Weekly Vulnerabilities Reports > April 8 to 14, 2019

Overview

353 new vulnerabilities reported during this period, including 36 critical vulnerabilities and 75 high severity vulnerabilities. This weekly summary report vulnerabilities in 924 products from 116 vendors including Microsoft, Fedoraproject, IBM, Juniper, and Debian. Vulnerabilities are notably categorized as "Cross-site Scripting", "Out-of-bounds Write", "Improper Input Validation", "Information Exposure", and "XXE".

  • 275 reported vulnerabilities are remotely exploitables.
  • 12 reported vulnerabilities have public exploit available.
  • 88 reported vulnerabilities are related to weaknesses in OWASP Top Ten.
  • 292 reported vulnerabilities are exploitable by an anonymous user.
  • Microsoft has the most reported vulnerabilities, with 146 reported vulnerabilities.
  • Microsoft has the most reported critical vulnerabilities, with 20 reported vulnerabilities.

TOTAL
VULNERABILITIES
CRITICAL RISK
VULNERABILITIES
HIGH RISK
VULNERABILITIES
MEDIUM RISK
VULNERABILITIES
LOW RISK
VULNERABILITIES
REMOTELY
EXPLOITABLE
LOCALLY
EXPLOITABLE
EXPLOIT
AVAILABLE
EXPLOITABLE
ANONYMOUSLY
AFFECTING
WEB APPLICATION

Vulnerability Details

The following table list reported vulnerabilities for the period covered by this report:

Expand/Hide

36 Critical Vulnerabilities

DATE CVE VENDOR VULNERABILITY CVSS
2019-04-12 CVE-2019-10880 Xerox OS Command Injection vulnerability in Xerox products

Within multiple XEROX products a vulnerability allows remote command execution on the Linux system, as the "nobody" user through a crafted "HTTP" request (OS Command Injection vulnerability in the HTTP interface).

10.0
2019-04-12 CVE-2019-11196 Vpcsbd SQL Injection vulnerability in Vpcsbd Integrated University Management System

An authentication bypass vulnerability in all versions of ValuePLUS Integrated University Management System (IUMS) allows unauthenticated, remote attackers to gain administrator privileges via the Teachers Web Panel (TWP) User ID or Password field.

10.0
2019-04-11 CVE-2018-19300 D Link Improper Input Validation vulnerability in D-Link products

On D-Link DAP-1530 (A1) before firmware version 1.06b01, DAP-1610 (A1) before firmware version 1.06b01, DWR-111 (A1) before firmware version 1.02v02, DWR-116 (A1) before firmware version 1.06b03, DWR-512 (B1) before firmware version 2.02b01, DWR-711 (A1) through firmware version 1.11, DWR-712 (B1) before firmware version 2.04b01, DWR-921 (A1) before firmware version 1.02b01, and DWR-921 (B1) before firmware version 2.03b01, there exists an EXCU_SHELL file in the web directory.

10.0
2019-04-08 CVE-2019-11014 Vstarcam Improper Input Validation vulnerability in Vstarcam Eye4

The VStarCam vstc.vscam.client library and vstc.vscam shared object, as used in the Eye4 application (for Android, iOS, and Windows), do not prevent spoofing of the camera server.

10.0
2019-04-09 CVE-2019-0853 Microsoft Access of Uninitialized Pointer vulnerability in Microsoft products

A remote code execution vulnerability exists in the way that the Windows Graphics Device Interface (GDI) handles objects in the memory, aka 'GDI+ Remote Code Execution Vulnerability'.

9.3
2019-04-09 CVE-2019-0851 Microsoft Unspecified vulnerability in Microsoft products

A remote code execution vulnerability exists when the Windows Jet Database Engine improperly handles objects in memory, aka 'Jet Database Engine Remote Code Execution Vulnerability'.

9.3
2019-04-09 CVE-2019-0847 Microsoft Unspecified vulnerability in Microsoft products

A remote code execution vulnerability exists when the Windows Jet Database Engine improperly handles objects in memory, aka 'Jet Database Engine Remote Code Execution Vulnerability'.

9.3
2019-04-09 CVE-2019-0846 Microsoft Unspecified vulnerability in Microsoft products

A remote code execution vulnerability exists when the Windows Jet Database Engine improperly handles objects in memory, aka 'Jet Database Engine Remote Code Execution Vulnerability'.

9.3
2019-04-09 CVE-2019-0845 Microsoft Unspecified vulnerability in Microsoft products

A remote code execution vulnerability exists when the IOleCvt interface renders ASP webpage content, aka 'Windows IOleCvt Interface Remote Code Execution Vulnerability'.

9.3
2019-04-09 CVE-2019-0842 Microsoft Out-Of-Bounds Write vulnerability in Microsoft products

A remote code execution vulnerability exists in the way that the VBScript engine handles objects in memory, aka 'Windows VBScript Engine Remote Code Execution Vulnerability'.

9.3
2019-04-09 CVE-2019-0828 Microsoft Unspecified vulnerability in Microsoft Excel and Office 365 Proplus

A remote code execution vulnerability exists in Microsoft Excel software when the software fails to properly handle objects in memory, aka 'Microsoft Excel Remote Code Execution Vulnerability'.

9.3
2019-04-09 CVE-2019-0822 Microsoft Unspecified vulnerability in Microsoft Office and Office 365 Proplus

A remote code execution vulnerability exists in the way that Microsoft Graphics Components handle objects in memory, aka 'Microsoft Graphics Components Remote Code Execution Vulnerability'.

9.3
2019-04-09 CVE-2019-0795 Microsoft XXE vulnerability in Microsoft products

A remote code execution vulnerability exists when the Microsoft XML Core Services MSXML parser processes user input, aka 'MS XML Remote Code Execution Vulnerability'.

9.3
2019-04-09 CVE-2019-0794 Microsoft Unspecified vulnerability in Microsoft products

A remote code execution vulnerability exists when OLE automation improperly handles objects in memory, aka 'OLE Automation Remote Code Execution Vulnerability'.

9.3
2019-04-09 CVE-2019-0793 Microsoft XXE vulnerability in Microsoft products

A remote code execution vulnerability exists when the Microsoft XML Core Services MSXML parser processes user input, aka 'MS XML Remote Code Execution Vulnerability'.

9.3
2019-04-09 CVE-2019-0792 Microsoft XXE vulnerability in Microsoft products

A remote code execution vulnerability exists when the Microsoft XML Core Services MSXML parser processes user input, aka 'MS XML Remote Code Execution Vulnerability'.

9.3
2019-04-09 CVE-2019-0791 Microsoft XXE vulnerability in Microsoft products

A remote code execution vulnerability exists when the Microsoft XML Core Services MSXML parser processes user input, aka 'MS XML Remote Code Execution Vulnerability'.

9.3
2019-04-09 CVE-2019-0790 Microsoft XXE vulnerability in Microsoft products

A remote code execution vulnerability exists when the Microsoft XML Core Services MSXML parser processes user input, aka 'MS XML Remote Code Execution Vulnerability'.

9.3
2019-04-09 CVE-2017-17023 NCP E
Sophos
Insufficient Verification of Data Authenticity vulnerability in multiple products

The Sophos UTM VPN endpoint interacts with client software provided by NPC Engineering (www.ncp-e.com).

9.3
2019-04-09 CVE-2019-0772 Microsoft Out-Of-Bounds Write vulnerability in Microsoft products

A remote code execution vulnerability exists in the way that the VBScript engine handles objects in memory, aka 'Windows VBScript Engine Remote Code Execution Vulnerability'.

9.3
2019-04-09 CVE-2019-0765 Microsoft Out-Of-Bounds Write vulnerability in Microsoft products

A remote code execution vulnerability exists in the way that comctl32.dll handles objects in memory, aka 'Comctl32 Remote Code Execution Vulnerability'.

9.3
2019-04-09 CVE-2019-0756 Microsoft XXE vulnerability in Microsoft products

A remote code execution vulnerability exists when the Microsoft XML Core Services MSXML parser processes user input, aka 'MS XML Remote Code Execution Vulnerability'.

9.3
2019-04-09 CVE-2019-0748 Microsoft Unspecified vulnerability in Microsoft Office 2010

A remote code execution vulnerability exists when the Microsoft Office Access Connectivity Engine improperly handles objects in memory, aka 'Microsoft Office Access Connectivity Engine Remote Code Execution Vulnerability'.

9.3
2019-04-08 CVE-2019-0617 Microsoft Unspecified vulnerability in Microsoft products

A remote code execution vulnerability exists when the Windows Jet Database Engine improperly handles objects in memory, aka 'Jet Database Engine Remote Code Execution Vulnerability'.

9.3
2019-04-11 CVE-2018-20487 Inteno Improper Input Validation vulnerability in Inteno Iopsys

An issue was discovered in the firewall3 component in Inteno IOPSYS 1.0 through 3.16.

9.0
2019-04-11 CVE-2019-6610 F5 Unspecified vulnerability in F5 Big-Ip Access Policy Manager

On BIG-IP versions 14.0.0-14.0.0.4, 13.0.0-13.1.1.1, 12.1.0-12.1.4, 11.6.0-11.6.3.4, and 11.5.1-11.5.8, the system is vulnerable to a denial of service attack when performing URL classification.

9.0
2019-04-11 CVE-2019-3914 Verizon OS Command Injection vulnerability in Verizon Fios Quantum Gateway G1100 Firmware 02.01.00.05

Remote command injection vulnerability in Verizon Fios Quantum Gateway (G1100) firmware version 02.01.00.05 allows a remote, authenticated attacker to execute arbitrary commands on the target device by adding an access control rule for a network object with a crafted hostname.

9.0
2019-04-10 CVE-2019-5425 UI OS Command Injection vulnerability in UI Edgeswitch X 1.1.0

In Ubiquiti Networks EdgeSwitch X v1.1.0 and prior, an authenticated user can execute arbitrary shell commands over the SSH interface bypassing the CLI interface, which allow them to escalate privileges to root.

9.0
2019-04-10 CVE-2019-5424 UI OS Command Injection vulnerability in UI Edgeswitch X 1.1.0

In Ubiquiti Networks EdgeSwitch X v1.1.0 and prior, a privileged user can execute arbitrary shell commands over the SSH CLI interface.

9.0
2019-04-10 CVE-2019-4013 IBM Unrestricted Upload of File With Dangerous Type vulnerability in IBM Bigfix Platform

IBM BigFix Platform 9.5 could allow any authenticated user to upload any file to any location on the server with root privileges.

9.0
2019-04-10 CVE-2018-20321 Rancher Exposure of Resource TO Wrong Sphere vulnerability in Rancher

An issue was discovered in Rancher 2 through 2.1.5.

9.0
2019-04-09 CVE-2019-0856 Microsoft Unspecified vulnerability in Microsoft products

A remote code execution vulnerability exists when Windows improperly handles objects in memory, aka 'Windows Remote Code Execution Vulnerability'.

9.0
2019-04-09 CVE-2018-19586 Silverpeas Path Traversal vulnerability in Silverpeas

Silverpeas 5.15 through 6.0.2 is affected by an authenticated Directory Traversal vulnerability that can be triggered during file uploads because core/webapi/upload/FileUploadData.java mishandles a StringUtil.java call.

9.0
2019-04-09 CVE-2018-15640 Odoo Improper Privilege Management vulnerability in Odoo 10.0/11.0/12.0

Improper access control in the Helpdesk App of Odoo Enterprise 10.0 through 12.0 allows remote authenticated attackers to obtain elevated privileges via a crafted request.

9.0
2019-04-09 CVE-2017-17544 Fortinet Improper Privilege Management vulnerability in Fortinet Fortios

A privilege escalation vulnerability in Fortinet FortiOS 6.0.0 to 6.0.6, 5.6.0 to 5.6.10, 5.4 and below allows admin users to elevate their profile to super_admin via restoring modified configurations.

9.0
2019-04-08 CVE-2019-11001 Reolink OS Command Injection vulnerability in Reolink products

On Reolink RLC-410W, C1 Pro, C2 Pro, RLC-422W, and RLC-511W devices through 1.0.227, an authenticated admin can use the "TestEmail" functionality to inject and run OS commands as root, as demonstrated by shell metacharacters in the addr1 field.

9.0

75 High Vulnerabilities

DATE CVE VENDOR VULNERABILITY CVSS
2019-04-08 CVE-2019-0603 Microsoft Unspecified vulnerability in Microsoft products

A remote code execution vulnerability exists in the way that Windows Deployment Services TFTP Server handles objects in memory.

8.5
2019-04-09 CVE-2019-0862 Microsoft Out-Of-Bounds Write vulnerability in Microsoft Internet Explorer 10/11

A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Internet Explorer, aka 'Scripting Engine Memory Corruption Vulnerability'.

7.6
2019-04-09 CVE-2019-0861 Microsoft Out-Of-Bounds Write vulnerability in Microsoft Chakracore and Edge

A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka 'Chakra Scripting Engine Memory Corruption Vulnerability'.

7.6
2019-04-09 CVE-2019-0860 Microsoft Out-Of-Bounds Write vulnerability in Microsoft Chakracore and Edge

A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka 'Chakra Scripting Engine Memory Corruption Vulnerability'.

7.6
2019-04-09 CVE-2019-0829 Microsoft Out-Of-Bounds Write vulnerability in Microsoft Chakracore and Edge

A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka 'Chakra Scripting Engine Memory Corruption Vulnerability'.

