# CVEs published 2019-04-04

99 CVEs were published on April 4, 2019: 1 critical, 0 high. Days are UTC.

- [CVE-2018-19282](https://cve.now/CVE-2018-19282.md): Rockwell Automation PowerFlex 525 AC Drives 5.001 and earlier allow remote attackers to cause a denial of service by crashing the Common Ind (no CVSS)
- [CVE-2018-18068](https://cve.now/CVE-2018-18068.md): The ARM-based hardware debugging feature on Raspberry Pi 3 module B+ and possibly other devices allows non-secure EL1 code to read/write any (no CVSS)
- [CVE-2019-6553](https://cve.now/CVE-2019-6553.md): A vulnerability was found in Rockwell Automation RSLinx Classic versions 4.10.00 and prior. (no CVSS, Rockwell Automation RSLinx Classic)
- [CVE-2019-10867](https://cve.now/CVE-2019-10867.md): An issue was discovered in Pimcore before 5.7.1. (no CVSS, pimcore/pimcore)
- [CVE-2019-10863](https://cve.now/CVE-2019-10863.md): A command injection vulnerability exists in TeemIp versions before 2.4.0. (no CVSS)
- [CVE-2018-20229](https://cve.now/CVE-2018-20229.md): GitLab Community and Enterprise Edition before 11.3.14, 11.4.x before 11.4.12, and 11.5.x before 11.5.5 allows Directory Traversal. (no CVSS)
- [CVE-2019-7001](https://cve.now/CVE-2019-7001.md): Avaya IPOCC WebUI SQL Injection (CVSS 9.9, Avaya IP Office Contact Center)
- [CVE-2019-10856](https://cve.now/CVE-2019-10856.md): In Jupyter Notebook before 5.7.8, an open redirect can occur via an empty netloc. (no CVSS, notebook)
- [CVE-2018-20222](https://cve.now/CVE-2018-20222.md): XXE issue in Airsonic before 10.1.2 during parse. (no CVSS)
- [CVE-2019-10287](https://cve.now/CVE-2019-10287.md): Jenkins youtrack-plugin Plugin 0.7.1 and older stored credentials unencrypted in its global configuration file on the Jenkins master where t (no CVSS, Jenkins project Jenkins youtrack-plugin Plugin · org.jenkin…)
- [CVE-2019-10288](https://cve.now/CVE-2019-10288.md): Jenkins Jabber Server Plugin stores credentials unencrypted in its global configuration file on the Jenkins master where they can be viewed (no CVSS, Jenkins project Jenkins Jabber Server Plugin · de.e-nexus:j…)
- [CVE-2019-10289](https://cve.now/CVE-2019-10289.md): A cross-site request forgery vulnerability in Jenkins Netsparker Cloud Scan Plugin 1.1.5 and older in the NCScanBuilder.DescriptorImpl#doVal (no CVSS, Jenkins project Jenkins Netsparker Cloud Scan Plugin · org.…)
- [CVE-2019-10290](https://cve.now/CVE-2019-10290.md): A missing permission check in Jenkins Netsparker Cloud Scan Plugin 1.1.5 and older in the NCScanBuilder.DescriptorImpl#doValidateAPI form va (no CVSS, Jenkins project Jenkins Netsparker Cloud Scan Plugin · org.…)
- [CVE-2019-10291](https://cve.now/CVE-2019-10291.md): Jenkins Netsparker Cloud Scan Plugin 1.1.5 and older stored credentials unencrypted in its global configuration file on the Jenkins master w (no CVSS, Jenkins project Jenkins Netsparker Cloud Scan Plugin · org.…)
- [CVE-2019-10292](https://cve.now/CVE-2019-10292.md): A cross-site request forgery vulnerability in Jenkins Kmap Plugin in KmapJenkinsBuilder.DescriptorImpl form validation methods allows attack (no CVSS, Jenkins project Jenkins Kmap Plugin · org.jenkins-ci.plugin…)
- [CVE-2019-10293](https://cve.now/CVE-2019-10293.md): A missing permission check in Jenkins Kmap Plugin in KmapJenkinsBuilder.DescriptorImpl form validation methods allows attackers with Overall (no CVSS, Jenkins project Jenkins Kmap Plugin · org.jenkins-ci.plugin…)
- [CVE-2019-10294](https://cve.now/CVE-2019-10294.md): Jenkins Kmap Plugin stores credentials unencrypted in job config.xml files on the Jenkins master where they can be viewed by users with Exte (no CVSS, Jenkins project Jenkins Kmap Plugin · org.jenkins-ci.plugin…)
