# CVEs published 2019-04-17

71 CVEs were published on April 17, 2019: 4 critical, 13 high. Days are UTC.

- [CVE-2019-1712](https://cve.now/CVE-2019-1712.md): Cisco IOS XR Software Protocol Independent Multicast Denial of Service Vulnerability (CVSS 5.8, Cisco IOS XR Software)
- [CVE-2019-1718](https://cve.now/CVE-2019-1718.md): Cisco Identity Services Engine SSL Renegotiation Denial of Service Vulnerability (CVSS 5.3, Cisco Identity Services Engine Software)
- [CVE-2019-1711](https://cve.now/CVE-2019-1711.md): Cisco IOS XR gRPC Software Denial of Service Vulnerability (CVSS 5.3, Cisco IOS XR Software)
- [CVE-2019-1686](https://cve.now/CVE-2019-1686.md): Cisco ASR 9000 Series Aggregation Services Routers ACL Bypass Vulnerability (CVSS 5.8, Cisco IOS XR Software)
- [CVE-2019-1710](https://cve.now/CVE-2019-1710.md): Cisco IOS XR 64-Bit Software for Cisco ASR 9000 Series Aggregation Services Routers Network Isolation Vulnerability (CVSS 9.8, Cisco IOS XR Software)
- [CVE-2019-1654](https://cve.now/CVE-2019-1654.md): Cisco Aironet Series Access Points Development Shell Access Vulnerability (CVSS 7.8, Cisco Aironet Access Point Software)
- [CVE-2018-0382](https://cve.now/CVE-2018-0382.md): Cisco Wireless LAN Controller Software Session Hijacking Vulnerability (CVSS 5.3, Cisco Wireless LAN Controller)
- [CVE-2018-0248](https://cve.now/CVE-2018-0248.md): Cisco Wireless LAN Controller Software GUI Configuration Denial of Service Vulnerabilities (CVSS 6.8, Cisco Wireless LAN Controller)
- [CVE-2018-20028](https://cve.now/CVE-2018-20028.md): Contao 3.x before 3.5.37, 4.4.x before 4.4.31 and 4.6.x before 4.6.11 has Incorrect Access Control. (no CVSS, contao/contao)
- [CVE-2019-10642](https://cve.now/CVE-2019-10642.md): Contao 4.7 allows CSRF. (no CVSS, contao/contao · contao/core-bundle)
- [CVE-2019-10643](https://cve.now/CVE-2019-10643.md): Contao 4.7 allows Use of a Key Past its Expiration Date. (no CVSS, contao/contao · contao/core-bundle)
- [CVE-2019-10641](https://cve.now/CVE-2019-10641.md): Contao before 3.5.39 and 4.x before 4.7.3 has a Weak Password Recovery Mechanism for a Forgotten Password. (no CVSS, contao/contao · contao/core-bundle +1)
- [CVE-2019-0163](https://cve.now/CVE-2019-0163.md): Insufficient input validation in system firmware for Intel(R) Broadwell U i5 vPro before version MYBDWi5v.86A may allow an authenticated use (no CVSS, Intel(R) NUC Advisory)
- [CVE-2019-0162](https://cve.now/CVE-2019-0162.md): Memory access in virtual memory mapping for some microprocessors may allow an authenticated user to potentially enable information disclosur (no CVSS, Microprocessor Memory Mapping Advisory)
- [CVE-2019-0158](https://cve.now/CVE-2019-0158.md): Insufficient path checking in the installation package for Intel(R) Graphics Performance Analyzer for Linux version 18.4 and before may allo (no CVSS, Intel(R) Graphics Performance Analyzer for Linux Advisory)
- [CVE-2018-18094](https://cve.now/CVE-2018-18094.md): Improper directory permissions in installer for Intel(R) Media SDK before 2018 R2.1 may allow an authenticated user to potentially enable es (no CVSS, Intel(R) Media SDK Advisory)
- [CVE-2019-9220](https://cve.now/CVE-2019-9220.md): An issue was discovered in GitLab Community and Enterprise Edition before 11.6.10, 11.7.x before 11.7.6, and 11.8.x before 11.8.1. (no CVSS)
- [CVE-2019-9223](https://cve.now/CVE-2019-9223.md): An issue was discovered in GitLab Community and Enterprise Edition before 11.6.10, 11.7.x before 11.7.6, and 11.8.x before 11.8.1. (no CVSS)
