CVEs published April 8, 2019
81 CVEs were published on April 8, 2019: 2 critical, 7 high. 3 are now in CISA KEV.
- Published
- 81
- Critical
- 2
- High
- 7
- Medium
- 12
- Low
- 0
- Unrated
- 60
- Now in CISA KEV
- 3
- Fix available
- 10
Most affected products
- Microsoft Windows
- 20
- Cisco ClamAV
- 5
- IBM Business Automation Workflow
- 5
- Microsoft Internet Explorer
- 4
- Apache HTTP Server
- 3
- Honeywell Experion PKS
- 3
- materialize-css · @materializecss/materialize
- 3
- Microsoft Edge · Microsoft ChakraCore +1
- 3
- IBM API Connect
- 2
- IBM Cloud Private
- 2
Critical 2
High 7
- CVE-2019-0211In Apache HTTP Server 2.4 releases 2.4.17 to 2.4.38, with MPM event, worker or prefork, code executing in less-privileged child processes orApache HTTP Server
- CVE-2019-1798Clam AntiVirus PE File Out-of-Bounds Read VulnerabilityCisco ClamAV
- CVE-2019-1788ClamAV OLE2 File Out-Of-Bounds Write VulnerabilityCisco ClamAV
- CVE-2019-1787Clam AntiVirus PDF Denial of Service VulnerabilityCisco ClamAV
- CVE-2019-1786Clam AntiVirus PDF Out-of-Bounds Read VulnerabilityCisco ClamAV
- CVE-2019-11001On Reolink RLC-410W, C1 Pro, C2 Pro, RLC-422W, and RLC-511W devices through 1.0.227, an authenticated admin can use the "TestEmail" function
- CVE-2019-4155IBM API Connect's Developer Portal 2018.1 and 2018.4.1.3 is impacted by a privilege escalation vulnerability when integrated with an OpenID IBM API Connect
Medium, low and unrated 72
- CVE-2019-0697A memory corruption vulnerability exists in the Windows DHCP client when an attacker sends specially crafted DHCP responses to a client, akaMicrosoft Windows
- CVE-2019-0698A memory corruption vulnerability exists in the Windows DHCP client when an attacker sends specially crafted DHCP responses to a client, akaMicrosoft Windows
- CVE-2019-0701A denial of service vulnerability exists when Microsoft Hyper-V on a host server fails to properly validate input from a privileged user on Microsoft Windows
- CVE-2019-0702An information disclosure vulnerability exists when the Windows kernel improperly handles objects in memory, aka 'Windows Kernel InformationMicrosoft Windows
- CVE-2019-0703An information disclosure vulnerability exists in the way that the Windows SMB Server handles certain requests, aka 'Windows SMB InformationMicrosoft Windows
- CVE-2019-0704An information disclosure vulnerability exists in the way that the Windows SMB Server handles certain requests, aka 'Windows SMB InformationMicrosoft Windows
- CVE-2019-0726A memory corruption vulnerability exists in the Windows DHCP client when an attacker sends specially crafted DHCP responses to a client, akaMicrosoft Windows
- CVE-2019-0746An information disclosure vulnerability exists when the scripting engine does not properly handle objects in memory in Microsoft Edge, aka 'Microsoft Internet Explorer · Microsoft Edge +2
- CVE-2019-0748A remote code execution vulnerability exists when the Microsoft Office Access Connectivity Engine improperly handles objects in memory, aka Microsoft Office
- CVE-2019-0754A denial of service vulnerability exists when Windows improperly handles objects in memory, aka 'Windows Denial of Service Vulnerability'.Microsoft Windows
- CVE-2019-0755An information disclosure vulnerability exists when the Windows kernel improperly handles objects in memory, aka 'Windows Kernel InformationMicrosoft Windows
- CVE-2019-0678An elevation of privilege vulnerability exists when Microsoft Edge does not properly enforce cross-domain policies, which could allow an attMicrosoft Edge
- CVE-2019-0680A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Internet Explorer, aka 'ScripMicrosoft Internet Explorer
- CVE-2019-0682An elevation of privilege vulnerability exists due to an integer overflow in Windows Subsystem for Linux, aka 'Windows Subsystem for Linux EMicrosoft Windows
- CVE-2019-0683An elevation of privilege vulnerability exists in Active Directory Forest trusts due to a default setting that lets an attacker in the trustMicrosoft Windows
- CVE-2019-0689An elevation of privilege vulnerability exists due to an integer overflow in Windows Subsystem for Linux, aka 'Windows Subsystem for Linux EMicrosoft Windows
- CVE-2019-0690A denial of service vulnerability exists when Microsoft Hyper-V Network Switch on a host server fails to properly validate input from a privMicrosoft Windows
- CVE-2019-0692An elevation of privilege vulnerability exists due to an integer overflow in Windows Subsystem for Linux, aka 'Windows Subsystem for Linux EMicrosoft Windows
- CVE-2019-0693An elevation of privilege vulnerability exists due to an integer overflow in Windows Subsystem for Linux, aka 'Windows Subsystem for Linux EMicrosoft Windows
