# CVEs published 2019-04-01

50 CVEs were published on April 1, 2019: 1 critical, 8 high. Days are UTC.

- [CVE-2019-3792](https://cve.now/CVE-2019-3792.md): Concourse 5.0.0 SQL Injection vulnerability (CVSS 6.8, Pivotal Concourse · github.com/concourse/concourse)
- [CVE-2017-8023](https://cve.now/CVE-2017-8023.md): EMC Networker Remote Code Execution Vulnerability (CVSS 9.8, Dell EMC Networker)
- [CVE-2018-17990](https://cve.now/CVE-2018-17990.md): An issue was discovered on D-Link DSL-3782 devices with firmware 1.01. (no CVSS)
- [CVE-2018-17565](https://cve.now/CVE-2018-17565.md): Shell Metacharacter Injection in the SSH configuration interface on Grandstream GXP16xx VoIP 1.0.4.128 phones allows attackers to execute ar (no CVSS)
- [CVE-2018-17564](https://cve.now/CVE-2018-17564.md): A Malformed Input String to /cgi-bin/delete\_CA on Grandstream GXP16xx VoIP 1.0.4.128 phones allows attackers to delete configuration paramet (no CVSS)
- [CVE-2018-17563](https://cve.now/CVE-2018-17563.md): A Malformed Input String to /cgi-bin/api-get\_line\_status on Grandstream GXP16xx VoIP 1.0.4.128 phones allows attackers to dump the device's (no CVSS)
- [CVE-2018-17989](https://cve.now/CVE-2018-17989.md): A stored XSS vulnerability exists in the web interface on D-Link DSL-3782 devices with firmware 1.01 that allows authenticated attackers to (no CVSS)
- [CVE-2019-5518](https://cve.now/CVE-2019-5518.md): VMware ESXi (6.7 before ESXi670-201903001, 6.5 before ESXi650-201903001, 6.0 before ESXi600-201903001), Workstation (15.x before 15.0.4, 14. (no CVSS, VMware ESXi, Workstation, Fusion)
- [CVE-2019-5519](https://cve.now/CVE-2019-5519.md): VMware ESXi (6.7 before ESXi670-201903001, 6.5 before ESXi650-201903001, 6.0 before ESXi600-201903001), Workstation (15.x before 15.0.4, 14. (no CVSS, VMware ESXi, Workstation, Fusion)
- [CVE-2019-5514](https://cve.now/CVE-2019-5514.md): VMware VMware Fusion (11.x before 11.0.3) contains a security vulnerability due to certain unauthenticated APIs accessible through a web soc (no CVSS, VMware Fusion)
- [CVE-2018-3979](https://cve.now/CVE-2018-3979.md): A remote denial-of-service vulnerability exists in the way the Nouveau Display Driver (the default Ubuntu Nvidia display driver) handles GPU (CVSS 7.4, Nouveau)
- [CVE-2018-19113](https://cve.now/CVE-2018-19113.md): The Pronestor PNHM (aka Health Monitoring or HealthMonitor) add-in before 8.1.13.0 for Outlook has "BUILTIN\\Users:(I)(F)" permissions for th (no CVSS)
- [CVE-2019-3489](https://cve.now/CVE-2019-3489.md): An unauthenticated file upload vulnerability has been identified in the Web Client component of Micro Focus Content Manager 9.1, 9.2, and 9. (no CVSS, Micro Focus Content Manager)
- [CVE-2019-6715](https://cve.now/CVE-2019-6715.md): pub/sns.php in the W3 Total Cache plugin before 0.9.4 for WordPress allows remote attackers to read arbitrary files via the SubscribeURL fie (no CVSS)
- [CVE-2019-8956](https://cve.now/CVE-2019-8956.md): In the Linux Kernel before versions 4.20.8 and 4.19.21 a use-after-free error in the "sctp\_sendmsg()" function (net/sctp/socket.c) when hand (no CVSS, Linux Kernel)
- [CVE-2018-4050](https://cve.now/CVE-2018-4050.md): An exploitable local privilege escalation vulnerability exists in the privileged helper tool of GOG Galaxy's Games, version 1.2.47 for macOS (CVSS 7.1, Talos GOG Galaxy)
- [CVE-2019-5523](https://cve.now/CVE-2019-5523.md): VMware vCloud Director for Service Providers 9.5.x prior to 9.5.0.3 update resolves a Remote Session Hijack vulnerability in the Tenant and (no CVSS, VMware vCloud Director for Service Providers)
