# CVEs published 2019-04-10

54 CVEs were published on April 10, 2019: 3 critical, 9 high. Days are UTC.

- [CVE-2018-14683](https://cve.now/CVE-2018-14683.md): PRTG before 19.1.49.1966 has Cross Site Scripting (XSS) in the WEBGUI. (no CVSS)
- [CVE-2019-11072](https://cve.now/CVE-2019-11072.md): lighttpd before 1.4.54 has a signed integer overflow, which might allow remote attackers to cause a denial of service (application crash) or (no CVSS)
- [CVE-2018-19453](https://cve.now/CVE-2018-19453.md): Kentico CMS before 11.0.45 allows unrestricted upload of a file with a dangerous type. (no CVSS)
- [CVE-2019-11071](https://cve.now/CVE-2019-11071.md): SPIP 3.1 before 3.1.10 and 3.2 before 3.2.4 allows authenticated visitors to execute arbitrary code on the host server because var\_memotri i (no CVSS)
- [CVE-2019-0285](https://cve.now/CVE-2019-0285.md): The .NET SDK WebForm Viewer in SAP Crystal Reports for Visual Studio (fixed in version 2010) discloses sensitive database information includ (no CVSS, SAP SE SAP Crystal Reports for Visual Studio)
- [CVE-2019-0284](https://cve.now/CVE-2019-0284.md): SLD Registration in SAP HANA (fixed in versions 1.0, 2.0) does not sufficiently validate an XML document accepted from an untrusted source. (no CVSS, SAP SE SAP HANA)
- [CVE-2019-0283](https://cve.now/CVE-2019-0283.md): SAP NetWeaver Process Integration (Adapter Engine), fixed in versions 7.10 to 7.11, 7.30, 7.31, 7.40, 7.50; is vulnerable to Digital Signatu (no CVSS, SAP SE SAP NetWeaver Process Integration)
- [CVE-2019-0282](https://cve.now/CVE-2019-0282.md): Several web pages in SAP NetWeaver Process Integration (Runtime Workbench), fixed in versions 7.10 to 7.11, 7.30, 7.31, 7.40, 7.50; can be a (no CVSS, SAP SE SAP NetWeaver Process Integration)
- [CVE-2019-0279](https://cve.now/CVE-2019-0279.md): ABAP BASIS function modules INST\_CREATE\_R3\_RFC\_DEST, INST\_CREATE\_TCPIP\_RFCDEST, and INST\_CREATE\_TCPIP\_RFC\_DEST in SAP BASIS (fixed in versio (no CVSS, SAP SE SAP BASIS)
- [CVE-2019-11070](https://cve.now/CVE-2019-11070.md): WebKitGTK and WPE WebKit prior to version 2.24.1 failed to properly apply configured HTTP proxy settings when downloading livestream video ( (no CVSS)
- [CVE-2019-0044](https://cve.now/CVE-2019-0044.md): Junos OS: SRX5000 series: Kernel crash (vmcore) upon receipt of a specific packet on fxp0 interface (CVSS 7.5, Juniper Networks Junos OS)
- [CVE-2019-0043](https://cve.now/CVE-2019-0043.md): Junos OS: RPD process crashes upon receipt of a specific SNMP packet (CVSS 7.5, Juniper Networks Junos OS)
- [CVE-2019-0042](https://cve.now/CVE-2019-0042.md): Incorrect messages from Juniper Identity Management Service (JIMS) can trigger Denial of Service or firewall bypass conditions for SRX series devices (CVSS 5.7, Juniper Networks Juniper Identity Management Service)
- [CVE-2019-0041](https://cve.now/CVE-2019-0041.md): Junos OS: EX4300-MP Series: IP transit traffic can reach the control plane via loopback interface. (CVSS 6.5, Juniper Networks Junos OS)
- [CVE-2019-0040](https://cve.now/CVE-2019-0040.md): Junos OS: Specially crafted packets sent to port 111 on any interface triggers responses from the management interface (CVSS 6.5, Juniper Networks Junos OS)
- [CVE-2019-0039](https://cve.now/CVE-2019-0039.md): Junos OS: Login credentials are vulnerable to brute force attacks through the REST API (CVSS 5.3, Juniper Networks Junos OS)
- [CVE-2019-0038](https://cve.now/CVE-2019-0038.md): SRX Series: Crafted packets destined to fxp0 management interface on SRX340/SRX345 devices can lead to DoS (CVSS 6.5, Juniper Networks Junos OS)
- [CVE-2019-0037](https://cve.now/CVE-2019-0037.md): Junos OS: jdhcpd crash upon receipt of crafted DHCPv6 solicit message (CVSS 7.4, Juniper Networks Junos OS)
