# CVEs published 2019-04-08

81 CVEs were published on April 8, 2019: 2 critical, 7 high. 3 are now in CISA KEV. Days are UTC.

- [CVE-2019-0697](https://cve.now/CVE-2019-0697.md): A memory corruption vulnerability exists in the Windows DHCP client when an attacker sends specially crafted DHCP responses to a client, aka (no CVSS, Microsoft Windows)
- [CVE-2019-0698](https://cve.now/CVE-2019-0698.md): A memory corruption vulnerability exists in the Windows DHCP client when an attacker sends specially crafted DHCP responses to a client, aka (no CVSS, Microsoft Windows)
- [CVE-2019-0701](https://cve.now/CVE-2019-0701.md): A denial of service vulnerability exists when Microsoft Hyper-V on a host server fails to properly validate input from a privileged user on (no CVSS, Microsoft Windows)
- [CVE-2019-0702](https://cve.now/CVE-2019-0702.md): An information disclosure vulnerability exists when the Windows kernel improperly handles objects in memory, aka 'Windows Kernel Information (no CVSS, Microsoft Windows)
- [CVE-2019-0703](https://cve.now/CVE-2019-0703.md): An information disclosure vulnerability exists in the way that the Windows SMB Server handles certain requests, aka 'Windows SMB Information (CVSS 6.5, KEV, Microsoft Windows)
- [CVE-2019-0704](https://cve.now/CVE-2019-0704.md): An information disclosure vulnerability exists in the way that the Windows SMB Server handles certain requests, aka 'Windows SMB Information (no CVSS, Microsoft Windows)
- [CVE-2019-0726](https://cve.now/CVE-2019-0726.md): A memory corruption vulnerability exists in the Windows DHCP client when an attacker sends specially crafted DHCP responses to a client, aka (no CVSS, Microsoft Windows)
- [CVE-2019-0746](https://cve.now/CVE-2019-0746.md): An information disclosure vulnerability exists when the scripting engine does not properly handle objects in memory in Microsoft Edge, aka ' (no CVSS, Microsoft Internet Explorer · Microsoft Edge +2)
- [CVE-2019-0748](https://cve.now/CVE-2019-0748.md): A remote code execution vulnerability exists when the Microsoft Office Access Connectivity Engine improperly handles objects in memory, aka (no CVSS, Microsoft Office)
- [CVE-2019-0754](https://cve.now/CVE-2019-0754.md): A denial of service vulnerability exists when Windows improperly handles objects in memory, aka 'Windows Denial of Service Vulnerability'. (no CVSS, Microsoft Windows)
- [CVE-2019-0755](https://cve.now/CVE-2019-0755.md): An information disclosure vulnerability exists when the Windows kernel improperly handles objects in memory, aka 'Windows Kernel Information (no CVSS, Microsoft Windows)
- [CVE-2019-0678](https://cve.now/CVE-2019-0678.md): An elevation of privilege vulnerability exists when Microsoft Edge does not properly enforce cross-domain policies, which could allow an att (no CVSS, Microsoft Edge)
- [CVE-2019-0680](https://cve.now/CVE-2019-0680.md): A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Internet Explorer, aka 'Scrip (no CVSS, Microsoft Internet Explorer)
- [CVE-2019-0682](https://cve.now/CVE-2019-0682.md): An elevation of privilege vulnerability exists due to an integer overflow in Windows Subsystem for Linux, aka 'Windows Subsystem for Linux E (no CVSS, Microsoft Windows)
- [CVE-2019-0683](https://cve.now/CVE-2019-0683.md): An elevation of privilege vulnerability exists in Active Directory Forest trusts due to a default setting that lets an attacker in the trust (no CVSS, Microsoft Windows)
