# CVEs published 2019-04-15

22 CVEs were published on April 15, 2019: 2 critical, 2 high. Days are UTC.

- [CVE-2018-16967](https://cve.now/CVE-2018-16967.md): There is an XSS vulnerability in the mndpsingh287 File Manager plugin 3.0 for WordPress via the page=wp\_file\_manager\_root public\_path parame (no CVSS)
- [CVE-2018-16966](https://cve.now/CVE-2018-16966.md): There is a CSRF vulnerability in the mndpsingh287 File Manager plugin 3.0 for WordPress via the page=wp\_file\_manager\_root public\_path parame (no CVSS)
- [CVE-2018-18019](https://cve.now/CVE-2018-18019.md): XSS exists in the Tribulant Slideshow Gallery plugin 1.6.8 for WordPress via the wp-admin/admin.php?page=slideshow-slides&method=save Slide\[ (no CVSS)
- [CVE-2018-18018](https://cve.now/CVE-2018-18018.md): SQL Injection exists in the Tribulant Slideshow Gallery plugin 1.6.8 for WordPress via the wp-admin/admin.php?page=slideshow-galleries&metho (no CVSS)
- [CVE-2018-18017](https://cve.now/CVE-2018-18017.md): XSS exists in the Tribulant Slideshow Gallery plugin 1.6.8 for WordPress via the wp-admin/admin.php?page=slideshow-galleries&method=save Gal (no CVSS)
- [CVE-2018-4008](https://cve.now/CVE-2018-4008.md): An exploitable privilege escalation vulnerability exists in the Shimo VPN 4.1.5.1 helper service in the RunVpncScript command. (CVSS 9.3, Shimo VPN)
- [CVE-2018-4009](https://cve.now/CVE-2018-4009.md): An exploitable privilege escalation vulnerability exists in the Shimo VPN helper service due to improper validation of code signing. (CVSS 8.8, Shimo VPN)
- [CVE-2018-17586](https://cve.now/CVE-2018-17586.md): The WP Fastest Cache plugin 0.8.8.5 for WordPress has XSS via the rules\[0\]\[content\] parameter in a wpfc\_save\_timeout\_pages action. (no CVSS)
- [CVE-2018-17585](https://cve.now/CVE-2018-17585.md): The WP Fastest Cache plugin 0.8.8.5 for WordPress has XSS via the wpfastestcacheoptions wpFastestCachePreload\_number or wpFastestCacheLangua (no CVSS)
- [CVE-2018-17584](https://cve.now/CVE-2018-17584.md): The WP Fastest Cache plugin 0.8.8.5 for WordPress has CSRF via the wp-admin/admin.php wpfastestcacheoptions page. (no CVSS)
- [CVE-2018-17583](https://cve.now/CVE-2018-17583.md): The WP Fastest Cache plugin 0.8.8.5 for WordPress has XSS via the rules\[0\]\[content\] parameter in a wpfc\_save\_exclude\_pages action. (no CVSS)
- [CVE-2019-5517](https://cve.now/CVE-2019-5517.md): VMware ESXi (6.7 before ESXi670-201904101-SG and 6.5 before ESXi650-201903001), Workstation (15.x before 15.0.3 and 14.x before 14.1.6), Fus (no CVSS, VMware ESXi · VMware Workstation +1)
- [CVE-2019-5520](https://cve.now/CVE-2019-5520.md): VMware ESXi (6.7 before ESXi670-201904101-SG and 6.5 before ESXi650-201903001), Workstation (15.x before 15.0.3 and 14.x before 14.1.6), Fus (no CVSS, VMware ESXi · VMware Workstation +1)
- [CVE-2019-5516](https://cve.now/CVE-2019-5516.md): VMware ESXi (6.7 before ESXi670-201904101-SG and 6.5 before ESXi650-201903001), Workstation (15.x before 15.0.3 and 14.x before 14.1.6), Fus (no CVSS, VMware ESXi · VMware Workstation +1)
- [CVE-2019-4203](https://cve.now/CVE-2019-4203.md): IBM API Connect 5.0.0.0 and 5.0.8.6 Developer Portal can be exploited by app developers to download arbitrary files from the host OS and pot (CVSS 8.9, IBM API Connect)
- [CVE-2019-4202](https://cve.now/CVE-2019-4202.md): IBM API Connect 5.0.0.0 and 5.0.8.6 Developer Portal is vulnerable to command injection. (CVSS 10.0, IBM API Connect)
- [CVE-2019-4178](https://cve.now/CVE-2019-4178.md): IBM Cognos Analytics 11 could allow a remote attacker to traverse directories on the system. (CVSS 6.4, IBM Cognos Analytics)
- [CVE-2019-4012](https://cve.now/CVE-2019-4012.md): IBM BigFix WebUI Profile Management 6 and Software Distribution 23 is vulnerable to SQL injection. (CVSS 6.3, IBM BigFix WebUI Profile Management · IBM BigFix WebUI Soft…)
- [CVE-2018-1925](https://cve.now/CVE-2018-1925.md): IBM WebShere MQ 9.1.0.0, 9.1.0.1, 9.1.1 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly se (CVSS 5.9, IBM MQ)
- [CVE-2019-6609](https://cve.now/CVE-2019-6609.md): Platform dependent weakness. (no CVSS, F5 BIG-IP APM)
- [CVE-2019-0232](https://cve.now/CVE-2019-0232.md): When running on Windows with enableCmdLineArguments enabled, the CGI Servlet in Apache Tomcat 9.0.0.M1 to 9.0.17, 8.5.0 to 8.5.39 and 7.0.0 (no CVSS, Apache Tomcat · org.apache.tomcat.embed:tomcat-embed-core)
- [CVE-2019-11236](https://cve.now/CVE-2019-11236.md): In the urllib3 library through 1.24.1 for Python, CRLF injection is possible if the attacker controls the request parameter. (no CVSS, urllib3)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2019-04-15
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.