CVEdetails.com the ultimate security vulnerability data source
(e.g.: CVE-2009-1234 or 2010-1234 or 20101234)
Log In   Register
  What's the CVSS score of your company?
Vulnerability Feeds & WidgetsNew   www.itsecdb.com  

Security Vulnerabilities Published In February 2019

Press ESC to close
# CVE ID CWE ID # of Exploits Vulnerability Type(s) Publish Date Update Date Score Gained Access Level Access Complexity Authentication Conf. Integ. Avail.
651 CVE-2018-18498 787 Overflow 2019-02-28 2020-08-24
7.5
None Remote Low Not required Partial Partial Partial
A potential vulnerability leading to an integer overflow can occur during buffer size calculations for images when a raw value is used instead of the checked value. This leads to a possible out-of-bounds write. This vulnerability affects Thunderbird < 60.4, Firefox ESR < 60.4, and Firefox < 64.
652 CVE-2018-18497 Bypass 2019-02-28 2020-08-24
4.3
None Remote Medium Not required Partial None None
Limitations on the URIs allowed to WebExtensions by the browser.windows.create API can be bypassed when a pipe in the URL field is used within the extension to load multiple pages as a single argument. This could allow a malicious WebExtension to open privileged about: or file: locations. This vulnerability affects Firefox < 64.
653 CVE-2018-18496 1021 2019-02-28 2020-08-24
6.8
None Remote Medium Not required Partial Partial Partial
When the RSS Feed preview about:feeds page is framed within another page, it can be used in concert with scripted content for a clickjacking attack that confuses users into downloading and executing an executable file from a temporary directory. *Note: This issue only affects Windows operating systems. Other operating systems are not affected.*. This vulnerability affects Firefox < 64.
654 CVE-2018-18495 732 2019-02-28 2020-08-24
4.3
None Remote Medium Not required Partial None None
WebExtension content scripts can be loaded into about: pages in some circumstances, in violation of the permissions granted to extensions. This could allow an extension to interfere with the loading and usage of these pages and use capabilities that were intended to be restricted from extensions. This vulnerability affects Firefox < 64.
655 CVE-2018-18494 346 2019-02-28 2019-03-11
4.3
None Remote Medium Not required Partial None None
A same-origin policy violation allowing the theft of cross-origin URL entries when using the Javascript location property to cause a redirection to another site using performance.getEntries(). This is a same-origin policy violation and could allow for data theft. This vulnerability affects Thunderbird < 60.4, Firefox ESR < 60.4, and Firefox < 64.
656 CVE-2018-18493 119 Overflow 2019-02-28 2019-03-11
7.5
None Remote Low Not required Partial Partial Partial
A buffer overflow can occur in the Skia library during buffer offset calculations with hardware accelerated canvas 2D actions due to the use of 32-bit calculations instead of 64-bit. This results in a potentially exploitable crash. This vulnerability affects Thunderbird < 60.4, Firefox ESR < 60.4, and Firefox < 64.
657 CVE-2018-18492 416 2019-02-28 2019-03-11
7.5
None Remote Low Not required Partial Partial Partial
A use-after-free vulnerability can occur after deleting a selection element due to a weak reference to the select element in the options collection. This results in a potentially exploitable crash. This vulnerability affects Thunderbird < 60.4, Firefox ESR < 60.4, and Firefox < 64.
658 CVE-2018-18364 426 Exec Code 2019-02-08 2019-02-13
6.0
None Remote Medium ??? Partial Partial Partial
Symantec Ghost Solution Suite (GSS) versions prior to 3.3 RU1 may be susceptible to a DLL hijacking vulnerability, which is a type of issue whereby a potential attacker attempts to execute unexpected code on your machine. This occurs via placement of a potentially foreign file (DLL) that the attacker then attempts to run via a linked application.
659 CVE-2018-18334 200 Bypass +Info 2019-02-05 2019-02-13
5.0
None Remote Low Not required Partial None None
A vulnerability in the Private Browser of Trend Micro Dr. Safety for Android (Consumer) versions below 3.0.1478 could allow an remote attacker to bypass the Same Origin Policy (SOP) and obtain sensitive information via crafted JavaScript code on vulnerable installations.
