# CVEs published 2019-03-30

17 CVEs were published on March 30, 2019: 0 critical, 0 high. Days are UTC.

- [CVE-2019-10663](https://cve.now/CVE-2019-10663.md): Grandstream UCM6204 before 1.0.19.20 devices allow remote authenticated users to conduct SQL injection attacks via the sord parameter in a l (no CVSS)
- [CVE-2019-10662](https://cve.now/CVE-2019-10662.md): Grandstream UCM6204 before 1.0.19.20 devices allow remote authenticated users to execute arbitrary code via shell metacharacters in the back (no CVSS)
- [CVE-2019-10661](https://cve.now/CVE-2019-10661.md): On Grandstream GXV3611IR\_HD before 1.0.3.23 devices, the root account lacks a password. (no CVSS)
- [CVE-2019-10660](https://cve.now/CVE-2019-10660.md): Grandstream GXV3611IR\_HD before 1.0.3.23 devices allow remote authenticated users to execute arbitrary code via shell metacharacters in the (no CVSS)
- [CVE-2019-10659](https://cve.now/CVE-2019-10659.md): Grandstream GXV3370 before 1.0.1.41 and WP820 before 1.0.3.6 devices allow remote authenticated users to execute arbitrary code via shell me (no CVSS)
- [CVE-2019-10658](https://cve.now/CVE-2019-10658.md): Grandstream GWN7610 before 1.0.8.18 devices allow remote authenticated users to execute arbitrary code via shell metacharacters in the filen (no CVSS)
- [CVE-2019-10657](https://cve.now/CVE-2019-10657.md): Grandstream GWN7000 before 1.0.6.32 and GWN7610 before 1.0.8.18 devices allow remote authenticated users to discover passwords via a /ubus/u (no CVSS)
- [CVE-2019-10656](https://cve.now/CVE-2019-10656.md): Grandstream GWN7000 before 1.0.6.32 devices allow remote authenticated users to execute arbitrary code via shell metacharacters in the filen (no CVSS)
- [CVE-2019-10655](https://cve.now/CVE-2019-10655.md): Grandstream GAC2500 1.0.3.35, GXP2200 1.0.3.27, GVC3202 1.0.3.51, GXV3275 before 1.0.3.219 Beta, and GXV3240 before 1.0.3.219 Beta devices a (no CVSS)
- [CVE-2019-10654](https://cve.now/CVE-2019-10654.md): The lzo1x\_decompress function in liblzo2.so.2 in LZO 2.10, as used in Long Range Zip (aka lrzip) 0.631, allows remote attackers to cause a d (no CVSS)
- [CVE-2019-10652](https://cve.now/CVE-2019-10652.md): An issue was discovered in flatCore 1.4.7. (no CVSS)
- [CVE-2019-10650](https://cve.now/CVE-2019-10650.md): In ImageMagick 7.0.8-36 Q16, there is a heap-based buffer over-read in the function WriteTIFFImage of coders/tiff.c, which allows an attacke (no CVSS)
- [CVE-2019-10649](https://cve.now/CVE-2019-10649.md): In ImageMagick 7.0.8-36 Q16, there is a memory leak in the function SVGKeyValuePairs of coders/svg.c, which allows an attacker to cause a de (no CVSS)
- [CVE-2019-10648](https://cve.now/CVE-2019-10648.md): Robocode through 1.9.3.5 allows remote attackers to cause external service interaction (DNS), as demonstrated by a query for a unique subdom (no CVSS, net.sf.robocode:robocode.host)
- [CVE-2019-10647](https://cve.now/CVE-2019-10647.md): ZZZCMS zzzphp v1.6.3 allows remote attackers to execute arbitrary PHP code via a .php URL in the plugins/ueditor/php/controller.php?action=c (no CVSS)
- [CVE-2019-10646](https://cve.now/CVE-2019-10646.md): Wolf CMS v0.8.3.1 is affected by cross site scripting (XSS) in the module Add Snippet (/?/admin/snippet/add). (no CVSS)
- [CVE-2019-10644](https://cve.now/CVE-2019-10644.md): An issue was discovered in HYBBS 2.2. (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2019-03-30
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.