7.6
2019-04-09 CVE-2019-0812 Microsoft Out-Of-Bounds Write vulnerability in Microsoft Chakracore and Edge

A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka 'Chakra Scripting Engine Memory Corruption Vulnerability'.

7.6
2019-04-09 CVE-2019-0810 Microsoft Type Confusion vulnerability in Microsoft Chakracore and Edge

A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka 'Chakra Scripting Engine Memory Corruption Vulnerability'.

7.6
2019-04-09 CVE-2019-0806 Microsoft Out-Of-Bounds Write vulnerability in Microsoft Chakracore and Edge

A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka 'Chakra Scripting Engine Memory Corruption Vulnerability'.

7.6
2019-04-09 CVE-2019-0753 Microsoft Out-Of-Bounds Write vulnerability in Microsoft Internet Explorer 10/11

A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Internet Explorer, aka 'Scripting Engine Memory Corruption Vulnerability'.

7.6
2019-04-09 CVE-2019-0752 Microsoft Type Confusion vulnerability in Microsoft Internet Explorer 10/11

A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Internet Explorer, aka 'Scripting Engine Memory Corruption Vulnerability'.

7.6
2019-04-09 CVE-2019-0739 Microsoft Out-Of-Bounds Write vulnerability in Microsoft Chakracore and Edge

A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Microsoft Edge, aka 'Scripting Engine Memory Corruption Vulnerability'.

7.6
2019-04-09 CVE-2019-0784 Microsoft Out-Of-Bounds Write vulnerability in Microsoft products

A remote code execution vulnerability exists in the way that the ActiveX Data objects (ADO) handles objects in memory, aka 'Windows ActiveX Remote Code Execution Vulnerability'.

7.6
2019-04-09 CVE-2019-0783 Microsoft Out-Of-Bounds Write vulnerability in Microsoft Internet Explorer 10/11

A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Internet Explorer, aka 'Scripting Engine Memory Corruption Vulnerability'.

7.6
2019-04-09 CVE-2019-0780 Microsoft Out-Of-Bounds Write vulnerability in Microsoft Edge and Internet Explorer

A remote code execution vulnerability exists in the way that Microsoft browsers access objects in memory, aka 'Microsoft Browser Memory Corruption Vulnerability'.

7.6
2019-04-09 CVE-2019-0779 Microsoft Out-Of-Bounds Write vulnerability in Microsoft Edge

A remote code execution vulnerability exists when Microsoft Edge improperly accesses objects in memory, aka 'Microsoft Edge Memory Corruption Vulnerability'.

7.6
2019-04-09 CVE-2019-0773 Microsoft Out-Of-Bounds Write vulnerability in Microsoft Chakracore and Edge

A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Microsoft Edge, aka 'Scripting Engine Memory Corruption Vulnerability'.

7.6
2019-04-09 CVE-2019-0771 Microsoft Out-Of-Bounds Write vulnerability in Microsoft Chakracore and Edge

A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Microsoft Edge, aka 'Scripting Engine Memory Corruption Vulnerability'.

7.6
2019-04-09 CVE-2019-0770 Microsoft Out-Of-Bounds Write vulnerability in Microsoft Edge

A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Microsoft Edge, aka 'Scripting Engine Memory Corruption Vulnerability'.

7.6
2019-04-09 CVE-2019-0769 Microsoft Out-Of-Bounds Write vulnerability in Microsoft Chakracore and Edge

A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Microsoft Edge, aka 'Scripting Engine Memory Corruption Vulnerability'.

7.6
2019-04-09 CVE-2019-0763 Microsoft Out-Of-Bounds Write vulnerability in Microsoft Internet Explorer 10/11

A remote code execution vulnerability exists when Internet Explorer improperly accesses objects in memory, aka 'Internet Explorer Memory Corruption Vulnerability'.

7.6
2019-04-09 CVE-2019-0680 Microsoft Out-Of-Bounds Write vulnerability in Microsoft Internet Explorer 11

A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Internet Explorer, aka 'Scripting Engine Memory Corruption Vulnerability'.

7.6
2019-04-08 CVE-2019-0667 Microsoft Out-Of-Bounds Write vulnerability in Microsoft Internet Explorer 10/11/9

A remote code execution vulnerability exists in the way that the VBScript engine handles objects in memory, aka 'Windows VBScript Engine Remote Code Execution Vulnerability'.

7.6
2019-04-08 CVE-2019-0666 Microsoft Out-Of-Bounds Write vulnerability in Microsoft Internet Explorer 10/11/9

A remote code execution vulnerability exists in the way that the VBScript engine handles objects in memory, aka 'Windows VBScript Engine Remote Code Execution Vulnerability'.

7.6
2019-04-08 CVE-2019-0665 Microsoft Out-Of-Bounds Write vulnerability in Microsoft Internet Explorer 10/11

A remote code execution vulnerability exists in the way that the VBScript engine handles objects in memory, aka 'Windows VBScript Engine Remote Code Execution Vulnerability'.

7.6
2019-04-08 CVE-2019-0639 Microsoft Integer Overflow OR Wraparound vulnerability in Microsoft Internet Explorer 11

A remote code execution vulnerability exists in the way that the ChakraCore scripting engine handles objects in memory, aka 'Scripting Engine Memory Corruption Vulnerability'.

7.6
2019-04-08 CVE-2019-0611 Microsoft Out-Of-Bounds Write vulnerability in Microsoft Chakracore and Edge

A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka 'Chakra Scripting Engine Memory Corruption Vulnerability'.

7.6
2019-04-08 CVE-2019-0609 Microsoft Out-Of-Bounds Write vulnerability in Microsoft Chakracore, Edge and Internet Explorer

A remote code execution vulnerability exists in the way the scripting engine handles objects in memory in Microsoft browsers, aka 'Scripting Engine Memory Corruption Vulnerability'.

7.6
2019-04-08 CVE-2019-0592 Microsoft Out-Of-Bounds Write vulnerability in Microsoft Chakracore and Edge

A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka 'Chakra Scripting Engine Memory Corruption Vulnerability'.

7.6
2019-04-12 CVE-2017-14199 Zephyrproject Improper Restriction of Operations Within the Bounds of A Memory Buffer vulnerability in Zephyrproject Zephyr 1.10.0/1.9.0

A buffer overflow has been found in the Zephyr Project's getaddrinfo() implementation in 1.9.0 and 1.10.0.

7.5
2019-04-11 CVE-2019-7644 Auth0 Information Exposure Through AN Error Message vulnerability in Auth0 Auth0-Wcf-Service-Jwt

Auth0 Auth0-WCF-Service-JWT before 1.0.4 leaks the expected JWT signature in an error message when it cannot successfully validate the JWT signature.

7.5
2019-04-11 CVE-2019-9733 Jfrog Unspecified vulnerability in Jfrog Artifactory 6.7.3

An issue was discovered in JFrog Artifactory 6.7.3.

7.5
2019-04-11 CVE-2019-5715 Silverstripe SQL Injection vulnerability in Silverstripe

All versions of SilverStripe 3 prior to 3.6.7 and 3.7.3, and all versions of SilverStripe 4 prior to 4.0.7, 4.1.5, 4.2.4, and 4.3.1 allows Reflected SQL Injection through Form and DataObject.

7.5
2019-04-11 CVE-2019-6318 HP Improper Verification of Cryptographic Signature vulnerability in HP products

HP LaserJet Enterprise printers, HP PageWide Enterprise printers, HP LaserJet Managed printers, HP Officejet Enterprise printers have an insufficient solution bundle signature validation that potentially allows execution of arbitrary code.

7.5
2019-04-10 CVE-2019-11072 Lighttpd Integer Overflow OR Wraparound vulnerability in Lighttpd

** DISPUTED ** lighttpd before 1.4.54 has a signed integer overflow, which might allow remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a malicious HTTP GET request, as demonstrated by mishandling of /%2F? in burl_normalize_2F_to_slash_fix in burl.c.

7.5
2019-04-10 CVE-2019-3943 Mikrotik Path Traversal vulnerability in Mikrotik Routeros

MikroTik RouterOS versions Stable 6.43.12 and below, Long-term 6.42.12 and below, and Testing 6.44beta75 and below are vulnerable to an authenticated, remote directory traversal via the HTTP or Winbox interfaces.

7.5
2019-04-10 CVE-2019-11068 Xmlsoft
Canonical
Debian
libxslt through 1.1.33 allows bypass of a protection mechanism because callers of xsltCheckRead and xsltCheckWrite permit access even upon receiving a -1 error code.
7.5
2019-04-10 CVE-2019-0036 Juniper Improper Check for Unusual OR Exceptional Conditions vulnerability in Juniper Junos

When configuring a stateless firewall filter in Junos OS, terms named using the format "internal-n" (e.g.

7.5
2019-04-10 CVE-2019-0008 Juniper Improper Restriction of Operations Within the Bounds of A Memory Buffer vulnerability in Juniper Junos

A certain sequence of valid BGP or IPv6 BFD packets may trigger a stack based buffer overflow in the Junos OS Packet Forwarding Engine manager (FXPC) process on QFX5000 series, EX4300, EX4600 devices.

7.5
2019-04-10 CVE-2005-3590 GNU Improper Restriction of Operations Within the Bounds of A Memory Buffer vulnerability in GNU Glibc

The getgrouplist function in the GNU C library (glibc) before version 2.3.5, when invoked with a zero argument, writes to the passed pointer even if the specified array size is zero, leading to a buffer overflow and potentially allowing attackers to corrupt memory.

7.5
2019-04-10 CVE-2019-10945 Joomla Path Traversal vulnerability in Joomla Joomla!

An issue was discovered in Joomla! before 3.9.5.

7.5
2019-04-10 CVE-2019-7139 Magento SQL Injection vulnerability in Magento

An unauthenticated user can execute SQL statements that allow arbitrary read access to the underlying database, which causes sensitive data leakage.

7.5
2019-04-10 CVE-2018-1994 IBM SQL Injection vulnerability in IBM products

IBM InfoSphere Information Server 11.5 and 11.7 is vulnerable to SQL injection.

7.5
2019-04-09 CVE-2019-6140 Forcepoint Unspecified vulnerability in Forcepoint Email Security 8.4/8.5/8.5.3

A configuration issue has been discovered in Forcepoint Email Security 8.4.x and 8.5.x: the product is left in a vulnerable state if the hybrid registration process is not completed.

7.5
2019-04-09 CVE-2019-0813 Microsoft Unspecified vulnerability in Microsoft Windows Admin Center

An elevation of privilege vulnerability exists when Windows Admin Center improperly impersonates operations in certain situations, aka 'Windows Admin Center Elevation of Privilege Vulnerability'.

7.5
2019-04-09 CVE-2019-0786 Microsoft Improper Input Validation vulnerability in Microsoft products

An elevation of privilege vulnerability exists in the Microsoft Server Message Block (SMB) Server when an attacker with valid credentials attempts to open a specially crafted file over the SMB protocol on the same machine, aka 'SMB Server Elevation of Privilege Vulnerability'.

7.5
2019-04-09 CVE-2018-16530 Forcepoint Out-Of-Bounds Write vulnerability in Forcepoint Email Security 8.4/8.5

A stack-based buffer overflow in Forcepoint Email Security version 8.5 allows an attacker to craft malicious input and potentially crash a process creating a denial-of-service.

7.5
2019-04-09 CVE-2019-9134 Solideos Out-Of-Bounds Write vulnerability in Solideos Architectural Information System 1.0

Architectural Information System 1.0 and earlier versions have a Stack-based buffer overflow, allows remote attackers to execute arbitrary code.

7.5
2019-04-09 CVE-2019-7174 Roxyfileman Unspecified vulnerability in Roxyfileman Roxy Fileman 1.4.5

Roxy Fileman 1.4.5 allows attackers to execute renamefile.php (aka Rename File), createdir.php (aka Create Directory), fileslist.php (aka Echo File List), and movefile.php (aka Move File) operations.

7.5
2019-04-09 CVE-2019-3940 Advantech Unrestricted Upload of File With Dangerous Type vulnerability in Advantech Webaccess 8.3.4

Advantech WebAccess 8.3.4 is vulnerable to file upload attacks via unauthenticated RPC call.

7.5
2019-04-09 CVE-2019-0726 Microsoft Out-Of-Bounds Write vulnerability in Microsoft products

A memory corruption vulnerability exists in the Windows DHCP client when an attacker sends specially crafted DHCP responses to a client, aka 'Windows DHCP Client Remote Code Execution Vulnerability'.

7.5
2019-04-09 CVE-2019-0698 Microsoft Out-Of-Bounds Write vulnerability in Microsoft products

A memory corruption vulnerability exists in the Windows DHCP client when an attacker sends specially crafted DHCP responses to a client, aka 'Windows DHCP Client Remote Code Execution Vulnerability'.

7.5
2019-04-09 CVE-2019-0697 Microsoft Out-Of-Bounds Write vulnerability in Microsoft products

A memory corruption vulnerability exists in the Windows DHCP client when an attacker sends specially crafted DHCP responses to a client, aka 'Windows DHCP Client Remote Code Execution Vulnerability'.

7.5
2019-04-08 CVE-2019-11005 Graphicsmagick
Opensuse
Out-Of-Bounds Write vulnerability in multiple products

In GraphicsMagick 1.4 snapshot-20190322 Q8, there is a stack-based buffer overflow in the function SVGStartElement of coders/svg.c, which allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a quoted font family value.

7.5
2019-04-08 CVE-2014-9186 Honeywell Improper Input Validation vulnerability in Honeywell Experion Process Knowledge System R400/R410/R430

A file inclusion vulnerability exists in the confd.exe module in Honeywell Experion PKS R40x before R400.6, R41x before R410.6, and R43x before R430.2, which could lead to accepting an arbitrary file into the function, and potential information disclosure or remote code execution.