660 CVE-2018-18333 426 2019-02-05 2021-09-09
6.8
None Remote Medium Not required Partial Partial Partial
A DLL hijacking vulnerability in Trend Micro Security 2019 (Consumer) versions below 15.0.0.1163 and below could allow an attacker to manipulate a specific DLL and escalate privileges on vulnerable installations.
661 CVE-2018-17542 89 Sql 2019-02-11 2019-10-09
5.0
None Remote Low Not required Partial None None
SQL Injection exists in MailSherlock before 1.5.235 for OAKlouds allows an unauthenticated user to extract the subjects of the emails of other users within the enterprise via the select_mid parameter in an letgo.cgi request.
662 CVE-2018-16890 125 Overflow 2019-02-06 2020-09-18
5.0
None Remote Low Not required None None Partial
libcurl versions from 7.36.0 to before 7.64.0 is vulnerable to a heap buffer out-of-bounds read. The function handling incoming NTLM type-2 messages (`lib/vauth/ntlm.c:ntlm_decode_type2_target`) does not validate incoming data correctly and is subject to an integer overflow vulnerability. Using that overflow, a malicious or broken NTLM server could trick libcurl to accept a bad length + offset combination that would lead to a buffer read out-of-bounds.
663 CVE-2018-16493 22 Dir. Trav. 2019-02-01 2019-10-09
5.0
None Remote Low Not required Partial None None
A path traversal vulnerability was found in module static-resource-server 1.7.2 that allows unauthorized read access to any file on the server by appending slashes in the URL.
664 CVE-2018-16492 74 2019-02-01 2019-10-09
7.5
None Remote Low Not required Partial Partial Partial
A prototype pollution vulnerability was found in module extend <2.0.2, ~<3.0.2 that allows an attacker to inject arbitrary properties onto Object.prototype.
665 CVE-2018-16491 74 2019-02-01 2019-10-09
7.5
None Remote Low Not required Partial Partial Partial
A prototype pollution vulnerability was found in node.extend <1.1.7, ~<2.0.1 that allows an attacker to inject arbitrary properties onto Object.prototype.
666 CVE-2018-16490 74 2019-02-01 2019-10-09
5.0
None Remote Low Not required None Partial None
A prototype pollution vulnerability was found in module mpath <0.5.1 that allows an attacker to inject arbitrary properties onto Object.prototype.
667 CVE-2018-16489 74 2019-02-01 2019-10-09
7.5
None Remote Low Not required Partial Partial Partial
A prototype pollution vulnerability was found in just-extend <4.0.0 that allows attack to inject properties onto Object.prototype through its functions.
668 CVE-2018-16487 2019-02-01 2020-09-18
6.8
None Remote Medium Not required Partial Partial Partial
A prototype pollution vulnerability was found in lodash <4.17.11 where the functions merge, mergeWith, and defaultsDeep can be tricked into adding or modifying properties of Object.prototype.
669 CVE-2018-16486 74 2019-02-01 2019-10-09
7.5
None Remote Low Not required Partial Partial Partial
A prototype pollution vulnerability was found in defaults-deep <=0.2.4 that would allow a malicious user to inject properties onto Object.prototype.
670 CVE-2018-16485 22 Dir. Trav. 2019-02-01 2019-10-09
4.0
None Remote Low ??? Partial None None
Path Traversal vulnerability in module m-server <1.4.1 allows malicious user to access unauthorized content of any file in the directory tree e.g. /etc/passwd by appending slashes to the URL request.
671 CVE-2018-16484 79 Exec Code XSS 2019-02-01 2019-10-09
3.5
None Remote Medium ??? None Partial None
A XSS vulnerability was found in module m-server <1.4.2 that allows malicious Javascript code or HTML to be executed, due to the lack of escaping for special characters in folder names.
