CVEs published April 17, 2019
71 CVEs were published on April 17, 2019: 4 critical, 13 high.
- Published
- 71
- Critical
- 4
- High
- 13
- Medium
- 8
- Low
- 0
- Unrated
- 46
- Now in CISA KEV
- 0
- Fix available
- 19
Most affected products
- Cisco IOS XR Software
- 4
- Shimo VPN
- 4
- Delta Industrial Automation CNCSoft
- 3
- Siemens CP
- 3
- Wi-Fi Alliance hostapd with EAP-pwd support · Wi-Fi Alli… +2
- 3
- Check Point ZoneAlarm
- 2
- Cisco Wireless LAN Controller
- 2
- contao/contao · contao/core-bundle
- 2
- Dell EMC IsilonSD Management Server
- 2
- Siemens SIMATIC S7-1500 CPU
- 2
Critical 4
- CVE-2019-1710Cisco IOS XR 64-Bit Software for Cisco ASR 9000 Series Aggregation Services Routers Network Isolation VulnerabilityCisco IOS XR Software
- CVE-2018-4006An exploitable privilege escalation vulnerability exists in the Shimo VPN 4.1.5.1 helper service in the writeConfig functionality.Shimo VPN
- CVE-2018-4005An exploitable privilege escalation vulnerability exists in the Shimo VPN 4.1.5.1 helper service in the configureRoutingWithCommand functionShimo VPN
- CVE-2018-4007An exploitable privilege escalation vulnerability exists in the Shimo VPN 4.1.5.1 helper service in the deleteConfig functionality.Shimo VPN
High 13
- CVE-2019-1654Cisco Aironet Series Access Points Development Shell Access VulnerabilityCisco Aironet Access Point Software
- CVE-2018-4004An exploitable privilege escalation vulnerability exists in the Shimo VPN 4.1.5.1 helper service in the disconnectService functionality.Shimo VPN
- CVE-2019-10953ABB, Phoenix Contact, Schneider Electric, Siemens, WAGO - Programmable Logic Controllers, multiple versions.ABB 1SAP120600R0071 PM554-TP-ETH · Phoenix Contact 2700… +10
- CVE-2018-7340Multiple SAML libraries may allow authentication bypass via incorrect XML canonicalization and DOM traversalDuo Security Duo Network Gateway
- CVE-2017-11430Multiple SAML libraries may allow authentication bypass via incorrect XML canonicalization and DOM traversalOmniAuth OmnitAuth-SAML · omniauth-saml
- CVE-2017-11429Multiple SAML libraries may allow authentication bypass via incorrect XML canonicalization and DOM traversalClever saml2-js · saml2-js
- CVE-2017-11428Multiple SAML libraries may allow authentication bypass via incorrect XML canonicalization and DOM traversalOneLogin Ruby-SAML · ruby-saml
- CVE-2017-11427Multiple SAML libraries may allow authentication bypass via incorrect XML canonicalization and DOM traversalOneLogin PythonSAML · python-saml
- CVE-2019-6568The webserver of the affected devices contains a vulnerability that may lead to a denial of service condition.Siemens SIMATIC CP · Siemens SIMATIC ET 200pro IM154-8… +82
- CVE-2019-6575A vulnerability has been identified in SIMATIC CP 443-1 OPC UA (All versions), SIMATIC ET 200SP Open Controller CPU 1515SP PC2 (incl.Siemens SIMATIC CP 443-1 OPC UA · Siemens SIMATIC ET 20… +15
- CVE-2018-16561A vulnerability has been identified in SIMATIC S7-300 CPUs (All versions < V3.X.16).Siemens SIMATIC S7-300 CPUs
- CVE-2019-3709Cross-Site Scripting Vulnerability while registering vCenter serversDell EMC IsilonSD Management Server
- CVE-2019-3708Cross-Site Scripting Vulnerability in OVA file upload featureDell EMC IsilonSD Management Server
Medium, low and unrated 54
- CVE-2019-1712Cisco IOS XR Software Protocol Independent Multicast Denial of Service VulnerabilityCisco IOS XR Software
- CVE-2019-1718Cisco Identity Services Engine SSL Renegotiation Denial of Service VulnerabilityCisco Identity Services Engine Software
- CVE-2019-1711Cisco IOS XR gRPC Software Denial of Service VulnerabilityCisco IOS XR Software
- CVE-2019-1686Cisco ASR 9000 Series Aggregation Services Routers ACL Bypass VulnerabilityCisco IOS XR Software