- [CVE-2019-9132](https://cve.now/CVE-2019-9132.md): Remote code execution vulnerability exists in KaKaoTalk PC messenger when user clicks specially crafted link in the message window. (no CVSS, Kakaotalk Windows PC Messenger)
- [CVE-2019-10686](https://cve.now/CVE-2019-10686.md): An SSRF vulnerability was found in an API from Ctrip Apollo through 1.4.0-SNAPSHOT. (no CVSS, com.ctrip.framework.apollo:apollo)
- [CVE-2018-5757](https://cve.now/CVE-2018-5757.md): An issue was discovered on AudioCodes 450HD IP Phone devices with firmware 3.0.0.535.106. (no CVSS)
- [CVE-2019-10684](https://cve.now/CVE-2019-10684.md): Application/Admin/Controller/ConfigController.class.php in 74cms v5.0.1 allows remote attackers to execute arbitrary PHP code via the index. (no CVSS)
- [CVE-2019-5891](https://cve.now/CVE-2019-5891.md): An issue was discovered in OverIT Geocall 6.3 before build 2:346977. (no CVSS)
- [CVE-2019-5890](https://cve.now/CVE-2019-5890.md): An issue was discovered in OverIT Geocall 6.3 before build 2:346977. (no CVSS)
- [CVE-2019-5889](https://cve.now/CVE-2019-5889.md): An log-management directory traversal issue was discovered in OverIT Geocall 6.3 before build 2:346977. (no CVSS)
- [CVE-2019-5888](https://cve.now/CVE-2019-5888.md): Multiple XSS vulnerabilities were discovered in OverIT Geocall 6.3 before build 2:346977. (no CVSS)
- [CVE-2018-13299](https://cve.now/CVE-2018-13299.md): Relative path traversal vulnerability in Attachment Uploader in Synology Calendar before 2.2.2-0532 allows remote authenticated users to upl (CVSS 4.3, Synology Calendar)
- [CVE-2018-13298](https://cve.now/CVE-2018-13298.md): Channel accessible by non-endpoint vulnerability in privacy page in Synology Android Moments before 1.2.3-199 allows man-in-the-middle attac (CVSS 4.2, Synology Android Moments)
- [CVE-2018-13297](https://cve.now/CVE-2018-13297.md): Information exposure vulnerability in SYNO.SynologyDrive.Files in Synology Drive before 1.1.2-10562 allows remote attackers to obtain sensit (CVSS 5.3, Synology Drive)
- [CVE-2018-13296](https://cve.now/CVE-2018-13296.md): Uncontrolled resource consumption vulnerability in TLS configuration in Synology MailPlus Server before 2.0.5-0606 allows remote attackers t (CVSS 7.5, Synology MailPlus Server)
- [CVE-2018-13295](https://cve.now/CVE-2018-13295.md): Information exposure vulnerability in SYNO.Personal.Application.Info in Synology Application Service before 1.5.4-0320 allows remote authent (CVSS 4.3, Synology Application Service)
- [CVE-2018-13294](https://cve.now/CVE-2018-13294.md): Information exposure vulnerability in SYNO.Personal.Profile in Synology Application Service before 1.5.4-0320 allows remote authenticated us (CVSS 4.3, Synology Application Service)
- [CVE-2018-13293](https://cve.now/CVE-2018-13293.md): Cross-site scripting (XSS) vulnerability in Control Panel SSO Settings in Synology DiskStation Manager (DSM) before 6.2.1-23824 allows remot (CVSS 5.9, Synology DiskStation Manager)
- [CVE-2018-13291](https://cve.now/CVE-2018-13291.md): Information exposure vulnerability in /usr/syno/etc/mount.conf in Synology DiskStation Manager (DSM) before 6.2.1-23824 allows remote authen (CVSS 4.3, Synology DiskStation Manager)
- [CVE-2018-13292](https://cve.now/CVE-2018-13292.md): Information exposure vulnerability in /usr/syno/etc/mount.conf in Synology Router Manager (SRM) before 1.1.7-6941-2 allows remote authentica (CVSS 4.3, Synology Router Manager)