- [CVE-2019-10295](https://cve.now/CVE-2019-10295.md): Jenkins crittercism-dsym Plugin stores credentials unencrypted in job config.xml files on the Jenkins master where they can be viewed by use (no CVSS, Jenkins project Jenkins crittercism-dsym Plugin · org.jenki…)
- [CVE-2019-10296](https://cve.now/CVE-2019-10296.md): Jenkins Serena SRA Deploy Plugin stores credentials unencrypted in its global configuration file on the Jenkins master where they can be vie (no CVSS, Jenkins project Jenkins Serena SRA Deploy Plugin · com.urba…)
- [CVE-2019-10297](https://cve.now/CVE-2019-10297.md): Jenkins Sametime Plugin stores credentials unencrypted in its global configuration file on the Jenkins master where they can be viewed by us (no CVSS, Jenkins project Jenkins Sametime Plugin · org.jenkins-ci.pl…)
- [CVE-2019-10298](https://cve.now/CVE-2019-10298.md): Jenkins Koji Plugin stores credentials unencrypted in its global configuration file on the Jenkins master where they can be viewed by users (no CVSS, Jenkins project Jenkins Koji Plugin · org.jenkins-ci.plugin…)
- [CVE-2019-10299](https://cve.now/CVE-2019-10299.md): Jenkins CloudCoreo DeployTime Plugin stores credentials unencrypted in its global configuration file on the Jenkins master where they can be (no CVSS, Jenkins project Jenkins CloudCoreo DeployTime Plugin · com.…)
- [CVE-2019-1003083](https://cve.now/CVE-2019-1003083.md): A missing permission check in Jenkins Gearman Plugin in the GearmanPluginConfig#doTestConnection form validation method allows attackers wit (no CVSS, Jenkins project Jenkins Gearman Plugin · org.jenkins-ci.plu…)
- [CVE-2019-1003084](https://cve.now/CVE-2019-1003084.md): A cross-site request forgery vulnerability in Jenkins Zephyr Enterprise Test Management Plugin in the ZeeDescriptor#doTestConnection form va (no CVSS, Jenkins project Jenkins Zephyr Enterprise Test Management P…)
- [CVE-2019-1003085](https://cve.now/CVE-2019-1003085.md): A missing permission check in Jenkins Zephyr Enterprise Test Management Plugin in the ZeeDescriptor#doTestConnection form validation method (no CVSS, Jenkins project Jenkins Zephyr Enterprise Test Management P…)
- [CVE-2019-1003086](https://cve.now/CVE-2019-1003086.md): A cross-site request forgery vulnerability in Jenkins Chef Sinatra Plugin in the ChefBuilderConfiguration.DescriptorImpl#doTestConnection fo (no CVSS, Jenkins project Jenkins Chef Sinatra Plugin · org.jenkins-c…)
- [CVE-2019-1003087](https://cve.now/CVE-2019-1003087.md): A missing permission check in Jenkins Chef Sinatra Plugin in the ChefBuilderConfiguration.DescriptorImpl#doTestConnection form validation me (no CVSS, Jenkins project Jenkins Chef Sinatra Plugin · org.jenkins-c…)
- [CVE-2019-1003088](https://cve.now/CVE-2019-1003088.md): Jenkins Fabric Beta Publisher Plugin stores credentials unencrypted in job config.xml files on the Jenkins master where they can be viewed b (no CVSS, Jenkins project Jenkins Fabric Beta Publisher Plugin · egor…)
- [CVE-2019-1003089](https://cve.now/CVE-2019-1003089.md): Jenkins Upload to pgyer Plugin stores credentials unencrypted in job config.xml files on the Jenkins master where they can be viewed by user (no CVSS, Jenkins project Jenkins Upload to pgyer Plugin · ren.hellow…)
- [CVE-2019-1003090](https://cve.now/CVE-2019-1003090.md): A cross-site request forgery vulnerability in Jenkins SOASTA CloudTest Plugin in the CloudTestServer.DescriptorImpl#doValidate form validati (no CVSS, Jenkins project Jenkins SOASTA CloudTest Plugin · com.soast…)
