# CVEs published 2019-04-22

52 CVEs were published on April 22, 2019: 1 critical, 5 high. Days are UTC.

- [CVE-2019-8452](https://cve.now/CVE-2019-8452.md): A hard-link created from log file archive of Check Point ZoneAlarm up to 15.4.062 or Check Point Endpoint Security client for Windows… (no CVSS, Check Point ZoneAlarm)
- [CVE-2019-0218](https://cve.now/CVE-2019-0218.md): A vulnerability was discovered wherein a specially crafted URL could enable reflected XSS via JavaScript in the pony mail interface. (no CVSS, The Apache Software Foundation Apache Pony Mail)
- [CVE-2019-11383](https://cve.now/CVE-2019-11383.md): An issue was discovered in the Medha WiFi FTP Server application 1.8.3 for Android. (no CVSS)
- [CVE-2019-11384](https://cve.now/CVE-2019-11384.md): The Zalora application 6.15.1 for Android stores confidential information insecurely on the system (i.e. (no CVSS)
- [CVE-2019-5427](https://cve.now/CVE-2019-5427.md): c3p0 version \< 0.9.5.4 may be exploited by a billion laughs attack when loading XML configuration due to missing protections against… (no CVSS, c3p0 · com.mchange:c3p0)
- [CVE-2019-11461](https://cve.now/CVE-2019-11461.md): An issue was discovered in GNOME Nautilus 3.30 prior to 3.30.6 and 3.32 prior to 3.32.1. (no CVSS)
- [CVE-2019-11460](https://cve.now/CVE-2019-11460.md): An issue was discovered in GNOME gnome-desktop 3.26, 3.28, and 3.30 prior to 3.30.2.2, and 3.32 prior to 3.32.1.1. (no CVSS)
- [CVE-2019-11459](https://cve.now/CVE-2019-11459.md): The tiff\_document\_render() and tiff\_document\_get\_thumbnail() functions in the TIFF document backend in GNOME Evince through 3.32.0 did not… (no CVSS)
- [CVE-2019-10248](https://cve.now/CVE-2019-10248.md): Eclipse Vorto versions prior to 0.11 resolved Maven build artifacts for the Xtext project over HTTP instead of HTTPS. (no CVSS, The Eclipse Foundation Eclipse Vorto · org.eclipse.vorto:or…)
- [CVE-2019-10241](https://cve.now/CVE-2019-10241.md): In Eclipse Jetty version 9.2.26 and older, 9.3.25 and older, and 9.4.15 and older, the server is vulnerable to XSS conditions if a remote… (no CVSS, The Eclipse Foundation Eclipse Jetty · org.eclipse.jetty:je…)
- [CVE-2019-10246](https://cve.now/CVE-2019-10246.md): In Eclipse Jetty version 9.2.27, 9.3.26, and 9.4.16, the server running on Windows is vulnerable to exposure of the fully qualified Base… (no CVSS, The Eclipse Foundation Eclipse Jetty · org.eclipse.jetty:je…)
- [CVE-2019-10247](https://cve.now/CVE-2019-10247.md): In Eclipse Jetty version 7.x, 8.x, 9.2.27 and older, 9.3.26 and older, and 9.4.16 and older, the server running on any OS and Jetty… (no CVSS, The Eclipse Foundation Eclipse Jetty · org.eclipse.jetty:je…)
- [CVE-2019-9955](https://cve.now/CVE-2019-9955.md): On Zyxel ATP200, ATP500, ATP800, USG20-VPN, USG20W-VPN, USG40, USG40W, USG60, USG60W, USG110, USG210, USG310, USG1100, USG1900… (no CVSS)
- [CVE-2016-1587](https://cve.now/CVE-2016-1587.md): The Snapweb interface before version 0.21.2 was exposing controls to install or remove snap packages without controlling the identity of… (CVSS 7.1, Ubuntu snapweb)
- [CVE-2016-1586](https://cve.now/CVE-2016-1586.md): A malicious webview could install long-lived unload handlers that re-use an incognito BrowserContext that is queued for destruction in… (CVSS 1.8, Ubuntu Oxide)
- [CVE-2016-1585](https://cve.now/CVE-2016-1585.md): AppArmor mount rules grant excessive permissions (CVSS 3.9, apparmor)
- [CVE-2016-1584](https://cve.now/CVE-2016-1584.md): Unity8 converged application lifecycle allows background applications to use on-screen keyboard when not top-most (CVSS 1.6, Ubuntu Unity8)
- [CVE-2016-1579](https://cve.now/CVE-2016-1579.md): UDM doesn't check for confinement before running post-processing commands (CVSS 6.7, Ubuntu Download Manager)
- [CVE-2016-1573](https://cve.now/CVE-2016-1573.md): Using a specially crafted fallback art property, scopes can execute arbitrary QML code in context of unity8-dash (CVSS 4.8, Ubuntu Unity8)
- [CVE-2015-1343](https://cve.now/CVE-2015-1343.md): unity-scope-gdrive search feature logs search terms to syslog (CVSS 2.0, Ubuntu unity-scope-gdrive)
- [CVE-2015-1341](https://cve.now/CVE-2015-1341.md): Apport privilege escalation through Python module imports (CVSS 7.4, Ubuntu Apport)
- [CVE-2015-1340](https://cve.now/CVE-2015-1340.md): chmod race in doUidshiftIntoContainer (CVSS 7.0, Ubuntu LXD · github.com/lxc/lxd)
- [CVE-2015-1327](https://cve.now/CVE-2015-1327.md): Content-hub DBUS API doesn't prevent confined apps from passing paths to files without access (CVSS 3.9, Ubuntu Content Hub)