- [CVE-2019-0689](https://cve.now/CVE-2019-0689.md): An elevation of privilege vulnerability exists due to an integer overflow in Windows Subsystem for Linux, aka 'Windows Subsystem for Linux E (no CVSS, Microsoft Windows)
- [CVE-2019-0690](https://cve.now/CVE-2019-0690.md): A denial of service vulnerability exists when Microsoft Hyper-V Network Switch on a host server fails to properly validate input from a priv (no CVSS, Microsoft Windows)
- [CVE-2019-0692](https://cve.now/CVE-2019-0692.md): An elevation of privilege vulnerability exists due to an integer overflow in Windows Subsystem for Linux, aka 'Windows Subsystem for Linux E (no CVSS, Microsoft Windows)
- [CVE-2019-0693](https://cve.now/CVE-2019-0693.md): An elevation of privilege vulnerability exists due to an integer overflow in Windows Subsystem for Linux, aka 'Windows Subsystem for Linux E (no CVSS, Microsoft Windows)
- [CVE-2019-0694](https://cve.now/CVE-2019-0694.md): An elevation of privilege vulnerability exists due to an integer overflow in Windows Subsystem for Linux, aka 'Windows Subsystem for Linux E (no CVSS, Microsoft Windows)
- [CVE-2019-0695](https://cve.now/CVE-2019-0695.md): A denial of service vulnerability exists when Microsoft Hyper-V on a host server fails to properly validate input from a privileged user on (no CVSS, Microsoft Windows)
- [CVE-2019-0696](https://cve.now/CVE-2019-0696.md): An elevation of privilege vulnerability exists when the Windows kernel fails to properly handle objects in memory, aka 'Windows Kernel Eleva (no CVSS, Microsoft Windows Server · Microsoft Windows)
- [CVE-2019-0667](https://cve.now/CVE-2019-0667.md): A remote code execution vulnerability exists in the way that the VBScript engine handles objects in memory, aka 'Windows VBScript Engine Rem (no CVSS, Microsoft Internet Explorer)
- [CVE-2019-0666](https://cve.now/CVE-2019-0666.md): A remote code execution vulnerability exists in the way that the VBScript engine handles objects in memory, aka 'Windows VBScript Engine Rem (no CVSS, Microsoft Internet Explorer)
- [CVE-2019-0665](https://cve.now/CVE-2019-0665.md): A remote code execution vulnerability exists in the way that the VBScript engine handles objects in memory, aka 'Windows VBScript Engine Rem (no CVSS, Microsoft Internet Explorer)
- [CVE-2019-0639](https://cve.now/CVE-2019-0639.md): A remote code execution vulnerability exists in the way that the ChakraCore scripting engine handles objects in memory, aka 'Scripting Engin (no CVSS, Microsoft Edge · Microsoft ChakraCore +1)
- [CVE-2019-0617](https://cve.now/CVE-2019-0617.md): A remote code execution vulnerability exists when the Windows Jet Database Engine improperly handles objects in memory, aka 'Jet Database En (no CVSS, Microsoft Windows)
- [CVE-2019-0614](https://cve.now/CVE-2019-0614.md): An information disclosure vulnerability exists when the Windows GDI component improperly discloses the contents of its memory, aka 'Windows (no CVSS, Microsoft Windows)
- [CVE-2019-0612](https://cve.now/CVE-2019-0612.md): A security feature bypass vulnerability exists when Click2Play protection in Microsoft Edge improperly handles flash objects. (no CVSS, Microsoft Edge)
- [CVE-2019-0611](https://cve.now/CVE-2019-0611.md): A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka 'C (no CVSS, Microsoft Edge · Microsoft ChakraCore +1)