- [CVE-2019-1003091](https://cve.now/CVE-2019-1003091.md): A missing permission check in Jenkins SOASTA CloudTest Plugin in the CloudTestServer.DescriptorImpl#doValidate form validation method allows (no CVSS, Jenkins project Jenkins SOASTA CloudTest Plugin · com.soast…)
- [CVE-2019-1003092](https://cve.now/CVE-2019-1003092.md): A cross-site request forgery vulnerability in Jenkins Nomad Plugin in the NomadCloud.DescriptorImpl#doTestConnection form validation method (no CVSS, Jenkins project Jenkins Nomad Plugin · org.jenkins-ci.plugi…)
- [CVE-2019-1003093](https://cve.now/CVE-2019-1003093.md): A missing permission check in Jenkins Nomad Plugin in the NomadCloud.DescriptorImpl#doTestConnection form validation method allows attackers (no CVSS, Jenkins project Jenkins Nomad Plugin · org.jenkins-ci.plugi…)
- [CVE-2019-1003094](https://cve.now/CVE-2019-1003094.md): Jenkins Open STF Plugin stores credentials unencrypted in its global configuration file on the Jenkins master where they can be viewed by us (no CVSS, Jenkins project Jenkins Open STF Plugin · org.jenkins-ci.pl…)
- [CVE-2019-1003095](https://cve.now/CVE-2019-1003095.md): Jenkins Perfecto Mobile Plugin stores credentials unencrypted in its global configuration file on the Jenkins master where they can be viewe (no CVSS, Jenkins project Jenkins Perfecto Mobile Plugin · org.jenkin…)
- [CVE-2019-1003096](https://cve.now/CVE-2019-1003096.md): Jenkins TestFairy Plugin stores credentials unencrypted in job config.xml files on the Jenkins master where they can be viewed by users with (no CVSS, Jenkins project Jenkins TestFairy Plugin · org.jenkins-ci.p…)
- [CVE-2019-1003097](https://cve.now/CVE-2019-1003097.md): Jenkins Crowd Integration Plugin stores credentials unencrypted in the global config.xml configuration file on the Jenkins master where they (no CVSS, Jenkins project Jenkins Crowd Integration Plugin · com.ds.t…)
- [CVE-2019-1003098](https://cve.now/CVE-2019-1003098.md): A cross-site request forgery vulnerability in Jenkins openid Plugin in the OpenIdSsoSecurityRealm.DescriptorImpl#doValidate form validation (no CVSS, Jenkins project Jenkins openid Plugin · org.jenkins-ci.plug…)
- [CVE-2019-1003099](https://cve.now/CVE-2019-1003099.md): A missing permission check in Jenkins openid Plugin in the OpenIdSsoSecurityRealm.DescriptorImpl#doValidate form validation method allows at (no CVSS, Jenkins project Jenkins openid Plugin · org.jenkins-ci.plug…)
- [CVE-2019-10277](https://cve.now/CVE-2019-10277.md): Jenkins StarTeam Plugin stores credentials unencrypted in job config.xml files on the Jenkins master where they can be viewed by users with (no CVSS, Jenkins project Jenkins StarTeam Plugin · hudson.plugins:st…)
- [CVE-2019-10278](https://cve.now/CVE-2019-10278.md): A cross-site request forgery vulnerability in Jenkins jenkins-reviewbot Plugin in the ReviewboardDescriptor#doTestConnection form validation (no CVSS, Jenkins project Jenkins jenkins-reviewbot Plugin · org.jenk…)
- [CVE-2019-10279](https://cve.now/CVE-2019-10279.md): A missing permission check in Jenkins jenkins-reviewbot Plugin in the ReviewboardDescriptor#doTestConnection form validation method allows a (no CVSS, Jenkins project Jenkins jenkins-reviewbot Plugin · org.jenk…)
- [CVE-2019-10280](https://cve.now/CVE-2019-10280.md): Jenkins Assembla Auth Plugin stores credentials unencrypted in the global config.xml configuration file on the Jenkins master where they can (no CVSS, Jenkins project Jenkins Assembla Auth Plugin · org.jenkins-…)
