CVEs published April 9, 2019
169 CVEs were published on April 9, 2019: 1 critical, 9 high. 6 are now in CISA KEV.
- Published
- 169
- Critical
- 1
- High
- 9
- Medium
- 9
- Low
- 3
- Unrated
- 147
- Now in CISA KEV
- 6
- Fix available
- 13
Most affected products
- Microsoft Windows
- 45
- Microsoft Edge · Microsoft ChakraCore +1
- 9
- Microsoft Internet Explorer
- 8
- Microsoft Office
- 7
- Microsoft Windows Server · Microsoft Windows
- 6
- Microsoft Team Foundation Server · Microsoft Azure DevOps S…
- 5
- Microsoft Azure DevOps Server
- 4
- Microsoft Edge
- 3
- Microsoft Internet Explorer · Microsoft Edge
- 3
- The Eclipse Foundation Eclipse Kura
- 3
Critical 1
High 9
- CVE-2019-0859An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in memory, aka 'Win32k Microsoft Windows
- CVE-2019-0841An elevation of privilege vulnerability exists when Windows AppX Deployment Service (AppXSVC) improperly handles hard links, aka 'Windows ElMicrosoft Windows
- CVE-2019-0803An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in memory, aka 'Win32k Microsoft Windows
- CVE-2019-0752A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Internet Explorer, aka 'ScripMicrosoft Internet Explorer
- CVE-2019-9134Architectural Information System 1.0 and earlier versions have a Stack-based buffer overflow, allows remote attackers to execute arbitrary cSolideo Systems Co Architectural Information System
- CVE-2019-9133KMPlayer Subtitles parser Heap Overflow VulnerabilityPandora.tv KMPlayer
- CVE-2018-15640Improper access control in the Helpdesk App of Odoo Enterprise 10.0 through 12.0 allows remote authenticated attackers to obtain elevated prOdoo Enterprise
- CVE-2019-0797An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in memory, aka 'Win32k Microsoft Windows Server · Microsoft Windows
- CVE-2019-0808An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in memory, aka 'Win32k Microsoft Windows
Medium, low and unrated 159
- CVE-2019-11065Gradle versions from 1.4 to 5.3.1 use an insecure HTTP URL to download dependencies when the built-in JavaScript or CoffeeScript Gradle plugorg.gradle:gradle-core
- CVE-2019-1573Information Disclosure in GlobalProtect AgentPalo Alto Networks GlobalProtect Agent
- CVE-2019-5585An improper access control vulnerability in FortiClientMac before 6.0.5 may allow an attacker to affect the application's performance via moFortinet FortiClientMac
- CVE-2018-1356A reflected Cross-Site-Scripting (XSS) vulnerability in Fortinet FortiSandbox before 3.0 may allow an attacker to execute unauthorized code Fortinet FortiSandbox
- CVE-2019-6140A configuration issue has been discovered in Forcepoint Email Security 8.4.x and 8.5.x: the product is left in a vulnerable state if the hybForcepoint Email Security
- CVE-2019-8456Check Point IKEv2 IPsec VPN up to R80.30, in some less common conditions, may allow an attacker with knowledge of the internal configurationCheck Point IPsec VPN
- CVE-2019-3842In systemd before v242-rc4, it was discovered that pam_systemd does not properly sanitize the environment before using the XDG_SEAT variableThe systemd Project systemd
- CVE-2019-9696Symantec VIP Enterprise Gateway (all versions) may be susceptible to a cross-site scripting (XSS) exploit, which is a type of issue that canSymantec VIP Enterprise Gateway
- CVE-2019-0869A spoofing vulnerability exists in Microsoft Azure DevOps Server when it fails to properly handle web requests, aka 'Azure DevOps Server HTMMicrosoft Azure DevOps Server
- CVE-2019-0870A Cross-site Scripting (XSS) vulnerability exists when Azure DevOps Server and Team Foundation Server do not properly sanitize user providedMicrosoft Team Foundation Server · Microsoft Azure DevOps S…
