CVEs published April 15, 2019
22 CVEs were published on April 15, 2019: 2 critical, 2 high.
- Published
- 22
- Critical
- 2
- High
- 2
- Medium
- 3
- Low
- 0
- Unrated
- 15
- Now in CISA KEV
- 0
- Fix available
- 2
Most affected products
- VMware ESXi · VMware Workstation +1
- 3
- IBM API Connect
- 2
- Shimo VPN
- 2
- Apache Tomcat · org.apache.tomcat.embed:tomcat-embed-core
- 1
- F5 BIG-IP APM
- 1
- IBM BigFix WebUI Profile Management · IBM BigFix WebUI Soft…
- 1
- IBM Cognos Analytics
- 1
- IBM MQ
- 1
- urllib3
- 1
Critical 2
High 2
- CVE-2018-4009An exploitable privilege escalation vulnerability exists in the Shimo VPN helper service due to improper validation of code signing.Shimo VPN
- CVE-2019-4203IBM API Connect 5.0.0.0 and 5.0.8.6 Developer Portal can be exploited by app developers to download arbitrary files from the host OS and potIBM API Connect
Medium, low and unrated 18
- CVE-2018-16967There is an XSS vulnerability in the mndpsingh287 File Manager plugin 3.0 for WordPress via the page=wp_file_manager_root public_path parame
- CVE-2018-16966There is a CSRF vulnerability in the mndpsingh287 File Manager plugin 3.0 for WordPress via the page=wp_file_manager_root public_path parame
- CVE-2018-18019XSS exists in the Tribulant Slideshow Gallery plugin 1.6.8 for WordPress via the wp-admin/admin.php?page=slideshow-slides&method=save Slide[
- CVE-2018-18018SQL Injection exists in the Tribulant Slideshow Gallery plugin 1.6.8 for WordPress via the wp-admin/admin.php?page=slideshow-galleries&metho
- CVE-2018-18017XSS exists in the Tribulant Slideshow Gallery plugin 1.6.8 for WordPress via the wp-admin/admin.php?page=slideshow-galleries&method=save Gal
- CVE-2018-17586The WP Fastest Cache plugin 0.8.8.5 for WordPress has XSS via the rules[0][content] parameter in a wpfc_save_timeout_pages action.
- CVE-2018-17585The WP Fastest Cache plugin 0.8.8.5 for WordPress has XSS via the wpfastestcacheoptions wpFastestCachePreload_number or wpFastestCacheLangua
- CVE-2018-17584The WP Fastest Cache plugin 0.8.8.5 for WordPress has CSRF via the wp-admin/admin.php wpfastestcacheoptions page.
- CVE-2018-17583The WP Fastest Cache plugin 0.8.8.5 for WordPress has XSS via the rules[0][content] parameter in a wpfc_save_exclude_pages action.
- CVE-2019-5517VMware ESXi (6.7 before ESXi670-201904101-SG and 6.5 before ESXi650-201903001), Workstation (15.x before 15.0.3 and 14.x before 14.1.6), FusVMware ESXi · VMware Workstation +1
- CVE-2019-5520VMware ESXi (6.7 before ESXi670-201904101-SG and 6.5 before ESXi650-201903001), Workstation (15.x before 15.0.3 and 14.x before 14.1.6), FusVMware ESXi · VMware Workstation +1
- CVE-2019-5516VMware ESXi (6.7 before ESXi670-201904101-SG and 6.5 before ESXi650-201903001), Workstation (15.x before 15.0.3 and 14.x before 14.1.6), FusVMware ESXi · VMware Workstation +1
- CVE-2019-4178IBM Cognos Analytics 11 could allow a remote attacker to traverse directories on the system.IBM Cognos Analytics
- CVE-2019-4012IBM BigFix WebUI Profile Management 6 and Software Distribution 23 is vulnerable to SQL injection.IBM BigFix WebUI Profile Management · IBM BigFix WebUI Soft…
- CVE-2018-1925IBM WebShere MQ 9.1.0.0, 9.1.0.1, 9.1.1 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly seIBM MQ
- CVE-2019-6609Platform dependent weakness.F5 BIG-IP APM
- CVE-2019-0232When running on Windows with enableCmdLineArguments enabled, the CGI Servlet in Apache Tomcat 9.0.0.M1 to 9.0.17, 8.5.0 to 8.5.39 and 7.0.0 Apache Tomcat · org.apache.tomcat.embed:tomcat-embed-core
- CVE-2019-11236In the urllib3 library through 1.24.1 for Python, CRLF injection is possible if the attacker controls the request parameter.urllib3