- [CVE-2018-13290](https://cve.now/CVE-2018-13290.md): Information exposure vulnerability in SYNO.Core.ACL in Synology Router Manager (SRM) before 1.1.7-6941-2 allows remote authenticated users t (CVSS 4.3, Synology Router Manager)
- [CVE-2018-13289](https://cve.now/CVE-2018-13289.md): Information exposure vulnerability in SYNO.FolderSharing.List in Synology Router Manager (SRM) before 1.1.7-6941-2 allows remote attackers t (CVSS 5.3, Synology Router Manager)
- [CVE-2018-13288](https://cve.now/CVE-2018-13288.md): Information exposure vulnerability in SYNO.FolderSharing.List in Synology File Station before 1.2.3-0252 and before 1.1.5-0125 allows remote (CVSS 5.3, Synology File Station)
- [CVE-2018-13287](https://cve.now/CVE-2018-13287.md): Incorrect default permissions vulnerability in synouser.conf in Synology Router Manager (SRM) before 1.1.7-6941-1 allows remote authenticate (CVSS 6.5, Synology Router Manager)
- [CVE-2018-13285](https://cve.now/CVE-2018-13285.md): Command injection vulnerability in ftpd in Synology Router Manager (SRM) before 1.1.7-6941-1 allows remote authenticated users to execute ar (CVSS 7.5, Synology Router Manager)
- [CVE-2018-13286](https://cve.now/CVE-2018-13286.md): Incorrect default permissions vulnerability in synouser.conf in Synology Diskstation Manager (DSM) before 6.2-23739-1 allows remote authenti (CVSS 6.5, Synology DiskStation Manager)
- [CVE-2018-13284](https://cve.now/CVE-2018-13284.md): Command injection vulnerability in ftpd in Synology Diskstation Manager (DSM) before 6.2-23739-1 allows remote authenticated users to execut (CVSS 7.5, Synology DiskStation Manager)
- [CVE-2018-13283](https://cve.now/CVE-2018-13283.md): Lack of administrator control over security vulnerability in client.cgi in Synology SSL VPN Client before 1.2.5-0226 allows remote attackers (CVSS 8.8, Synology SSL VPN Client)
- [CVE-2017-16775](https://cve.now/CVE-2017-16775.md): Improper restriction of rendered UI layers or frames vulnerability in SSOOauth.cgi in Synology SSO Server before 2.1.3-0129 allows remote at (CVSS 7.1, Synology SSO Server)
- [CVE-2017-16774](https://cve.now/CVE-2017-16774.md): Cross-site scripting (XSS) vulnerability in SYNO.Core.PersonalNotification.Event in Synology DiskStation Manager (DSM) before 6.1.4-15217-3 (CVSS 6.5, Synology DiskStation Manager)
- [CVE-2018-8913](https://cve.now/CVE-2018-8913.md): Missing custom error page vulnerability in Synology Web Station before 2.1.3-0139 allows remote attackers to conduct phishing attacks via a (CVSS 7.1, Synology Web Station)
- [CVE-2019-3836](https://cve.now/CVE-2019-3836.md): It was discovered in gnutls before version 3.6.7 upstream that there is an uninitialized pointer access in gnutls versions 3.6.3 or later wh (CVSS 5.9, gnutls)
- [CVE-2019-3876](https://cve.now/CVE-2019-3876.md): A flaw was found in the /oauth/token/request custom endpoint of the OpenShift OAuth server allowing for XSS generation of CLI tokens due to (CVSS 5.0, Red Hat web-console)
- [CVE-2019-1002101](https://cve.now/CVE-2019-1002101.md): kubectl cp path traversal (CVSS 6.4, Kubernetes · k8s.io/kubernetes)
- [CVE-2019-1002100](https://cve.now/CVE-2019-1002100.md): In all Kubernetes versions prior to v1.11.8, v1.12.6, and v1.13.4, users that are authorized to make patch requests to the Kubernetes API Se (CVSS 6.5, Kubernetes · k8s.io/kubernetes)
- [CVE-2019-9193](https://cve.now/CVE-2019-9193.md): In PostgreSQL 9.3 through 11.2, the "COPY TO/FROM PROGRAM" function allows superusers and users in the 'pg\_execute\_server\_program' group to (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2019-04-01
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.