- [CVE-2019-0036](https://cve.now/CVE-2019-0036.md): Junos OS: Firewall filter terms named "internal-1" and "internal-2" being ignored (CVSS 7.2, Juniper Networks Junos OS)
- [CVE-2019-0035](https://cve.now/CVE-2019-0035.md): Junos OS: 'set system ports console insecure' allows root password recovery on OAM volumes (CVSS 6.8, Juniper Networks Junos OS)
- [CVE-2019-0033](https://cve.now/CVE-2019-0033.md): SRX Series: A remote attacker may cause a high CPU Denial of Service to the device when proxy ARP is configured. (CVSS 7.5, Juniper Networks Junos OS)
- [CVE-2019-0032](https://cve.now/CVE-2019-0032.md): Junos Space Service Now and Service Insight: Organization username and password stored in plaintext in log files. (CVSS 6.5, Juniper Networks Service Insight · Juniper Networks Service…)
- [CVE-2019-0031](https://cve.now/CVE-2019-0031.md): Junos OS: jdhcpd daemon memory consumption Denial of Service when receiving specific IPv6 DHCP packets. (CVSS 7.4, Juniper Networks Junos OS)
- [CVE-2019-0028](https://cve.now/CVE-2019-0028.md): Junos OS: RPD process crashes due to specific BGP peer restarts condition. (CVSS 7.5, Juniper Networks Junos OS)
- [CVE-2019-0019](https://cve.now/CVE-2019-0019.md): BGP packets can trigger rpd crash when BGP tracing is enabled. (CVSS 7.5, Juniper Networks Junos OS)
- [CVE-2019-0008](https://cve.now/CVE-2019-0008.md): QFX5000 Series, EX4300, EX4600: A stack buffer overflow vulnerability in Packet Forwarding Engine manager (FXPC) process (CVSS 9.8, Juniper Networks Junos OS)
- [CVE-2019-0278](https://cve.now/CVE-2019-0278.md): Under certain conditions the Monitoring Servlet of the SAP NetWeaver Process Integration (Messaging System), fixed in versions 7.10 to 7.11, (no CVSS, SAP SE SAP NetWeaver Process Integration)
- [CVE-2019-1003050](https://cve.now/CVE-2019-1003050.md): The f:validateButton form control for the Jenkins UI did not properly escape job URLs in Jenkins 2.171 and earlier and Jenkins LTS 2.164.1 a (no CVSS, Jenkins project Jenkins · org.jenkins-ci.main:jenkins-core)
- [CVE-2019-1003049](https://cve.now/CVE-2019-1003049.md): Users who cached their CLI authentication before Jenkins was updated to 2.150.2 and newer, or 2.160 and newer, would remain authenticated in (no CVSS, Jenkins project Jenkins · org.jenkins-ci.main:jenkins-core)
- [CVE-2019-3612](https://cve.now/CVE-2019-3612.md): Information disclosure vulnerability in McAfee TIE Server and DXL Platform (CVSS 8.2, McAfee Data eXchange Layer (DXL) Platform · McAfee Threat I…)
- [CVE-2019-3943](https://cve.now/CVE-2019-3943.md): MikroTik RouterOS versions Stable 6.43.12 and below, Long-term 6.42.12 and below, and Testing 6.44beta75 and below are vulnerable to an auth (no CVSS, MikroTik RouterOS)
- [CVE-2019-9694](https://cve.now/CVE-2019-9694.md): Symantec Endpoint Encryption prior to SEE 11.2.1 MP1 may be susceptible to a Privilege Escalation vulnerability, which is a type of issue wh (no CVSS, Symantec Endpoint Encryption)
- [CVE-2006-7254](https://cve.now/CVE-2006-7254.md): The nscd daemon in the GNU C Library (glibc) before version 2.5 does not close incoming client sockets if they cannot be handled by the daem (no CVSS)
- [CVE-2005-3590](https://cve.now/CVE-2005-3590.md): The getgrouplist function in the GNU C library (glibc) before version 2.3.5, when invoked with a zero argument, writes to the passed pointer (no CVSS)
- [CVE-2019-0216](https://cve.now/CVE-2019-0216.md): A malicious admin user could edit the state of objects in the Airflow metadata database to execute arbitrary javascript on certain page view (no CVSS, Apache Airflow · apache-airflow)
- [CVE-2019-0229](https://cve.now/CVE-2019-0229.md): A number of HTTP endpoints in the Airflow webserver (both RBAC and classic) did not have adequate protection and were vulnerable to cross-si (no CVSS, Apache Airflow · apache-airflow)