- [CVE-2019-9222](https://cve.now/CVE-2019-9222.md): An issue was discovered in GitLab Community and Enterprise Edition before 11.6.10, 11.7.x before 11.7.6, and 11.8.x before 11.8.1. (no CVSS)
- [CVE-2019-9217](https://cve.now/CVE-2019-9217.md): An issue was discovered in GitLab Community and Enterprise Edition before 11.6.10, 11.7.x before 11.7.6, and 11.8.x before 11.8.1. (no CVSS)
- [CVE-2019-9219](https://cve.now/CVE-2019-9219.md): An issue was discovered in GitLab Community and Enterprise Edition before 11.6.10, 11.7.x before 11.7.6, and 11.8.x before 11.8.1. (no CVSS)
- [CVE-2019-9225](https://cve.now/CVE-2019-9225.md): An issue was discovered in GitLab Community and Enterprise Edition before 11.6.10, 11.7.x before 11.7.6, and 11.8.x before 11.8.1. (no CVSS)
- [CVE-2019-9224](https://cve.now/CVE-2019-9224.md): An issue was discovered in GitLab Community and Enterprise Edition before 11.6.10, 11.7.x before 11.7.6, and 11.8.x before 11.8.1. (no CVSS)
- [CVE-2019-9171](https://cve.now/CVE-2019-9171.md): An issue was discovered in GitLab Community and Enterprise Edition before 11.6.10, 11.7.x before 11.7.6, and 11.8.x before 11.8.1. (no CVSS)
- [CVE-2019-9890](https://cve.now/CVE-2019-9890.md): An issue was discovered in GitLab Community and Enterprise Edition 10.x and 11.x before 11.6.10, 11.7.x before 11.7.6, and 11.8.x before 11. (no CVSS)
- [CVE-2019-9179](https://cve.now/CVE-2019-9179.md): An issue was discovered in GitLab Community and Enterprise Edition before 11.6.10, 11.7.x before 11.7.6, and 11.8.x before 11.8.1. (no CVSS)
- [CVE-2019-9178](https://cve.now/CVE-2019-9178.md): An issue was discovered in GitLab Community and Enterprise Edition before 11.6.10, 11.7.x before 11.7.6, and 11.8.x before 11.8.1. (no CVSS)
- [CVE-2019-9175](https://cve.now/CVE-2019-9175.md): An issue was discovered in GitLab Community and Enterprise Edition before 11.6.10, 11.7.x before 11.7.6, and 11.8.x before 11.8.1. (no CVSS)
- [CVE-2019-9170](https://cve.now/CVE-2019-9170.md): An issue was discovered in GitLab Community and Enterprise Edition before 11.6.10, 11.7.x before 11.7.6, and 11.8.x before 11.8.1. (no CVSS)
- [CVE-2019-9172](https://cve.now/CVE-2019-9172.md): An issue was discovered in GitLab Community and Enterprise Edition before 11.6.10, 11.7.x before 11.7.6, and 11.8.x before 11.8.1. (no CVSS)
- [CVE-2019-9174](https://cve.now/CVE-2019-9174.md): An issue was discovered in GitLab Community and Enterprise Edition before 11.6.10, 11.7.x before 11.7.6, and 11.8.x before 11.8.1. (no CVSS)
- [CVE-2019-9176](https://cve.now/CVE-2019-9176.md): An issue was discovered in GitLab Community and Enterprise Edition before 11.6.10, 11.7.x before 11.7.6, and 11.8.x before 11.8.1. (no CVSS)
- [CVE-2019-9756](https://cve.now/CVE-2019-9756.md): An issue was discovered in GitLab Community and Enterprise Edition 10.x (starting from 10.8) and 11.x before 11.6.10, 11.7.x before 11.7.6, (no CVSS)
- [CVE-2018-13378](https://cve.now/CVE-2018-13378.md): An information disclosure vulnerability in Fortinet FortiSIEM 5.2.0 and below versions exposes the LDAP server plaintext password via the HT (no CVSS, Fortinet FortiSIEM)
- [CVE-2018-4006](https://cve.now/CVE-2018-4006.md): An exploitable privilege escalation vulnerability exists in the Shimo VPN 4.1.5.1 helper service in the writeConfig functionality. (CVSS 9.3, Shimo VPN)
- [CVE-2018-10959](https://cve.now/CVE-2018-10959.md): Avecto Defendpoint 4 prior to 4.4 SR6 and 5 prior to 5.1 SR1 has an Untrusted Search Path vulnerability, exploitable by modifying environmen (no CVSS)
- [CVE-2018-4004](https://cve.now/CVE-2018-4004.md): An exploitable privilege escalation vulnerability exists in the Shimo VPN 4.1.5.1 helper service in the disconnectService functionality. (CVSS 7.1, Shimo VPN)