- [CVE-2019-0609](https://cve.now/CVE-2019-0609.md): A remote code execution vulnerability exists in the way the scripting engine handles objects in memory in Microsoft browsers, aka 'Scripting (no CVSS, Microsoft Internet Explorer · Microsoft Edge +2)
- [CVE-2019-0603](https://cve.now/CVE-2019-0603.md): A remote code execution vulnerability exists in the way that Windows Deployment Services TFTP Server handles objects in memory. (no CVSS, Microsoft Windows)
- [CVE-2019-0592](https://cve.now/CVE-2019-0592.md): A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka 'C (no CVSS, Microsoft Edge · Microsoft ChakraCore +1)
- [CVE-2019-11026](https://cve.now/CVE-2019-11026.md): FontInfoScanner::scanFonts in FontInfo.cc in Poppler 0.75.0 has infinite recursion, leading to a call to the error function in Error.cc. (no CVSS)
- [CVE-2019-11025](https://cve.now/CVE-2019-11025.md): In clearFilter() in utilities.php in Cacti before 1.2.3, no escaping occurs before printing out the value of the SNMP community string (SNMP (no CVSS)
- [CVE-2019-11024](https://cve.now/CVE-2019-11024.md): The load\_pnm function in frompnm.c in libsixel.a in libsixel 1.8.2 has infinite recursion. (no CVSS)
- [CVE-2019-11023](https://cve.now/CVE-2019-11023.md): The agroot() function in cgraph\\obj.c in libcgraph.a in Graphviz 2.39.20160612.1140 has a NULL pointer dereference, as demonstrated by graph (no CVSS)
- [CVE-2019-0211](https://cve.now/CVE-2019-0211.md): In Apache HTTP Server 2.4 releases 2.4.17 to 2.4.38, with MPM event, worker or prefork, code executing in less-privileged child processes or (CVSS 7.8, KEV, Apache HTTP Server)
- [CVE-2019-11018](https://cve.now/CVE-2019-11018.md): application\\admin\\controller\\User.php in ThinkAdmin V4.0 does not prevent continued use of an administrator's cookie-based credentials after (no CVSS, zoujingli/thinkadmin)
- [CVE-2019-11016](https://cve.now/CVE-2019-11016.md): Elgg before 1.12.18 and 2.3.x before 2.3.11 has an open redirect. (no CVSS, elgg/elgg)
- [CVE-2019-0217](https://cve.now/CVE-2019-0217.md): In Apache HTTP Server 2.4 release 2.4.38 and prior, a race condition in mod\_auth\_digest when running in a threaded server could allow a user (no CVSS, Apache HTTP Server)
- [CVE-2019-11014](https://cve.now/CVE-2019-11014.md): The VStarCam vstc.vscam.client library and vstc.vscam shared object, as used in the Eye4 application (for Android, iOS, and Windows), do not (no CVSS)
- [CVE-2019-1798](https://cve.now/CVE-2019-1798.md): Clam AntiVirus PE File Out-of-Bounds Read Vulnerability (CVSS 7.5, Cisco ClamAV)
- [CVE-2019-0215](https://cve.now/CVE-2019-0215.md): In Apache HTTP Server 2.4 releases 2.4.37 and 2.4.38, a bug in mod\_ssl when using per-location client certificate verification with TLSv1.3 (no CVSS, Apache HTTP Server)
- [CVE-2019-1788](https://cve.now/CVE-2019-1788.md): ClamAV OLE2 File Out-Of-Bounds Write Vulnerability (CVSS 7.5, Cisco ClamAV)
- [CVE-2019-1787](https://cve.now/CVE-2019-1787.md): Clam AntiVirus PDF Denial of Service Vulnerability (CVSS 7.5, Cisco ClamAV)
- [CVE-2019-1785](https://cve.now/CVE-2019-1785.md): Clam AntiVirus RAR Directory Traversal Vulnerability (CVSS 9.8, Cisco ClamAV)
- [CVE-2019-1786](https://cve.now/CVE-2019-1786.md): Clam AntiVirus PDF Out-of-Bounds Read Vulnerability (CVSS 7.5, Cisco ClamAV)
- [CVE-2019-11010](https://cve.now/CVE-2019-11010.md): In GraphicsMagick 1.4 snapshot-20190322 Q8, there is a memory leak in the function ReadMPCImage of coders/mpc.c, which allows attackers to c (no CVSS)
