# CVEs published 2019-04-12

25 CVEs were published on April 12, 2019: 1 critical, 0 high. Days are UTC.

- [CVE-2017-18366](https://cve.now/CVE-2017-18366.md): Subrion CMS 4.1.5 has CSRF in blog/delete/. (no CVSS, intelliants/subrion)
- [CVE-2019-3891](https://cve.now/CVE-2019-3891.md): It was discovered that a world-readable log file belonging to Candlepin component of Red Hat Satellite 6.4 leaked the credentials of the Can (CVSS 5.5, Red Hat candlepin)
- [CVE-2019-6526](https://cve.now/CVE-2019-6526.md): Moxa IKS-G6824A series Versions 4.5 and prior, EDS-405A series Version 3.8 and prior, EDS-408A series Version 3.8 and prior, and EDS-510A se (no CVSS, Moxa IKS, EDS)
- [CVE-2017-7777](https://cve.now/CVE-2017-7777.md): Use of uninitialized memory in Graphite2 library in Firefox before 54 in graphite2::GlyphCache::Loader::read\_glyph function. (no CVSS, Mozilla Firefox)
- [CVE-2017-7776](https://cve.now/CVE-2017-7776.md): Heap-based Buffer Overflow read in Graphite2 library in Firefox before 54 in graphite2::Silf::getClassGlyph. (no CVSS, Mozilla Firefox)
- [CVE-2017-7774](https://cve.now/CVE-2017-7774.md): Out-of-bounds read in Graphite2 Library in Firefox before 54 in graphite2::Silf::readGraphite function. (no CVSS, Mozilla Firefox)
- [CVE-2017-7773](https://cve.now/CVE-2017-7773.md): Heap-based Buffer Overflow write in Graphite2 library in Firefox before 54 in lz4::decompress src/Decompressor. (no CVSS, Mozilla Firefox)
- [CVE-2017-7771](https://cve.now/CVE-2017-7771.md): Out-of-bounds read in Graphite2 Library in Firefox before 54 in graphite2::Pass::readPass function. (no CVSS, Mozilla Firefox)
- [CVE-2019-11222](https://cve.now/CVE-2019-11222.md): gf\_bin128\_parse in utils/os\_divers.c in GPAC 0.7.1 has a buffer overflow issue for the crypt feature when encountering a crafted\_drm\_file.xm (no CVSS)
- [CVE-2019-11221](https://cve.now/CVE-2019-11221.md): GPAC 0.7.1 has a buffer overflow issue in gf\_import\_message() in media\_import.c. (no CVSS)
- [CVE-2018-16259](https://cve.now/CVE-2018-16259.md): There is an XSS vulnerability in WP All Import plugin 3.4.9 for WordPress via pmxi-admin-settings large\_feed\_limit. (no CVSS)
- [CVE-2018-16258](https://cve.now/CVE-2018-16258.md): There is an XSS vulnerability in WP All Import plugin 3.4.9 for WordPress via pmxi-admin-import custom\_type. (no CVSS)
- [CVE-2018-16257](https://cve.now/CVE-2018-16257.md): There are multiple XSS vulnerabilities in WP All Import plugin 3.4.9 for WordPress via action=template. (no CVSS)
- [CVE-2017-7772](https://cve.now/CVE-2017-7772.md): Heap-based Buffer Overflow in Graphite2 library in Firefox before 54 in lz4::decompress function. (no CVSS, Mozilla Firefox)
- [CVE-2018-16256](https://cve.now/CVE-2018-16256.md): There is an XSS vulnerability in WP All Import plugin 3.4.9 for WordPress via Add Filtering Options(Add Rule). (no CVSS)
- [CVE-2018-16255](https://cve.now/CVE-2018-16255.md): There is an XSS vulnerability in WP All Import plugin 3.4.9 for WordPress via action=evaluate. (no CVSS)
- [CVE-2018-16254](https://cve.now/CVE-2018-16254.md): There is an XSS vulnerability in WP All Import plugin 3.4.9 for WordPress via action=options. (no CVSS)
- [CVE-2018-13137](https://cve.now/CVE-2018-13137.md): The Events Manager plugin 5.9.4 for WordPress has XSS via the dbem\_event\_reapproved\_email\_body parameter to the wp-admin/edit.php?post\_type= (no CVSS)
- [CVE-2019-10880](https://cve.now/CVE-2019-10880.md): Within multiple XEROX products a vulnerability allows remote command execution on the Linux system, as the "nobody" user through a crafted " (CVSS 9.8, XEROX AltaLink B8045/B8055/B8065/B8075/B8090 · XEROX Alt… +4)
- [CVE-2019-1574](https://cve.now/CVE-2019-1574.md): Cross-site scripting (XSS) vulnerability in Palo Alto Networks Expedition Migration tool 1.1.12 and earlier may allow an authenticated attac (no CVSS, Palo Alto Networks Expedition Migration Tool)
- [CVE-2018-6269](https://cve.now/CVE-2018-6269.md): NVIDIA Jetson TX2 contains a vulnerability in the kernel driver where input/output control (IOCTL) handling for user mode requests could cre (no CVSS, NVIDIA Jetson Tegra TX2)
- [CVE-2018-6239](https://cve.now/CVE-2018-6239.md): NVIDIA Jetson TX2 contains a vulnerability by means of speculative execution where local and unprivileged code may access the contents of ca (no CVSS, NVIDIA Jetson TX2)
- [CVE-2017-14199](https://cve.now/CVE-2017-14199.md): A buffer overflow has been found in the Zephyr Project's getaddrinfo() implementation in 1.9.0 and 1.10.0. (no CVSS, Zephyr getaddrinfo)
- [CVE-2019-11213](https://cve.now/CVE-2019-11213.md): In Pulse Secure Pulse Desktop Client and Network Connect, an attacker could access session tokens to replay and spoof sessions, and as a res (no CVSS)
- [CVE-2019-11196](https://cve.now/CVE-2019-11196.md): An authentication bypass vulnerability in all versions of ValuePLUS Integrated University Management System (IUMS) allows unauthenticated, r (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2019-04-12
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.