7.5
2019-04-08 CVE-2014-5435 Honeywell Out-Of-Bounds Write vulnerability in Honeywell Experion Process Knowledge System R400/R410/R430

An arbitrary memory write vulnerability exists in the dual_onsrv.exe module in Honeywell Experion PKS R40x before R400.6, R41x before R410.6, and R43x before R430.2, that could lead to possible remote code execution or denial of service.

7.5
2019-04-08 CVE-2019-4155 IBM Unspecified vulnerability in IBM API Connect

IBM API Connect's Developer Portal 2018.1 and 2018.4.1.3 is impacted by a privilege escalation vulnerability when integrated with an OpenID Connect (OIDC) user registry.

7.5
2019-04-08 CVE-2017-7912 Hanwhasecurity Improper Authentication vulnerability in Hanwhasecurity Srn-4000 Firmware

Hanwha Techwin SRN-4000, SRN-4000 firmware versions prior to SRN4000_v2.16_170401, A specially crafted http request and response could allow an attacker to gain access to the device management page with admin privileges without proper authentication.

7.5
2019-04-08 CVE-2019-10914 Matrixssl Improper Certificate Validation vulnerability in Matrixssl

pubRsaDecryptSignedElementExt in MatrixSSL 4.0.1 Open, as used in Inside Secure TLS Toolkit, has a stack-based buffer overflow during X.509 certificate verification because of missing validation in psRsaDecryptPubExt in crypto/pubkey/rsa_pub.c.

7.5
2019-04-11 CVE-2019-5024 Capsuletech Improper Input Validation vulnerability in Capsuletech Smartlinx Neuron 2 Firmware 6.9.1

A restricted environment escape vulnerability exists in the “kiosk mode” function of Capsule Technologies SmartLinx Neuron 2 medical information collection devices running versions 9.0.3 or lower.

7.2
2019-04-10 CVE-2019-0035 Juniper Insufficiently Protected Credentials vulnerability in Juniper Junos 15.1/15.1X49/15.1X53

When "set system ports console insecure" is enabled, root login is disallowed for Junos OS as expected.

7.2
2019-04-10 CVE-2018-1903 IBM Unspecified vulnerability in IBM Sterling Connect:Direct 4.2.0/4.3.0/6.0.0

IBM Sterling Connect:Direct for UNIX 4.2.0, 4.3.0, and 6.0.0 could allow a user with restricted sudo access on a system to manipulate CD UNIX to gain full sudo access.

7.2
2019-04-09 CVE-2019-0879 Microsoft Unspecified vulnerability in Microsoft products

A remote code execution vulnerability exists when the Windows Jet Database Engine improperly handles objects in memory, aka 'Jet Database Engine Remote Code Execution Vulnerability'.

7.2
2019-04-09 CVE-2019-0877 Microsoft Unspecified vulnerability in Microsoft products

A remote code execution vulnerability exists when the Windows Jet Database Engine improperly handles objects in memory, aka 'Jet Database Engine Remote Code Execution Vulnerability'.

7.2
2019-04-09 CVE-2019-0859 Microsoft Unspecified vulnerability in Microsoft products

An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in memory, aka 'Win32k Elevation of Privilege Vulnerability'.

7.2
2019-04-09 CVE-2019-0841 Microsoft Link Following vulnerability in Microsoft products

An elevation of privilege vulnerability exists when Windows AppX Deployment Service (AppXSVC) improperly handles hard links, aka 'Windows Elevation of Privilege Vulnerability'.

7.2
2019-04-09 CVE-2019-0803 Microsoft Unspecified vulnerability in Microsoft products

An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in memory, aka 'Win32k Elevation of Privilege Vulnerability'.

7.2
2019-04-09 CVE-2019-0735 Microsoft Improper Privilege Management vulnerability in Microsoft products

An elevation of privilege vulnerability exists when the Windows Client Server Run-Time Subsystem (CSRSS) fails to properly handle objects in memory, aka 'Windows CSRSS Elevation of Privilege Vulnerability'.

7.2
2019-04-09 CVE-2019-0685 Microsoft Unspecified vulnerability in Microsoft products

An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in memory, aka 'Win32k Elevation of Privilege Vulnerability'.

7.2
2019-04-09 CVE-2019-5512 Vmware
Microsoft
Unspecified vulnerability in VMWare Workstation

VMware Workstation (15.x before 15.0.3, 14.x before 14.1.6) running on Windows does not handle COM classes appropriately.

7.2
2019-04-09 CVE-2019-5511 Vmware
Microsoft
Unspecified vulnerability in VMWare Workstation

VMware Workstation (15.x before 15.0.3, 14.x before 14.1.6) running on Windows does not handle paths appropriately.

7.2
2019-04-09 CVE-2019-0808 Microsoft Unspecified vulnerability in Microsoft Windows 7 and Windows Server 2008

An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in memory, aka 'Win32k Elevation of Privilege Vulnerability'.

7.2
2019-04-09 CVE-2019-0797 Microsoft Unspecified vulnerability in Microsoft products

An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in memory, aka 'Win32k Elevation of Privilege Vulnerability'.

7.2
2019-04-09 CVE-2019-0766 Microsoft Unspecified vulnerability in Microsoft products

An elevation of privilege vulnerability exists in Windows AppX Deployment Server that allows file creation in arbitrary locations.

7.2
2019-04-09 CVE-2019-0696 Microsoft Unspecified vulnerability in Microsoft products

An elevation of privilege vulnerability exists when the Windows kernel fails to properly handle objects in memory, aka 'Windows Kernel Elevation of Privilege Vulnerability'.

7.2
2019-04-08 CVE-2019-0211 Apache
Fedoraproject
Canonical
Debian
Opensuse
USE After Free vulnerability in multiple products

In Apache HTTP Server 2.4 releases 2.4.17 to 2.4.38, with MPM event, worker or prefork, code executing in less-privileged child processes or threads (including scripts executed by an in-process scripting interpreter) could execute arbitrary code with the privileges of the parent process (usually root) by manipulating the scoreboard.

7.2

192 Medium Vulnerabilities

DATE CVE VENDOR VULNERABILITY CVSS
2019-04-12 CVE-2017-7772 Mozilla
SIL
Improper Restriction of Operations Within the Bounds of A Memory Buffer vulnerability in multiple products

Heap-based Buffer Overflow in Graphite2 library in Firefox before 54 in lz4::decompress function.

6.8
2019-04-12 CVE-2019-11213 Pulsesecure Session Fixation vulnerability in Pulsesecure Pulse Connect Secure and Pulse Secure Desktop Client

In Pulse Secure Pulse Desktop Client and Network Connect, an attacker could access session tokens to replay and spoof sessions, and as a result, gain unauthorized access as an end user, a related issue to CVE-2019-1573.

6.8
2019-04-11 CVE-2019-6534 Gemalto Uncontrolled Search Path Element vulnerability in Gemalto Sentinel Ultrapro Client Library 1.3.0/1.3.1/1.3.2

The uncontrolled search path element vulnerability in Gemalto Sentinel UltraPro Client Library ux32w.dll Versions 1.3.0, 1.3.1, and 1.3.2 enables an attacker to load and execute a malicious file.

6.8
2019-04-11 CVE-2019-11078 Mkcms Project Cross-Site Request Forgery (CSRF) vulnerability in Mkcms Project Mkcms 5.0

MKCMS V5.0 has a CSRF vulnerability to add a new admin user via the ucenter/userinfo.php URI.

6.8
2019-04-11 CVE-2019-11077 Fastadmin Cross-Site Request Forgery (CSRF) vulnerability in Fastadmin 1.0.0.20190111

FastAdmin V1.0.0.20190111_beta has a CSRF vulnerability to add a new admin user via the admin/auth/admin/add?dialog=1 URI.

6.8
2019-04-10 CVE-2019-1003049 Jenkins Improper Authentication vulnerability in Jenkins

Users who cached their CLI authentication before Jenkins was updated to 2.150.2 and newer, or 2.160 and newer, would remain authenticated in Jenkins 2.171 and earlier and Jenkins LTS 2.164.1 and earlier, because the fix for CVE-2019-1003004 in these releases did not reject existing remoting-based CLI authentication caches.

6.8
2019-04-10 CVE-2018-19453 Kentico Unrestricted Upload of File With Dangerous Type vulnerability in Kentico CMS

Kentico CMS before 11.0.45 allows unrestricted upload of a file with a dangerous type.

6.8
2019-04-10 CVE-2019-6556 Omron USE After Free vulnerability in Omron Common Components and Cx-Programmer

When processing project files, the application (Omron CX-Programmer v9.70 and prior and Common Components January 2019 and prior) fails to check if it is referencing freed memory.

6.8
2019-04-10 CVE-2019-0229 Apache Cross-Site Request Forgery (CSRF) vulnerability in Apache Airflow

A number of HTTP endpoints in the Airflow webserver (both RBAC and classic) did not have adequate protection and were vulnerable to cross-site request forgery attacks.

6.8
2019-04-10 CVE-2019-6154 Lenovo Untrusted Search Path vulnerability in Lenovo Bootable USB

A DLL search path vulnerability was reported in Lenovo Bootable Generator, prior to version Mar-2019, that could allow a malicious user with local access to execute code on the system.

6.8
2019-04-09 CVE-2019-0827 Microsoft Unspecified vulnerability in Microsoft Office and Office 365 Proplus

A remote code execution vulnerability exists when the Microsoft Office Access Connectivity Engine improperly handles objects in memory, aka 'Microsoft Office Access Connectivity Engine Remote Code Execution Vulnerability'.

6.8
2019-04-09 CVE-2019-0826 Microsoft Unspecified vulnerability in Microsoft Office and Office 365 Proplus

A remote code execution vulnerability exists when the Microsoft Office Access Connectivity Engine improperly handles objects in memory, aka 'Microsoft Office Access Connectivity Engine Remote Code Execution Vulnerability'.

6.8
2019-04-09 CVE-2019-0825 Microsoft Unspecified vulnerability in Microsoft Office and Office 365 Proplus

A remote code execution vulnerability exists when the Microsoft Office Access Connectivity Engine improperly handles objects in memory, aka 'Microsoft Office Access Connectivity Engine Remote Code Execution Vulnerability'.

6.8
2019-04-09 CVE-2019-0824 Microsoft Unspecified vulnerability in Microsoft Office and Office 365 Proplus

A remote code execution vulnerability exists when the Microsoft Office Access Connectivity Engine improperly handles objects in memory, aka 'Microsoft Office Access Connectivity Engine Remote Code Execution Vulnerability'.

6.8
2019-04-09 CVE-2019-0823 Microsoft Unspecified vulnerability in Microsoft Office 2010

A remote code execution vulnerability exists when the Microsoft Office Access Connectivity Engine improperly handles objects in memory, aka 'Microsoft Office Access Connectivity Engine Remote Code Execution Vulnerability'.

6.8
2019-04-09 CVE-2019-0801 Microsoft Data Processing Errors vulnerability in Microsoft Office and Office 365 Proplus

A remote code execution vulnerability exists when Microsoft Office fails to properly handle certain files.To exploit the vulnerability, an attacker would have to convince a user to open a specially crafted URL file that points to an Excel or PowerPoint file that was also downloaded.The update addresses the vulnerability by correcting how Office handles these files., aka 'Office Remote Code Execution Vulnerability'.

6.8
2019-04-09 CVE-2019-7361 Autodesk Deserialization of Untrusted Data vulnerability in Autodesk products

An attacker may convince a victim to open a malicious action micro (.actm) file that has serialized data, which may trigger a code execution in Autodesk Advance Steel 2018, Autodesk AutoCAD 2018, Autodesk AutoCAD Architecture 2018, Autodesk AutoCAD Electrical 2018, Autodesk AutoCAD Map 3D 2018, Autodesk AutoCAD Mechanical 2018, Autodesk AutoCAD MEP 2018, Autodesk AutoCAD P&ID 2018, Autodesk AutoCAD Plant 3D 2018, Autodesk AutoCAD LT 2018, and Autodesk Civil 3D 2018.

6.8
2019-04-09 CVE-2019-7360 Autodesk USE After Free vulnerability in Autodesk products

An exploitable use-after-free vulnerability in the DXF-parsing functionality in Autodesk Advance Steel 2018, Autodesk AutoCAD 2018, Autodesk AutoCAD Architecture 2018, Autodesk AutoCAD Electrical 2018, Autodesk AutoCAD Map 3D 2018, Autodesk AutoCAD Mechanical 2018, Autodesk AutoCAD MEP 2018, Autodesk AutoCAD P&ID 2018, Autodesk AutoCAD Plant 3D 2018, Autodesk AutoCAD LT 2018, and Autodesk Civil 3D 2018.

6.8
2019-04-09 CVE-2019-7359 Autodesk Out-Of-Bounds Write vulnerability in Autodesk products

An exploitable heap overflow vulnerability in the AcCellMargin handling code in Autodesk Advance Steel 2018, Autodesk AutoCAD 2018, Autodesk AutoCAD Architecture 2018, Autodesk AutoCAD Electrical 2018, Autodesk AutoCAD Map 3D 2018, Autodesk AutoCAD Mechanical 2018, Autodesk AutoCAD MEP 2018, Autodesk AutoCAD P&ID 2018, Autodesk AutoCAD Plant 3D 2018, Autodesk AutoCAD LT 2018, and Autodesk Civil 3D 2018.