- [CVE-2015-1326](https://cve.now/CVE-2015-1326.md): python-dbusmock arbitrary code execution or file overwrite when templates are loaded from /tmp (CVSS 5.7, Ubuntu python-dbusmock · python-dbusmock)
- [CVE-2015-1320](https://cve.now/CVE-2015-1320.md): Probe-and-enlist for SeaMicro chassis writes password to the log (CVSS 5.5, Ubuntu MAAS)
- [CVE-2015-1316](https://cve.now/CVE-2015-1316.md): Juju Joyent provider uploads user's private ssh key by default (CVSS 6.4, Ubuntu Juju)
- [CVE-2014-1428](https://cve.now/CVE-2014-1428.md): uuid.uuid1() is not suitable as an unguessable identifier/token (CVSS 2.0, Ubuntu MAAS)
- [CVE-2014-1427](https://cve.now/CVE-2014-1427.md): MAAS API vulnerable to CSRF attack (CVSS 9.6, Ubuntu MAAS)
- [CVE-2014-1426](https://cve.now/CVE-2014-1426.md): get\_file\_by\_name does not check owner (CVSS 8.6, Ubuntu maas)
- [CVE-2011-3151](https://cve.now/CVE-2011-3151.md): SELinux initscript misuse of touch (CVSS 5.2)
- [CVE-2011-3147](https://cve.now/CVE-2011-3147.md): qcow format could expose host filesystem information (CVSS 2.8, nova)
- [CVE-2011-3145](https://cve.now/CVE-2011-3145.md): mount.ecrpytfs\_private sets group owner of /etc/mtab to user's primary group (CVSS 3.8)
- [CVE-2011-1830](https://cve.now/CVE-2011-1830.md): Ekiga attempts to dlopen /tmp/ekiga\_test.so (CVSS 5.7, Gnome Ekiga)
- [CVE-2019-11456](https://cve.now/CVE-2019-11456.md): Gila CMS 1.10.1 allows fm/save CSRF for executing arbitrary PHP code. (no CVSS)
- [CVE-2019-3902](https://cve.now/CVE-2019-3902.md): A flaw was found in Mercurial before 4.9. (CVSS 5.1, The Mercurial Project mercurial · mercurial)
- [CVE-2019-3901](https://cve.now/CVE-2019-3901.md): A race condition in perf\_event\_open() allows local attackers to leak sensitive data from setuid programs. (CVSS 5.6, The Linux Foundation kernel)
- [CVE-2019-6157](https://cve.now/CVE-2019-6157.md): In various firmware versions of Lenovo System x, the integrated management module II (IMM2)'s first failure data capture (FFDC) includes… (CVSS 6.5, Lenovo System x)
- [CVE-2019-6155](https://cve.now/CVE-2019-6155.md): A potential vulnerability was found in an SMI handler in various BIOS versions of certain legacy IBM System x and IBM BladeCenter systems… (CVSS 4.1, IBM System x BIOS · IBM BladeCenter BIOS)
- [CVE-2019-3899](https://cve.now/CVE-2019-3899.md): It was found that default configuration of Heketi does not require any authentication potentially exposing the management interface to… (CVSS 7.3, The Heketi Project heketi)
- [CVE-2019-11455](https://cve.now/CVE-2019-11455.md): A buffer over-read in Util\_urlDecode in util.c in Tildeslash Monit before 5.25.3 allows a remote authenticated attacker to retrieve the… (no CVSS)
- [CVE-2019-11454](https://cve.now/CVE-2019-11454.md): Persistent cross-site scripting (XSS) in http/cervlet.c in Tildeslash Monit before 5.25.3 allows a remote unauthenticated attacker to… (no CVSS)
- [CVE-2019-11243](https://cve.now/CVE-2019-11243.md): In Kubernetes v1.12.0-v1.12.4 and v1.13.0, the rest.AnonymousClientConfig() method returns a copy of the provided config, with credentials… (CVSS 3.1, Kubernetes · k8s.io/kubernetes)
- [CVE-2019-11244](https://cve.now/CVE-2019-11244.md): kubectl creates world-writeable cached schema files (CVSS 3.3, Kubernetes · k8s.io/client-go)
- [CVE-2019-11452](https://cve.now/CVE-2019-11452.md): whatsns 4.0 allows index.php?admin\_category/remove.html cid\[\] SQL injection. (no CVSS)
- [CVE-2019-11451](https://cve.now/CVE-2019-11451.md): whatsns 4.0 allows index.php?inform/add.html qid SQL injection. (no CVSS)
- [CVE-2019-11450](https://cve.now/CVE-2019-11450.md): whatsns 4.0 allows index.php?question/ajaxadd.html title SQL injection. (no CVSS)
- [CVE-2019-11449](https://cve.now/CVE-2019-11449.md): I, Librarian 4.10 has XSS via the notes.php notes parameter. (no CVSS)
- [CVE-2019-11448](https://cve.now/CVE-2019-11448.md): An issue was discovered in Zoho ManageEngine Applications Manager 11.0 through 14.0. (no CVSS)
- [CVE-2019-11447](https://cve.now/CVE-2019-11447.md): An issue was discovered in CutePHP CuteNews 2.1.2. (no CVSS)
- [CVE-2019-11446](https://cve.now/CVE-2019-11446.md): An issue was discovered in ATutor through 2.2.4. (no CVSS)
- [CVE-2019-11445](https://cve.now/CVE-2019-11445.md): OpenKM 6.3.2 through 6.3.7 allows an attacker to upload a malicious JSP file into the /okm:root directories and move that file to the home… (no CVSS)
- [CVE-2019-11444](https://cve.now/CVE-2019-11444.md): An issue was discovered in Liferay Portal CE 7.1.2 GA3. (no CVSS)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/archive/2019-04-22
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.