- [CVE-2019-10281](https://cve.now/CVE-2019-10281.md): Jenkins Relution Enterprise Appstore Publisher Plugin stores credentials unencrypted in its global configuration file on the Jenkins master (no CVSS, Jenkins project Jenkins Relution Enterprise Appstore Publis…)
- [CVE-2019-10282](https://cve.now/CVE-2019-10282.md): Jenkins Klaros-Testmanagement Plugin stores credentials unencrypted in job config.xml files on the Jenkins master where they can be viewed b (no CVSS, Jenkins project Jenkins Klaros-Testmanagement Plugin · huds…)
- [CVE-2019-10283](https://cve.now/CVE-2019-10283.md): Jenkins mabl Plugin stores credentials unencrypted in job config.xml files on the Jenkins master where they can be viewed by users with Exte (no CVSS, Jenkins project Jenkins mabl Plugin · com.mabl.integration.…)
- [CVE-2019-10284](https://cve.now/CVE-2019-10284.md): Jenkins Diawi Upload Plugin stores credentials unencrypted in job config.xml files on the Jenkins master where they can be viewed by users w (no CVSS, Jenkins project Jenkins Diawi Upload Plugin · org.jenkins-c…)
- [CVE-2019-10285](https://cve.now/CVE-2019-10285.md): Jenkins Minio Storage Plugin stores credentials unencrypted in its global configuration file on the Jenkins master where they can be viewed (no CVSS, Jenkins project Jenkins Minio Storage Plugin · org.jenkins-…)
- [CVE-2019-10286](https://cve.now/CVE-2019-10286.md): Jenkins DeployHub Plugin stores credentials unencrypted in job config.xml files on the Jenkins master where they can be viewed by users with (no CVSS, Jenkins project Jenkins DeployHub Plugin · com.openmake:dep…)
- [CVE-2019-1003056](https://cve.now/CVE-2019-1003056.md): Jenkins WebSphere Deployer Plugin stores credentials unencrypted in job config.xml files on the Jenkins master where they can be viewed by u (no CVSS, Jenkins project Jenkins WebSphere Deployer Plugin · org.jen…)
- [CVE-2019-1003057](https://cve.now/CVE-2019-1003057.md): Jenkins Bitbucket Approve Plugin stores credentials unencrypted in its global configuration file on the Jenkins master where they can be vie (no CVSS, Jenkins project Jenkins Bitbucket Approve Plugin · org.jenk…)
- [CVE-2019-1003058](https://cve.now/CVE-2019-1003058.md): A cross-site request forgery vulnerability in Jenkins FTP publisher Plugin in the FTPPublisher.DescriptorImpl#doLoginCheck method allows att (no CVSS, Jenkins project Jenkins FTP publisher Plugin · org.jvnet.hu…)
- [CVE-2019-1003059](https://cve.now/CVE-2019-1003059.md): A missing permission check in Jenkins FTP publisher Plugin in the FTPPublisher.DescriptorImpl#doLoginCheck method allows attackers with Over (no CVSS, Jenkins project Jenkins FTP publisher Plugin · org.jvnet.hu…)
- [CVE-2019-1003060](https://cve.now/CVE-2019-1003060.md): Jenkins Official OWASP ZAP Plugin stores credentials unencrypted in its global configuration file on the Jenkins master where they can be vi (no CVSS, Jenkins project Jenkins Official OWASP ZAP Plugin · org.jen…)
- [CVE-2019-1003061](https://cve.now/CVE-2019-1003061.md): Jenkins jenkins-cloudformation-plugin Plugin stores credentials unencrypted in job config.xml files on the Jenkins master where they can be (no CVSS, Jenkins project Jenkins jenkins-cloudformation-plugin Plugi…)
- [CVE-2019-1003062](https://cve.now/CVE-2019-1003062.md): Jenkins AWS CloudWatch Logs Publisher Plugin stores credentials unencrypted in its global configuration file on the Jenkins master where the (no CVSS, Jenkins project Jenkins AWS CloudWatch Logs Publisher Plugi…)
