# CVEs published 2019-04-10

54 CVEs were published on April 10, 2019: 3 critical, 9 high. Days are UTC.

- [CVE-2018-14683](https://cve.now/CVE-2018-14683.md): PRTG before 19.1.49.1966 has Cross Site Scripting (XSS) in the WEBGUI. (no CVSS)
- [CVE-2019-11072](https://cve.now/CVE-2019-11072.md): lighttpd before 1.4.54 has a signed integer overflow, which might allow remote attackers to cause a denial of service (application crash)… (no CVSS)
- [CVE-2018-19453](https://cve.now/CVE-2018-19453.md): Kentico CMS before 11.0.45 allows unrestricted upload of a file with a dangerous type. (no CVSS)
- [CVE-2019-11071](https://cve.now/CVE-2019-11071.md): SPIP 3.1 before 3.1.10 and 3.2 before 3.2.4 allows authenticated visitors to execute arbitrary code on the host server because var\_memotri… (no CVSS)
- [CVE-2019-0285](https://cve.now/CVE-2019-0285.md): The .NET SDK WebForm Viewer in SAP Crystal Reports for Visual Studio (fixed in version 2010) discloses sensitive database information… (no CVSS, SAP SE SAP Crystal Reports for Visual Studio)
- [CVE-2019-0284](https://cve.now/CVE-2019-0284.md): SLD Registration in SAP HANA (fixed in versions 1.0, 2.0) does not sufficiently validate an XML document accepted from an untrusted source. (no CVSS, SAP SE SAP HANA)
- [CVE-2019-0283](https://cve.now/CVE-2019-0283.md): SAP NetWeaver Process Integration (Adapter Engine), fixed in versions 7.10 to 7.11, 7.30, 7.31, 7.40, 7.50; is vulnerable to Digital… (no CVSS, SAP SE SAP NetWeaver Process Integration)
- [CVE-2019-0282](https://cve.now/CVE-2019-0282.md): Several web pages in SAP NetWeaver Process Integration (Runtime Workbench), fixed in versions 7.10 to 7.11, 7.30, 7.31, 7.40, 7.50; can be… (no CVSS, SAP SE SAP NetWeaver Process Integration)
- [CVE-2019-0279](https://cve.now/CVE-2019-0279.md): ABAP BASIS function modules INST\_CREATE\_R3\_RFC\_DEST, INST\_CREATE\_TCPIP\_RFCDEST, and INST\_CREATE\_TCPIP\_RFC\_DEST in SAP BASIS (fixed in… (no CVSS, SAP SE SAP BASIS)
- [CVE-2019-11070](https://cve.now/CVE-2019-11070.md): WebKitGTK and WPE WebKit prior to version 2.24.1 failed to properly apply configured HTTP proxy settings when downloading livestream video… (no CVSS)
- [CVE-2019-0044](https://cve.now/CVE-2019-0044.md): Junos OS: SRX5000 series: Kernel crash (vmcore) upon receipt of a specific packet on fxp0 interface (CVSS 7.5, Juniper Networks Junos OS)
- [CVE-2019-0043](https://cve.now/CVE-2019-0043.md): Junos OS: RPD process crashes upon receipt of a specific SNMP packet (CVSS 7.5, Juniper Networks Junos OS)
- [CVE-2019-0042](https://cve.now/CVE-2019-0042.md): Incorrect messages from Juniper Identity Management Service (JIMS) can trigger Denial of Service or firewall bypass conditions for SRX… (CVSS 5.7, Juniper Networks Juniper Identity Management Service)
- [CVE-2019-0041](https://cve.now/CVE-2019-0041.md): Junos OS: EX4300-MP Series: IP transit traffic can reach the control plane via loopback interface. (CVSS 6.5, Juniper Networks Junos OS)
- [CVE-2019-0040](https://cve.now/CVE-2019-0040.md): Junos OS: Specially crafted packets sent to port 111 on any interface triggers responses from the management interface (CVSS 6.5, Juniper Networks Junos OS)
- [CVE-2019-0039](https://cve.now/CVE-2019-0039.md): Junos OS: Login credentials are vulnerable to brute force attacks through the REST API (CVSS 5.3, Juniper Networks Junos OS)
- [CVE-2019-0038](https://cve.now/CVE-2019-0038.md): SRX Series: Crafted packets destined to fxp0 management interface on SRX340/SRX345 devices can lead to DoS (CVSS 6.5, Juniper Networks Junos OS)
- [CVE-2019-0037](https://cve.now/CVE-2019-0037.md): Junos OS: jdhcpd crash upon receipt of crafted DHCPv6 solicit message (CVSS 7.4, Juniper Networks Junos OS)