6.8
2019-04-09 CVE-2019-7358 Autodesk Out-Of-Bounds Write vulnerability in Autodesk products

An exploitable heap overflow vulnerability in the DXF-parsing functionality in Autodesk Advance Steel 2018, Autodesk AutoCAD 2018, Autodesk AutoCAD Architecture 2018, Autodesk AutoCAD Electrical 2018, Autodesk AutoCAD Map 3D 2018, Autodesk AutoCAD Mechanical 2018, Autodesk AutoCAD MEP 2018, Autodesk AutoCAD P&ID 2018, Autodesk AutoCAD Plant 3D 2018, Autodesk AutoCAD LT 2018, and Autodesk Civil 3D 2018.

6.8
2019-04-09 CVE-2019-8990 Tibco Improper Authentication vulnerability in Tibco Activematrix Businessworks

The HTTP Connector component of TIBCO Software Inc.'s TIBCO ActiveMatrix BusinessWorks contains a vulnerability that theoretically allows unauthenticated HTTP requests to be processed by the BusinessWorks engine even when authentication is required.

6.8
2019-04-09 CVE-2019-0809 Microsoft Untrusted Search Path vulnerability in Microsoft Visual Studio 2017 15.9

A remote code execution vulnerability exists when the Visual Studio C++ Redistributable Installer improperly validates input before loading dynamic link library (DLL) files, aka 'Visual Studio Remote Code Execution Vulnerability'.

6.8
2019-04-08 CVE-2019-11023 Graphviz Null Pointer Dereference vulnerability in Graphviz 2.39.20160612.1140

The agroot() function in cgraph\obj.c in libcgraph.a in Graphviz 2.39.20160612.1140 has a NULL pointer dereference, as demonstrated by graphml2gv.

6.8
2019-04-08 CVE-2019-1785 Clamav Path Traversal vulnerability in Clamav 0.101.0/0.101.1

A vulnerability in the RAR file scanning functionality of Clam AntiVirus (ClamAV) Software versions 0.101.1 and 0.101.0 could allow an unauthenticated, remote attacker to cause a denial of service condition on an affected device.

6.8
2019-04-08 CVE-2019-11008 Graphicsmagick
Opensuse
Debian
Out-Of-Bounds Write vulnerability in multiple products

In GraphicsMagick 1.4 snapshot-20190322 Q8, there is a heap-based buffer overflow in the function WriteXWDImage of coders/xwd.c, which allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted image file.

6.8
2019-04-08 CVE-2018-2000 IBM Cross-Site Request Forgery (CSRF) vulnerability in IBM products

IBM Business Automation Workflow 18.0.0.0 and 18.0.0.1 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts.

6.8
2019-04-11 CVE-2019-9056 Cmsmadesimple Deserialization of Untrusted Data vulnerability in Cmsmadesimple CMS Made Simple 2.2.8

An issue was discovered in CMS Made Simple 2.2.8.

6.5
2019-04-11 CVE-2018-17305 Uipath Incorrect Permission Assignment FOR Critical Resource vulnerability in Uipath Orchestrator

UiPath Orchestrator through 2018.2.4 allows any authenticated user to change the information of arbitrary users (even administrators) leading to privilege escalation and remote code execution.

6.5
2019-04-10 CVE-2019-11071 Spip
Debian
Improper Input Validation vulnerability in multiple products

SPIP 3.1 before 3.1.10 and 3.2 before 3.2.4 allows authenticated visitors to execute arbitrary code on the host server because var_memotri is mishandled.

6.5
2019-04-10 CVE-2019-0279 SAP Missing Authorization vulnerability in SAP Business Application Software Integrated Solution

ABAP BASIS function modules INST_CREATE_R3_RFC_DEST, INST_CREATE_TCPIP_RFCDEST, and INST_CREATE_TCPIP_RFC_DEST in SAP BASIS (fixed in versions 7.0 to 7.02, 7.10 to 7.30, 7.31, 7.40, 7.50 to 7.53) do not perform necessary authorization checks in all circumstances for an authenticated user, resulting in escalation of privileges.

6.5
2019-04-10 CVE-2019-6287 Rancher Improper Privilege Management vulnerability in Rancher

In Rancher 2.0.0 through 2.1.5, project members have continued access to create, update, read, and delete namespaces in a project after they have been removed from it.

6.5
2019-04-09 CVE-2019-11028 Gatship Unrestricted Upload of File With Dangerous Type vulnerability in Gatship web Module 1.30/1.39

GAT-Ship Web Module before 1.40 suffers from a vulnerability allowing authenticated attackers to upload any file type to the server via the "Documents" area.

6.5
2019-04-09 CVE-2019-10633 Zyxel Code Injection vulnerability in Zyxel Nas326 Firmware

An eval injection vulnerability in the Python web server routing on the Zyxel NAS 326 version 5.21 and below allows a remote authenticated attacker to execute arbitrary code via the tjp6jp6y4, simZysh, and ck6fup6 APIs.

6.5
2019-04-09 CVE-2019-10631 Zyxel OS Command Injection vulnerability in Zyxel Nas326 Firmware

Shell Metacharacter Injection in the package installer on Zyxel NAS 326 version 5.21 and below allows an authenticated attacker to execute arbitrary code via multiple different requests.

6.5
2019-04-11 CVE-2019-9974 Dasannetworks Missing Authentication FOR Critical Function vulnerability in Dasannetworks H660Rm Firmware 1.030022

diag_tool.cgi on DASAN H660RM GPON routers with firmware 1.03-0022 lacks any authorization check, which allows remote attackers to run a ping command via a GET request to enumerate LAN devices or crash the router with a DoS attack.

6.4
2019-04-11 CVE-2019-5672 Nvidia KEY Management Errors vulnerability in Nvidia Jetson TX1 and Jetson TX2

NVIDIA Jetson TX1 and TX2 contain a vulnerability in the Linux for Tegra (L4T) operating system (on all versions prior to R28.3) where the Secure Shell (SSH) keys provided in the sample rootfs are not replaced by unique host keys after sample rootsfs generation and flashing, which may lead to information disclosure.

6.4
2019-04-10 CVE-2019-0040 Juniper Improper Input Validation vulnerability in Juniper Junos

On Junos OS, rpcbind should only be listening to port 111 on the internal routing instance (IRI).

6.4
2019-04-09 CVE-2019-3941 Advantech Missing Authentication FOR Critical Function vulnerability in Advantech Webaccess 8.3.4

Advantech WebAccess 8.3.4 allows unauthenticated, remote attackers to delete arbitrary files via IOCTL 10005 RPC.

6.4
2019-04-08 CVE-2019-11006 Graphicsmagick
Opensuse
Debian
Out-Of-Bounds Read vulnerability in multiple products

In GraphicsMagick 1.4 snapshot-20190322 Q8, there is a heap-based buffer over-read in the function ReadMIFFImage of coders/miff.c, which allows attackers to cause a denial of service or information disclosure via an RLE packet.

6.4
2019-04-10 CVE-2019-0038 Juniper Resource Management Errors vulnerability in Juniper Junos

Crafted packets destined to the management interface (fxp0) of an SRX340 or SRX345 services gateway may create a denial of service (DoS) condition due to buffer space exhaustion.

6.1
2019-04-10 CVE-2019-7551 Cantemo Cross-Site Scripting vulnerability in Cantemo Portal

Cantemo Portal before 3.2.13, 3.3.x before 3.3.8, and 3.4.x before 3.4.9 has XSS.

6.0
2019-04-08 CVE-2019-0217 Apache
Debian
Fedoraproject
Canonical
Redhat
Opensuse
Netapp
Oracle
Race Condition vulnerability in multiple products

In Apache HTTP Server 2.4 release 2.4.38 and prior, a race condition in mod_auth_digest when running in a threaded server could allow a user with valid credentials to authenticate using another username, bypassing configured access control restrictions.

6.0
2019-04-08 CVE-2019-0215 Apache
Fedoraproject
In Apache HTTP Server 2.4 releases 2.4.37 and 2.4.38, a bug in mod_ssl when using per-location client certificate verification with TLSv1.3 allowed a client to bypass configured access control restrictions.
6.0
2019-04-10 CVE-2019-5426 UI Improper Authentication vulnerability in UI Edgeswitch X 1.1.0

In Ubiquiti Networks EdgeSwitch X v1.1.0 and prior, an unauthenticated user can use the "local port forwarding" and "dynamic port forwarding" (SOCKS proxy) functionalities.

5.8
2019-04-09 CVE-2019-0817 Microsoft Data Processing Errors vulnerability in Microsoft Exchange Server

A spoofing vulnerability exists in Microsoft Exchange Server when Outlook Web Access (OWA) fails to properly handle web requests, aka 'Microsoft Exchange Spoofing Vulnerability'.

5.8
2019-04-08 CVE-2019-11016 Elgg Open Redirect vulnerability in Elgg

Elgg before 1.12.18 and 2.3.x before 2.3.11 has an open redirect.

5.8
2019-04-08 CVE-2019-11009 Graphicsmagick
Opensuse
Debian
Out-Of-Bounds Read vulnerability in multiple products

In GraphicsMagick 1.4 snapshot-20190322 Q8, there is a heap-based buffer over-read in the function ReadXWDImage of coders/xwd.c, which allows attackers to cause a denial of service or information disclosure via a crafted image file.

5.8
2019-04-08 CVE-2019-11007 Graphicsmagick
Opensuse
Debian
Out-Of-Bounds Read vulnerability in multiple products

In GraphicsMagick 1.4 snapshot-20190322 Q8, there is a heap-based buffer over-read in the ReadMNGImage function of coders/png.c, which allows attackers to cause a denial of service or information disclosure via an image colormap.

5.8
2019-04-10 CVE-2019-0283 SAP Authentication Bypass BY Spoofing vulnerability in SAP Netweaver Process Integration

SAP NetWeaver Process Integration (Adapter Engine), fixed in versions 7.10 to 7.11, 7.30, 7.31, 7.40, 7.50; is vulnerable to Digital Signature Spoofing.

5.5
2019-04-09 CVE-2018-19589 Utimaco Incorrect Permission Assignment FOR Critical Resource vulnerability in Utimaco Securityserver CSE Firmware

Incorrect Access Controls of Security Officer (SO) in PKCS11 R2 provider that ships with the Utimaco CryptoServer HSM product package allows an SO authenticated to a slot to retrieve attributes of keys marked as private keys in external key storage, and also delete keys marked as private keys in external key storage.

5.5
2019-04-09 CVE-2019-3880 Samba
Debian
Redhat
Fedoraproject
Opensuse
Path Traversal vulnerability in multiple products

A flaw was found in the way samba implemented an RPC endpoint emulating the Windows registry service API.

5.5
2019-04-09 CVE-2019-0701 Microsoft Improper Input Validation vulnerability in Microsoft products

A denial of service vulnerability exists when Microsoft Hyper-V on a host server fails to properly validate input from a privileged user on a guest operating system, aka 'Windows Hyper-V Denial of Service Vulnerability'.

5.5
2019-04-09 CVE-2019-0695 Microsoft Improper Input Validation vulnerability in Microsoft products

A denial of service vulnerability exists when Microsoft Hyper-V on a host server fails to properly validate input from a privileged user on a guest operating system, aka 'Windows Hyper-V Denial of Service Vulnerability'.

5.5
2019-04-09 CVE-2019-0690 Microsoft Improper Input Validation vulnerability in Microsoft products

A denial of service vulnerability exists when Microsoft Hyper-V Network Switch on a host server fails to properly validate input from a privileged user on a guest operating system, aka 'Windows Hyper-V Denial of Service Vulnerability'.

5.5
2019-04-08 CVE-2019-4210 IBM Unspecified vulnerability in IBM Qradar Security Information and Event Manager 7.3.2

IBM QRadar SIEM 7.3.2 could allow a user to bypass authentication exposing certain functionality which could lead to information disclosure or modification of application configuration.

5.5
2019-04-11 CVE-2019-3915 Verizon Authentication Bypass BY Capture-Replay vulnerability in Verizon Fios Quantum Gateway G1100 Firmware 02.01.00.05

Authentication Bypass by Capture-replay vulnerability in Verizon Fios Quantum Gateway (G1100) firmware version 02.01.00.05 allows an unauthenticated attacker with adjacent network access to intercept and replay login requests to gain access to the administrative web interface.

5.4
2019-04-11 CVE-2019-3845 Redhat Unspecified vulnerability in Redhat Satellite

A lack of access control was found in the message queues maintained by Satellite's QPID broker and used by katello-agent in versions before Satellite 6.2, Satellite 6.1 optional and Satellite Capsule 6.1.

5.2
2019-04-11 CVE-2019-9628 Xmltooling Project
Canonical
Opensuse
Improper Input Validation vulnerability in multiple products

The XMLTooling library all versions prior to V3.0.4, provided with the OpenSAML and Shibboleth Service Provider software, contains an XML parsing class.

5.0
2019-04-11 CVE-2019-9975 Dasannetworks USE of Hard-Coded Credentials vulnerability in Dasannetworks H660Rm Firmware 1.030022

DASAN H660RM devices with firmware 1.03-0022 use a hard-coded key for logs encryption.

5.0
2019-04-11 CVE-2019-3916 Verizon Forced Browsing vulnerability in Verizon Fios Quantum Gateway G1100 Firmware 02.01.00.05

Information disclosure vulnerability in Verizon Fios Quantum Gateway (G1100) firmware version 02.01.00.05 allows an remote, unauthenticated attacker to retrieve the value of the password salt by simply requesting an API URL in a web browser (e.g.

