CVEs published April 1, 2019
50 CVEs were published on April 1, 2019: 1 critical, 8 high.
- Published
- 50
- Critical
- 1
- High
- 8
- Medium
- 19
- Low
- 0
- Unrated
- 22
- Now in CISA KEV
- 0
- Fix available
- 24
Most affected products
- Synology DiskStation Manager
- 5
- Synology Router Manager
- 5
- Kubernetes · k8s.io/kubernetes
- 2
- Synology Application Service
- 2
- VMware ESXi, Workstation, Fusion
- 2
- com.ctrip.framework.apollo:apollo
- 1
- Dell EMC Networker
- 1
- gnutls
- 1
- Kakaotalk Windows PC Messenger
- 1
- Linux Kernel
- 1
Critical 1
High 8
- CVE-2018-3979A remote denial-of-service vulnerability exists in the way the Nouveau Display Driver (the default Ubuntu Nvidia display driver) handles GPUNouveau
- CVE-2018-4050An exploitable local privilege escalation vulnerability exists in the privileged helper tool of GOG Galaxy's Games, version 1.2.47 for macOSTalos GOG Galaxy
- CVE-2018-13296Uncontrolled resource consumption vulnerability in TLS configuration in Synology MailPlus Server before 2.0.5-0606 allows remote attackers tSynology MailPlus Server
- CVE-2018-13285Command injection vulnerability in ftpd in Synology Router Manager (SRM) before 1.1.7-6941-1 allows remote authenticated users to execute arSynology Router Manager
- CVE-2018-13284Command injection vulnerability in ftpd in Synology Diskstation Manager (DSM) before 6.2-23739-1 allows remote authenticated users to executSynology DiskStation Manager
- CVE-2018-13283Lack of administrator control over security vulnerability in client.cgi in Synology SSL VPN Client before 1.2.5-0226 allows remote attackersSynology SSL VPN Client
- CVE-2017-16775Improper restriction of rendered UI layers or frames vulnerability in SSOOauth.cgi in Synology SSO Server before 2.1.3-0129 allows remote atSynology SSO Server
- CVE-2018-8913Missing custom error page vulnerability in Synology Web Station before 2.1.3-0139 allows remote attackers to conduct phishing attacks via a Synology Web Station
Medium, low and unrated 41
- CVE-2019-3792Concourse 5.0.0 SQL Injection vulnerabilityPivotal Concourse · github.com/concourse/concourse
- CVE-2018-17990An issue was discovered on D-Link DSL-3782 devices with firmware 1.01.
- CVE-2018-17565Shell Metacharacter Injection in the SSH configuration interface on Grandstream GXP16xx VoIP 1.0.4.128 phones allows attackers to execute ar
- CVE-2018-17564A Malformed Input String to /cgi-bin/delete_CA on Grandstream GXP16xx VoIP 1.0.4.128 phones allows attackers to delete configuration paramet
- CVE-2018-17563A Malformed Input String to /cgi-bin/api-get_line_status on Grandstream GXP16xx VoIP 1.0.4.128 phones allows attackers to dump the device's
- CVE-2018-17989A stored XSS vulnerability exists in the web interface on D-Link DSL-3782 devices with firmware 1.01 that allows authenticated attackers to
- CVE-2019-5518VMware ESXi (6.7 before ESXi670-201903001, 6.5 before ESXi650-201903001, 6.0 before ESXi600-201903001), Workstation (15.x before 15.0.4, 14.VMware ESXi, Workstation, Fusion
- CVE-2019-5519VMware ESXi (6.7 before ESXi670-201903001, 6.5 before ESXi650-201903001, 6.0 before ESXi600-201903001), Workstation (15.x before 15.0.4, 14.VMware ESXi, Workstation, Fusion
- CVE-2019-5514VMware VMware Fusion (11.x before 11.0.3) contains a security vulnerability due to certain unauthenticated APIs accessible through a web socVMware Fusion
- CVE-2018-19113The Pronestor PNHM (aka Health Monitoring or HealthMonitor) add-in before 8.1.13.0 for Outlook has "BUILTIN\Users:(I)(F)" permissions for th
- CVE-2019-3489An unauthenticated file upload vulnerability has been identified in the Web Client component of Micro Focus Content Manager 9.1, 9.2, and 9.Micro Focus Content Manager
- CVE-2019-6715pub/sns.php in the W3 Total Cache plugin before 0.9.4 for WordPress allows remote attackers to read arbitrary files via the SubscribeURL fie
- CVE-2019-8956In the Linux Kernel before versions 4.20.8 and 4.19.21 a use-after-free error in the "sctp_sendmsg()" function (net/sctp/socket.c) when handLinux Kernel
- CVE-2019-5523VMware vCloud Director for Service Providers 9.5.x prior to 9.5.0.3 update resolves a Remote Session Hijack vulnerability in the Tenant and VMware vCloud Director for Service Providers
- CVE-2019-9132Remote code execution vulnerability exists in KaKaoTalk PC messenger when user clicks specially crafted link in the message window.Kakaotalk Windows PC Messenger
- CVE-2019-10686An SSRF vulnerability was found in an API from Ctrip Apollo through 1.4.0-SNAPSHOT.com.ctrip.framework.apollo:apollo
- CVE-2018-5757An issue was discovered on AudioCodes 450HD IP Phone devices with firmware 3.0.0.535.106.