672 CVE-2018-16483 290 2019-02-01 2020-08-24
6.5
None Remote Low ??? Partial Partial Partial
A deficiency in the access control in module express-cart <=1.1.5 allows unprivileged users to add new users to the application as administrators.
673 CVE-2018-16482 22 Dir. Trav. 2019-02-01 2019-10-09
5.0
None Remote Low Not required Partial None None
A server directory traversal vulnerability was found on node module mcstatic <=0.0.20 that would allow an attack to access sensitive information in the file system by appending slashes in the URL path.
674 CVE-2018-16481 79 Exec Code XSS 2019-02-01 2019-10-09
4.3
None Remote Medium Not required None Partial None
A XSS vulnerability was found in html-page <=2.1.1 that allows malicious Javascript code to be executed in the user's browser due to the absence of sanitization of the paths before rendering.
675 CVE-2018-16480 79 XSS 2019-02-01 2019-10-09
4.3
None Remote Medium Not required None Partial None
A XSS vulnerability was found in module public <0.1.4 that allows malicious Javascript code to run in the browser, due to the absence of sanitization of the file/folder names before rendering.
676 CVE-2018-16479 22 Dir. Trav. 2019-02-01 2019-10-09
5.0
None Remote Low Not required Partial None None
Path traversal vulnerability in http-live-simulator <1.0.7 causes unauthorized access to arbitrary files on disk by appending extra slashes after the URL.
677 CVE-2018-16190 426 +Priv 2019-02-13 2019-02-21
6.8
None Remote Medium Not required Partial Partial Partial
Untrusted search path vulnerability in UNARJ32.DLL for Win32, LHMelting for Win32, and LMLzh32.DLL (UNARJ32.DLL for Win32 Ver 1.10.1.25 and earlier, LHMelting for Win32 Ver 1.65.3.6 and earlier, LMLzh32.DLL Ver 2.67.1.2 and earlier) allows an attacker to gain privileges via a Trojan horse DLL in an unspecified directory.
678 CVE-2018-16189 426 +Priv 2019-02-13 2019-02-19
6.8
None Remote Medium Not required Partial Partial Partial
Untrusted search path vulnerability in Self-Extracting Archives created by UNLHA32.DLL prior to Ver 3.00 allows an attacker to gain privileges via a Trojan horse DLL in an unspecified directory.
679 CVE-2018-15781 798 2019-02-13 2019-10-09
7.9
None Local Network Medium Not required Complete Complete Complete
The Dell Wyse Password Encoder in ThinLinux2 versions prior to 2.1.0.01 contain a Hard-coded Cryptographic Key vulnerability. An unauthenticated remote attacker could reverse engineer the cryptographic system used in the Dell Wyse Password Encoder to discover the hard coded private key and decrypt locally stored cipher text.
680 CVE-2018-15778 20 2019-02-04 2019-10-09
7.2
None Local Low Not required Complete Complete Complete
Dell OS10 versions prior to 10.4.2.1 contain a vulnerability caused by lack of proper input validation on the command-line interface (CLI).
681 CVE-2018-15659 200 +Info 2019-02-05 2019-02-14
4.3
None Remote Medium Not required Partial None None
An issue was discovered in 42Gears SureMDM before 2018-11-27, related to the access policy for Silverlight applications. Cross-origin access is possible.
682 CVE-2018-15658 200 +Info 2019-02-05 2019-02-19
5.0
None Remote Low Not required Partial None None
An issue was discovered in 42Gears SureMDM before 2018-11-27. By visiting the page found at /console/ConsolePage/Master.html, an attacker is able to see the markup that would be presented to an authenticated user. This is caused by the session validation occurring after the initial markup is loaded. This results in a list of unprotected API endpoints that disclose call logs, SMS logs, and user-account data.
683 CVE-2018-15657 918 2019-02-05 2019-02-21
1.9
None Local Medium Not required Partial None None
An SSRF issue was discovered in 42Gears SureMDM before 2018-11-27 via the /api/DownloadUrlResponse.ashx "url" parameter.