5.0
2019-04-10 CVE-2019-11070 Webkitgtk
Wpewebkit
Data Processing Errors vulnerability in multiple products

WebKitGTK and WPE WebKit prior to version 2.24.1 failed to properly apply configured HTTP proxy settings when downloading livestream video (HLS, DASH, or Smooth Streaming), an error resulting in deanonymization.

5.0
2019-04-10 CVE-2019-11069 Sequelizejs Improper Input Validation vulnerability in Sequelizejs Sequelize

Sequelize version 5 before 5.3.0 does not properly ensure that standard conforming strings are used.

5.0
2019-04-10 CVE-2019-0285 SAP Cleartext Storage of Sensitive Information vulnerability in SAP Crystal Reports 2010

The .NET SDK WebForm Viewer in SAP Crystal Reports for Visual Studio (fixed in version 2010) discloses sensitive database information including credentials which can be misused by the attacker.

5.0
2019-04-10 CVE-2019-0282 SAP Improper Authentication vulnerability in SAP Netweaver Process Integration

Several web pages in SAP NetWeaver Process Integration (Runtime Workbench), fixed in versions 7.10 to 7.11, 7.30, 7.31, 7.40, 7.50; can be accessed without user authentication, which might expose internal data like release information, Java package and Java object names which can be misused by the attacker.

5.0
2019-04-10 CVE-2019-0044 Juniper Improper Input Validation vulnerability in Juniper Junos 12.1X46/12.3X48/15.1X49

Receipt of a specific packet on the out-of-band management interface fxp0 may cause the system to crash and restart (vmcore).

5.0
2019-04-10 CVE-2019-0043 Juniper Improper Input Validation vulnerability in Juniper Junos

In MPLS environments, receipt of a specific SNMP packet may cause the routing protocol daemon (RPD) process to crash and restart.

5.0
2019-04-10 CVE-2019-0041 Juniper 7PK - Security Features vulnerability in Juniper Junos 18.2

On EX4300-MP Series devices with any lo0 filters applied, transit network traffic may reach the control plane via loopback interface (lo0).

5.0
2019-04-10 CVE-2019-0037 Juniper Improper Input Validation vulnerability in Juniper Junos

In a Dynamic Host Configuration Protocol version 6 (DHCPv6) environment, the jdhcpd daemon may crash and restart upon receipt of certain DHCPv6 solicit messages received from a DHCPv6 client.

5.0
2019-04-10 CVE-2019-0033 Juniper Resource Exhaustion vulnerability in Juniper Junos

A firewall bypass vulnerability in the proxy ARP service of Juniper Networks Junos OS allows an attacker to cause a high CPU condition leading to a Denial of Service (DoS).

5.0
2019-04-10 CVE-2019-0031 Juniper Resource Management Errors vulnerability in Juniper Junos 17.4/18.1

Specific IPv6 DHCP packets received by the jdhcpd daemon will cause a memory resource consumption issue to occur on a Junos OS device using the jdhcpd daemon configured to respond to IPv6 requests.

5.0
2019-04-10 CVE-2019-0028 Juniper Improper Input Validation vulnerability in Juniper Junos

On Junos devices with the BGP graceful restart helper mode enabled or the BGP graceful restart mechanism enabled, a BGP session restart on a remote peer that has the graceful restart mechanism enabled may cause the local routing protocol daemon (RPD) process to crash and restart.

5.0
2019-04-10 CVE-2019-0019 Juniper Improper Input Validation vulnerability in Juniper Junos

When BGP tracing is enabled an incoming BGP message may cause the Junos OS routing protocol daemon (rpd) process to crash and restart.

5.0
2019-04-10 CVE-2019-10946 Joomla Missing Authentication FOR Critical Function vulnerability in Joomla Joomla!

An issue was discovered in Joomla! before 3.9.5.

5.0
2019-04-10 CVE-2019-0199 Apache Resource Exhaustion vulnerability in Apache Tomcat

The HTTP/2 implementation in Apache Tomcat 9.0.0.M1 to 9.0.14 and 8.5.0 to 8.5.37 accepted streams with excessive numbers of SETTINGS frames and also permitted clients to keep streams open without reading/writing request/response data.

5.0
2019-04-09 CVE-2019-0875 Microsoft Unspecified vulnerability in Microsoft Azure Devops Server 2019

An elevation of privilege vulnerability exists when Azure DevOps Server 2019 does not properly enforce project permissions, aka 'Azure DevOps Server Elevation of Privilege Vulnerability'.

5.0
2019-04-09 CVE-2019-0815 Microsoft Data Processing Errors vulnerability in Microsoft Asp.Net Core 2.2

A denial of service vulnerability exists when ASP.NET Core improperly handles web requests, aka 'ASP.NET Core Denial of Service Vulnerability'.

5.0
2019-04-09 CVE-2019-0688 Microsoft USE of A Broken OR Risky Cryptographic Algorithm vulnerability in Microsoft products

An information disclosure vulnerability exists when the Windows TCP/IP stack improperly handles fragmented IP packets, aka 'Windows TCP/IP Information Disclosure Vulnerability'.

5.0
2019-04-09 CVE-2019-5513 Vmware
Microsoft
Unspecified vulnerability in VMWare Horizon

VMware Horizon Connection Server (7.x before 7.8, 7.5.x before 7.5.2, 6.x before 6.2.8) contains an information disclosure vulnerability.

5.0
2019-04-09 CVE-2018-18365 Symantec Unspecified vulnerability in Symantec Norton Password Manager

Norton Password Manager may be susceptible to an address spoofing issue.

5.0
2019-04-09 CVE-2017-3139 ISC
Redhat
Reachable Assertion vulnerability in multiple products

A denial of service flaw was found in the way BIND handled DNSSEC validation.

5.0
2019-04-09 CVE-2018-13366 Fortinet Information Exposure vulnerability in Fortinet Fortios

An information disclosure vulnerability in Fortinet FortiOS 6.0.1, 5.6.7 and below allows attacker to reveals serial number of FortiGate via hostname field defined in connection control setup packets of PPTP protocol.

5.0
2019-04-09 CVE-2019-3795 Pivotal Software Insufficient Entropy in PRNG vulnerability in Pivotal Software Spring Security

Spring Security versions 4.2.x prior to 4.2.12, 5.0.x prior to 5.0.12, and 5.1.x prior to 5.1.5 contain an insecure randomness vulnerability when using SecureRandomFactoryBean#setSeed to configure a SecureRandom instance.

5.0
2019-04-09 CVE-2019-10244 Eclipse XXE vulnerability in Eclipse Kura 2.0.2/4.0.0

In Eclipse Kura versions up to 4.0.0, the Web UI package and component services, the Artemis simple Mqtt component and the emulator position service (not part of the device distribution) could potentially be target of XXE attack due to an improper factory and parser initialisation.

5.0
2019-04-09 CVE-2019-10243 Eclipse Information Exposure vulnerability in Eclipse Kura 2.0.2/4.0.0

In Eclipse Kura versions up to 4.0.0, Kura exposes the underlying Ui Web server version in its replies.

5.0
2019-04-09 CVE-2019-10242 Eclipse Path Traversal vulnerability in Eclipse Kura 2.0.2/4.0.0

In Eclipse Kura versions up to 4.0.0, the SkinServlet did not checked the path passed during servlet call, potentially allowing path traversal in get requests for a limited number of file types.

5.0
2019-04-09 CVE-2019-10903 Wireshark
Fedoraproject
Out-Of-Bounds Read vulnerability in multiple products

In Wireshark 2.4.0 to 2.4.13, 2.6.0 to 2.6.7, and 3.0.0, the DCERPC SPOOLSS dissector could crash.

5.0
2019-04-09 CVE-2019-10902 Wireshark
Fedoraproject
Unchecked Return Value vulnerability in multiple products

In Wireshark 3.0.0, the TSDNS dissector could crash.

5.0
2019-04-09 CVE-2019-10901 Wireshark
Fedoraproject
Null Pointer Dereference vulnerability in multiple products

In Wireshark 2.4.0 to 2.4.13, 2.6.0 to 2.6.7, and 3.0.0, the LDSS dissector could crash.

5.0
2019-04-09 CVE-2019-10900 Wireshark
Fedoraproject
Infinite Loop vulnerability in multiple products

In Wireshark 3.0.0, the Rbm dissector could go into an infinite loop.

5.0
2019-04-09 CVE-2019-10899 Wireshark
Fedoraproject
Improper Restriction of Operations Within the Bounds of A Memory Buffer vulnerability in multiple products

In Wireshark 2.4.0 to 2.4.13, 2.6.0 to 2.6.7, and 3.0.0, the SRVLOC dissector could crash.

5.0
2019-04-09 CVE-2019-10898 Wireshark
Fedoraproject
Infinite Loop vulnerability in multiple products

In Wireshark 3.0.0, the GSUP dissector could go into an infinite loop.

5.0
2019-04-09 CVE-2019-10897 Wireshark
Fedoraproject
Infinite Loop vulnerability in multiple products

In Wireshark 3.0.0, the IEEE 802.11 dissector could go into an infinite loop.

5.0
2019-04-09 CVE-2019-10896 Wireshark
Fedoraproject
Out-Of-Bounds Write vulnerability in multiple products

In Wireshark 2.4.0 to 2.4.13, 2.6.0 to 2.6.7, and 3.0.0, the DOF dissector could crash.

5.0
2019-04-09 CVE-2019-10895 Wireshark
Fedoraproject
Improper Input Validation vulnerability in multiple products

In Wireshark 2.4.0 to 2.4.13, 2.6.0 to 2.6.7, and 3.0.0, the NetScaler file parser could crash.

5.0
2019-04-09 CVE-2019-10894 Wireshark
Fedoraproject
Reachable Assertion vulnerability in multiple products

In Wireshark 2.4.0 to 2.4.13, 2.6.0 to 2.6.7, and 3.0.0, the GSS-API dissector could crash.

5.0
2019-04-08 CVE-2019-11018 Ctolog Improper Authentication vulnerability in Ctolog Thinkadmin 4.0

application\admin\controller\User.php in ThinkAdmin V4.0 does not prevent continued use of an administrator's cookie-based credentials after a password change.

5.0
2019-04-08 CVE-2014-5436 Honeywell Path Traversal vulnerability in Honeywell Experion Process Knowledge System R400/R410/R430

A directory traversal vulnerability exists in the confd.exe module in Honeywell Experion PKS R40x before R400.6, R41x before R410.6, and R43x before R430.2, which could lead to possible information disclosure.

5.0
2019-04-08 CVE-2019-4051 IBM Information Exposure vulnerability in IBM API Connect

Some URIs in IBM API Connect 2018.1 and 2018.4.1.3 disclose system specification information like the machine id, system uuid, filesystem paths, network interface names along with their mac addresses.

5.0
2019-04-08 CVE-2018-1885 IBM Information Exposure vulnerability in IBM products

IBM Business Automation Workflow 18.0.0.0, 18.0.0.1, and 18.0.0.2 could allow an unauthenticated attacker to obtain sensitve information using a specially cracted HTTP request.

5.0
2019-04-08 CVE-2016-10745 Palletsprojects USE of Externally-Controlled Format String vulnerability in Palletsprojects Jinja

In Pallets Jinja before 2.8.1, str.format allows a sandbox escape.

5.0
2019-04-11 CVE-2019-3837 Linux
Redhat
Race Condition vulnerability in multiple products

It was found that the net_dma code in tcp_recvmsg() in the 2.6.32 kernel as shipped in RHEL6 is thread-unsafe.

4.9
2019-04-09 CVE-2019-0754 Microsoft Unspecified vulnerability in Microsoft products

A denial of service vulnerability exists when Windows improperly handles objects in memory, aka 'Windows Denial of Service Vulnerability'.

4.9
2019-04-12 CVE-2019-11190 Linux Race Condition vulnerability in Linux Kernel

The Linux kernel before 4.8 allows local users to bypass ASLR on setuid programs (such as /bin/su) because install_exec_creds() is called too late in load_elf_binary() in fs/binfmt_elf.c, and thus the ptrace_may_access() check has a race condition when reading /proc/pid/stat.

4.7
2019-04-09 CVE-2019-3887 Linux Improper Input Validation vulnerability in Linux Kernel

A flaw was found in the way KVM hypervisor handled x2APIC Machine Specific Rregister (MSR) access with nested(=1) virtualization enabled.

4.7
2019-04-12 CVE-2018-6269 Nvidia Incorrect Permission Assignment for Critical Resource vulnerability in Nvidia Jetson TX2 R28.1/R28.2.1

NVIDIA Jetson TX2 contains a vulnerability in the kernel driver where input/output control (IOCTL) handling for user mode requests could create a non-trusted pointer dereference, which may lead to information disclosure, denial of service, escalation of privileges, or code execution.

4.6
2019-04-10 CVE-2019-9694 Symantec Unspecified vulnerability in Symantec Endpoint Encryption

Symantec Endpoint Encryption prior to SEE 11.2.1 MP1 may be susceptible to a Privilege Escalation vulnerability, which is a type of issue whereby an attacker may attempt to compromise the software application to gain elevated access to resources that are normally protected from an application or user.

4.6
2019-04-09 CVE-2019-0836 Microsoft Time-Of-Check Time-Of-Use (Toctou) Race Condition vulnerability in Microsoft products

An elevation of privilege vulnerability exists when Windows improperly handles calls to the LUAFV driver (luafv.sys), aka 'Windows Elevation of Privilege Vulnerability'.