- CVE-2019-0871A Cross-site Scripting (XSS) vulnerability exists when Azure DevOps Server and Team Foundation Server do not properly sanitize user providedMicrosoft Team Foundation Server · Microsoft Azure DevOps S…
- CVE-2019-0874A Cross-site Scripting (XSS) vulnerability exists when Azure DevOps Server does not properly sanitize user provided input, aka 'Azure DevOpsMicrosoft Azure DevOps Server
- CVE-2019-0875An elevation of privilege vulnerability exists when Azure DevOps Server 2019 does not properly enforce project permissions, aka 'Azure DevOpMicrosoft Azure DevOps Server
- CVE-2019-0876An information disclosure vulnerability exists when affected Open Enclave SDK versions improperly handle objects in memory, aka 'Open EnclavMicrosoft Open Enclave SDK
- CVE-2019-0877A remote code execution vulnerability exists when the Windows Jet Database Engine improperly handles objects in memory, aka 'Jet Database EnMicrosoft Windows
- CVE-2019-0879A remote code execution vulnerability exists when the Windows Jet Database Engine improperly handles objects in memory, aka 'Jet Database EnMicrosoft Windows
- CVE-2019-0853A remote code execution vulnerability exists in the way that the Windows Graphics Device Interface (GDI) handles objects in the memory, aka Microsoft Windows
- CVE-2019-0856A remote code execution vulnerability exists when Windows improperly handles objects in memory, aka 'Windows Remote Code Execution VulnerabiMicrosoft Windows
- CVE-2019-0857A spoofing vulnerability that could allow a security feature bypass exists in when Azure DevOps Server does not properly sanitize user proviMicrosoft Azure DevOps Server
- CVE-2019-0858A spoofing vulnerability exists in Microsoft Exchange Server when Outlook Web Access (OWA) fails to properly handle web requests, aka 'MicroMicrosoft Exchange Server
- CVE-2019-0860A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka 'CMicrosoft Edge · Microsoft ChakraCore +1
- CVE-2019-0861A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka 'CMicrosoft Edge · Microsoft ChakraCore +1
- CVE-2019-0862A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Internet Explorer, aka 'ScripMicrosoft Internet Explorer
- CVE-2019-0866A Cross-site Scripting (XSS) vulnerability exists when Azure DevOps Server and Team Foundation Server do not properly sanitize user providedMicrosoft Team Foundation Server · Microsoft Azure DevOps S…
- CVE-2019-0867A Cross-site Scripting (XSS) vulnerability exists when Azure DevOps Server and Team Foundation Server do not properly sanitize user providedMicrosoft Team Foundation Server · Microsoft Azure DevOps S…
- CVE-2019-0868A Cross-site Scripting (XSS) vulnerability exists when Azure DevOps Server and Team Foundation Server do not properly sanitize user providedMicrosoft Team Foundation Server · Microsoft Azure DevOps S…
- CVE-2019-0839An information disclosure vulnerability exists when the Terminal Services component improperly discloses the contents of its memory, aka 'WiMicrosoft Windows
- CVE-2019-0840An information disclosure vulnerability exists when the Windows kernel improperly handles objects in memory, aka 'Windows Kernel InformationMicrosoft Windows
- CVE-2019-0842A remote code execution vulnerability exists in the way that the VBScript engine handles objects in memory, aka 'Windows VBScript Engine RemMicrosoft Windows
- CVE-2019-0844An information disclosure vulnerability exists when the Windows kernel improperly handles objects in memory, aka 'Windows Kernel InformationMicrosoft Windows
- CVE-2019-0845A remote code execution vulnerability exists when the IOleCvt interface renders ASP webpage content, aka 'Windows IOleCvt Interface Remote CMicrosoft Windows
- CVE-2019-0846A remote code execution vulnerability exists when the Windows Jet Database Engine improperly handles objects in memory, aka 'Jet Database EnMicrosoft Windows