- [CVE-2018-4005](https://cve.now/CVE-2018-4005.md): An exploitable privilege escalation vulnerability exists in the Shimo VPN 4.1.5.1 helper service in the configureRoutingWithCommand function (CVSS 9.3, Shimo VPN)
- [CVE-2018-4007](https://cve.now/CVE-2018-4007.md): An exploitable privilege escalation vulnerability exists in the Shimo VPN 4.1.5.1 helper service in the deleteConfig functionality. (CVSS 9.0, Shimo VPN)
- [CVE-2019-0228](https://cve.now/CVE-2019-0228.md): Apache PDFBox 2.0.14 does not properly initialize the XML parser, which allows context-dependent attackers to conduct XML External Entity (X (no CVSS, Apache PDFBox · org.apache.pdfbox:pdfbox)
- [CVE-2019-8453](https://cve.now/CVE-2019-8453.md): Some of the DLLs loaded by Check Point ZoneAlarm up to 15.4.062 are taken from directories where all users have write permissions. (no CVSS, Check Point ZoneAlarm)
- [CVE-2019-8455](https://cve.now/CVE-2019-8455.md): A hard-link created from the log file of Check Point ZoneAlarm up to 15.4.062 to any file on the system will get its permission changed so t (no CVSS, Check Point ZoneAlarm)
- [CVE-2019-10947](https://cve.now/CVE-2019-10947.md): Delta Industrial Automation CNCSoft, CNCSoft ScreenEditor Version 1.00.88 and prior. (no CVSS, Delta Industrial Automation CNCSoft)
- [CVE-2019-10951](https://cve.now/CVE-2019-10951.md): Delta Industrial Automation CNCSoft, CNCSoft ScreenEditor Version 1.00.88 and prior. (no CVSS, Delta Industrial Automation CNCSoft)
- [CVE-2019-10949](https://cve.now/CVE-2019-10949.md): Delta Industrial Automation CNCSoft, CNCSoft ScreenEditor Version 1.00.88 and prior. (no CVSS, Delta Industrial Automation CNCSoft)
- [CVE-2019-10953](https://cve.now/CVE-2019-10953.md): ABB, Phoenix Contact, Schneider Electric, Siemens, WAGO - Programmable Logic Controllers, multiple versions. (CVSS 7.5, ABB 1SAP120600R0071 PM554-TP-ETH · Phoenix Contact 2700… +10)
- [CVE-2018-7340](https://cve.now/CVE-2018-7340.md): Multiple SAML libraries may allow authentication bypass via incorrect XML canonicalization and DOM traversal (CVSS 7.7, Duo Security Duo Network Gateway)
- [CVE-2017-11430](https://cve.now/CVE-2017-11430.md): Multiple SAML libraries may allow authentication bypass via incorrect XML canonicalization and DOM traversal (CVSS 7.7, OmniAuth OmnitAuth-SAML · omniauth-saml)
- [CVE-2017-11429](https://cve.now/CVE-2017-11429.md): Multiple SAML libraries may allow authentication bypass via incorrect XML canonicalization and DOM traversal (CVSS 7.7, Clever saml2-js · saml2-js)
- [CVE-2017-11428](https://cve.now/CVE-2017-11428.md): Multiple SAML libraries may allow authentication bypass via incorrect XML canonicalization and DOM traversal (CVSS 7.7, OneLogin Ruby-SAML · ruby-saml)
- [CVE-2017-11427](https://cve.now/CVE-2017-11427.md): Multiple SAML libraries may allow authentication bypass via incorrect XML canonicalization and DOM traversal (CVSS 7.7, OneLogin PythonSAML · python-saml)
- [CVE-2019-6568](https://cve.now/CVE-2019-6568.md): The webserver of the affected devices contains a vulnerability that may lead to a denial of service condition. (CVSS 7.5, Siemens SIMATIC CP · Siemens SIMATIC ET 200pro IM154-8… +82)
- [CVE-2019-6570](https://cve.now/CVE-2019-6570.md): A vulnerability has been identified in SINEMA Remote Connect Server (All versions \< V2.0). (no CVSS, Siemens SINEMA Remote Connect Server)
- [CVE-2019-6575](https://cve.now/CVE-2019-6575.md): A vulnerability has been identified in SIMATIC CP 443-1 OPC UA (All versions), SIMATIC ET 200SP Open Controller CPU 1515SP PC2 (incl. (CVSS 7.5, Siemens SIMATIC CP 443-1 OPC UA · Siemens SIMATIC ET 20… +15)