4.6
2019-04-09 CVE-2019-0805 Microsoft Insufficient Verification of Data Authenticity vulnerability in Microsoft products

An elevation of privilege vulnerability exists when Windows improperly handles calls to the LUAFV driver (luafv.sys), aka 'Windows Elevation of Privilege Vulnerability'.

4.6
2019-04-09 CVE-2019-0732 Microsoft Incorrect Authorization vulnerability in Microsoft products

A security feature bypass vulnerability exists in Windows which could allow an attacker to bypass Device Guard when Windows improperly handles calls to the LUAFV driver (luafv.sys), aka 'Windows Security Feature Bypass Vulnerability'.

4.6
2019-04-09 CVE-2019-0731 Microsoft Permissions, Privileges, and Access Controls vulnerability in Microsoft products

An elevation of privilege vulnerability exists when Windows improperly handles calls to the LUAFV driver (luafv.sys), aka 'Windows Elevation of Privilege Vulnerability'.

4.6
2019-04-09 CVE-2019-0730 Microsoft Permissions, Privileges, and Access Controls vulnerability in Microsoft products

An elevation of privilege vulnerability exists when Windows improperly handles calls to the LUAFV driver (luafv.sys), aka 'Windows Elevation of Privilege Vulnerability'.

4.6
2019-04-09 CVE-2018-7118 HP Unspecified vulnerability in HP Service Pack FOR Proliant 2018.06.0

A local access restriction bypass vulnerability was identified in HPE Service Pack for ProLiant (SPP) Bundled Software earlier than version 2018.09.0.

4.6
2019-04-09 CVE-2018-14894 Cyberark Improper Privilege Management vulnerability in Cyberark Endpoint Privilege Manager

CyberArk Endpoint Privilege Manager 10.2.1.603 and earlier allows an attacker (who is able to edit permissions of a file) to bypass intended access restrictions and execute blocked applications.

4.6
2019-04-09 CVE-2019-0694 Microsoft Integer Overflow OR Wraparound vulnerability in Microsoft products

An elevation of privilege vulnerability exists due to an integer overflow in Windows Subsystem for Linux, aka 'Windows Subsystem for Linux Elevation of Privilege Vulnerability'.

4.6
2019-04-09 CVE-2019-0693 Microsoft Integer Overflow OR Wraparound vulnerability in Microsoft products

An elevation of privilege vulnerability exists due to an integer overflow in Windows Subsystem for Linux, aka 'Windows Subsystem for Linux Elevation of Privilege Vulnerability'.

4.6
2019-04-09 CVE-2019-0692 Microsoft Integer Overflow OR Wraparound vulnerability in Microsoft products

An elevation of privilege vulnerability exists due to an integer overflow in Windows Subsystem for Linux, aka 'Windows Subsystem for Linux Elevation of Privilege Vulnerability'.

4.6
2019-04-09 CVE-2019-0689 Microsoft Integer Overflow OR Wraparound vulnerability in Microsoft products

An elevation of privilege vulnerability exists due to an integer overflow in Windows Subsystem for Linux, aka 'Windows Subsystem for Linux Elevation of Privilege Vulnerability'.

4.6
2019-04-09 CVE-2019-0682 Microsoft Integer Overflow OR Wraparound vulnerability in Microsoft products

An elevation of privilege vulnerability exists due to an integer overflow in Windows Subsystem for Linux, aka 'Windows Subsystem for Linux Elevation of Privilege Vulnerability'.

4.6
2019-04-08 CVE-2018-20341 Winmagic Unquoted Search Path OR Element vulnerability in Winmagic Securedoc Disk Encryption 4.60.0

WINMAGIC SecureDoc Disk Encryption software before 8.3 has an Unquoted Service Path vulnerability, which could allow an attacker to execute arbitrary code on a target system.

4.6
2019-04-09 CVE-2019-3842 Systemd Project
Redhat
Fedoraproject
Debian
Permissions, Privileges, and Access Controls vulnerability in multiple products

In systemd before v242-rc4, it was discovered that pam_systemd does not properly sanitize the environment before using the XDG_SEAT variable.

4.4
2019-04-12 CVE-2018-16259 Soflyy Cross-Site Scripting vulnerability in Soflyy WP ALL Import 3.4.9

** DISPUTED ** There is an XSS vulnerability in WP All Import plugin 3.4.9 for WordPress via pmxi-admin-settings large_feed_limit.

4.3
2019-04-12 CVE-2018-16258 Soflyy Cross-Site Scripting vulnerability in Soflyy WP ALL Import 3.4.9

** DISPUTED ** There is an XSS vulnerability in WP All Import plugin 3.4.9 for WordPress via pmxi-admin-import custom_type.

4.3
2019-04-12 CVE-2018-16257 Soflyy Cross-Site Scripting vulnerability in Soflyy WP ALL Import 3.4.9

** DISPUTED ** There are multiple XSS vulnerabilities in WP All Import plugin 3.4.9 for WordPress via action=template.

4.3
2019-04-12 CVE-2018-16256 Soflyy Cross-Site Scripting vulnerability in Soflyy WP ALL Import 3.4.9

** DISPUTED ** There is an XSS vulnerability in WP All Import plugin 3.4.9 for WordPress via Add Filtering Options(Add Rule).

4.3
2019-04-12 CVE-2018-16255 Soflyy Cross-Site Scripting vulnerability in Soflyy WP ALL Import 3.4.9

** DISPUTED ** There is an XSS vulnerability in WP All Import plugin 3.4.9 for WordPress via action=evaluate.

4.3
2019-04-12 CVE-2018-16254 Soflyy Cross-Site Scripting vulnerability in Soflyy WP ALL Import 3.4.9

** DISPUTED ** There is an XSS vulnerability in WP All Import plugin 3.4.9 for WordPress via action=options.

4.3
2019-04-11 CVE-2019-6796 Gitlab Cross-Site Scripting vulnerability in Gitlab

An issue was discovered in GitLab Community and Enterprise Edition before 11.5.8, 11.6.x before 11.6.6, and 11.7.x before 11.7.1.

4.3
2019-04-11 CVE-2018-19202 Mybb Cross-Site Scripting vulnerability in Mybb

A reflected XSS vulnerability in index.php in MyBB 1.8.x through 1.8.19 allows remote attackers to inject JavaScript via the 'upsetting[bburl]' parameter.

4.3
2019-04-11 CVE-2019-7219 Zarafa Cross-Site Scripting vulnerability in Zarafa Webaccess 7.2.048204

Unauthenticated reflected cross-site scripting (XSS) exists in Zarafa Webapp 2.0.1.47791 and earlier.

4.3
2019-04-10 CVE-2018-14683 Paessler Cross-Site Scripting vulnerability in Paessler Prtg

PRTG before 19.1.49.1966 has Cross Site Scripting (XSS) in the WEBGUI.

4.3
2019-04-10 CVE-2019-0039 Juniper Credentials Management vulnerability in Juniper Junos

If REST API is enabled, the Junos OS login credentials are vulnerable to brute force attacks.

4.3
2019-04-10 CVE-2019-11065 Gradle
Fedoraproject
Gradle versions from 1.4 to 5.3.1 use an insecure HTTP URL to download dependencies when the built-in JavaScript or CoffeeScript Gradle plugins are used.
4.3
2019-04-09 CVE-2019-9696 Symantec Cross-Site Scripting vulnerability in Symantec VIP Enterprise Gateway

Symantec VIP Enterprise Gateway (all versions) may be susceptible to a cross-site scripting (XSS) exploit, which is a type of issue that can enable attackers to inject client-side scripts into web pages viewed by other users.

4.3
2019-04-09 CVE-2019-8456 Checkpoint Unspecified vulnerability in Checkpoint Ipsec VPN R80.10/R80.20

Check Point IKEv2 IPsec VPN up to R80.30, in some less common conditions, may allow an attacker with knowledge of the internal configuration and setup to successfully connect to a site-to-site VPN server.

4.3
2019-04-09 CVE-2019-0874 Microsoft Cross-Site Scripting vulnerability in Microsoft Azure Devops Server

A Cross-site Scripting (XSS) vulnerability exists when Azure DevOps Server does not properly sanitize user provided input, aka 'Azure DevOps Server Cross-site Scripting Vulnerability'.

4.3
2019-04-09 CVE-2019-0871 Microsoft Cross-Site Scripting vulnerability in Microsoft Azure Devops Server and Team Foundation Server

A Cross-site Scripting (XSS) vulnerability exists when Azure DevOps Server and Team Foundation Server do not properly sanitize user provided input, aka 'Azure DevOps Server and Team Foundation Server Cross-site Scripting Vulnerability'.

4.3
2019-04-09 CVE-2019-0870 Microsoft Cross-Site Scripting vulnerability in Microsoft Azure Devops Server and Team Foundation Server

A Cross-site Scripting (XSS) vulnerability exists when Azure DevOps Server and Team Foundation Server do not properly sanitize user provided input, aka 'Azure DevOps Server and Team Foundation Server Cross-site Scripting Vulnerability'.

4.3
2019-04-09 CVE-2019-0869 Microsoft Cross-Site Scripting vulnerability in Microsoft Azure Devops Server 2019

A spoofing vulnerability exists in Microsoft Azure DevOps Server when it fails to properly handle web requests, aka 'Azure DevOps Server HTML Injection Vulnerability'.

4.3
2019-04-09 CVE-2019-0868 Microsoft Cross-Site Scripting vulnerability in Microsoft Azure Devops Server and Team Foundation Server

A Cross-site Scripting (XSS) vulnerability exists when Azure DevOps Server and Team Foundation Server do not properly sanitize user provided input, aka 'Azure DevOps Server and Team Foundation Server Cross-site Scripting Vulnerability'.

4.3
2019-04-09 CVE-2019-0867 Microsoft Cross-Site Scripting vulnerability in Microsoft Azure Devops Server and Team Foundation Server

A Cross-site Scripting (XSS) vulnerability exists when Azure DevOps Server and Team Foundation Server do not properly sanitize user provided input, aka 'Azure DevOps Server and Team Foundation Server Cross-site Scripting Vulnerability'.

4.3
2019-04-09 CVE-2019-0866 Microsoft Cross-Site Scripting vulnerability in Microsoft Azure Devops Server and Team Foundation Server

A Cross-site Scripting (XSS) vulnerability exists when Azure DevOps Server and Team Foundation Server do not properly sanitize user provided input, aka 'Azure DevOps Server and Team Foundation Server Cross-site Scripting Vulnerability'.

4.3
2019-04-09 CVE-2019-0858 Microsoft Cross-Site Scripting vulnerability in Microsoft Exchange Server 2013/2016/2019

A spoofing vulnerability exists in Microsoft Exchange Server when Outlook Web Access (OWA) fails to properly handle web requests, aka 'Microsoft Exchange Spoofing Vulnerability'.

4.3
2019-04-09 CVE-2019-0857 Microsoft Improper Encoding OR Escaping of Output vulnerability in Microsoft Azure Devops Server 2019

A spoofing vulnerability that could allow a security feature bypass exists in when Azure DevOps Server does not properly sanitize user provided input, aka 'Azure DevOps Server Spoofing Vulnerability'.

4.3
2019-04-09 CVE-2019-0849 Microsoft Unspecified vulnerability in Microsoft products

An information disclosure vulnerability exists when the Windows GDI component improperly discloses the contents of its memory, aka 'Windows GDI Information Disclosure Vulnerability'.

4.3
2019-04-09 CVE-2019-0835 Microsoft Unspecified vulnerability in Microsoft Internet Explorer 10/11

An information disclosure vulnerability exists when the scripting engine does not properly handle objects in memory, aka 'Microsoft Scripting Engine Information Disclosure Vulnerability'.

4.3
2019-04-09 CVE-2019-0833 Microsoft Unspecified vulnerability in Microsoft Edge

An information disclosure vulnerability exists when Microsoft Edge improperly handles objects in memory, aka 'Microsoft Edge Information Disclosure Vulnerability'.

4.3
2019-04-09 CVE-2019-0802 Microsoft Unspecified vulnerability in Microsoft products

An information disclosure vulnerability exists when the Windows GDI component improperly discloses the contents of its memory, aka 'Windows GDI Information Disclosure Vulnerability'.

4.3
2019-04-09 CVE-2019-0764 Microsoft Argument Injection OR Modification vulnerability in Microsoft Edge and Internet Explorer

A tampering vulnerability exists when Microsoft browsers do not properly validate input under specific conditions, aka 'Microsoft Browsers Tampering Vulnerability'.

4.3
2019-04-09 CVE-2018-1356 Fortinet Cross-Site Scripting vulnerability in Fortinet Fortisandbox

A reflected Cross-Site-Scripting (XSS) vulnerability in Fortinet FortiSandbox before 3.0 may allow an attacker to execute unauthorized code or commands via the back_url parameter in the file scan component.

4.3
2019-04-09 CVE-2018-7117 HP Cross-Site Scripting vulnerability in HP Integrated Lights-Out 5 Firmware

A remote Cross-Site Scripting in HPE iLO 5 Web User Interface vulnerability was identified in HPE Integrated Lights-Out 5 (iLO 5) for Gen10 ProLiant Servers earlier than version v1.40.

4.3
2019-04-09 CVE-2019-9133 Kmplayer
Microsoft
Integer Underflow (Wrap OR Wraparound) vulnerability in Kmplayer 2018.12.24.14/4.2.2.31/4.2.2.4

When processing subtitles format media file, KMPlayer version 2018.12.24.14 or lower doesn't check object size correctly, which leads to integer underflow then to memory out-of-bound read/write.