- CVE-2018-0382Cisco Wireless LAN Controller Software Session Hijacking VulnerabilityCisco Wireless LAN Controller
- CVE-2018-0248Cisco Wireless LAN Controller Software GUI Configuration Denial of Service VulnerabilitiesCisco Wireless LAN Controller
- CVE-2018-20028Contao 3.x before 3.5.37, 4.4.x before 4.4.31 and 4.6.x before 4.6.11 has Incorrect Access Control.contao/contao
- CVE-2019-10642Contao 4.7 allows CSRF.contao/contao · contao/core-bundle
- CVE-2019-10643Contao 4.7 allows Use of a Key Past its Expiration Date.contao/contao · contao/core-bundle
- CVE-2019-10641Contao before 3.5.39 and 4.x before 4.7.3 has a Weak Password Recovery Mechanism for a Forgotten Password.contao/contao · contao/core-bundle +1
- CVE-2019-0163Insufficient input validation in system firmware for Intel(R) Broadwell U i5 vPro before version MYBDWi5v.86A may allow an authenticated useIntel(R) NUC Advisory
- CVE-2019-0162Memory access in virtual memory mapping for some microprocessors may allow an authenticated user to potentially enable information disclosurMicroprocessor Memory Mapping Advisory
- CVE-2019-0158Insufficient path checking in the installation package for Intel(R) Graphics Performance Analyzer for Linux version 18.4 and before may alloIntel(R) Graphics Performance Analyzer for Linux Advisory
- CVE-2018-18094Improper directory permissions in installer for Intel(R) Media SDK before 2018 R2.1 may allow an authenticated user to potentially enable esIntel(R) Media SDK Advisory
- CVE-2019-9220An issue was discovered in GitLab Community and Enterprise Edition before 11.6.10, 11.7.x before 11.7.6, and 11.8.x before 11.8.1.
- CVE-2019-9223An issue was discovered in GitLab Community and Enterprise Edition before 11.6.10, 11.7.x before 11.7.6, and 11.8.x before 11.8.1.
- CVE-2019-9222An issue was discovered in GitLab Community and Enterprise Edition before 11.6.10, 11.7.x before 11.7.6, and 11.8.x before 11.8.1.
- CVE-2019-9217An issue was discovered in GitLab Community and Enterprise Edition before 11.6.10, 11.7.x before 11.7.6, and 11.8.x before 11.8.1.
- CVE-2019-9219An issue was discovered in GitLab Community and Enterprise Edition before 11.6.10, 11.7.x before 11.7.6, and 11.8.x before 11.8.1.
- CVE-2019-9225An issue was discovered in GitLab Community and Enterprise Edition before 11.6.10, 11.7.x before 11.7.6, and 11.8.x before 11.8.1.
- CVE-2019-9224An issue was discovered in GitLab Community and Enterprise Edition before 11.6.10, 11.7.x before 11.7.6, and 11.8.x before 11.8.1.
- CVE-2019-9171An issue was discovered in GitLab Community and Enterprise Edition before 11.6.10, 11.7.x before 11.7.6, and 11.8.x before 11.8.1.
- CVE-2019-9890An issue was discovered in GitLab Community and Enterprise Edition 10.x and 11.x before 11.6.10, 11.7.x before 11.7.6, and 11.8.x before 11.
- CVE-2019-9179An issue was discovered in GitLab Community and Enterprise Edition before 11.6.10, 11.7.x before 11.7.6, and 11.8.x before 11.8.1.
- CVE-2019-9178An issue was discovered in GitLab Community and Enterprise Edition before 11.6.10, 11.7.x before 11.7.6, and 11.8.x before 11.8.1.
- CVE-2019-9175An issue was discovered in GitLab Community and Enterprise Edition before 11.6.10, 11.7.x before 11.7.6, and 11.8.x before 11.8.1.
- CVE-2019-9170An issue was discovered in GitLab Community and Enterprise Edition before 11.6.10, 11.7.x before 11.7.6, and 11.8.x before 11.8.1.
- CVE-2019-9172An issue was discovered in GitLab Community and Enterprise Edition before 11.6.10, 11.7.x before 11.7.6, and 11.8.x before 11.8.1.
- CVE-2019-9174An issue was discovered in GitLab Community and Enterprise Edition before 11.6.10, 11.7.x before 11.7.6, and 11.8.x before 11.8.1.
- CVE-2019-9176An issue was discovered in GitLab Community and Enterprise Edition before 11.6.10, 11.7.x before 11.7.6, and 11.8.x before 11.8.1.