684 CVE-2018-15656 200 +Info 2019-02-05 2019-02-19
5.0
None Remote Low Not required Partial None None
An issue was discovered in the registration API endpoint in 42Gears SureMDM before 2018-11-27. An attacker can submit a GET request to /api/register/:email, where :email is a base64 encoded e-mail address, to receive confirmation as to whether a user account exists in the system with the specified e-mail address. The request must be made with an "apiKey" value in the "ApiKey" header.
685 CVE-2018-15655 200 +Info 2019-02-05 2019-02-06
4.3
None Remote Medium Not required Partial None None
An issue was discovered in 42Gears SureMDM before 2018-11-27, related to CORS settings. Cross-origin access is possible.
686 CVE-2018-15617 DoS 2019-02-01 2019-10-09
5.0
None Remote Low Not required None None Partial
A vulnerability in the "capro" (Call Processor) process component of Avaya Aura Communication Manager could allow a remote, unauthenticated user to cause denial of service. Affected versions include 6.3.x, all 7.x versions prior to 7.1.3.2, and all 8.x versions prior to 8.0.1.
687 CVE-2018-15588 290 2019-02-11 2019-10-03
5.0
None Remote Low Not required None Partial None
MailMate before 1.11.3 mishandles a suspicious HTML/MIME structure in a signed/encrypted email.
688 CVE-2018-15587 347 2019-02-11 2019-06-10
4.3
None Remote Medium Not required None Partial None
GNOME Evolution through 3.28.2 is prone to OpenPGP signatures being spoofed for arbitrary messages using a specially crafted email that contains a valid signature from the entity to be impersonated as an attachment.
689 CVE-2018-15586 347 2019-02-11 2019-05-16
4.3
None Remote Medium Not required None Partial None
Enigmail before 2.0.6 is prone to to OpenPGP signatures being spoofed for arbitrary messages using a PGP/INLINE signature wrapped within a specially crafted multipart HTML email.
690 CVE-2018-15380 78 Exec Code 2019-02-20 2019-10-09
8.3
None Local Network Low Not required Complete Complete Complete
A vulnerability in the cluster service manager of Cisco HyperFlex Software could allow an unauthenticated, adjacent attacker to execute commands as the root user. The vulnerability is due to insufficient input validation. An attacker could exploit this vulnerability by connecting to the cluster service manager and injecting commands into the bound process. A successful exploit could allow the attacker to run commands on the affected host as the root user. This vulnerability affects Cisco HyperFlex Software releases prior to 3.5(2a).
691 CVE-2018-13914 119 Overflow 2019-02-25 2019-02-26
4.6
None Local Low Not required Partial Partial Partial
Lack of input validation for data received from user space can lead to an out of bound array issue in Snapdragon Auto, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Wearables in version MDM9150, MDM9206, MDM9607, MDM9650, MSM8909W, MSM8996AU, SD 210/SD 212/SD 205, SD 636, SD 820A, SD 835, SDM630, SDM660, SDX20.
692 CVE-2018-13913 129 2019-02-25 2019-02-26
4.6
None Local Low Not required Partial Partial Partial
Improper validation of array index can lead to unauthorized access while processing debugFS in Snapdragon Auto, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon IoT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables in version MDM9150, MDM9206, MDM9607, MDM9640, MDM9650, MSM8909W, MSM8996AU, QCS605, SD 210/SD 212/SD 205, SD 425, SD 439 / SD 429, SD 615/16/SD 415, SD 625, SD 636, SD 650/52, SD 712 / SD 710 / SD 670, SD 820A, SD 835, SD 845 / SD 850, SD 855, SDA660, SDM439, SDM630, SDM660, SDX20, SDX24.
693 CVE-2018-13912 119 Overflow 2019-02-25 2019-02-26
2.1
None Local Low Not required None Partial None
Arbitrary write issue can occur when user provides kernel address in compat mode in Snapdragon Auto, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables in MDM9150, MDM9206, MDM9607, MDM9640, MDM9650, MSM8909W, MSM8996AU, QCS605, SD 210/SD 212/SD 205, SD 425, SD 439 / SD 429, SD 625, SD 636, SD 712 / SD 710 / SD 670, SD 820, SD 820A, SD 835, SD 845 / SD 850, SDA660, SDM439, SDM630, SDM660, SDX20, SDX24.