- CVE-2019-0847A remote code execution vulnerability exists when the Windows Jet Database Engine improperly handles objects in memory, aka 'Jet Database EnMicrosoft Windows
- CVE-2019-0848An information disclosure vulnerability exists when the win32k component improperly provides kernel information, aka 'Win32k Information DisMicrosoft Windows
- CVE-2019-0849An information disclosure vulnerability exists when the Windows GDI component improperly discloses the contents of its memory, aka 'Windows Microsoft Windows
- CVE-2019-0851A remote code execution vulnerability exists when the Windows Jet Database Engine improperly handles objects in memory, aka 'Jet Database EnMicrosoft Windows
- CVE-2019-0826A remote code execution vulnerability exists when the Microsoft Office Access Connectivity Engine improperly handles objects in memory, aka Microsoft Office
- CVE-2019-0827A remote code execution vulnerability exists when the Microsoft Office Access Connectivity Engine improperly handles objects in memory, aka Microsoft Office
- CVE-2019-0828A remote code execution vulnerability exists in Microsoft Excel software when the software fails to properly handle objects in memory, aka 'Microsoft Excel · Microsoft Office
- CVE-2019-0829A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka 'CMicrosoft Edge · Microsoft ChakraCore +1
- CVE-2019-0830A cross-site-scripting (XSS) vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web requesMicrosoft SharePoint Foundation · Microsoft SharePoint E… +1
- CVE-2019-0831A cross-site-scripting (XSS) vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web requesMicrosoft SharePoint Server · Microsoft SharePoint Found… +1
- CVE-2019-0833An information disclosure vulnerability exists when Microsoft Edge improperly handles objects in memory, aka 'Microsoft Edge Information DisMicrosoft Edge
- CVE-2019-0835An information disclosure vulnerability exists when the scripting engine does not properly handle objects in memory, aka 'Microsoft ScriptinMicrosoft Internet Explorer
- CVE-2019-0836An elevation of privilege vulnerability exists when Windows improperly handles calls to the LUAFV driver (luafv.sys), aka 'Windows ElevationMicrosoft Windows
- CVE-2019-0837An information disclosure vulnerability exists when DirectX improperly handles objects in memory, aka 'DirectX Information Disclosure VulnerMicrosoft Windows
- CVE-2019-0838An information disclosure vulnerability exists when Windows Task Scheduler improperly discloses credentials to Windows Credential Manager, aMicrosoft Windows
- CVE-2019-0806A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka 'CMicrosoft Edge · Microsoft ChakraCore +1
- CVE-2019-0810A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka 'CMicrosoft Edge · Microsoft ChakraCore +1
- CVE-2019-0812A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka 'CMicrosoft Edge · Microsoft ChakraCore +1
- CVE-2019-0813An elevation of privilege vulnerability exists when Windows Admin Center improperly impersonates operations in certain situations, aka 'WindMicrosoft Windows Admin Center
- CVE-2019-0814An information disclosure vulnerability exists when the win32k component improperly provides kernel information, aka 'Win32k Information DisMicrosoft Windows Server · Microsoft Windows
- CVE-2019-0815A denial of service vulnerability exists when ASP.NET Core improperly handles web requests, aka 'ASP.NET Core Denial of Service VulnerabilitMicrosoft ASP.NET Core
- CVE-2019-0817A spoofing vulnerability exists in Microsoft Exchange Server when Outlook Web Access (OWA) fails to properly handle web requests, aka 'MicroMicrosoft Exchange Server
- CVE-2019-0822A remote code execution vulnerability exists in the way that Microsoft Graphics Components handle objects in memory, aka 'Microsoft GraphicsMicrosoft Office