- [CVE-2019-11009](https://cve.now/CVE-2019-11009.md): In GraphicsMagick 1.4 snapshot-20190322 Q8, there is a heap-based buffer over-read in the function ReadXWDImage of coders/xwd.c, which allow (no CVSS)
- [CVE-2019-11008](https://cve.now/CVE-2019-11008.md): In GraphicsMagick 1.4 snapshot-20190322 Q8, there is a heap-based buffer overflow in the function WriteXWDImage of coders/xwd.c, which allow (no CVSS)
- [CVE-2019-11007](https://cve.now/CVE-2019-11007.md): In GraphicsMagick 1.4 snapshot-20190322 Q8, there is a heap-based buffer over-read in the ReadMNGImage function of coders/png.c, which allow (no CVSS)
- [CVE-2019-11006](https://cve.now/CVE-2019-11006.md): In GraphicsMagick 1.4 snapshot-20190322 Q8, there is a heap-based buffer over-read in the function ReadMIFFImage of coders/miff.c, which all (no CVSS)
- [CVE-2019-11005](https://cve.now/CVE-2019-11005.md): In GraphicsMagick 1.4 snapshot-20190322 Q8, there is a stack-based buffer overflow in the function SVGStartElement of coders/svg.c, which al (no CVSS)
- [CVE-2019-10845](https://cve.now/CVE-2019-10845.md): An issue was discovered in Uniqkey Password Manager 1.14. (no CVSS)
- [CVE-2019-11004](https://cve.now/CVE-2019-11004.md): In Materialize through 1.0.0, XSS is possible via the Toast feature. (no CVSS, materialize-css · @materializecss/materialize)
- [CVE-2019-11003](https://cve.now/CVE-2019-11003.md): In Materialize through 1.0.0, XSS is possible via the Autocomplete feature. (no CVSS, materialize-css · @materializecss/materialize)
- [CVE-2019-11002](https://cve.now/CVE-2019-11002.md): In Materialize through 1.0.0, XSS is possible via the Tooltip feature. (no CVSS, materialize-css · @materializecss/materialize)
- [CVE-2019-11001](https://cve.now/CVE-2019-11001.md): On Reolink RLC-410W, C1 Pro, C2 Pro, RLC-422W, and RLC-511W devices through 1.0.227, an authenticated admin can use the "TestEmail" function (CVSS 7.2, KEV)
- [CVE-2019-10676](https://cve.now/CVE-2019-10676.md): An issue was discovered in Uniqkey Password Manager 1.14. (no CVSS)
- [CVE-2014-5435](https://cve.now/CVE-2014-5435.md): An arbitrary memory write vulnerability exists in the dual\_onsrv.exe module in Honeywell Experion PKS R40x before R400.6, R41x before R410.6 (no CVSS, Honeywell Experion PKS)
- [CVE-2014-5436](https://cve.now/CVE-2014-5436.md): A directory traversal vulnerability exists in the confd.exe module in Honeywell Experion PKS R40x before R400.6, R41x before R410.6, and R43 (no CVSS, Honeywell Experion PKS)
- [CVE-2014-9186](https://cve.now/CVE-2014-9186.md): A file inclusion vulnerability exists in the confd.exe module in Honeywell Experion PKS R40x before R400.6, R41x before R410.6, and R43x bef (no CVSS, Honeywell Experion PKS)
- [CVE-2019-4210](https://cve.now/CVE-2019-4210.md): IBM QRadar SIEM 7.3.2 could allow a user to bypass authentication exposing certain functionality which could lead to information disclosure (CVSS 9.4, IBM QRadar SIEM)
- [CVE-2019-4155](https://cve.now/CVE-2019-4155.md): IBM API Connect's Developer Portal 2018.1 and 2018.4.1.3 is impacted by a privilege escalation vulnerability when integrated with an OpenID (CVSS 8.8, IBM API Connect)
- [CVE-2019-4143](https://cve.now/CVE-2019-4143.md): The IBM Cloud Private Key Management Service (IBM Cloud Private 3.1.1 and 3.1.2) could allow a local user to obtain sensitive from the KMS p (CVSS 5.5, IBM Cloud Private)