694 CVE-2018-13905 416 2019-02-25 2019-02-27
7.2
None Local Low Not required Complete Complete Complete
KGSL syncsource lock not handled properly during syncsource cleanup can lead to use after free issue in Snapdragon Auto, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Wearables in MDM9206, MDM9607, MDM9650, MSM8909W, QCS605, SD 210/SD 212/SD 205, SD 439 / SD 429, SD 712 / SD 710 / SD 670, SD 820A, SD 845 / SD 850, SD 855, SDM439, SDM660, SDX24.
695 CVE-2018-13904 20 2019-02-25 2019-02-26
7.5
None Remote Low Not required Partial Partial Partial
Improper input validation in SCM handler to access storage in TZ can lead to unauthorized access in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile in versions MDM9206, MDM9607, MDM9650, MDM9655, QCS605, SD 410/12, SD 675, SD 712 / SD 710 / SD 670, SD 8CX, SXR1130.
696 CVE-2018-13900 416 2019-02-25 2019-02-27
7.2
None Local Low Not required Complete Complete Complete
Use-after-free vulnerability will occur as there is no protection for the route table`s rule in IPA driver in Snapdragon Auto, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables in versions MDM9150, MDM9206, MDM9607, MDM9640, MDM9650, MSM8909W, MSM8996AU, QCS605, SD 210/SD 212/SD 205, SD 425, SD 427, SD 430, SD 435, SD 439 / SD 429, SD 450, SD 625, SD 636, SD 712 / SD 710 / SD 670, SD 820, SD 820A, SD 835, SD 845 / SD 850, SD 855, SDA660, SDM439, SDM630, SDM660, SDX20, SDX24.
697 CVE-2018-13893 119 Overflow 2019-02-11 2019-02-12
4.6
None Local Low Not required Partial Partial Partial
In all android releases(Android for MSM, Firefox OS for MSM, QRD Android) from CAF using the linux kernel, Out of bound mask range access caused by using possible old value of msg mask table count while copying masks to userspace.
698 CVE-2018-13889 416 2019-02-11 2019-02-12
7.2
None Local Low Not required Complete Complete Complete
In all android releases(Android for MSM, Firefox OS for MSM, QRD Android) from CAF using the linux kernel, Heap memory was accessed after it was freed
699 CVE-2018-13888 119 Overflow Mem. Corr. 2019-02-11 2019-02-14
7.2
None Local Low Not required Complete Complete Complete
There is potential for memory corruption in the RIL daemon due to de reference of memory outside the allocated array length in RIL in Snapdragon Auto, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Wearables in versions MDM9206, MDM9607, MDM9635M, MDM9650, MSM8909W, SD 210/SD 212/SD 205, SD 425, SD 427, SD 430, SD 435, SD 439 / SD 429, SD 450, SD 625, SD 636, SD 650/52, SD 675, SD 712 / SD 710 / SD 670, SD 820A, SD 835, SD 845 / SD 850, SD 855, SDM439, SDM630, SDM660, ZZ_QCS605.
700 CVE-2018-13792 89 Exec Code Sql 2019-02-10 2020-09-10
7.5
None Remote Low Not required Partial Partial Partial
Multiple SQL injection vulnerabilities in the monitoring feature in the HTTP API in ABBYY FlexiCapture before 12 Release 2 allow an attacker to execute arbitrary SQL commands via the mask, sortOrder, filter, or Order parameter.
Total number of vulnerabilities : 839   Page : 1 2 3 4 5 6 7 8 9 10 11 12 13 14 (This Page)15 16 17
CVE is a registred trademark of the MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. CWE is a registred trademark of the MITRE Corporation and the authoritative source of CWE content is MITRE's CWE web site. OVAL is a registered trademark of The MITRE Corporation and the authoritative source of OVAL content is MITRE's OVAL web site.
Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.