- [CVE-2019-1003063](https://cve.now/CVE-2019-1003063.md): Jenkins Amazon SNS Build Notifier Plugin stores credentials unencrypted in its global configuration file on the Jenkins master where they ca (no CVSS, Jenkins project Jenkins Amazon SNS Build Notifier Plugin ·…)
- [CVE-2019-1003064](https://cve.now/CVE-2019-1003064.md): Jenkins aws-device-farm Plugin stores credentials unencrypted in its global configuration file on the Jenkins master where they can be viewe (no CVSS, Jenkins project Jenkins aws-device-farm Plugin · org.jenkin…)
- [CVE-2019-1003065](https://cve.now/CVE-2019-1003065.md): Jenkins CloudShare Docker-Machine Plugin stores credentials unencrypted in its global configuration file on the Jenkins master where they ca (no CVSS, Jenkins project Jenkins CloudShare Docker-Machine Plugin ·…)
- [CVE-2019-1003066](https://cve.now/CVE-2019-1003066.md): Jenkins Bugzilla Plugin stores credentials unencrypted in its global configuration file on the Jenkins master where they can be viewed by us (no CVSS, Jenkins project Jenkins Bugzilla Plugin · org.jvnet.hudson.…)
- [CVE-2019-1003067](https://cve.now/CVE-2019-1003067.md): Jenkins Trac Publisher Plugin stores credentials unencrypted in job config.xml files on the Jenkins master where they can be viewed by users (no CVSS, Jenkins project Jenkins Trac Publisher Plugin · org.jenkins…)
- [CVE-2019-1003068](https://cve.now/CVE-2019-1003068.md): Jenkins VMware vRealize Automation Plugin stores credentials unencrypted in job config.xml files on the Jenkins master where they can be vie (no CVSS, Jenkins project Jenkins VMware vRealize Automation Plugin ·…)
- [CVE-2019-1003069](https://cve.now/CVE-2019-1003069.md): Jenkins Aqua Security Scanner Plugin stores credentials unencrypted in its global configuration file on the Jenkins master where they can be (no CVSS, Jenkins project Jenkins Aqua Security Scanner Plugin · org.…)
- [CVE-2019-1003070](https://cve.now/CVE-2019-1003070.md): Jenkins veracode-scanner Plugin stores credentials unencrypted in its global configuration file on the Jenkins master where they can be view (no CVSS, Jenkins project Jenkins veracode-scanner Plugin · org.jenki…)
- [CVE-2019-1003071](https://cve.now/CVE-2019-1003071.md): Jenkins OctopusDeploy Plugin stores credentials unencrypted in its global configuration file on the Jenkins master where they can be viewed (no CVSS, Jenkins project Jenkins OctopusDeploy Plugin · hudson.plugi…)
- [CVE-2019-1003072](https://cve.now/CVE-2019-1003072.md): Jenkins WildFly Deployer Plugin stores credentials unencrypted in job config.xml files on the Jenkins master where they can be viewed by use (no CVSS, Jenkins project Jenkins WildFly Deployer Plugin · org.jenki…)
- [CVE-2019-1003073](https://cve.now/CVE-2019-1003073.md): Jenkins VS Team Services Continuous Deployment Plugin stores credentials unencrypted in job config.xml files on the Jenkins master where the (no CVSS, Jenkins project Jenkins VS Team Services Continuous Deploym…)
- [CVE-2019-1003074](https://cve.now/CVE-2019-1003074.md): Jenkins Hyper.sh Commons Plugin stores credentials unencrypted in its global configuration file on the Jenkins master where they can be view (no CVSS, Jenkins project Jenkins Hyper.sh Commons Plugin · sh.hyper.…)
- [CVE-2019-1003075](https://cve.now/CVE-2019-1003075.md): Jenkins Audit to Database Plugin stores credentials unencrypted in its global configuration file on the Jenkins master where they can be vie (no CVSS, Jenkins project Jenkins Audit to Database Plugin · org.jenk…)
- [CVE-2019-1003076](https://cve.now/CVE-2019-1003076.md): A cross-site request forgery vulnerability in Jenkins Audit to Database Plugin in the DbAuditPublisherDescriptorImpl#doTestJdbcConnection fo (no CVSS, Jenkins project Jenkins Audit to Database Plugin · org.jenk…)
