# CVEs published 2019-04-11

33 CVEs were published on April 11, 2019: 0 critical, 2 high. Days are UTC.

- [CVE-2019-11191](https://cve.now/CVE-2019-11191.md): The Linux kernel through 5.0.7, when CONFIG\_IA32\_AOUT is enabled and ia32\_aout is loaded, allows local users to bypass ASLR on setuid a.out (no CVSS)
- [CVE-2019-11190](https://cve.now/CVE-2019-11190.md): The Linux kernel before 4.8 allows local users to bypass ASLR on setuid programs (such as /bin/su) because install\_exec\_creds() is called to (no CVSS)
- [CVE-2019-6534](https://cve.now/CVE-2019-6534.md): The uncontrolled search path element vulnerability in Gemalto Sentinel UltraPro Client Library ux32w.dll Versions 1.3.0, 1.3.1, and 1.3.2 en (no CVSS, Gemalto Sentinel UltraPro)
- [CVE-2019-6525](https://cve.now/CVE-2019-6525.md): AVEVA Wonderware System Platform 2017 Update 2 and prior uses an ArchestrA network user account for authentication of system processes and i (no CVSS, AVEVA Wonderware System Platform)
- [CVE-2018-20487](https://cve.now/CVE-2018-20487.md): An issue was discovered in the firewall3 component in Inteno IOPSYS 1.0 through 3.16. (no CVSS)
- [CVE-2018-19202](https://cve.now/CVE-2018-19202.md): A reflected XSS vulnerability in index.php in MyBB 1.8.x through 1.8.19 allows remote attackers to inject JavaScript via the 'upsetting\[bbur (no CVSS)
- [CVE-2019-6796](https://cve.now/CVE-2019-6796.md): An issue was discovered in GitLab Community and Enterprise Edition before 11.5.8, 11.6.x before 11.6.6, and 11.7.x before 11.7.1. (no CVSS)
- [CVE-2019-7644](https://cve.now/CVE-2019-7644.md): Auth0 Auth0-WCF-Service-JWT before 1.0.4 leaks the expected JWT signature in an error message when it cannot successfully validate the JWT s (no CVSS, Auth0-WCF-Service-JWT)
- [CVE-2019-6493](https://cve.now/CVE-2019-6493.md): SmartDefragDriver.sys (2.0) in IObit Smart Defrag 6 never frees an executable kernel pool that is allocated with user defined bytes and size (no CVSS)
- [CVE-2019-9056](https://cve.now/CVE-2019-9056.md): An issue was discovered in CMS Made Simple 2.2.8. (no CVSS)
- [CVE-2019-9628](https://cve.now/CVE-2019-9628.md): The XMLTooling library all versions prior to V3.0.4, provided with the OpenSAML and Shibboleth Service Provider software, contains an XML pa (no CVSS)
- [CVE-2019-9733](https://cve.now/CVE-2019-9733.md): An issue was discovered in JFrog Artifactory 6.7.3. (no CVSS)
- [CVE-2019-7219](https://cve.now/CVE-2019-7219.md): Unauthenticated reflected cross-site scripting (XSS) exists in Zarafa Webapp 2.0.1.47791 and earlier. (no CVSS)
- [CVE-2019-5715](https://cve.now/CVE-2019-5715.md): All versions of SilverStripe 3 prior to 3.6.7 and 3.7.3, and all versions of SilverStripe 4 prior to 4.0.7, 4.1.5, 4.2.4, and 4.3.1 allows R (no CVSS, silverstripe/framework)
- [CVE-2019-9976](https://cve.now/CVE-2019-9976.md): The Boa server configuration on DASAN H660RM devices with firmware 1.03-0022 logs POST data to the /tmp/boa-temp file, which allows logged-i (no CVSS)
- [CVE-2019-9975](https://cve.now/CVE-2019-9975.md): DASAN H660RM devices with firmware 1.03-0022 use a hard-coded key for logs encryption. (no CVSS)
- [CVE-2019-9974](https://cve.now/CVE-2019-9974.md): diag\_tool.cgi on DASAN H660RM GPON routers with firmware 1.03-0022 lacks any authorization check, which allows remote attackers to run a pin (no CVSS)