- [CVE-2019-6556](https://cve.now/CVE-2019-6556.md): When processing project files, the application (Omron CX-Programmer v9.70 and prior and Common Components January 2019 and prior) fails to c (no CVSS, Omron CX-Programmer within CX-One)
- [CVE-2019-11068](https://cve.now/CVE-2019-11068.md): libxslt through 1.1.33 allows bypass of a protection mechanism because callers of xsltCheckRead and xsltCheckWrite permit access even upon r (CVSS 9.8, nokogiri)
- [CVE-2019-10946](https://cve.now/CVE-2019-10946.md): An issue was discovered in Joomla! before 3.9.5. (no CVSS)
- [CVE-2019-10945](https://cve.now/CVE-2019-10945.md): An issue was discovered in Joomla! before 3.9.5. (no CVSS)
- [CVE-2019-5426](https://cve.now/CVE-2019-5426.md): In Ubiquiti Networks EdgeSwitch X v1.1.0 and prior, an unauthenticated user can use the "local port forwarding" and "dynamic port forwarding (no CVSS, Ubiquiti Networks EdgeMAX)
- [CVE-2019-5425](https://cve.now/CVE-2019-5425.md): In Ubiquiti Networks EdgeSwitch X v1.1.0 and prior, an authenticated user can execute arbitrary shell commands over the SSH interface bypass (no CVSS, Ubiquiti Networks EdgeMAX)
- [CVE-2019-5424](https://cve.now/CVE-2019-5424.md): In Ubiquiti Networks EdgeSwitch X v1.1.0 and prior, a privileged user can execute arbitrary shell commands over the SSH CLI interface. (no CVSS, Ubiquiti Networks EdgeMAX)
- [CVE-2019-7139](https://cve.now/CVE-2019-7139.md): An unauthenticated user can execute SQL statements that allow arbitrary read access to the underlying database, which causes sensitive data (no CVSS, Magento Open Source · Magento Commerce +2)
- [CVE-2019-6156](https://cve.now/CVE-2019-6156.md): In Lenovo systems, SMM BIOS Write Protection is used to prevent writes to SPI Flash. (no CVSS, Lenovo BIOS)
- [CVE-2019-6154](https://cve.now/CVE-2019-6154.md): A DLL search path vulnerability was reported in Lenovo Bootable Generator, prior to version Mar-2019, that could allow a malicious user with (CVSS 5.3, Lenovo Bootable Generator)
- [CVE-2019-7551](https://cve.now/CVE-2019-7551.md): Cantemo Portal before 3.2.13, 3.3.x before 3.3.8, and 3.4.x before 3.4.9 has XSS. (no CVSS)
- [CVE-2019-4013](https://cve.now/CVE-2019-4013.md): IBM BigFix Platform 9.5 could allow any authenticated user to upload any file to any location on the server with root privileges. (CVSS 9.0, IBM BigFix Platform)
- [CVE-2018-1994](https://cve.now/CVE-2018-1994.md): IBM InfoSphere Information Server 11.5 and 11.7 is vulnerable to SQL injection. (CVSS 6.3, IBM InfoSphere Information Server)
- [CVE-2018-1903](https://cve.now/CVE-2018-1903.md): IBM Sterling Connect:Direct for UNIX 4.2.0, 4.3.0, and 6.0.0 could allow a user with restricted sudo access on a system to manipulate CD UNI (CVSS 6.7, IBM Sterling Connect:Direct for UNIX)
- [CVE-2019-0199](https://cve.now/CVE-2019-0199.md): The HTTP/2 implementation in Apache Tomcat 9.0.0.M1 to 9.0.14 and 8.5.0 to 8.5.37 accepted streams with excessive numbers of SETTINGS frames (no CVSS, Apache Tomcat · org.apache.tomcat.embed:tomcat-embed-core +1)
- [CVE-2019-6287](https://cve.now/CVE-2019-6287.md): In Rancher 2.0.0 through 2.1.5, project members have continued access to create, update, read, and delete namespaces in a project after they (no CVSS, github.com/rancher/rancher)
- [CVE-2018-20321](https://cve.now/CVE-2018-20321.md): An issue was discovered in Rancher 2 through 2.1.5. (no CVSS, github.com/rancher/rancher)
- [CVE-2019-11069](https://cve.now/CVE-2019-11069.md): Sequelize version 5 before 5.3.0 does not properly ensure that standard conforming strings are used. (no CVSS, sequelize)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2019-04-10
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.