- CVE-2019-0823A remote code execution vulnerability exists when the Microsoft Office Access Connectivity Engine improperly handles objects in memory, aka Microsoft Office
- CVE-2019-0824A remote code execution vulnerability exists when the Microsoft Office Access Connectivity Engine improperly handles objects in memory, aka Microsoft Office
- CVE-2019-0825A remote code execution vulnerability exists when the Microsoft Office Access Connectivity Engine improperly handles objects in memory, aka Microsoft Office
- CVE-2019-0791A remote code execution vulnerability exists when the Microsoft XML Core Services MSXML parser processes user input, aka 'MS XML Remote CodeMicrosoft Windows
- CVE-2019-0792A remote code execution vulnerability exists when the Microsoft XML Core Services MSXML parser processes user input, aka 'MS XML Remote CodeMicrosoft Windows
- CVE-2019-0793A remote code execution vulnerability exists when the Microsoft XML Core Services MSXML parser processes user input, aka 'MS XML Remote CodeMicrosoft Windows
- CVE-2019-0794A remote code execution vulnerability exists when OLE automation improperly handles objects in memory, aka 'OLE Automation Remote Code ExecuMicrosoft Windows
- CVE-2019-0795A remote code execution vulnerability exists when the Microsoft XML Core Services MSXML parser processes user input, aka 'MS XML Remote CodeMicrosoft Windows
- CVE-2019-0796An elevation of privilege vulnerability exists when Windows improperly handles calls to the LUAFV driver (luafv.sys), aka 'Windows ElevationMicrosoft Windows
- CVE-2019-0801A remote code execution vulnerability exists when Microsoft Office fails to properly handle certain files.To exploit the vulnerability, an aMicrosoft Office
- CVE-2019-0802An information disclosure vulnerability exists when the Windows GDI component improperly discloses the contents of its memory, aka 'Windows Microsoft Windows
- CVE-2019-0805An elevation of privilege vulnerability exists when Windows improperly handles calls to the LUAFV driver (luafv.sys), aka 'Windows ElevationMicrosoft Windows
- CVE-2019-0790A remote code execution vulnerability exists when the Microsoft XML Core Services MSXML parser processes user input, aka 'MS XML Remote CodeMicrosoft Windows Server · Microsoft Windows
- CVE-2019-0685An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in memory, aka 'Win32k Microsoft Windows Server · Microsoft Windows
- CVE-2019-0688An information disclosure vulnerability exists when the Windows TCP/IP stack improperly handles fragmented IP packets, aka 'Windows TCP/IP IMicrosoft Windows Server · Microsoft Windows
- CVE-2019-0730An elevation of privilege vulnerability exists when Windows improperly handles calls to the LUAFV driver (luafv.sys), aka 'Windows ElevationMicrosoft Windows
- CVE-2019-0731An elevation of privilege vulnerability exists when Windows improperly handles calls to the LUAFV driver (luafv.sys), aka 'Windows ElevationMicrosoft Windows
- CVE-2019-0732A security feature bypass vulnerability exists in Windows which could allow an attacker to bypass Device Guard when Windows improperly handlMicrosoft Windows
- CVE-2019-0735An elevation of privilege vulnerability exists when the Windows Client Server Run-Time Subsystem (CSRSS) fails to properly handle objects inMicrosoft Windows
- CVE-2019-0739A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Microsoft Edge, aka 'ScriptinMicrosoft Edge · Microsoft ChakraCore
- CVE-2019-0753A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Internet Explorer, aka 'ScripMicrosoft Internet Explorer
- CVE-2019-0764A tampering vulnerability exists when Microsoft browsers do not properly validate input under specific conditions, aka 'Microsoft Browsers TMicrosoft Internet Explorer · Microsoft Edge
