CVEs published April 11, 2019
33 CVEs were published on April 11, 2019: 0 critical, 2 high.
- Published
- 33
- Critical
- 0
- High
- 2
- Medium
- 1
- Low
- 0
- Unrated
- 30
- Now in CISA KEV
- 0
- Fix available
- 2
Most affected products
- Verizon Fios Quantum Gateway
- 3
- Linux
- 2
- Auth0-WCF-Service-JWT
- 1
- AVEVA Wonderware System Platform
- 1
- Capsule Technologies SmartLinx Neuron
- 1
- F5 BIG-IP
- 1
- Gemalto Sentinel UltraPro
- 1
- HP LaserJet Enterprise printers, HP PageWide Enterprise pri…
- 1
- NVIDIA Jetson TX1 and TX2
- 1
- NVIDIA Jetson TX2
- 1
High 2
- CVE-2019-5024A restricted environment escape vulnerability exists in the “kiosk mode” function of Capsule Technologies SmartLinx Neuron 2 medical informaCapsule Technologies SmartLinx Neuron
- CVE-2019-3845A lack of access control was found in the message queues maintained by Satellite's QPID broker and used by katello-agent in versions before Red Hat qpid-dispatch-router
Medium, low and unrated 31
- CVE-2019-11191The Linux kernel through 5.0.7, when CONFIG_IA32_AOUT is enabled and ia32_aout is loaded, allows local users to bypass ASLR on setuid a.out
- CVE-2019-11190The Linux kernel before 4.8 allows local users to bypass ASLR on setuid programs (such as /bin/su) because install_exec_creds() is called to
- CVE-2019-6534The uncontrolled search path element vulnerability in Gemalto Sentinel UltraPro Client Library ux32w.dll Versions 1.3.0, 1.3.1, and 1.3.2 enGemalto Sentinel UltraPro
- CVE-2019-6525AVEVA Wonderware System Platform 2017 Update 2 and prior uses an ArchestrA network user account for authentication of system processes and iAVEVA Wonderware System Platform
- CVE-2018-20487An issue was discovered in the firewall3 component in Inteno IOPSYS 1.0 through 3.16.
- CVE-2018-19202A reflected XSS vulnerability in index.php in MyBB 1.8.x through 1.8.19 allows remote attackers to inject JavaScript via the 'upsetting[bbur
- CVE-2019-6796An issue was discovered in GitLab Community and Enterprise Edition before 11.5.8, 11.6.x before 11.6.6, and 11.7.x before 11.7.1.
- CVE-2019-7644Auth0 Auth0-WCF-Service-JWT before 1.0.4 leaks the expected JWT signature in an error message when it cannot successfully validate the JWT sAuth0-WCF-Service-JWT
- CVE-2019-6493SmartDefragDriver.sys (2.0) in IObit Smart Defrag 6 never frees an executable kernel pool that is allocated with user defined bytes and size
- CVE-2019-9056An issue was discovered in CMS Made Simple 2.2.8.
- CVE-2019-9628The XMLTooling library all versions prior to V3.0.4, provided with the OpenSAML and Shibboleth Service Provider software, contains an XML pa
- CVE-2019-9733An issue was discovered in JFrog Artifactory 6.7.3.
- CVE-2019-7219Unauthenticated reflected cross-site scripting (XSS) exists in Zarafa Webapp 2.0.1.47791 and earlier.
- CVE-2019-5715All versions of SilverStripe 3 prior to 3.6.7 and 3.7.3, and all versions of SilverStripe 4 prior to 4.0.7, 4.1.5, 4.2.4, and 4.3.1 allows Rsilverstripe/framework
- CVE-2019-9976The Boa server configuration on DASAN H660RM devices with firmware 1.03-0022 logs POST data to the /tmp/boa-temp file, which allows logged-i
- CVE-2019-9975DASAN H660RM devices with firmware 1.03-0022 use a hard-coded key for logs encryption.
- CVE-2019-9974diag_tool.cgi on DASAN H660RM GPON routers with firmware 1.03-0022 lacks any authorization check, which allows remote attackers to run a pin
- CVE-2019-6610On BIG-IP versions 14.0.0-14.0.0.4, 13.0.0-13.1.1.1, 12.1.0-12.1.4, 11.6.0-11.6.3.4, and 11.5.1-11.5.8, the system is vulnerable to a denialF5 BIG-IP
- CVE-2019-5673NVIDIA Jetson TX2 contains a vulnerability in the kernel driver (on all versions prior to R28.3) where the ARM System Memory Management UnitNVIDIA Jetson TX2
- CVE-2019-5672NVIDIA Jetson TX1 and TX2 contain a vulnerability in the Linux for Tegra (L4T) operating system (on all versions prior to R28.3) where the SNVIDIA Jetson TX1 and TX2
- CVE-2018-17305UiPath Orchestrator through 2018.2.4 allows any authenticated user to change the information of arbitrary users (even administrators) leadin
- CVE-2019-3460A heap data infoleak in multiple locations including L2CAP_PARSE_CONF_RSP was found in the Linux kernel before 5.1-rc1.Linux
- CVE-2019-3459A heap address information leak while using L2CAP_GET_CONF_OPT was discovered in the Linux kernel before 5.1-rc1.Linux
- CVE-2018-19300On D-Link DAP-1530 (A1) before firmware version 1.06b01, DAP-1610 (A1) before firmware version 1.06b01, DWR-111 (A1) before firmware version
- CVE-2019-6318HP LaserJet Enterprise printers, HP PageWide Enterprise printers, HP LaserJet Managed printers, HP Officejet Enterprise printers have an insHP LaserJet Enterprise printers, HP PageWide Enterprise pri…
- CVE-2019-3837It was found that the net_dma code in tcp_recvmsg() in the 2.6.32 kernel as shipped in RHEL6 is thread-unsafe.The Linux Foundation kernel
- CVE-2019-3916Information disclosure vulnerability in Verizon Fios Quantum Gateway (G1100) firmware version 02.01.00.05 allows an remote, unauthenticated Verizon Fios Quantum Gateway
- CVE-2019-3915Authentication Bypass by Capture-replay vulnerability in Verizon Fios Quantum Gateway (G1100) firmware version 02.01.00.05 allows an unautheVerizon Fios Quantum Gateway
- CVE-2019-3914Remote command injection vulnerability in Verizon Fios Quantum Gateway (G1100) firmware version 02.01.00.05 allows a remote, authenticated aVerizon Fios Quantum Gateway
- CVE-2019-11078MKCMS V5.0 has a CSRF vulnerability to add a new admin user via the ucenter/userinfo.php URI.
- CVE-2019-11077FastAdmin V1.0.0.20190111_beta has a CSRF vulnerability to add a new admin user via the admin/auth/admin/add?dialog=1 URI.