CVEs published April 2, 2019
39 CVEs were published on April 2, 2019: 2 critical, 4 high.
- Published
- 39
- Critical
- 2
- High
- 4
- Medium
- 10
- Low
- 2
- Unrated
- 21
- Now in CISA KEV
- 0
- Fix available
- 1
Most affected products
- IBM Security Privileged Identity Manager
- 7
- GOG.COM GOG Galaxy
- 5
- SonicWall SonicOS · SonicWall SonicOSv
- 3
- Detcon Sitewatch Gateway
- 2
- IBM InfoSphere Information Server
- 2
- coapthon
- 1
- coapthon3
- 1
- IBM API Connect
- 1
- IBM Spectrum Protect
- 1
- IBM Sterling B2B Integrator
- 1
Critical 2
- CVE-2018-4049An exploitable local privilege elevation vulnerability exists in the file system permissions of GOG Galaxy's “Games” directory, version 1.2.GOG.COM GOG Galaxy
- CVE-2018-3974An exploitable local privilege elevation vulnerability exists in the file system permissions of GOG Galaxy's install directory.GOG.COM GOG Galaxy
High 4
- CVE-2018-4051An exploitable local privilege escalation vulnerability exists in the privileged helper tool of GOG Galaxy's Games, version 1.2.47 for macOSGOG.COM GOG Galaxy
- CVE-2019-4043IBM Sterling B2B Integrator Standard Edition 5.2.0 snf 6.0.0.0 is vulnerable to an XML External Entity Injection (XXE) attack when processinIBM Sterling B2B Integrator
- CVE-2018-1640IBM Security Privileged Identity Manager Virtual Appliance 2.2.1 could allow a remote authenticated attacker to execute arbitrary commands oIBM Security Privileged Identity Manager
- CVE-2018-1618IBM Security Privileged Identity Manager Virtual Appliance 2.2.1 could allow a remote attacker to traverse directories on the system.IBM Security Privileged Identity Manager
Medium, low and unrated 33
- CVE-2018-18035A vulnerability in flashcanvas.swf in OpenEMR before 5.0.1 Patch 6 could allow an unauthenticated, remote attacker to conduct a cross-site s
- CVE-2019-6506SuiteCRM before 7.8.28, 7.9.x and 7.10.x before 7.10.15, and 7.11.x before 7.11.3 allows SQL Injection.
- CVE-2019-10714LocaleLowercase in MagickCore/locale.c in ImageMagick before 7.0.8-32 allows out-of-bounds access, leading to a SIGSEGV.
- CVE-2017-6047Detcon Sitewatch Gateway, all versions without cellular, Passwords are presented in plaintext in a file that is accessible without authenticDetcon Sitewatch Gateway
- CVE-2017-6049Detcon Sitewatch Gateway, all versions without cellular, an attacker can edit settings on the device using a specially crafted URL.Detcon Sitewatch Gateway
- CVE-2019-6531An attacker could retrieve passwords from a HTTP GET request from the Kunbus PR100088 Modbus gateway versions prior to Release R02 (or SoftwKunbus PR100088 Modbus gateway
- CVE-2018-12680The Serialize.deserialize() method in CoAPthon 3.1, 4.0.0, 4.0.1, and 4.0.2 mishandles certain exceptions, leading to a denial of service incoapthon
- CVE-2018-12679The Serialize.deserialize() method in CoAPthon3 1.0 and 1.0.1 mishandles certain exceptions, leading to a denial of service in applications coapthon3
- CVE-2019-10708S-CMS PHP v1.0 has SQL injection via the 4/js/scms.php?action=unlike id parameter.
- CVE-2019-10707MKCMS V5.0 has SQL injection via the bplay.php play parameter.