- CVE-2019-0786An elevation of privilege vulnerability exists in the Microsoft Server Message Block (SMB) Server when an attacker with valid credentials atMicrosoft Windows
- CVE-2019-5513VMware Horizon Connection Server (7.x before 7.8, 7.5.x before 7.5.2, 6.x before 6.2.8) contains an information disclosure vulnerability.VMware Horizon Connection Server
- CVE-2019-5512VMware Workstation (15.x before 15.0.3, 14.x before 14.1.6) running on Windows does not handle COM classes appropriately.VMware Workstation
- CVE-2019-5511VMware Workstation (15.x before 15.0.3, 14.x before 14.1.6) running on Windows does not handle paths appropriately.VMware Workstation
- CVE-2019-7359An exploitable heap overflow vulnerability in the AcCellMargin handling code in Autodesk Advance Steel 2018, Autodesk AutoCAD 2018, AutodeskAutodesk Advance Steel · Autodesk AutoCAD +1
- CVE-2019-7358An exploitable heap overflow vulnerability in the DXF-parsing functionality in Autodesk Advance Steel 2018, Autodesk AutoCAD 2018, Autodesk Autodesk AutoCAD LT · Autodesk Civil +2
- CVE-2019-7361An attacker may convince a victim to open a malicious action micro (.actm) file that has serialized data, which may trigger a code executionAutodesk Civil · Autodesk Advance Steel +1
- CVE-2019-7360An exploitable use-after-free vulnerability in the DXF-parsing functionality in Autodesk Advance Steel 2018, Autodesk AutoCAD 2018, AutodeskAutodesk Civil · Autodesk Advance Steel +1
- CVE-2019-1567The Expedition Migration tool 1.1.6 and earlier may allow an authenticated attacker to run arbitrary JavaScript or HTML in the User Mapping Palo Alto Networks Expedition Migration Tool
- CVE-2018-18365Norton Password Manager may be susceptible to an address spoofing issue.Norton Password Manager
- CVE-2018-16530A stack-based buffer overflow in Forcepoint Email Security version 8.5 allows an attacker to craft malicious input and potentially crash a pForcepoint Email Security
- CVE-2018-7117A remote Cross-Site Scripting in HPE iLO 5 Web User Interface vulnerability was identified in HPE Integrated Lights-Out 5 (iLO 5) for Gen10 HPE Integrated Lights-Out 5 (iLO 5) for HPE Gen10 Servers
- CVE-2018-7118A local access restriction bypass vulnerability was identified in HPE Service Pack for ProLiant (SPP) Bundled Software earlier than version HPE Service Pack for Proliant
- CVE-2019-7174Roxy Fileman 1.4.5 allows attackers to execute renamefile.php (aka Rename File), createdir.php (aka Create Directory), fileslist.php (aka Ec
- CVE-2019-6117The wpape APE GALLERY plugin 1.6.14 for WordPress has stored XSS via the classGallery.php getCategories function.
- CVE-2018-19586Silverpeas 5.15 through 6.0.2 is affected by an authenticated Directory Traversal vulnerability that can be triggered during file uploads be
- CVE-2018-14894CyberArk Endpoint Privilege Manager 10.2.1.603 and earlier allows an attacker (who is able to edit permissions of a file) to bypass intended
- CVE-2017-17023The Sophos UTM VPN endpoint interacts with client software provided by NPC Engineering (www.ncp-e.com).
- CVE-2017-3139A denial of service flaw was found in the way BIND handled DNSSEC validation.Red Hat BIND
- CVE-2018-20698The floragunn Search Guard plugin before 6.x-16 for Kibana allows URL injection for login redirects on the login page when basePath is set.
- CVE-2018-19589Incorrect Access Controls of Security Officer (SO) in PKCS11 R2 provider that ships with the Utimaco CryptoServer HSM product package allows
- CVE-2018-13366An information disclosure vulnerability in Fortinet FortiOS 6.0.1, 5.6.7 and below allows attacker to reveals serial number of FortiGate viaFortinet FortiOS
- CVE-2019-10242In Eclipse Kura versions up to 4.0.0, the SkinServlet did not checked the path passed during servlet call, potentially allowing path traversThe Eclipse Foundation Eclipse Kura
