# CVEs published 2019-04-24

42 CVEs were published on April 24, 2019: 1 critical, 6 high. Days are UTC.

- [CVE-2018-7575](https://cve.now/CVE-2018-7575.md): Google TensorFlow 1.7.x and earlier is affected by a Buffer Overflow vulnerability. (no CVSS, tensorflow · tensorflow-gpu +1)
- [CVE-2019-11506](https://cve.now/CVE-2019-11506.md): In GraphicsMagick from version 1.3.30 to 1.4 snapshot-20190403 Q8, there is a heap-based buffer overflow in the function WriteMATLABImage… (no CVSS)
- [CVE-2019-11505](https://cve.now/CVE-2019-11505.md): In GraphicsMagick from version 1.3.8 to 1.4 snapshot-20190403 Q8, there is a heap-based buffer overflow in the function WritePDBImage of… (no CVSS)
- [CVE-2019-8995](https://cve.now/CVE-2019-8995.md): TIBCO ActiveMatrix BPM Open Redirect Vulnerability (CVSS 4.7, TIBCO Software TIBCO ActiveMatrix BPM · TIBCO Software TIBC…)
- [CVE-2019-8994](https://cve.now/CVE-2019-8994.md): TIBCO ActiveMatrix BPM Escalation of Privileges Vulnerability (CVSS 5.4, TIBCO Software TIBCO ActiveMatrix BPM · TIBCO Software TIBC…)
- [CVE-2019-8993](https://cve.now/CVE-2019-8993.md): TIBCO Active Matrix Service Grid Administrator Unauthenticated Download of Sensitive File (CVSS 8.6, TIBCO Software TIBCO ActiveMatrix BPM · TIBCO Software T… +4)
- [CVE-2019-8992](https://cve.now/CVE-2019-8992.md): TIBCO Active Matrix Service Grid Administrator Remote Code Execution (CVSS 9.9, TIBCO Software TIBCO ActiveMatrix BPM · TIBCO Software T… +4)
- [CVE-2019-8991](https://cve.now/CVE-2019-8991.md): TIBCO Active Matrix Service Grid Administrator With Multiple Cross-Site Scripting and Cross-Site Request Forgery Vulnerabilities (CVSS 8.8, TIBCO Software TIBCO ActiveMatrix BPM · TIBCO Software T… +4)
- [CVE-2019-11203](https://cve.now/CVE-2019-11203.md): TIBCO ActiveMatrix BPM Cross-Site Scripting and Cross-Site Request Forgery Vulnerabilities (CVSS 8.8, TIBCO Software TIBCO ActiveMatrix BPM · TIBCO Software TIBC…)
- [CVE-2019-11504](https://cve.now/CVE-2019-11504.md): Zotonic before version 0.47 has mod\_admin XSS. (no CVSS)
- [CVE-2018-18251](https://cve.now/CVE-2018-18251.md): Deltek Vision 7.x before 7.6 permits the execution of any attacker supplied SQL statement through a custom RPC over HTTP protocol. (no CVSS)
- [CVE-2018-20434](https://cve.now/CVE-2018-20434.md): LibreNMS 1.46 allows remote attackers to execute arbitrary OS commands by using the $\_POST\['community'\] parameter to… (no CVSS, librenms/librenms)
- [CVE-2019-11503](https://cve.now/CVE-2019-11503.md): snap-confine as included in snapd before 2.39 did not guard against symlink races when performing the chdir() to the current working… (no CVSS)
- [CVE-2019-11502](https://cve.now/CVE-2019-11502.md): snap-confine in snapd before 2.38 incorrectly set the ownership of a snap application to the uid and gid of the first calling user. (no CVSS)
- [CVE-2017-18367](https://cve.now/CVE-2017-18367.md): libseccomp-golang 0.9.0 and earlier incorrectly generates BPFs that OR multiple arguments rather than ANDing them. (no CVSS, github.com/seccomp/libseccomp-golang)
- [CVE-2019-11218](https://cve.now/CVE-2019-11218.md): Improper handling of extra parameters in the AccountController (User Profile edit) in Jakub Chodounsky Bonobo Git Server before 6.5.0… (no CVSS)
- [CVE-2019-11217](https://cve.now/CVE-2019-11217.md): The GitController in Jakub Chodounsky Bonobo Git Server before 6.5.0 allows execution of arbitrary commands in the context of the web… (no CVSS)
- [CVE-2019-10008](https://cve.now/CVE-2019-10008.md): Zoho ManageEngine ServiceDesk 9.3 allows session hijacking and privilege escalation because an established guest session is automatically… (no CVSS)
- [CVE-2019-9951](https://cve.now/CVE-2019-9951.md): Western Digital My Cloud, My Cloud Mirror Gen2, My Cloud EX2 Ultra, My Cloud EX2100, My Cloud EX4100, My Cloud DL2100, My Cloud DL4100, My… (no CVSS)
- [CVE-2019-9950](https://cve.now/CVE-2019-9950.md): Western Digital My Cloud, My Cloud Mirror Gen2, My Cloud EX2 Ultra, My Cloud EX2100, My Cloud EX4100, My Cloud DL2100, My Cloud DL4100, My… (no CVSS)