- CVE-2018-19275The BluStar component in Mitel InAttend before 2.5 SP3 and CMG before 8.4 SP3 Suite Servers has a default password, which could allow remote
- CVE-2019-10692In the wp-google-maps plugin before 7.11.18 for WordPress, includes/class.rest-api.php in the REST API does not sanitize field names before
- CVE-2019-9946Cloud Native Computing Foundation (CNCF) CNI (Container Networking Interface) 0.7.4 has a network firewall misconfiguration which affects Ku
- CVE-2019-7474A vulnerability in SonicWall SonicOS and SonicOSv, allow authenticated read-only admin to leave the firewall in an unstable state by downloaSonicWall SonicOS · SonicWall SonicOSv
- CVE-2019-7475A vulnerability in SonicWall SonicOS and SonicOSv with management enabled system on specific configuration allow unprivileged user to accessSonicWall SonicOS · SonicWall SonicOSv
- CVE-2019-7477A vulnerability in SonicWall SonicOS and SonicOSv TLS CBC Cipher allow remote attackers to obtain sensitive plaintext data when CBC cipher sSonicWall SonicOS · SonicWall SonicOSv
- CVE-2018-15180qTest Portal in QASymphony qTest Manager 9.0.0 has an Open Redirect via the /portal/loginform redirect parameter.
- CVE-2018-4053An exploitable local denial-of-service vulnerability exists in the privileged helper tool of GOG Galaxy's Games, version 1.2.47 for macOS.GOG.COM GOG Galaxy
- CVE-2018-4052An exploitable local information leak vulnerability exists in the privileged helper tool of GOG Galaxy's Games, version 1.2.47 for macOS.GOG.COM GOG Galaxy
- CVE-2019-5515VMware Workstation (15.x before 15.0.3, 14.x before 14.1.6) and Fusion (11.x before 11.0.3, 10.x before 10.1.6) updates address an out-of-boVMware Workstation and Fusion
- CVE-2019-5524VMware Workstation (14.x before 14.1.6) and Fusion (10.x before 10.1.6) contain an out-of-bounds write vulnerability in the e1000 virtual neVMware Workstation, VMware Fusion
- CVE-2019-1010260Using ktlint to download and execute custom rulesets can result in arbitrary code execution as the served jars can be compromised by a MITM.ktlint · com.github.shyiko.ktlint:ktlint-core
- CVE-2019-9759An issue was discovered in TONGDA Office Anywhere 10.18.190121.
- CVE-2019-4093IBM Tivoli Storage Manager (IBM Spectrum Protect 8.1.7) could allow a user to restore files and directories using IBM Spectrum Prootect ClieIBM Spectrum Protect
- CVE-2019-4080IBM WebSphere Application Server Admin Console 7.5, 8.0, 8.5, and 9.0 is vulnerable to a potential denial of service, caused by improper parIBM WebSphere Application Server
- CVE-2018-1917IBM InfoSphere Information Server 11.3, 11.5, and 11.7 could allow an authenticated user to access JSP files and disclose sensitive informatIBM InfoSphere Information Server
- CVE-2018-1906IBM InfoSphere Information Server 11.3, 11.5, and 11.7could allow an authenticated user to download code using a specially crafted HTTP requIBM InfoSphere Information Server
- CVE-2018-1874IBM API Connect 5.0.0.0 through 5.0.8.5 could display highly sensitive information to an attacker with physical access to the system.IBM API Connect
- CVE-2018-1680IBM Security Privileged Identity Manager Virtual Appliance 2.2.1 does not require that users should have strong passwords by default, which IBM Security Privileged Identity Manager
- CVE-2018-1626IBM Security Privileged Identity Manager Virtual Appliance 2.2.1 does not renew a session variable after a successful authentication which cIBM Security Privileged Identity Manager
- CVE-2018-1625IBM Security Privileged Identity Manager Virtual Appliance 2.2.1 generates an error message that includes sensitive information about its enIBM Security Privileged Identity Manager
- CVE-2018-1623IBM Security Privileged Identity Manager Virtual Appliance 2.2.1 allows web pages to be stored locally which can be read by another user on IBM Security Privileged Identity Manager
- CVE-2018-1622IBM Security Privileged Identity Manager Virtual Appliance 2.2.1 is vulnerable to cross-site request forgery which could allow an attacker tIBM Security Privileged Identity Manager