- CVE-2019-10243In Eclipse Kura versions up to 4.0.0, Kura exposes the underlying Ui Web server version in its replies.The Eclipse Foundation Eclipse Kura
- CVE-2019-10244In Eclipse Kura versions up to 4.0.0, the Web UI package and component services, the Artemis simple Mqtt component and the emulator positionThe Eclipse Foundation Eclipse Kura
- CVE-2018-15631Improper access control in the Discuss App of Odoo Community 12.0 and earlier, and Odoo Enterprise 12.0 and earlier allows remote authenticaOdoo Community · Odoo Enterprise
- CVE-2018-15635Cross-site scripting vulnerability in the Discuss App of Odoo Community 12.0 and earlier, and Odoo Enterprise 12.0 and earlier allows remoteOdoo Community · Odoo Enterprise
- CVE-2017-17544A privilege escalation vulnerability in Fortinet FortiOS 6.0.0 to 6.0.6, 5.6.0 to 5.6.10, 5.4 and below allows admin users to elevate their Fortinet FortiOS
- CVE-2019-3795Insecure Randomness When Using a SecureRandom Instance Constructed by Spring SecuritySpring Security · org.springframework.security:spring-secur…
- CVE-2019-5615Rapid7 InsightVM Stored Credential ExposureRapid7 InsightVM
- CVE-2019-3880A flaw was found in the way samba implemented an RPC endpoint emulating the Windows registry service API.The Samba Project samba
- CVE-2019-3870A vulnerability was found in Samba from version (including) 4.9 to versions before 4.9.6 and 4.10.2.The Samba Project samba
- CVE-2019-3893In Foreman it was discovered that the delete compute resource operation, when executed from the Foreman API, leads to the disclosure of the The Foreman Project foreman
- CVE-2019-3941Advantech WebAccess 8.3.4 allows unauthenticated, remote attackers to delete arbitrary files via IOCTL 10005 RPC.Advantech WebAccess
- CVE-2019-3940Advantech WebAccess 8.3.4 is vulnerable to file upload attacks via unauthenticated RPC call.Advantech WebAccess
- CVE-2019-11028GAT-Ship Web Module before 1.40 suffers from a vulnerability allowing authenticated attackers to upload any file type to the server via the
- CVE-2019-10634An XSS vulnerability in the Zyxel NAS 326 version 5.21 and below allows a remote authenticated attacker to inject arbitrary JavaScript or HT
- CVE-2019-10633An eval injection vulnerability in the Python web server routing on the Zyxel NAS 326 version 5.21 and below allows a remote authenticated a
- CVE-2019-10632A directory traversal vulnerability in the file browser component on the Zyxel NAS 326 version 5.21 and below allows a lower privileged user
- CVE-2019-10631Shell Metacharacter Injection in the package installer on Zyxel NAS 326 version 5.21 and below allows an authenticated attacker to execute a
- CVE-2019-10630A plaintext password vulnerability in the Zyxel NAS 326 through 5.21 allows an elevated privileged user to get the admin password of the dev
- CVE-2019-10903In Wireshark 2.4.0 to 2.4.13, 2.6.0 to 2.6.7, and 3.0.0, the DCERPC SPOOLSS dissector could crash.
- CVE-2019-10902In Wireshark 3.0.0, the TSDNS dissector could crash.
- CVE-2019-10901In Wireshark 2.4.0 to 2.4.13, 2.6.0 to 2.6.7, and 3.0.0, the LDSS dissector could crash.
- CVE-2019-10900In Wireshark 3.0.0, the Rbm dissector could go into an infinite loop.
- CVE-2019-10899In Wireshark 2.4.0 to 2.4.13, 2.6.0 to 2.6.7, and 3.0.0, the SRVLOC dissector could crash.
- CVE-2019-10898In Wireshark 3.0.0, the GSUP dissector could go into an infinite loop.
- CVE-2019-10897In Wireshark 3.0.0, the IEEE 802.11 dissector could go into an infinite loop.
- CVE-2019-10896In Wireshark 2.4.0 to 2.4.13, 2.6.0 to 2.6.7, and 3.0.0, the DOF dissector could crash.
- CVE-2019-10895In Wireshark 2.4.0 to 2.4.13, 2.6.0 to 2.6.7, and 3.0.0, the NetScaler file parser could crash.
- CVE-2019-10894In Wireshark 2.4.0 to 2.4.13, 2.6.0 to 2.6.7, and 3.0.0, the GSS-API dissector could crash.