- CVE-2019-0694An elevation of privilege vulnerability exists due to an integer overflow in Windows Subsystem for Linux, aka 'Windows Subsystem for Linux EMicrosoft Windows
- CVE-2019-0695A denial of service vulnerability exists when Microsoft Hyper-V on a host server fails to properly validate input from a privileged user on Microsoft Windows
- CVE-2019-0696An elevation of privilege vulnerability exists when the Windows kernel fails to properly handle objects in memory, aka 'Windows Kernel ElevaMicrosoft Windows Server · Microsoft Windows
- CVE-2019-0667A remote code execution vulnerability exists in the way that the VBScript engine handles objects in memory, aka 'Windows VBScript Engine RemMicrosoft Internet Explorer
- CVE-2019-0666A remote code execution vulnerability exists in the way that the VBScript engine handles objects in memory, aka 'Windows VBScript Engine RemMicrosoft Internet Explorer
- CVE-2019-0665A remote code execution vulnerability exists in the way that the VBScript engine handles objects in memory, aka 'Windows VBScript Engine RemMicrosoft Internet Explorer
- CVE-2019-0639A remote code execution vulnerability exists in the way that the ChakraCore scripting engine handles objects in memory, aka 'Scripting EnginMicrosoft Edge · Microsoft ChakraCore +1
- CVE-2019-0617A remote code execution vulnerability exists when the Windows Jet Database Engine improperly handles objects in memory, aka 'Jet Database EnMicrosoft Windows
- CVE-2019-0614An information disclosure vulnerability exists when the Windows GDI component improperly discloses the contents of its memory, aka 'Windows Microsoft Windows
- CVE-2019-0612A security feature bypass vulnerability exists when Click2Play protection in Microsoft Edge improperly handles flash objects.Microsoft Edge
- CVE-2019-0611A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka 'CMicrosoft Edge · Microsoft ChakraCore +1
- CVE-2019-0609A remote code execution vulnerability exists in the way the scripting engine handles objects in memory in Microsoft browsers, aka 'ScriptingMicrosoft Internet Explorer · Microsoft Edge +2
- CVE-2019-0603A remote code execution vulnerability exists in the way that Windows Deployment Services TFTP Server handles objects in memory.Microsoft Windows
- CVE-2019-0592A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka 'CMicrosoft Edge · Microsoft ChakraCore +1
- CVE-2019-11026FontInfoScanner::scanFonts in FontInfo.cc in Poppler 0.75.0 has infinite recursion, leading to a call to the error function in Error.cc.
- CVE-2019-11025In clearFilter() in utilities.php in Cacti before 1.2.3, no escaping occurs before printing out the value of the SNMP community string (SNMP
- CVE-2019-11024The load_pnm function in frompnm.c in libsixel.a in libsixel 1.8.2 has infinite recursion.
- CVE-2019-11023The agroot() function in cgraph\obj.c in libcgraph.a in Graphviz 2.39.20160612.1140 has a NULL pointer dereference, as demonstrated by graph
- CVE-2019-11018application\admin\controller\User.php in ThinkAdmin V4.0 does not prevent continued use of an administrator's cookie-based credentials afterzoujingli/thinkadmin
- CVE-2019-11016Elgg before 1.12.18 and 2.3.x before 2.3.11 has an open redirect.elgg/elgg
- CVE-2019-0217In Apache HTTP Server 2.4 release 2.4.38 and prior, a race condition in mod_auth_digest when running in a threaded server could allow a userApache HTTP Server
- CVE-2019-11014The VStarCam vstc.vscam.client library and vstc.vscam shared object, as used in the Eye4 application (for Android, iOS, and Windows), do not
- CVE-2019-0215In Apache HTTP Server 2.4 releases 2.4.37 and 2.4.38, a bug in mod_ssl when using per-location client certificate verification with TLSv1.3 Apache HTTP Server
- CVE-2019-11010In GraphicsMagick 1.4 snapshot-20190322 Q8, there is a memory leak in the function ReadMPCImage of coders/mpc.c, which allows attackers to c
- CVE-2019-11009In GraphicsMagick 1.4 snapshot-20190322 Q8, there is a heap-based buffer over-read in the function ReadXWDImage of coders/xwd.c, which allow
- CVE-2019-11008In GraphicsMagick 1.4 snapshot-20190322 Q8, there is a heap-based buffer overflow in the function WriteXWDImage of coders/xwd.c, which allow
- CVE-2019-11007In GraphicsMagick 1.4 snapshot-20190322 Q8, there is a heap-based buffer over-read in the ReadMNGImage function of coders/png.c, which allow
- CVE-2019-11006In GraphicsMagick 1.4 snapshot-20190322 Q8, there is a heap-based buffer over-read in the function ReadMIFFImage of coders/miff.c, which all
- CVE-2019-11005In GraphicsMagick 1.4 snapshot-20190322 Q8, there is a stack-based buffer overflow in the function SVGStartElement of coders/svg.c, which al
- CVE-2019-10845An issue was discovered in Uniqkey Password Manager 1.14.