- [CVE-2019-1003077](https://cve.now/CVE-2019-1003077.md): A missing permission check in Jenkins Audit to Database Plugin in the DbAuditPublisherDescriptorImpl#doTestJdbcConnection form validation me (no CVSS, Jenkins project Jenkins Audit to Database Plugin · org.jenk…)
- [CVE-2019-1003078](https://cve.now/CVE-2019-1003078.md): A cross-site request forgery vulnerability in Jenkins VMware Lab Manager Slaves Plugin in the LabManager.DescriptorImpl#doTestConnection for (no CVSS, Jenkins project Jenkins VMware Lab Manager Slaves Plugin ·…)
- [CVE-2019-1003079](https://cve.now/CVE-2019-1003079.md): A missing permission check in Jenkins VMware Lab Manager Slaves Plugin in the LabManager.DescriptorImpl#doTestConnection form validation met (no CVSS, Jenkins project Jenkins VMware Lab Manager Slaves Plugin ·…)
- [CVE-2019-1003080](https://cve.now/CVE-2019-1003080.md): A cross-site request forgery vulnerability in Jenkins OpenShift Deployer Plugin in the DeployApplication.DeployApplicationDescriptor#doCheck (no CVSS, Jenkins project Jenkins OpenShift Deployer Plugin · org.jen…)
- [CVE-2019-1003081](https://cve.now/CVE-2019-1003081.md): A missing permission check in Jenkins OpenShift Deployer Plugin in the DeployApplication.DeployApplicationDescriptor#doCheckLogin form valid (no CVSS, Jenkins project Jenkins OpenShift Deployer Plugin · org.jen…)
- [CVE-2019-1003082](https://cve.now/CVE-2019-1003082.md): A cross-site request forgery vulnerability in Jenkins Gearman Plugin in the GearmanPluginConfig#doTestConnection form validation method allo (no CVSS, Jenkins project Jenkins Gearman Plugin · org.jenkins-ci.plu…)
- [CVE-2019-1003051](https://cve.now/CVE-2019-1003051.md): Jenkins IRC Plugin stores credentials unencrypted in its global configuration file on the Jenkins master where they can be viewed by users w (no CVSS, Jenkins project Jenkins IRC Plugin · org.jvnet.hudson.plugi…)
- [CVE-2019-1003052](https://cve.now/CVE-2019-1003052.md): Jenkins AWS Elastic Beanstalk Publisher Plugin stores credentials unencrypted in its global configuration file on the Jenkins master where t (no CVSS, Jenkins project Jenkins AWS Elastic Beanstalk Publisher Plu…)
- [CVE-2019-1003053](https://cve.now/CVE-2019-1003053.md): Jenkins HockeyApp Plugin stores credentials unencrypted in job config.xml files on the Jenkins master where they can be viewed by users with (no CVSS, Jenkins project Jenkins HockeyApp Plugin · org.jenkins-ci.p…)
- [CVE-2019-1003054](https://cve.now/CVE-2019-1003054.md): Jenkins Jira Issue Updater Plugin stores credentials unencrypted in job config.xml files on the Jenkins master where they can be viewed by u (no CVSS, Jenkins project Jenkins Jira Issue Updater Plugin · info.bl…)
- [CVE-2019-1003055](https://cve.now/CVE-2019-1003055.md): Jenkins FTP publisher Plugin stores credentials unencrypted in its global configuration file on the Jenkins master where they can be viewed (no CVSS, Jenkins project Jenkins FTP publisher Plugin · org.jvnet.hu…)
- [CVE-2019-10273](https://cve.now/CVE-2019-10273.md): Information leakage vulnerability in the /mc login page in ManageEngine ServiceDesk Plus 9.3 software allows authenticated users to enumerat (no CVSS)
- [CVE-2019-1828](https://cve.now/CVE-2019-1828.md): Cisco Small Business RV320 and RV325 Routers Weak Credential Encryption Vulnerability (CVSS 5.9, Cisco Small Business RV Series Router Firmware)