- CVE-2019-0782An information disclosure vulnerability exists when the Windows kernel fails to properly initialize a memory address, aka 'Windows Kernel InMicrosoft Windows
- CVE-2019-0783A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Internet Explorer, aka 'ScripMicrosoft Internet Explorer
- CVE-2019-0784A remote code execution vulnerability exists in the way that the ActiveX Data objects (ADO) handles objects in memory, aka 'Windows ActiveX Microsoft Windows
- CVE-2019-0798A spoofing vulnerability exists when a Lync Server or Skype for Business Server does not properly sanitize a specially crafted request, aka Microsoft Skype for Business Server · Microsoft Lync Server
- CVE-2019-0804An information disclosure vulnerability exists in the way Azure WaLinuxAgent creates swap files on resource disks, aka 'Azure Linux Agent InMicrosoft Azure
- CVE-2019-0809A remote code execution vulnerability exists when the Visual Studio C++ Redistributable Installer improperly validates input before loading Microsoft Visual Studio
- CVE-2019-0816A security feature bypass exists in Azure SSH Keypairs, due to a change in the provisioning logic for some Linux images that use cloud-init,Microsoft Ubuntu Server
- CVE-2019-0821An information disclosure vulnerability exists in the way that the Windows SMB Server handles certain requests, aka 'Windows SMB InformationMicrosoft Windows
- CVE-2019-0770A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Microsoft Edge, aka 'ScriptinMicrosoft Edge
- CVE-2019-0771A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Microsoft Edge, aka 'ScriptinMicrosoft Edge · Microsoft ChakraCore +1
- CVE-2019-0772A remote code execution vulnerability exists in the way that the VBScript engine handles objects in memory, aka 'Windows VBScript Engine RemMicrosoft Windows
- CVE-2019-0773A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Microsoft Edge, aka 'ScriptinMicrosoft Edge · Microsoft ChakraCore +1
- CVE-2019-0774An information disclosure vulnerability exists when the Windows GDI component improperly discloses the contents of its memory, aka 'Windows Microsoft Windows
- CVE-2019-0775An information disclosure vulnerability exists when the Windows kernel improperly handles objects in memory, aka 'Windows Kernel InformationMicrosoft Windows
- CVE-2019-0776An information disclosure vulnerability exists when the win32k component improperly provides kernel information, aka 'Win32k Information DisMicrosoft Windows
- CVE-2019-0777A Cross-site Scripting (XSS) vulnerability exists when Team Foundation Server does not properly sanitize user provided input, aka 'Team FounMicrosoft Team Foundation Server
- CVE-2019-0778A cross-site-scripting (XSS) vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web requesMicrosoft SharePoint Foundation · Microsoft SharePoint Ente…
- CVE-2019-0779A remote code execution vulnerability exists when Microsoft Edge improperly accesses objects in memory, aka 'Microsoft Edge Memory CorruptioMicrosoft Edge
- CVE-2019-0780A remote code execution vulnerability exists in the way that Microsoft browsers access objects in memory, aka 'Microsoft Browser Memory CorrMicrosoft Internet Explorer · Microsoft Edge
- CVE-2019-0756A remote code execution vulnerability exists when the Microsoft XML Core Services MSXML parser processes user input, aka 'MS XML Remote CodeMicrosoft Windows
- CVE-2019-0757A tampering vulnerability exists in the NuGet Package Manager for Linux and Mac that could allow an authenticated attacker to modify a NuGetMicrosoft Visual Studio · Microsoft .NET Core SDK +2
- CVE-2019-0759An information disclosure vulnerability exists when the Windows Print Spooler does not properly handle objects in memory, aka 'Windows PrintMicrosoft Windows
- CVE-2019-0761A security feature bypass vulnerability exists when Internet Explorer fails to validate the correct Security Zone of requests for specific UMicrosoft Internet Explorer
- CVE-2019-0762A security feature bypass vulnerability exists when Microsoft browsers improperly handle requests of different origins, aka 'Microsoft BrowsMicrosoft Internet Explorer · Microsoft Edge
- CVE-2019-0763A remote code execution vulnerability exists when Internet Explorer improperly accesses objects in memory, aka 'Internet Explorer Memory CorMicrosoft Internet Explorer
- CVE-2019-0765A remote code execution vulnerability exists in the way that comctl32.dll handles objects in memory, aka 'Comctl32 Remote Code Execution VulMicrosoft Windows
- CVE-2019-0766An elevation of privilege vulnerability exists in Windows AppX Deployment Server that allows file creation in arbitrary locations.Microsoft Windows Server · Microsoft Windows
- CVE-2019-0767An information disclosure vulnerability exists when the Windows kernel improperly initializes objects in memory.To exploit this vulnerabilitMicrosoft Windows
- CVE-2019-0768A security feature bypass vulnerability exists when Internet Explorer VBScript execution policy does not properly restrict VBScript under spMicrosoft Internet Explorer
- CVE-2019-0769A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Microsoft Edge, aka 'ScriptinMicrosoft Edge · Microsoft ChakraCore +1
- CVE-2019-3887A flaw was found in the way KVM hypervisor handled x2APIC Machine Specific Rregister (MSR) access with nested(=1) virtualization enabled.The Linux Foundation Kernel