- CVE-2019-11004In Materialize through 1.0.0, XSS is possible via the Toast feature.materialize-css · @materializecss/materialize
- CVE-2019-11003In Materialize through 1.0.0, XSS is possible via the Autocomplete feature.materialize-css · @materializecss/materialize
- CVE-2019-11002In Materialize through 1.0.0, XSS is possible via the Tooltip feature.materialize-css · @materializecss/materialize
- CVE-2019-10676An issue was discovered in Uniqkey Password Manager 1.14.
- CVE-2014-5435An arbitrary memory write vulnerability exists in the dual_onsrv.exe module in Honeywell Experion PKS R40x before R400.6, R41x before R410.6Honeywell Experion PKS
- CVE-2014-5436A directory traversal vulnerability exists in the confd.exe module in Honeywell Experion PKS R40x before R400.6, R41x before R410.6, and R43Honeywell Experion PKS
- CVE-2014-9186A file inclusion vulnerability exists in the confd.exe module in Honeywell Experion PKS R40x before R400.6, R41x before R410.6, and R43x befHoneywell Experion PKS
- CVE-2019-4143The IBM Cloud Private Key Management Service (IBM Cloud Private 3.1.1 and 3.1.2) could allow a local user to obtain sensitive from the KMS pIBM Cloud Private
- CVE-2019-4051Some URIs in IBM API Connect 2018.1 and 2018.4.1.3 disclose system specification information like the machine id, system uuid, filesystem paIBM API Connect
- CVE-2019-4045IBM Business Automation Workflow and IBM Business Process Manager 18.0.0.0, 18.0.0.1, and 18.0.0.2 provide embedded document management featIBM Business Automation Workflow
- CVE-2018-2000IBM Business Automation Workflow 18.0.0.0 and 18.0.0.1 is vulnerable to cross-site request forgery which could allow an attacker to execute IBM Business Automation Workflow
- CVE-2018-1999IBM Business Automation Workflow 18.0.0.0, 18.0.0.1, and 18.0.0.2 could reveal sensitive version information about the server from error pagIBM Business Automation Workflow
- CVE-2018-1997IBM Business Automation Workflow and Business Process Manager 18.0.0.0, 18.0.0.1, and 18.0.0.2 are vulnerable to a denial of service attack.IBM Business Automation Workflow
- CVE-2018-1943IBM Cloud Private 3.1.0 and 3.1.1 is vulnerable to HTTP HOST header injection, caused by improper validation of input.IBM Cloud Private
- CVE-2018-1885IBM Business Automation Workflow 18.0.0.0, 18.0.0.1, and 18.0.0.2 could allow an unauthenticated attacker to obtain sensitve information usiIBM Business Automation Workflow
- CVE-2018-1882In a certain atypical IBM Spectrum Protect 7.1 and 8.1 configurations, the node password could be displayed in plain text in the IBM SpectruIBM Spectrum Protect for Space Management · IBM Spectrum Pr…
- CVE-2018-1853IBM Tivoli Storage Manager (IBM Spectrum Protect 7.1 and 8.1) could allow a remote attacker to hijack the clicking action of the victim.IBM Spectrum Protect
- CVE-2018-1787IBM Spectrum Protect 7.1 and 8.1 is affected by a password exposure vulnerability caused by insecure file permissions.IBM Spectrum Protect
- CVE-2018-20341WINMAGIC SecureDoc Disk Encryption software before 8.3 has an Unquoted Service Path vulnerability, which could allow an attacker to execute
- CVE-2018-19006OSIsoft PI Vision, versions PI Vision 2017, and PI Vision 2017 R2, The application contains a cross-site scripting vulnerability where displOSIsoft PI Vision
- CVE-2017-7912Hanwha Techwin SRN-4000, SRN-4000 firmware versions prior to SRN4000_v2.16_170401, A specially crafted http request and response could allowHanwha Techwin SRN-4000
- CVE-2019-10914pubRsaDecryptSignedElementExt in MatrixSSL 4.0.1 Open, as used in Inside Secure TLS Toolkit, has a stack-based buffer overflow during X.509
- CVE-2016-10745In Pallets Jinja before 2.8.1, str.format allows a sandbox escape.jinja2