- [CVE-2019-0036](https://cve.now/CVE-2019-0036.md): Junos OS: Firewall filter terms named "internal-1" and "internal-2" being ignored (CVSS 7.2, Juniper Networks Junos OS)
- [CVE-2019-0035](https://cve.now/CVE-2019-0035.md): Junos OS: 'set system ports console insecure' allows root password recovery on OAM volumes (CVSS 6.8, Juniper Networks Junos OS)
- [CVE-2019-0033](https://cve.now/CVE-2019-0033.md): SRX Series: A remote attacker may cause a high CPU Denial of Service to the device when proxy ARP is configured. (CVSS 7.5, Juniper Networks Junos OS)
- [CVE-2019-0032](https://cve.now/CVE-2019-0032.md): Junos Space Service Now and Service Insight: Organization username and password stored in plaintext in log files. (CVSS 6.5, Juniper Networks Service Insight · Juniper Networks Service…)
- [CVE-2019-0031](https://cve.now/CVE-2019-0031.md): Junos OS: jdhcpd daemon memory consumption Denial of Service when receiving specific IPv6 DHCP packets. (CVSS 7.4, Juniper Networks Junos OS)
- [CVE-2019-0028](https://cve.now/CVE-2019-0028.md): Junos OS: RPD process crashes due to specific BGP peer restarts condition. (CVSS 7.5, Juniper Networks Junos OS)
- [CVE-2019-0019](https://cve.now/CVE-2019-0019.md): BGP packets can trigger rpd crash when BGP tracing is enabled. (CVSS 7.5, Juniper Networks Junos OS)
- [CVE-2019-0008](https://cve.now/CVE-2019-0008.md): QFX5000 Series, EX4300, EX4600: A stack buffer overflow vulnerability in Packet Forwarding Engine manager (FXPC) process (CVSS 9.8, Juniper Networks Junos OS)
- [CVE-2019-0278](https://cve.now/CVE-2019-0278.md): Under certain conditions the Monitoring Servlet of the SAP NetWeaver Process Integration (Messaging System), fixed in versions 7.10 to… (no CVSS, SAP SE SAP NetWeaver Process Integration)
- [CVE-2019-1003050](https://cve.now/CVE-2019-1003050.md): The f:validateButton form control for the Jenkins UI did not properly escape job URLs in Jenkins 2.171 and earlier and Jenkins LTS 2.164.1… (no CVSS, Jenkins project Jenkins · org.jenkins-ci.main:jenkins-core)
- [CVE-2019-1003049](https://cve.now/CVE-2019-1003049.md): Users who cached their CLI authentication before Jenkins was updated to 2.150.2 and newer, or 2.160 and newer, would remain authenticated… (no CVSS, Jenkins project Jenkins · org.jenkins-ci.main:jenkins-core)
- [CVE-2019-3612](https://cve.now/CVE-2019-3612.md): Information disclosure vulnerability in McAfee TIE Server and DXL Platform (CVSS 8.2, McAfee Data eXchange Layer (DXL) Platform · McAfee Threat I…)
- [CVE-2019-3943](https://cve.now/CVE-2019-3943.md): MikroTik RouterOS versions Stable 6.43.12 and below, Long-term 6.42.12 and below, and Testing 6.44beta75 and below are vulnerable to an… (no CVSS, MikroTik RouterOS)
- [CVE-2019-9694](https://cve.now/CVE-2019-9694.md): Symantec Endpoint Encryption prior to SEE 11.2.1 MP1 may be susceptible to a Privilege Escalation vulnerability, which is a type of issue… (no CVSS, Symantec Endpoint Encryption)
- [CVE-2006-7254](https://cve.now/CVE-2006-7254.md): The nscd daemon in the GNU C Library (glibc) before version 2.5 does not close incoming client sockets if they cannot be handled by the… (no CVSS)
- [CVE-2005-3590](https://cve.now/CVE-2005-3590.md): The getgrouplist function in the GNU C library (glibc) before version 2.3.5, when invoked with a zero argument, writes to the passed… (no CVSS)
- [CVE-2019-0216](https://cve.now/CVE-2019-0216.md): A malicious admin user could edit the state of objects in the Airflow metadata database to execute arbitrary javascript on certain page… (no CVSS, Apache Airflow · apache-airflow)
- [CVE-2019-0229](https://cve.now/CVE-2019-0229.md): A number of HTTP endpoints in the Airflow webserver (both RBAC and classic) did not have adequate protection and were vulnerable to… (no CVSS, Apache Airflow · apache-airflow)
