CVEs published April 10, 2019
54 CVEs were published on April 10, 2019: 3 critical, 9 high.
- Published
- 54
- Critical
- 3
- High
- 9
- Medium
- 10
- Low
- 0
- Unrated
- 32
- Now in CISA KEV
- 0
- Fix available
- 33
Most affected products
- Juniper Networks Junos OS
- 14
- SAP SE SAP NetWeaver Process Integration
- 3
- Ubiquiti Networks EdgeMAX
- 3
- Apache Airflow · apache-airflow
- 2
- github.com/rancher/rancher
- 2
- Jenkins project Jenkins · org.jenkins-ci.main:jenkins-core
- 2
- Apache Tomcat · org.apache.tomcat.embed:tomcat-embed-core +1
- 1
- IBM BigFix Platform
- 1
- IBM InfoSphere Information Server
- 1
- IBM Sterling Connect:Direct for UNIX
- 1
Critical 3
- CVE-2019-0008QFX5000 Series, EX4300, EX4600: A stack buffer overflow vulnerability in Packet Forwarding Engine manager (FXPC) processJuniper Networks Junos OS
- CVE-2019-11068libxslt through 1.1.33 allows bypass of a protection mechanism because callers of xsltCheckRead and xsltCheckWrite permit access even upon rnokogiri
- CVE-2019-4013IBM BigFix Platform 9.5 could allow any authenticated user to upload any file to any location on the server with root privileges.IBM BigFix Platform
High 9
- CVE-2019-0044Junos OS: SRX5000 series: Kernel crash (vmcore) upon receipt of a specific packet on fxp0 interfaceJuniper Networks Junos OS
- CVE-2019-0043Junos OS: RPD process crashes upon receipt of a specific SNMP packetJuniper Networks Junos OS
- CVE-2019-0037Junos OS: jdhcpd crash upon receipt of crafted DHCPv6 solicit messageJuniper Networks Junos OS
- CVE-2019-0036Junos OS: Firewall filter terms named "internal-1" and "internal-2" being ignoredJuniper Networks Junos OS
- CVE-2019-0033SRX Series: A remote attacker may cause a high CPU Denial of Service to the device when proxy ARP is configured.Juniper Networks Junos OS
- CVE-2019-0031Junos OS: jdhcpd daemon memory consumption Denial of Service when receiving specific IPv6 DHCP packets.Juniper Networks Junos OS
- CVE-2019-0028Junos OS: RPD process crashes due to specific BGP peer restarts condition.Juniper Networks Junos OS
- CVE-2019-0019BGP packets can trigger rpd crash when BGP tracing is enabled.Juniper Networks Junos OS
- CVE-2019-3612Information disclosure vulnerability in McAfee TIE Server and DXL PlatformMcAfee Data eXchange Layer (DXL) Platform · McAfee Threat I…
Medium, low and unrated 42
- CVE-2018-14683PRTG before 19.1.49.1966 has Cross Site Scripting (XSS) in the WEBGUI.
- CVE-2019-11072lighttpd before 1.4.54 has a signed integer overflow, which might allow remote attackers to cause a denial of service (application crash) or
- CVE-2018-19453Kentico CMS before 11.0.45 allows unrestricted upload of a file with a dangerous type.
- CVE-2019-11071SPIP 3.1 before 3.1.10 and 3.2 before 3.2.4 allows authenticated visitors to execute arbitrary code on the host server because var_memotri i
- CVE-2019-0285The .NET SDK WebForm Viewer in SAP Crystal Reports for Visual Studio (fixed in version 2010) discloses sensitive database information includSAP SE SAP Crystal Reports for Visual Studio
- CVE-2019-0284SLD Registration in SAP HANA (fixed in versions 1.0, 2.0) does not sufficiently validate an XML document accepted from an untrusted source.SAP SE SAP HANA
- CVE-2019-0283SAP NetWeaver Process Integration (Adapter Engine), fixed in versions 7.10 to 7.11, 7.30, 7.31, 7.40, 7.50; is vulnerable to Digital SignatuSAP SE SAP NetWeaver Process Integration
- CVE-2019-0282Several web pages in SAP NetWeaver Process Integration (Runtime Workbench), fixed in versions 7.10 to 7.11, 7.30, 7.31, 7.40, 7.50; can be aSAP SE SAP NetWeaver Process Integration
- CVE-2019-0279ABAP BASIS function modules INST_CREATE_R3_RFC_DEST, INST_CREATE_TCPIP_RFCDEST, and INST_CREATE_TCPIP_RFC_DEST in SAP BASIS (fixed in versioSAP SE SAP BASIS
- CVE-2019-11070WebKitGTK and WPE WebKit prior to version 2.24.1 failed to properly apply configured HTTP proxy settings when downloading livestream video (
- CVE-2019-0042Incorrect messages from Juniper Identity Management Service (JIMS) can trigger Denial of Service or firewall bypass conditions for SRX series devicesJuniper Networks Juniper Identity Management Service
- CVE-2019-0041Junos OS: EX4300-MP Series: IP transit traffic can reach the control plane via loopback interface.Juniper Networks Junos OS
- CVE-2019-0040Junos OS: Specially crafted packets sent to port 111 on any interface triggers responses from the management interfaceJuniper Networks Junos OS
- CVE-2019-0039Junos OS: Login credentials are vulnerable to brute force attacks through the REST APIJuniper Networks Junos OS
