from version 3.1.0 before version 3.1.1 allows remote attackers to (no CVSS, Atlassian Crowd)
- [CVE-2017-18108](https://cve.now/CVE-2017-18108.md): The administration SMTP configuration resource in Atlassian Crowd before version 2.10.2 allows remote attackers with administration rights t (no CVSS, Atlassian Crowd)
- [CVE-2017-18106](https://cve.now/CVE-2017-18106.md): The identifier\_hash for a session token in Atlassian Crowd before version 2.9.1 could potentially collide with an identifier\_hash for anothe (no CVSS, Atlassian Crowd)
- [CVE-2017-18105](https://cve.now/CVE-2017-18105.md): The console login resource in Atlassian Crowd before version 3.0.2 and from version 3.1.0 before version 3.1.1 allows remote attackers, who (no CVSS, Atlassian Crowd)
- [CVE-2019-9604](https://cve.now/CVE-2019-9604.md): PHP Scripts Mall Online Lottery PHP Readymade Script 1.7.0 has Cross-Site Request Forgery (CSRF) for Edit Profile actions. (no CVSS)
- [CVE-2019-9605](https://cve.now/CVE-2019-9605.md): PHP Scripts Mall Online Lottery PHP Readymade Script 1.7.0 has Reflected Cross-site Scripting (XSS) via the err value in a .ico picture uplo (no CVSS)
- [CVE-2019-9695](https://cve.now/CVE-2019-9695.md): Norton Core prior to v278 may be susceptible to an arbitrary code execution issue, which is a type of vulnerability that has the potential o (no CVSS, Norton Core)
- [CVE-2019-6481](https://cve.now/CVE-2019-6481.md): Abine Blur 7.8.2431 allows remote attackers to conduct "Second-Factor Auth Bypass" attacks by using the "Perform a right-click operation to (no CVSS)
- [CVE-2019-10477](https://cve.now/CVE-2019-10477.md): The FusionInventory plugin before 1.4 for GLPI 9.3.x and before 1.1 for GLPI 9.4.x mishandles sendXML actions. (no CVSS)
- [CVE-2019-10276](https://cve.now/CVE-2019-10276.md): Western Bridge Cobub Razor 0.8.0 has a file upload vulnerability via the web/assets/swf/uploadify.php URI, as demonstrated by a .php file wi (no CVSS)
- [CVE-2019-10269](https://cve.now/CVE-2019-10269.md): BWA (aka Burrow-Wheeler Aligner) before 2019-01-23 has a stack-based buffer overflow in the bns\_restore function in bntseq.c via a long sequ (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2019-03-29
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.