- [CVE-2019-6556](https://cve.now/CVE-2019-6556.md): When processing project files, the application (Omron CX-Programmer v9.70 and prior and Common Components January 2019 and prior) fails to… (no CVSS, Omron CX-Programmer within CX-One)
- [CVE-2019-11068](https://cve.now/CVE-2019-11068.md): libxslt through 1.1.33 allows bypass of a protection mechanism because callers of xsltCheckRead and xsltCheckWrite permit access even upon… (CVSS 9.8, nokogiri)
- [CVE-2019-10946](https://cve.now/CVE-2019-10946.md): An issue was discovered in Joomla! before 3.9.5. (no CVSS)
- [CVE-2019-10945](https://cve.now/CVE-2019-10945.md): An issue was discovered in Joomla! before 3.9.5. (no CVSS)
- [CVE-2019-5426](https://cve.now/CVE-2019-5426.md): In Ubiquiti Networks EdgeSwitch X v1.1.0 and prior, an unauthenticated user can use the "local port forwarding" and "dynamic port… (no CVSS, Ubiquiti Networks EdgeMAX)
- [CVE-2019-5425](https://cve.now/CVE-2019-5425.md): In Ubiquiti Networks EdgeSwitch X v1.1.0 and prior, an authenticated user can execute arbitrary shell commands over the SSH interface… (no CVSS, Ubiquiti Networks EdgeMAX)
- [CVE-2019-5424](https://cve.now/CVE-2019-5424.md): In Ubiquiti Networks EdgeSwitch X v1.1.0 and prior, a privileged user can execute arbitrary shell commands over the SSH CLI interface. (no CVSS, Ubiquiti Networks EdgeMAX)
- [CVE-2019-7139](https://cve.now/CVE-2019-7139.md): An unauthenticated user can execute SQL statements that allow arbitrary read access to the underlying database, which causes sensitive… (no CVSS, Magento Open Source · Magento Commerce +2)
- [CVE-2019-6156](https://cve.now/CVE-2019-6156.md): In Lenovo systems, SMM BIOS Write Protection is used to prevent writes to SPI Flash. (no CVSS, Lenovo BIOS)
- [CVE-2019-6154](https://cve.now/CVE-2019-6154.md): A DLL search path vulnerability was reported in Lenovo Bootable Generator, prior to version Mar-2019, that could allow a malicious user… (CVSS 5.3, Lenovo Bootable Generator)
- [CVE-2019-7551](https://cve.now/CVE-2019-7551.md): Cantemo Portal before 3.2.13, 3.3.x before 3.3.8, and 3.4.x before 3.4.9 has XSS. (no CVSS)
- [CVE-2019-4013](https://cve.now/CVE-2019-4013.md): IBM BigFix Platform 9.5 could allow any authenticated user to upload any file to any location on the server with root privileges. (CVSS 9.0, IBM BigFix Platform)
- [CVE-2018-1994](https://cve.now/CVE-2018-1994.md): IBM InfoSphere Information Server 11.5 and 11.7 is vulnerable to SQL injection. (CVSS 6.3, IBM InfoSphere Information Server)
- [CVE-2018-1903](https://cve.now/CVE-2018-1903.md): IBM Sterling Connect:Direct for UNIX 4.2.0, 4.3.0, and 6.0.0 could allow a user with restricted sudo access on a system to manipulate CD… (CVSS 6.7, IBM Sterling Connect:Direct for UNIX)
- [CVE-2019-0199](https://cve.now/CVE-2019-0199.md): The HTTP/2 implementation in Apache Tomcat 9.0.0.M1 to 9.0.14 and 8.5.0 to 8.5.37 accepted streams with excessive numbers of SETTINGS… (no CVSS, Apache Tomcat · org.apache.tomcat.embed:tomcat-embed-core +1)
- [CVE-2019-6287](https://cve.now/CVE-2019-6287.md): In Rancher 2.0.0 through 2.1.5, project members have continued access to create, update, read, and delete namespaces in a project after… (no CVSS, github.com/rancher/rancher)
- [CVE-2018-20321](https://cve.now/CVE-2018-20321.md): An issue was discovered in Rancher 2 through 2.1.5. (no CVSS, github.com/rancher/rancher)
- [CVE-2019-11069](https://cve.now/CVE-2019-11069.md): Sequelize version 5 before 5.3.0 does not properly ensure that standard conforming strings are used. (no CVSS, sequelize)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/archive/2019-04-10
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.