- CVE-2019-10684Application/Admin/Controller/ConfigController.class.php in 74cms v5.0.1 allows remote attackers to execute arbitrary PHP code via the index.
- CVE-2019-5891An issue was discovered in OverIT Geocall 6.3 before build 2:346977.
- CVE-2019-5890An issue was discovered in OverIT Geocall 6.3 before build 2:346977.
- CVE-2019-5889An log-management directory traversal issue was discovered in OverIT Geocall 6.3 before build 2:346977.
- CVE-2019-5888Multiple XSS vulnerabilities were discovered in OverIT Geocall 6.3 before build 2:346977.
- CVE-2018-13299Relative path traversal vulnerability in Attachment Uploader in Synology Calendar before 2.2.2-0532 allows remote authenticated users to uplSynology Calendar
- CVE-2018-13298Channel accessible by non-endpoint vulnerability in privacy page in Synology Android Moments before 1.2.3-199 allows man-in-the-middle attacSynology Android Moments
- CVE-2018-13297Information exposure vulnerability in SYNO.SynologyDrive.Files in Synology Drive before 1.1.2-10562 allows remote attackers to obtain sensitSynology Drive
- CVE-2018-13295Information exposure vulnerability in SYNO.Personal.Application.Info in Synology Application Service before 1.5.4-0320 allows remote authentSynology Application Service
- CVE-2018-13294Information exposure vulnerability in SYNO.Personal.Profile in Synology Application Service before 1.5.4-0320 allows remote authenticated usSynology Application Service
- CVE-2018-13293Cross-site scripting (XSS) vulnerability in Control Panel SSO Settings in Synology DiskStation Manager (DSM) before 6.2.1-23824 allows remotSynology DiskStation Manager
- CVE-2018-13291Information exposure vulnerability in /usr/syno/etc/mount.conf in Synology DiskStation Manager (DSM) before 6.2.1-23824 allows remote authenSynology DiskStation Manager
- CVE-2018-13292Information exposure vulnerability in /usr/syno/etc/mount.conf in Synology Router Manager (SRM) before 1.1.7-6941-2 allows remote authenticaSynology Router Manager
- CVE-2018-13290Information exposure vulnerability in SYNO.Core.ACL in Synology Router Manager (SRM) before 1.1.7-6941-2 allows remote authenticated users tSynology Router Manager
- CVE-2018-13289Information exposure vulnerability in SYNO.FolderSharing.List in Synology Router Manager (SRM) before 1.1.7-6941-2 allows remote attackers tSynology Router Manager
- CVE-2018-13288Information exposure vulnerability in SYNO.FolderSharing.List in Synology File Station before 1.2.3-0252 and before 1.1.5-0125 allows remoteSynology File Station
- CVE-2018-13287Incorrect default permissions vulnerability in synouser.conf in Synology Router Manager (SRM) before 1.1.7-6941-1 allows remote authenticateSynology Router Manager
- CVE-2018-13286Incorrect default permissions vulnerability in synouser.conf in Synology Diskstation Manager (DSM) before 6.2-23739-1 allows remote authentiSynology DiskStation Manager
- CVE-2017-16774Cross-site scripting (XSS) vulnerability in SYNO.Core.PersonalNotification.Event in Synology DiskStation Manager (DSM) before 6.1.4-15217-3 Synology DiskStation Manager
- CVE-2019-3836It was discovered in gnutls before version 3.6.7 upstream that there is an uninitialized pointer access in gnutls versions 3.6.3 or later whgnutls
- CVE-2019-3876A flaw was found in the /oauth/token/request custom endpoint of the OpenShift OAuth server allowing for XSS generation of CLI tokens due to Red Hat web-console
- CVE-2019-1002101kubectl cp path traversalKubernetes · k8s.io/kubernetes
- CVE-2019-1002100In all Kubernetes versions prior to v1.11.8, v1.12.6, and v1.13.4, users that are authorized to make patch requests to the Kubernetes API SeKubernetes · k8s.io/kubernetes
- CVE-2019-9193In PostgreSQL 9.3 through 11.2, the "COPY TO/FROM PROGRAM" function allows superusers and users in the 'pg_execute_server_program' group to