- [CVE-2018-20449](https://cve.now/CVE-2018-20449.md): The hidma\_chan\_stats function in drivers/dma/qcom/hidma\_dbg.c in the Linux kernel 4.14.90 allows local users to obtain sensitive address inf (no CVSS)
- [CVE-2019-1827](https://cve.now/CVE-2019-1827.md): Cisco Small Business RV320 and RV325 Routers Online Help Reflected Cross-Site Scripting Vulnerability (CVSS 6.1, Cisco Small Business RV Series Router Firmware)
- [CVE-2018-10243](https://cve.now/CVE-2018-10243.md): htp\_parse\_authorization\_digest in htp\_parsers.c in LibHTP 0.5.26 allows remote attackers to cause a heap-based buffer over-read via an autho (no CVSS)
- [CVE-2018-11830](https://cve.now/CVE-2018-11830.md): Improper input validation in QCPE create function may lead to integer overflow in Snapdragon Auto, Snapdragon Consumer Electronics Connectiv (no CVSS, Qualcomm Snapdragon Auto, Snapdragon Consumer Electronics C…)
- [CVE-2018-11958](https://cve.now/CVE-2018-11958.md): Insufficient protection of keys in keypad can lead HLOS to gain access to confidential keypad input data in Snapdragon Auto, Snapdragon Cons (no CVSS, Qualcomm Snapdragon Auto, Snapdragon Consumer Electronics C…)
- [CVE-2018-11966](https://cve.now/CVE-2018-11966.md): Undefined behavior in UE while processing unknown IEI in OTA message in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdr (no CVSS, Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…)
- [CVE-2018-11970](https://cve.now/CVE-2018-11970.md): TZ App dynamic allocations not protected from XBL loader in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer Electronics Connectivit (no CVSS, Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…)
- [CVE-2018-11971](https://cve.now/CVE-2018-11971.md): Interrupt exit code flow may undermine access control policy set forth by secure world can lead to potential secure asset leakage in Snapdra (no CVSS, Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…)
- [CVE-2018-13918](https://cve.now/CVE-2018-13918.md): kernel could return a received message length higher than expected, which leads to buffer overflow in a subsequent operation and stops norma (no CVSS, Qualcomm Snapdragon Auto, Snapdragon Consumer IOT, Snapdrag…)
- [CVE-2018-10244](https://cve.now/CVE-2018-10244.md): Suricata version 4.0.4 incorrectly handles the parsing of an EtherNet/IP PDU. (no CVSS)
- [CVE-2018-10242](https://cve.now/CVE-2018-10242.md): Suricata version 4.0.4 incorrectly handles the parsing of the SSH banner. (no CVSS)
- [CVE-2018-19981](https://cve.now/CVE-2018-19981.md): Amazon AWS SDK \<=2.8.5 for Android uses Android SharedPreferences to store plain text AWS STS Temporary Credentials retrieved by AWS Cognito (no CVSS)
- [CVE-2014-3603](https://cve.now/CVE-2014-3603.md): The (1) HttpResource and (2) FileBackedHttpResource implementations in Shibboleth Identity Provider (IdP) before 2.4.1 and OpenSAML Java 2.6 (no CVSS, Shibboleth; OpenSAML Java Identity Provider · Shibboleth… +2)
- [CVE-2019-10844](https://cve.now/CVE-2019-10844.md): nbla/logger.cpp in libnnabla.a in Sony Neural Network Libraries (aka nnabla) through v1.0.14 relies on the HOME environment variable, which (no CVSS, nnabla)
- [CVE-2019-10842](https://cve.now/CVE-2019-10842.md): Arbitrary code execution (via backdoor code) was discovered in bootstrap-sass 3.2.0.3, when downloaded from rubygems.org. (no CVSS, bootstrap-sass)
- [CVE-2019-3886](https://cve.now/CVE-2019-3886.md): An incorrect permissions check was discovered in libvirt 4.8.0 and above. (CVSS 5.4, The libvirt Project libvirt)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2019-04-04
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.