4.3
2019-04-09 CVE-2019-6117 Wpape Cross-Site Scripting vulnerability in Wpape APE Gallery 1.6.14

The wpape APE GALLERY plugin 1.6.14 for WordPress has stored XSS via the classGallery.php getCategories function.

4.3
2019-04-09 CVE-2018-20698 Search Guard Open Redirect vulnerability in Search-Guard Search Guard

The floragunn Search Guard plugin before 6.x-16 for Kibana allows URL injection for login redirects on the login page when basePath is set.

4.3
2019-04-09 CVE-2018-15635 Odoo Cross-Site Scripting vulnerability in Odoo

Cross-site scripting vulnerability in the Discuss App of Odoo Community 12.0 and earlier, and Odoo Enterprise 12.0 and earlier allows remote attackers to inject arbitrary web script in the browser of an internal user of the system by tricking them into inviting a follower on a document with a crafted name.

4.3
2019-04-09 CVE-2019-0798 Microsoft Cross-Site Scripting vulnerability in Microsoft Lync Server and Skype FOR Business Server

A spoofing vulnerability exists when a Lync Server or Skype for Business Server does not properly sanitize a specially crafted request, aka 'Skype for Business and Lync Spoofing Vulnerability'.

4.3
2019-04-09 CVE-2019-0774 Microsoft Unspecified vulnerability in Microsoft products

An information disclosure vulnerability exists when the Windows GDI component improperly discloses the contents of its memory, aka 'Windows GDI Information Disclosure Vulnerability'.

4.3
2019-04-09 CVE-2019-9844 Khanacademy
Fedoraproject
Cross-Site Scripting vulnerability in multiple products

simple-markdown.js in Khan Academy simple-markdown before 0.4.4 allows XSS via a data: or vbscript: URI.

4.3
2019-04-09 CVE-2019-0768 Microsoft Improper Input Validation vulnerability in Microsoft Internet Explorer 11

A security feature bypass vulnerability exists when Internet Explorer VBScript execution policy does not properly restrict VBScript under specific conditions, and to allow requests that should otherwise be ignored, aka 'Internet Explorer Security Feature Bypass Vulnerability'.

4.3
2019-04-09 CVE-2019-0762 Microsoft Incorrect Authorization vulnerability in Microsoft Edge and Internet Explorer

A security feature bypass vulnerability exists when Microsoft browsers improperly handle requests of different origins, aka 'Microsoft Browsers Security Feature Bypass Vulnerability'.

4.3
2019-04-09 CVE-2019-0761 Microsoft Incorrect Authorization vulnerability in Microsoft Internet Explorer 10/11

A security feature bypass vulnerability exists when Internet Explorer fails to validate the correct Security Zone of requests for specific URLs, aka 'Internet Explorer Security Feature Bypass Vulnerability'.

4.3
2019-04-09 CVE-2019-0746 Microsoft Unspecified vulnerability in Microsoft Chakracore, Edge and Internet Explorer

An information disclosure vulnerability exists when the scripting engine does not properly handle objects in memory in Microsoft Edge, aka 'Scripting Engine Information Disclosure Vulnerability'.

4.3
2019-04-09 CVE-2019-0683 Microsoft Incorrect Default Permissions vulnerability in Microsoft Windows 7 and Windows Server 2008

An elevation of privilege vulnerability exists in Active Directory Forest trusts due to a default setting that lets an attacker in the trusting forest request delegation of a TGT for an identity from the trusted forest, aka 'Active Directory Elevation of Privilege Vulnerability'.

4.3
2019-04-08 CVE-2019-11026 Freedesktop
Fedoraproject
Uncontrolled Recursion vulnerability in multiple products

FontInfoScanner::scanFonts in FontInfo.cc in Poppler 0.75.0 has infinite recursion, leading to a call to the error function in Error.cc.

4.3
2019-04-08 CVE-2019-11024 Libsixel Project Uncontrolled Recursion vulnerability in Libsixel Project Libsixel 1.8.2

The load_pnm function in frompnm.c in libsixel.a in libsixel 1.8.2 has infinite recursion.

4.3
2019-04-08 CVE-2019-0614 Microsoft Unspecified vulnerability in Microsoft products

An information disclosure vulnerability exists when the Windows GDI component improperly discloses the contents of its memory, aka 'Windows GDI Information Disclosure Vulnerability'.

4.3
2019-04-08 CVE-2019-1798 Clamav Out-Of-Bounds Read vulnerability in Clamav

A vulnerability in the Portable Executable (PE) file scanning functionality of Clam AntiVirus (ClamAV) Software versions 0.101.1 and prior could allow an unauthenticated, remote attacker to cause a denial of service condition on an affected device.

4.3
2019-04-08 CVE-2019-1788 Clamav
Opensuse
Debian
Out-Of-Bounds Write vulnerability in multiple products

A vulnerability in the Object Linking & Embedding (OLE2) file scanning functionality of Clam AntiVirus (ClamAV) Software versions 0.101.1 and prior could allow an unauthenticated, remote attacker to cause a denial of service condition on an affected device.

4.3
2019-04-08 CVE-2019-1787 Clamav
Debian
Opensuse
Out-Of-Bounds Read vulnerability in multiple products

A vulnerability in the Portable Document Format (PDF) scanning functionality of Clam AntiVirus (ClamAV) Software versions 0.101.1 and prior could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device.

4.3
2019-04-08 CVE-2019-1786 Clamav Out-Of-Bounds Read vulnerability in Clamav 0.101.0/0.101.1

A vulnerability in the Portable Document Format (PDF) scanning functionality of Clam AntiVirus (ClamAV) Software versions 0.101.1 and 0.101.0 could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device.

4.3
2019-04-08 CVE-2019-11010 Graphicsmagick
Debian
Opensuse
Memory Leak vulnerability in multiple products

In GraphicsMagick 1.4 snapshot-20190322 Q8, there is a memory leak in the function ReadMPCImage of coders/mpc.c, which allows attackers to cause a denial of service via a crafted image file.

4.3
2019-04-08 CVE-2019-11004 Materializecss Cross-Site Scripting vulnerability in Materializecss Materialize 1.0.0

In Materialize through 1.0.0, XSS is possible via the Toast feature.

4.3
2019-04-08 CVE-2019-11003 Materializecss Cross-Site Scripting vulnerability in Materializecss Materialize 1.0.0

In Materialize through 1.0.0, XSS is possible via the Autocomplete feature.

4.3
2019-04-08 CVE-2019-11002 Materializecss Cross-Site Scripting vulnerability in Materializecss Materialize 1.0.0

In Materialize through 1.0.0, XSS is possible via the Tooltip feature.

4.3
2019-04-08 CVE-2019-10845 Uniqkey Unspecified vulnerability in Uniqkey Password Manager 1.14

An issue was discovered in Uniqkey Password Manager 1.14.

4.3
2019-04-08 CVE-2019-10676 Uniqkey Improper Privilege Management vulnerability in Uniqkey Password Manager 1.14

An issue was discovered in Uniqkey Password Manager 1.14.

4.3
2019-04-08 CVE-2018-1853 IBM
Apple
Linux
Microsoft
Oracle
Improper Restriction of Rendered UI Layers OR Frames vulnerability in IBM Spectrum Protect Backup-Archive Client 7.1.0.0/8.1.0.0

IBM Tivoli Storage Manager (IBM Spectrum Protect 7.1 and 8.1) could allow a remote attacker to hijack the clicking action of the victim.

4.3
2019-04-11 CVE-2019-6525 Aveva Improper Privilege Management vulnerability in Aveva Wonderware System Platform 2014/2017

AVEVA Wonderware System Platform 2017 Update 2 and prior uses an ArchestrA network user account for authentication of system processes and inter-node communications.

4.0
2019-04-11 CVE-2019-9976 Dasannetworks Information Exposure Through LOG Files vulnerability in Dasannetworks H660Rm Firmware 1.030022

The Boa server configuration on DASAN H660RM devices with firmware 1.03-0022 logs POST data to the /tmp/boa-temp file, which allows logged-in users to read the credentials of administration web interface users.

4.0
2019-04-10 CVE-2019-0278 SAP Unspecified vulnerability in SAP Netweaver Process Integration

Under certain conditions the Monitoring Servlet of the SAP NetWeaver Process Integration (Messaging System), fixed in versions 7.10 to 7.11, 7.20, 7.30, 7.31, 7.40, 7.50, allows an attacker to see the names of database tables used by the application, leading to information disclosure.

4.0
2019-04-09 CVE-2019-3893 Theforeman
Redhat
Incorrect Permission Assignment for Critical Resource vulnerability in multiple products

In Foreman it was discovered that the delete compute resource operation, when executed from the Foreman API, leads to the disclosure of the plaintext password or token for the affected compute resource.

4.0
2019-04-09 CVE-2018-15631 Odoo Unspecified vulnerability in Odoo

Improper access control in the Discuss App of Odoo Community 12.0 and earlier, and Odoo Enterprise 12.0 and earlier allows remote authenticated attackers to e-mail themselves arbitrary files from the database, via a crafted RPC request.

4.0
2019-04-09 CVE-2019-10632 Zyxel Path Traversal vulnerability in Zyxel Nas326 Firmware

A directory traversal vulnerability in the file browser component on the Zyxel NAS 326 version 5.21 and below allows a lower privileged user to change the location of any other user's files.

4.0
2019-04-09 CVE-2019-10630 Zyxel Insufficiently Protected Credentials vulnerability in Zyxel Nas326 Firmware

A plaintext password vulnerability in the Zyxel NAS 326 through 5.21 allows an elevated privileged user to get the admin password of the device.

4.0
2019-04-09 CVE-2019-0821 Microsoft Unspecified vulnerability in Microsoft products

An information disclosure vulnerability exists in the way that the Windows SMB Server handles certain requests, aka 'Windows SMB Information Disclosure Vulnerability'.

4.0
2019-04-09 CVE-2019-0804 Microsoft Incorrect Permission Assignment FOR Critical Resource vulnerability in Microsoft Walinuxagent

An information disclosure vulnerability exists in the way Azure WaLinuxAgent creates swap files on resource disks, aka 'Azure Linux Agent Information Disclosure Vulnerability'.

4.0
2019-04-09 CVE-2019-0757 Microsoft
Apple
Mono Project
A tampering vulnerability exists in the NuGet Package Manager for Linux and Mac that could allow an authenticated attacker to modify a NuGet package's folder structure, aka 'NuGet Package Manager Tampering Vulnerability'.
4.0
2019-04-09 CVE-2019-0704 Microsoft Unspecified vulnerability in Microsoft products

An information disclosure vulnerability exists in the way that the Windows SMB Server handles certain requests, aka 'Windows SMB Information Disclosure Vulnerability'.

4.0
2019-04-09 CVE-2019-0703 Microsoft Unspecified vulnerability in Microsoft products

An information disclosure vulnerability exists in the way that the Windows SMB Server handles certain requests, aka 'Windows SMB Information Disclosure Vulnerability'.

4.0
2019-04-09 CVE-2019-0678 Microsoft Incorrect Authorization vulnerability in Microsoft Edge

An elevation of privilege vulnerability exists when Microsoft Edge does not properly enforce cross-domain policies, which could allow an attacker to access information from one domain and inject it into another domain.In a web-based attack scenario, an attacker could host a website that is used to attempt to exploit the vulnerability, aka 'Microsoft Edge Elevation of Privilege Vulnerability'.

4.0
2019-04-08 CVE-2019-4045 IBM Improper Input Validation vulnerability in IBM products

IBM Business Automation Workflow and IBM Business Process Manager 18.0.0.0, 18.0.0.1, and 18.0.0.2 provide embedded document management features.

4.0
2019-04-08 CVE-2018-1999 IBM Information Exposure vulnerability in IBM products

IBM Business Automation Workflow 18.0.0.0, 18.0.0.1, and 18.0.0.2 could reveal sensitive version information about the server from error pages that could aid an attacker in further attacks against the system.

4.0
2019-04-08 CVE-2018-1997 IBM Unspecified vulnerability in IBM products

IBM Business Automation Workflow and Business Process Manager 18.0.0.0, 18.0.0.1, and 18.0.0.2 are vulnerable to a denial of service attack.

4.0

50 Low Vulnerabilities

DATE CVE VENDOR VULNERABILITY CVSS
2019-04-11 CVE-2019-5673 Nvidia Improper Check for Unusual OR Exceptional Conditions vulnerability in Nvidia Jetson TX2 R28.1/R28.2.1

NVIDIA Jetson TX2 contains a vulnerability in the kernel driver (on all versions prior to R28.3) where the ARM System Memory Management Unit (SMMU) improperly checks for a fault condition, causing transactions to be discarded, which may lead to denial of service.

3.6
2019-04-10 CVE-2019-0284 SAP XXE vulnerability in SAP Hana 1.0/2.0

SLD Registration in SAP HANA (fixed in versions 1.0, 2.0) does not sufficiently validate an XML document accepted from an untrusted source.

3.6
2019-04-09 CVE-2019-5585 Forticlient Unspecified vulnerability in Forticlient

An improper access control vulnerability in FortiClientMac before 6.0.5 may allow an attacker to affect the application's performance via modifying the contents of a file used by several FortiClientMac processes.

3.6
2019-04-09 CVE-2019-3870 Samba
Fedoraproject
Synology
Incorrect Default Permissions vulnerability in multiple products

A vulnerability was found in Samba from version (including) 4.9 to versions before 4.9.6 and 4.10.2.