- [CVE-2019-6579](https://cve.now/CVE-2019-6579.md): A vulnerability has been identified in Spectrum Power 4 (with Web Office Portal). (no CVSS, Siemens AG Spectrum Power™)
- [CVE-2018-13808](https://cve.now/CVE-2018-13808.md): A vulnerability has been identified in CP 1604 (All versions), CP 1616 (All versions). (no CVSS, Siemens CP)
- [CVE-2018-13809](https://cve.now/CVE-2018-13809.md): A vulnerability has been identified in CP 1604 (All versions), CP 1616 (All versions). (no CVSS, Siemens CP)
- [CVE-2018-13810](https://cve.now/CVE-2018-13810.md): A vulnerability has been identified in CP 1604 (All versions), CP 1616 (All versions). (no CVSS, Siemens CP)
- [CVE-2018-16558](https://cve.now/CVE-2018-16558.md): A vulnerability has been identified in SIMATIC S7-1500 CPU (All versions \>= V2.0 and \< V2.5), SIMATIC S7-1500 CPU (All versions \<= V1.8.5). (no CVSS, Siemens SIMATIC S7-1500 CPU)
- [CVE-2018-16559](https://cve.now/CVE-2018-16559.md): A vulnerability has been identified in SIMATIC S7-1500 CPU (All versions \>= V2.0 and \< V2.5), SIMATIC S7-1500 CPU (All versions \<= V1.8.5). (no CVSS, Siemens SIMATIC S7-1500 CPU)
- [CVE-2018-16561](https://cve.now/CVE-2018-16561.md): A vulnerability has been identified in SIMATIC S7-300 CPUs (All versions \< V3.X.16). (CVSS 7.5, Siemens SIMATIC S7-300 CPUs)
- [CVE-2019-3798](https://cve.now/CVE-2019-3798.md): Escalation of Privileges in Cloud Controller (CVSS 6.0, Cloud Foundry CAPI-release)
- [CVE-2019-3709](https://cve.now/CVE-2019-3709.md): Cross-Site Scripting Vulnerability while registering vCenter servers (CVSS 8.3, Dell EMC IsilonSD Management Server)
- [CVE-2019-3708](https://cve.now/CVE-2019-3708.md): Cross-Site Scripting Vulnerability in OVA file upload feature (CVSS 8.3, Dell EMC IsilonSD Management Server)
- [CVE-2019-9494](https://cve.now/CVE-2019-9494.md): The implementations of SAE in hostapd and wpa\_supplicant are vulnerable to side-channel attacks (no CVSS, Wi-Fi Alliance hostapd with SAE support · Wi-Fi Alliance wp…)
- [CVE-2019-9495](https://cve.now/CVE-2019-9495.md): The implementations of EAP-PWD in hostapd and wpa\_supplicant are vulnerable to side-channel attacks as a result of cache access patterns (no CVSS, Wi-Fi Alliance hostapd with EAP-pwd support · Wi-Fi Allianc…)
- [CVE-2019-9496](https://cve.now/CVE-2019-9496.md): An invalid authentication sequence could result in the hostapd process terminating due to missing state validation steps (no CVSS, Wi-Fi Alliance hostapd with SAE support · Wi-Fi Alliance wp…)
- [CVE-2019-9497](https://cve.now/CVE-2019-9497.md): The implementations of EAP-PWD in hostapd EAP Server and wpa\_supplicant EAP Peer do not validate the scalar and element values in EAP-pwd-Commit (no CVSS, Wi-Fi Alliance hostapd with EAP-pwd support · Wi-Fi Alli… +2)
- [CVE-2019-9498](https://cve.now/CVE-2019-9498.md): The implementations of EAP-PWD in hostapd EAP Server do not validate the scalar and element values in EAP-pwd-Commit (no CVSS, Wi-Fi Alliance hostapd with EAP-pwd support · Wi-Fi Alli… +2)
- [CVE-2019-9499](https://cve.now/CVE-2019-9499.md): The implementations of EAP-PWD in wpa\_supplicant EAP Peer do not validate the scalar and element values in EAP-pwd-Commit (no CVSS, Wi-Fi Alliance hostapd with EAP-pwd support · Wi-Fi Alli… +2)
- [CVE-2019-3883](https://cve.now/CVE-2019-3883.md): In 389-ds-base up to version 1.4.1.2, requests are handled by workers threads. (CVSS 5.3, Red Hat 389-ds-base)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2019-04-17
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.