- CVE-2019-0038SRX Series: Crafted packets destined to fxp0 management interface on SRX340/SRX345 devices can lead to DoSJuniper Networks Junos OS
- CVE-2019-0035Junos OS: 'set system ports console insecure' allows root password recovery on OAM volumesJuniper Networks Junos OS
- CVE-2019-0032Junos Space Service Now and Service Insight: Organization username and password stored in plaintext in log files.Juniper Networks Service Insight · Juniper Networks Service…
- CVE-2019-0278Under certain conditions the Monitoring Servlet of the SAP NetWeaver Process Integration (Messaging System), fixed in versions 7.10 to 7.11,SAP SE SAP NetWeaver Process Integration
- CVE-2019-1003050The f:validateButton form control for the Jenkins UI did not properly escape job URLs in Jenkins 2.171 and earlier and Jenkins LTS 2.164.1 aJenkins project Jenkins · org.jenkins-ci.main:jenkins-core
- CVE-2019-1003049Users who cached their CLI authentication before Jenkins was updated to 2.150.2 and newer, or 2.160 and newer, would remain authenticated inJenkins project Jenkins · org.jenkins-ci.main:jenkins-core
- CVE-2019-3943MikroTik RouterOS versions Stable 6.43.12 and below, Long-term 6.42.12 and below, and Testing 6.44beta75 and below are vulnerable to an authMikroTik RouterOS
- CVE-2019-9694Symantec Endpoint Encryption prior to SEE 11.2.1 MP1 may be susceptible to a Privilege Escalation vulnerability, which is a type of issue whSymantec Endpoint Encryption
- CVE-2006-7254The nscd daemon in the GNU C Library (glibc) before version 2.5 does not close incoming client sockets if they cannot be handled by the daem
- CVE-2005-3590The getgrouplist function in the GNU C library (glibc) before version 2.3.5, when invoked with a zero argument, writes to the passed pointer
- CVE-2019-0216A malicious admin user could edit the state of objects in the Airflow metadata database to execute arbitrary javascript on certain page viewApache Airflow · apache-airflow
- CVE-2019-0229A number of HTTP endpoints in the Airflow webserver (both RBAC and classic) did not have adequate protection and were vulnerable to cross-siApache Airflow · apache-airflow
- CVE-2019-6556When processing project files, the application (Omron CX-Programmer v9.70 and prior and Common Components January 2019 and prior) fails to cOmron CX-Programmer within CX-One
- CVE-2019-10946An issue was discovered in Joomla! before 3.9.5.
- CVE-2019-10945An issue was discovered in Joomla! before 3.9.5.
- CVE-2019-5426In Ubiquiti Networks EdgeSwitch X v1.1.0 and prior, an unauthenticated user can use the "local port forwarding" and "dynamic port forwardingUbiquiti Networks EdgeMAX
- CVE-2019-5425In Ubiquiti Networks EdgeSwitch X v1.1.0 and prior, an authenticated user can execute arbitrary shell commands over the SSH interface bypassUbiquiti Networks EdgeMAX
- CVE-2019-5424In Ubiquiti Networks EdgeSwitch X v1.1.0 and prior, a privileged user can execute arbitrary shell commands over the SSH CLI interface.Ubiquiti Networks EdgeMAX
- CVE-2019-7139An unauthenticated user can execute SQL statements that allow arbitrary read access to the underlying database, which causes sensitive data Magento Open Source · Magento Commerce +2
- CVE-2019-6156In Lenovo systems, SMM BIOS Write Protection is used to prevent writes to SPI Flash.Lenovo BIOS
- CVE-2019-6154A DLL search path vulnerability was reported in Lenovo Bootable Generator, prior to version Mar-2019, that could allow a malicious user withLenovo Bootable Generator
- CVE-2019-7551Cantemo Portal before 3.2.13, 3.3.x before 3.3.8, and 3.4.x before 3.4.9 has XSS.
- CVE-2018-1994IBM InfoSphere Information Server 11.5 and 11.7 is vulnerable to SQL injection.IBM InfoSphere Information Server
- CVE-2018-1903IBM Sterling Connect:Direct for UNIX 4.2.0, 4.3.0, and 6.0.0 could allow a user with restricted sudo access on a system to manipulate CD UNIIBM Sterling Connect:Direct for UNIX
- CVE-2019-0199The HTTP/2 implementation in Apache Tomcat 9.0.0.M1 to 9.0.14 and 8.5.0 to 8.5.37 accepted streams with excessive numbers of SETTINGS framesApache Tomcat · org.apache.tomcat.embed:tomcat-embed-core +1
- CVE-2019-6287In Rancher 2.0.0 through 2.1.5, project members have continued access to create, update, read, and delete namespaces in a project after theygithub.com/rancher/rancher
- CVE-2018-20321An issue was discovered in Rancher 2 through 2.1.5.github.com/rancher/rancher
- CVE-2019-11069Sequelize version 5 before 5.3.0 does not properly ensure that standard conforming strings are used.sequelize