3.6
2019-04-12 CVE-2018-13137 WP Events Plugin Cross-Site Scripting vulnerability in Wp-Events-Plugin Events Manager 5.9.4

The Events Manager plugin 5.9.4 for WordPress has XSS via the dbem_event_reapproved_email_body parameter to the wp-admin/edit.php?post_type=event&page=events-manager-options URI.

3.5
2019-04-12 CVE-2019-1574 Paloaltonetworks Cross-Site Scripting vulnerability in Paloaltonetworks Expedition Migration Tool

Cross-site scripting (XSS) vulnerability in Palo Alto Networks Expedition Migration tool 1.1.12 and earlier may allow an authenticated attacker to run arbitrary JavaScript or HTML in the Devices View.

3.5
2019-04-10 CVE-2019-1003050 Jenkins Cross-Site Scripting vulnerability in Jenkins

The f:validateButton form control for the Jenkins UI did not properly escape job URLs in Jenkins 2.171 and earlier and Jenkins LTS 2.164.1 and earlier, resulting in a cross-site scripting (XSS) vulnerability exploitable by users with the ability to control job names.

3.5
2019-04-10 CVE-2019-0216 Apache Cross-Site Scripting vulnerability in Apache Airflow

A malicious admin user could edit the state of objects in the Airflow metadata database to execute arbitrary javascript on certain page views.

3.5
2019-04-09 CVE-2019-0831 Microsoft Cross-Site Scripting vulnerability in Microsoft products

A cross-site-scripting (XSS) vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected SharePoint server, aka 'Microsoft Office SharePoint XSS Vulnerability'.

3.5
2019-04-09 CVE-2019-0830 Microsoft Cross-Site Scripting vulnerability in Microsoft products

A cross-site-scripting (XSS) vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected SharePoint server, aka 'Microsoft Office SharePoint XSS Vulnerability'.

3.5
2019-04-09 CVE-2019-1567 Paloaltonetworks Cross-Site Scripting vulnerability in Paloaltonetworks Expedition Migration Tool

The Expedition Migration tool 1.1.6 and earlier may allow an authenticated attacker to run arbitrary JavaScript or HTML in the User Mapping Settings.

3.5
2019-04-09 CVE-2019-5615 Rapid7 Insufficiently Protected Credentials vulnerability in Rapid7 Insightvm

Users with Site-level permissions can access files containing the username-encrypted passwords of Security Console Global Administrators and clear-text passwords for restoring backups, as well as the salt for those passwords.

3.5
2019-04-09 CVE-2019-10634 Zyxel Cross-Site Scripting vulnerability in Zyxel Nas326 Firmware

An XSS vulnerability in the Zyxel NAS 326 version 5.21 and below allows a remote authenticated attacker to inject arbitrary JavaScript or HTML via the user, group, and file-share description fields.

3.5
2019-04-09 CVE-2019-0778 Microsoft Cross-Site Scripting vulnerability in Microsoft products

A cross-site-scripting (XSS) vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected SharePoint server, aka 'Microsoft Office SharePoint XSS Vulnerability'.

3.5
2019-04-09 CVE-2019-0777 Microsoft Cross-Site Scripting vulnerability in Microsoft Team Foundation Server 2017/2018

A Cross-site Scripting (XSS) vulnerability exists when Team Foundation Server does not properly sanitize user provided input, aka 'Team Foundation Server Cross-site Scripting Vulnerability'.

3.5
2019-04-08 CVE-2019-11025 Cacti Cross-Site Scripting vulnerability in Cacti

In clearFilter() in utilities.php in Cacti before 1.2.3, no escaping occurs before printing out the value of the SNMP community string (SNMP Options) in the View poller cache, leading to XSS.

3.5
2019-04-08 CVE-2018-1943 IBM Injection vulnerability in IBM Cloud Private 3.1.0/3.1.1

IBM Cloud Private 3.1.0 and 3.1.1 is vulnerable to HTTP HOST header injection, caused by improper validation of input.

3.5
2019-04-08 CVE-2018-19006 Osisoft Cross-Site Scripting vulnerability in Osisoft PI Vision 2017

OSIsoft PI Vision, versions PI Vision 2017, and PI Vision 2017 R2, The application contains a cross-site scripting vulnerability where displays that reference AF elements and attributes containing JavaScript are affected.

3.5
2019-04-11 CVE-2019-3460 Linux
Canonical
Debian
Information Exposure vulnerability in Linux Kernel

A heap data infoleak in multiple locations including L2CAP_PARSE_CONF_RSP was found in the Linux kernel before 5.1-rc1.

3.3
2019-04-11 CVE-2019-3459 Linux
Canonical
Redhat
Debian
Information Exposure vulnerability in Linux Kernel

A heap address information leak while using L2CAP_GET_CONF_OPT was discovered in the Linux kernel before 5.1-rc1.

3.3
2019-04-08 CVE-2019-0612 Microsoft Unspecified vulnerability in Microsoft Edge

A security feature bypass vulnerability exists when Click2Play protection in Microsoft Edge improperly handles flash objects.

2.6
2019-04-12 CVE-2018-6239 Nvidia Information Exposure vulnerability in Nvidia Jetson TX2 R28.1/R28.2.1

NVIDIA Jetson TX2 contains a vulnerability by means of speculative execution where local and unprivileged code may access the contents of cached information in an unauthorized manner, which may lead to information disclosure.

2.1
2019-04-11 CVE-2019-6493 Iobit Memory Leak vulnerability in Iobit Smart Defrag 6

SmartDefragDriver.sys (2.0) in IObit Smart Defrag 6 never frees an executable kernel pool that is allocated with user defined bytes and size when IOCTL 0x9C401CC0 is called.

2.1
2019-04-10 CVE-2019-3612 Mcafee Cleartext Storage of Sensitive Information vulnerability in Mcafee Data Exchange Layer and Threat Intelligence Exchange

Information Disclosure vulnerability in McAfee DXL Platform and TIE Server in DXL prior to 5.0.1 HF2 and TIE prior to 2.3.1 HF1 allows Authenticated users to view sensitive information in plain text via the GUI or command line.

2.1
2019-04-10 CVE-2019-0032 Juniper Credentials Management vulnerability in Juniper Service Insight and Service NOW

A password management issue exists where the Organization authentication username and password were stored in plaintext in log files.

2.1
2019-04-10 CVE-2006-7254 GNU Data Processing Errors vulnerability in GNU Glibc

The nscd daemon in the GNU C Library (glibc) before version 2.5 does not close incoming client sockets if they cannot be handled by the daemon, allowing local users to carry out a denial of service attack on the daemon.

2.1
2019-04-10 CVE-2019-6156 Lenovo Improper Locking vulnerability in Lenovo products

In Lenovo systems, SMM BIOS Write Protection is used to prevent writes to SPI Flash.

2.1
2019-04-09 CVE-2019-0876 Microsoft Unspecified vulnerability in Microsoft Open Enclave Software Development KIT 0.1.0/0.4.0/0.4.1

An information disclosure vulnerability exists when affected Open Enclave SDK versions improperly handle objects in memory, aka 'Open Enclave SDK Information Disclosure Vulnerability'.

2.1
2019-04-09 CVE-2019-0848 Microsoft Unspecified vulnerability in Microsoft products

An information disclosure vulnerability exists when the win32k component improperly provides kernel information, aka 'Win32k Information Disclosure Vulnerability'.

2.1
2019-04-09 CVE-2019-0844 Microsoft Unspecified vulnerability in Microsoft products

An information disclosure vulnerability exists when the Windows kernel improperly handles objects in memory, aka 'Windows Kernel Information Disclosure Vulnerability'.

2.1
2019-04-09 CVE-2019-0840 Microsoft Unspecified vulnerability in Microsoft products

An information disclosure vulnerability exists when the Windows kernel improperly handles objects in memory, aka 'Windows Kernel Information Disclosure Vulnerability'.

2.1
2019-04-09 CVE-2019-0839 Microsoft Unspecified vulnerability in Microsoft products

An information disclosure vulnerability exists when the Terminal Services component improperly discloses the contents of its memory, aka 'Windows Information Disclosure Vulnerability'.

2.1
2019-04-09 CVE-2019-0838 Microsoft Unspecified vulnerability in Microsoft products

An information disclosure vulnerability exists when Windows Task Scheduler improperly discloses credentials to Windows Credential Manager, aka 'Windows Information Disclosure Vulnerability'.

2.1
2019-04-09 CVE-2019-0837 Microsoft Unspecified vulnerability in Microsoft Windows 10 and Windows Server 2016

An information disclosure vulnerability exists when DirectX improperly handles objects in memory, aka 'DirectX Information Disclosure Vulnerability'.

2.1
2019-04-09 CVE-2019-0814 Microsoft Unspecified vulnerability in Microsoft products

An information disclosure vulnerability exists when the win32k component improperly provides kernel information, aka 'Win32k Information Disclosure Vulnerability'.

2.1
2019-04-09 CVE-2019-0796 Microsoft Permissions, Privileges, and Access Controls vulnerability in Microsoft products

An elevation of privilege vulnerability exists when Windows improperly handles calls to the LUAFV driver (luafv.sys), aka 'Windows Elevation of Privilege Vulnerability'.

2.1
2019-04-09 CVE-2019-0782 Microsoft Improper Initialization vulnerability in Microsoft products

An information disclosure vulnerability exists when the Windows kernel fails to properly initialize a memory address, aka 'Windows Kernel Information Disclosure Vulnerability'.

2.1
2019-04-09 CVE-2019-0776 Microsoft Unspecified vulnerability in Microsoft products

An information disclosure vulnerability exists when the win32k component improperly provides kernel information, aka 'Win32k Information Disclosure Vulnerability'.

2.1
2019-04-09 CVE-2019-0767 Microsoft Improper Initialization vulnerability in Microsoft products

An information disclosure vulnerability exists when the Windows kernel improperly initializes objects in memory.To exploit this vulnerability, an authenticated attacker could run a specially crafted application, aka 'Windows Kernel Information Disclosure Vulnerability'.

2.1
2019-04-09 CVE-2019-0759 Microsoft Unspecified vulnerability in Microsoft products

An information disclosure vulnerability exists when the Windows Print Spooler does not properly handle objects in memory, aka 'Windows Print Spooler Information Disclosure Vulnerability'.

2.1
2019-04-09 CVE-2019-0755 Microsoft Unspecified vulnerability in Microsoft products

An information disclosure vulnerability exists when the Windows kernel improperly handles objects in memory, aka 'Windows Kernel Information Disclosure Vulnerability'.

2.1
2019-04-09 CVE-2019-0702 Microsoft Unspecified vulnerability in Microsoft products

An information disclosure vulnerability exists when the Windows kernel improperly handles objects in memory, aka 'Windows Kernel Information Disclosure Vulnerability'.

2.1
2019-04-08 CVE-2019-4143 IBM Information Exposure Through LOG Files vulnerability in IBM Cloud Private 3.1.1/3.1.2

The IBM Cloud Private Key Management Service (IBM Cloud Private 3.1.1 and 3.1.2) could allow a local user to obtain sensitive from the KMS plugin container log.

2.1
2019-04-08 CVE-2018-1787 IBM
Microsoft
Incorrect Permission Assignment FOR Critical Resource vulnerability in IBM products

IBM Spectrum Protect 7.1 and 8.1 is affected by a password exposure vulnerability caused by insecure file permissions.

2.1
2019-04-12 CVE-2019-11191 Linux Race Condition vulnerability in Linux Kernel

** DISPUTED ** The Linux kernel through 5.0.7, when CONFIG_IA32_AOUT is enabled and ia32_aout is loaded, allows local users to bypass ASLR on setuid a.out programs (if any exist) because install_exec_creds() is called too late in load_aout_binary() in fs/binfmt_aout.c, and thus the ptrace_may_access() check has a race condition when reading /proc/pid/stat.

1.9
2019-04-10 CVE-2019-0042 Juniper Improper Input Validation vulnerability in Juniper Identity Management Service

Juniper Identity Management Service (JIMS) for Windows versions prior to 1.1.4 may send an incorrect message to associated SRX services gateways.

1.9
2019-04-09 CVE-2019-1573 Paloaltonetworks Information Exposure vulnerability in Paloaltonetworks Globalprotect 4.1.0/4.1.10

GlobalProtect Agent 4.1.0 for Windows and GlobalProtect Agent 4.1.10 and earlier for macOS may allow a local authenticated attacker who has compromised the end-user account and gained the ability to inspect memory, to access authentication and/or session tokens and replay them to spoof the VPN session and gain access as the user.

1.9
2019-04-09 CVE-2019-0816 Canonical
Microsoft
USE of Incorrectly-Resolved Name OR Reference vulnerability in Canonical Ubuntu Linux 18.04

A security feature bypass exists in Azure SSH Keypairs, due to a change in the provisioning logic for some Linux images that use cloud-init, aka 'Azure SSH Keypairs Security Feature Bypass Vulnerability'.

1.9
2019-04-09 CVE-2019-0775 Microsoft Unspecified vulnerability in Microsoft products

An information disclosure vulnerability exists when the Windows kernel improperly handles objects in memory, aka 'Windows Kernel Information Disclosure Vulnerability'.

1.9
2019-04-08 CVE-2018-1882 IBM
Apple
Linux
Microsoft
Oracle
Missing Encryption of Sensitive Data vulnerability in IBM products

In a certain atypical IBM Spectrum Protect 7.1 and 8.1 configurations, the node password could be displayed in plain text in the IBM Spectrum Protect client trace file.

1.9