- [CVE-2019-5024](https://cve.now/CVE-2019-5024.md): A restricted environment escape vulnerability exists in the “kiosk mode” function of Capsule Technologies SmartLinx Neuron 2 medical informa (CVSS 7.6, Capsule Technologies SmartLinx Neuron)
- [CVE-2019-6610](https://cve.now/CVE-2019-6610.md): On BIG-IP versions 14.0.0-14.0.0.4, 13.0.0-13.1.1.1, 12.1.0-12.1.4, 11.6.0-11.6.3.4, and 11.5.1-11.5.8, the system is vulnerable to a denial (no CVSS, F5 BIG-IP)
- [CVE-2019-5673](https://cve.now/CVE-2019-5673.md): NVIDIA Jetson TX2 contains a vulnerability in the kernel driver (on all versions prior to R28.3) where the ARM System Memory Management Unit (no CVSS, NVIDIA Jetson TX2)
- [CVE-2019-5672](https://cve.now/CVE-2019-5672.md): NVIDIA Jetson TX1 and TX2 contain a vulnerability in the Linux for Tegra (L4T) operating system (on all versions prior to R28.3) where the S (no CVSS, NVIDIA Jetson TX1 and TX2)
- [CVE-2018-17305](https://cve.now/CVE-2018-17305.md): UiPath Orchestrator through 2018.2.4 allows any authenticated user to change the information of arbitrary users (even administrators) leadin (no CVSS)
- [CVE-2019-3460](https://cve.now/CVE-2019-3460.md): A heap data infoleak in multiple locations including L2CAP\_PARSE\_CONF\_RSP was found in the Linux kernel before 5.1-rc1. (no CVSS, Linux)
- [CVE-2019-3459](https://cve.now/CVE-2019-3459.md): A heap address information leak while using L2CAP\_GET\_CONF\_OPT was discovered in the Linux kernel before 5.1-rc1. (no CVSS, Linux)
- [CVE-2018-19300](https://cve.now/CVE-2018-19300.md): On D-Link DAP-1530 (A1) before firmware version 1.06b01, DAP-1610 (A1) before firmware version 1.06b01, DWR-111 (A1) before firmware version (no CVSS)
- [CVE-2019-6318](https://cve.now/CVE-2019-6318.md): HP LaserJet Enterprise printers, HP PageWide Enterprise printers, HP LaserJet Managed printers, HP Officejet Enterprise printers have an ins (no CVSS, HP LaserJet Enterprise printers, HP PageWide Enterprise pri…)
- [CVE-2019-3837](https://cve.now/CVE-2019-3837.md): It was found that the net\_dma code in tcp\_recvmsg() in the 2.6.32 kernel as shipped in RHEL6 is thread-unsafe. (CVSS 6.1, The Linux Foundation kernel)
- [CVE-2019-3845](https://cve.now/CVE-2019-3845.md): A lack of access control was found in the message queues maintained by Satellite's QPID broker and used by katello-agent in versions before (CVSS 8.0, Red Hat qpid-dispatch-router)
- [CVE-2019-3916](https://cve.now/CVE-2019-3916.md): Information disclosure vulnerability in Verizon Fios Quantum Gateway (G1100) firmware version 02.01.00.05 allows an remote, unauthenticated (no CVSS, Verizon Fios Quantum Gateway)
- [CVE-2019-3915](https://cve.now/CVE-2019-3915.md): Authentication Bypass by Capture-replay vulnerability in Verizon Fios Quantum Gateway (G1100) firmware version 02.01.00.05 allows an unauthe (no CVSS, Verizon Fios Quantum Gateway)
- [CVE-2019-3914](https://cve.now/CVE-2019-3914.md): Remote command injection vulnerability in Verizon Fios Quantum Gateway (G1100) firmware version 02.01.00.05 allows a remote, authenticated a (no CVSS, Verizon Fios Quantum Gateway)
- [CVE-2019-11078](https://cve.now/CVE-2019-11078.md): MKCMS V5.0 has a CSRF vulnerability to add a new admin user via the ucenter/userinfo.php URI. (no CVSS)
- [CVE-2019-11077](https://cve.now/CVE-2019-11077.md): FastAdmin V1.0.0.20190111\_beta has a CSRF vulnerability to add a new admin user via the admin/auth/admin/add?dialog=1 URI. (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2019-04-11
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.