- CVE-2019-9756An issue was discovered in GitLab Community and Enterprise Edition 10.x (starting from 10.8) and 11.x before 11.6.10, 11.7.x before 11.7.6,
- CVE-2018-13378An information disclosure vulnerability in Fortinet FortiSIEM 5.2.0 and below versions exposes the LDAP server plaintext password via the HTFortinet FortiSIEM
- CVE-2018-10959Avecto Defendpoint 4 prior to 4.4 SR6 and 5 prior to 5.1 SR1 has an Untrusted Search Path vulnerability, exploitable by modifying environmen
- CVE-2019-0228Apache PDFBox 2.0.14 does not properly initialize the XML parser, which allows context-dependent attackers to conduct XML External Entity (XApache PDFBox · org.apache.pdfbox:pdfbox
- CVE-2019-8453Some of the DLLs loaded by Check Point ZoneAlarm up to 15.4.062 are taken from directories where all users have write permissions.Check Point ZoneAlarm
- CVE-2019-8455A hard-link created from the log file of Check Point ZoneAlarm up to 15.4.062 to any file on the system will get its permission changed so tCheck Point ZoneAlarm
- CVE-2019-10947Delta Industrial Automation CNCSoft, CNCSoft ScreenEditor Version 1.00.88 and prior.Delta Industrial Automation CNCSoft
- CVE-2019-10951Delta Industrial Automation CNCSoft, CNCSoft ScreenEditor Version 1.00.88 and prior.Delta Industrial Automation CNCSoft
- CVE-2019-10949Delta Industrial Automation CNCSoft, CNCSoft ScreenEditor Version 1.00.88 and prior.Delta Industrial Automation CNCSoft
- CVE-2019-6570A vulnerability has been identified in SINEMA Remote Connect Server (All versions < V2.0).Siemens SINEMA Remote Connect Server
- CVE-2019-6579A vulnerability has been identified in Spectrum Power 4 (with Web Office Portal).Siemens AG Spectrum Power™
- CVE-2018-13808A vulnerability has been identified in CP 1604 (All versions), CP 1616 (All versions).Siemens CP
- CVE-2018-13809A vulnerability has been identified in CP 1604 (All versions), CP 1616 (All versions).Siemens CP
- CVE-2018-13810A vulnerability has been identified in CP 1604 (All versions), CP 1616 (All versions).Siemens CP
- CVE-2018-16558A vulnerability has been identified in SIMATIC S7-1500 CPU (All versions >= V2.0 and < V2.5), SIMATIC S7-1500 CPU (All versions <= V1.8.5).Siemens SIMATIC S7-1500 CPU
- CVE-2018-16559A vulnerability has been identified in SIMATIC S7-1500 CPU (All versions >= V2.0 and < V2.5), SIMATIC S7-1500 CPU (All versions <= V1.8.5).Siemens SIMATIC S7-1500 CPU
- CVE-2019-3798Escalation of Privileges in Cloud ControllerCloud Foundry CAPI-release
- CVE-2019-9494The implementations of SAE in hostapd and wpa_supplicant are vulnerable to side-channel attacksWi-Fi Alliance hostapd with SAE support · Wi-Fi Alliance wp…
- CVE-2019-9495The implementations of EAP-PWD in hostapd and wpa_supplicant are vulnerable to side-channel attacks as a result of cache access patternsWi-Fi Alliance hostapd with EAP-pwd support · Wi-Fi Allianc…
- CVE-2019-9496An invalid authentication sequence could result in the hostapd process terminating due to missing state validation stepsWi-Fi Alliance hostapd with SAE support · Wi-Fi Alliance wp…
- CVE-2019-9497The implementations of EAP-PWD in hostapd EAP Server and wpa_supplicant EAP Peer do not validate the scalar and element values in EAP-pwd-CommitWi-Fi Alliance hostapd with EAP-pwd support · Wi-Fi Alli… +2
- CVE-2019-9498The implementations of EAP-PWD in hostapd EAP Server do not validate the scalar and element values in EAP-pwd-CommitWi-Fi Alliance hostapd with EAP-pwd support · Wi-Fi Alli… +2
- CVE-2019-9499The implementations of EAP-PWD in wpa_supplicant EAP Peer do not validate the scalar and element values in EAP-pwd-CommitWi-Fi Alliance hostapd with EAP-pwd support · Wi-Fi Alli… +2
- CVE-2019-3883In 389-ds-base up to version 1.4.1.2, requests are handled by workers threads.Red Hat 389-ds-base