- [CVE-2019-10691](https://cve.now/CVE-2019-10691.md): The JSON encoder in Dovecot before 2.3.5.2 allows attackers to repeatedly crash the authentication service by attempting to authenticate… (no CVSS)
- [CVE-2019-9635](https://cve.now/CVE-2019-9635.md): NULL pointer dereference in Google TensorFlow before 1.12.2 could cause a denial of service via an invalid GIF file. (no CVSS, tensorflow-gpu · tensorflow-cpu +1)
- [CVE-2018-10055](https://cve.now/CVE-2018-10055.md): Invalid memory access and/or a heap buffer overflow in the TensorFlow XLA compiler in Google TensorFlow before 1.7.1 could cause a crash… (no CVSS, tensorflow · tensorflow-gpu +1)
- [CVE-2018-7577](https://cve.now/CVE-2018-7577.md): Memcpy parameter overlap in Google Snappy library 1.1.4, as used in Google TensorFlow before 1.7.1, could result in a crash or read from… (no CVSS, tensorflow · tensorflow-gpu +1)
- [CVE-2019-3882](https://cve.now/CVE-2019-3882.md): A flaw was found in the Linux kernel's vfio interface implementation that permits violation of the user's locked memory limit. (CVSS 4.7, The Linux Foundation kernel)
- [CVE-2019-3868](https://cve.now/CVE-2019-3868.md): Keycloak up to version 6.0.0 allows the end user token (access or id token JWT) to be used as the session cookie for browser sessions for… (CVSS 3.8, Red Hat keycloak · org.keycloak:keycloak-core)
- [CVE-2019-3793](https://cve.now/CVE-2019-3793.md): Invitations Service supports HTTP connections (CVSS 8.1, Pivotal Apps Manager)
- [CVE-2019-3789](https://cve.now/CVE-2019-3789.md): Gorouter allows space developer to hijack route services hosted outside the platform (CVSS 8.8, Cloud Foundry CF Routing)
- [CVE-2019-3786](https://cve.now/CVE-2019-3786.md): BBR could run arbitrary scripts on deployment VMs (CVSS 7.7, Cloud Foundry BOSH Backup and Restore)
- [CVE-2019-11032](https://cve.now/CVE-2019-11032.md): In EasyToRecruit (E2R) before 2.11, the upload feature and the Candidate Profile Management feature are prone to Cross Site Scripting… (CVSS 6.1)
- [CVE-2019-9928](https://cve.now/CVE-2019-9928.md): GStreamer before 1.16.0 has a heap-based buffer overflow in the RTSP connection parser via a crafted response from a server, potentially… (no CVSS)
- [CVE-2019-7213](https://cve.now/CVE-2019-7213.md): SmarterTools SmarterMail 16.x before build 6985 allows directory traversal. (no CVSS)
- [CVE-2019-7212](https://cve.now/CVE-2019-7212.md): SmarterTools SmarterMail 16.x before build 6985 has hardcoded secret keys. (no CVSS)
- [CVE-2019-11081](https://cve.now/CVE-2019-11081.md): A default username and password in Dentsply Sirona Sidexis 4.3.1 and earlier allows an attacker to gain administrative access to the… (no CVSS)
- [CVE-2019-7211](https://cve.now/CVE-2019-7211.md): SmarterTools SmarterMail 16.x before build 6995 has stored XSS. (no CVSS)
- [CVE-2019-10239](https://cve.now/CVE-2019-10239.md): Robotronic RunAsSpc 3.7.0.0 protects stored credentials insufficiently, which allows locally authenticated attackers (under the same user… (no CVSS)
- [CVE-2018-13443](https://cve.now/CVE-2018-13443.md): EOS.IO jit-wasm 4.1 has a heap-based buffer overflow via a crafted wast file. (no CVSS)
- [CVE-2019-9734](https://cve.now/CVE-2019-9734.md): Aquarius CMS through 4.3.5 writes POST and GET parameters (including passwords) to a log file due to an overwriting of configuration… (no CVSS)
- [CVE-2019-9724](https://cve.now/CVE-2019-9724.md): aquaverde Aquarius CMS through 4.3.5 allows Information Exposure through Log Files because of an error in the Log-File writer component. (no CVSS)
- [CVE-2019-11498](https://cve.now/CVE-2019-11498.md): WavpackSetConfiguration64 in pack\_utils.c in libwavpack.a in WavPack through 5.1.0 has a "Conditional jump or move depends on… (no CVSS)
- [CVE-2019-11490](https://cve.now/CVE-2019-11490.md): An issue was discovered in Npcap 0.992. (no CVSS)
- [CVE-2019-7214](https://cve.now/CVE-2019-7214.md): SmarterTools SmarterMail 16.x before build 6985 allows deserialization of untrusted data. (no CVSS)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/archive/2019-04-24
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.