- [CVE-2019-4051](https://cve.now/CVE-2019-4051.md): Some URIs in IBM API Connect 2018.1 and 2018.4.1.3 disclose system specification information like the machine id, system uuid, filesystem pa (CVSS 5.3, IBM API Connect)
- [CVE-2019-4045](https://cve.now/CVE-2019-4045.md): IBM Business Automation Workflow and IBM Business Process Manager 18.0.0.0, 18.0.0.1, and 18.0.0.2 provide embedded document management feat (CVSS 4.3, IBM Business Automation Workflow)
- [CVE-2018-2000](https://cve.now/CVE-2018-2000.md): IBM Business Automation Workflow 18.0.0.0 and 18.0.0.1 is vulnerable to cross-site request forgery which could allow an attacker to execute (CVSS 4.3, IBM Business Automation Workflow)
- [CVE-2018-1999](https://cve.now/CVE-2018-1999.md): IBM Business Automation Workflow 18.0.0.0, 18.0.0.1, and 18.0.0.2 could reveal sensitive version information about the server from error pag (CVSS 4.3, IBM Business Automation Workflow)
- [CVE-2018-1997](https://cve.now/CVE-2018-1997.md): IBM Business Automation Workflow and Business Process Manager 18.0.0.0, 18.0.0.1, and 18.0.0.2 are vulnerable to a denial of service attack. (CVSS 4.3, IBM Business Automation Workflow)
- [CVE-2018-1943](https://cve.now/CVE-2018-1943.md): IBM Cloud Private 3.1.0 and 3.1.1 is vulnerable to HTTP HOST header injection, caused by improper validation of input. (CVSS 5.4, IBM Cloud Private)
- [CVE-2018-1885](https://cve.now/CVE-2018-1885.md): IBM Business Automation Workflow 18.0.0.0, 18.0.0.1, and 18.0.0.2 could allow an unauthenticated attacker to obtain sensitve information usi (CVSS 5.3, IBM Business Automation Workflow)
- [CVE-2018-1882](https://cve.now/CVE-2018-1882.md): In a certain atypical IBM Spectrum Protect 7.1 and 8.1 configurations, the node password could be displayed in plain text in the IBM Spectru (CVSS 4.7, IBM Spectrum Protect for Space Management · IBM Spectrum Pr…)
- [CVE-2018-1853](https://cve.now/CVE-2018-1853.md): IBM Tivoli Storage Manager (IBM Spectrum Protect 7.1 and 8.1) could allow a remote attacker to hijack the clicking action of the victim. (CVSS 6.1, IBM Spectrum Protect)
- [CVE-2018-1787](https://cve.now/CVE-2018-1787.md): IBM Spectrum Protect 7.1 and 8.1 is affected by a password exposure vulnerability caused by insecure file permissions. (CVSS 5.1, IBM Spectrum Protect)
- [CVE-2018-20341](https://cve.now/CVE-2018-20341.md): WINMAGIC SecureDoc Disk Encryption software before 8.3 has an Unquoted Service Path vulnerability, which could allow an attacker to execute (no CVSS)
- [CVE-2018-19006](https://cve.now/CVE-2018-19006.md): OSIsoft PI Vision, versions PI Vision 2017, and PI Vision 2017 R2, The application contains a cross-site scripting vulnerability where displ (no CVSS, OSIsoft PI Vision)
- [CVE-2017-7912](https://cve.now/CVE-2017-7912.md): Hanwha Techwin SRN-4000, SRN-4000 firmware versions prior to SRN4000\_v2.16\_170401, A specially crafted http request and response could allow (no CVSS, Hanwha Techwin SRN-4000)
- [CVE-2019-10914](https://cve.now/CVE-2019-10914.md): pubRsaDecryptSignedElementExt in MatrixSSL 4.0.1 Open, as used in Inside Secure TLS Toolkit, has a stack-based buffer overflow during X.509 (no CVSS)
- [CVE-2016-10745](https://cve.now/CVE-2016-10745.md): In Pallets Jinja before 2.8.1, str.format allows a sandbox escape. (no CVSS, jinja2)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2019-04-08
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.