CVEs published April 18, 2019
62 CVEs were published on April 18, 2019: 0 critical, 11 high. 1 is now in CISA KEV.
- Published
- 62
- Critical
- 0
- High
- 11
- Medium
- 18
- Low
- 1
- Unrated
- 32
- Now in CISA KEV
- 1
- Fix available
- 25
Most affected products
- Cisco Wireless LAN Controller
- 6
- Cisco Aironet Access Point Software
- 4
- Cisco TelePresence Video Communication Server
- 3
- ClusterLabs pacemaker
- 3
- Dell SupportAssist Client
- 2
- Jenkins project Jenkins GitLab Plugin · org.jenkins-ci.plug…
- 2
- Jenkins project Jenkins XebiaLabs XL Deploy Plugin · com.xe…
- 2
- PHP Group PHP
- 2
- Atlassian Confluence
- 1
- BlackBerry UEM
- 1
High 11
- CVE-2019-3719Dell SupportAssist Client versions prior to 3.2.0.90 contain a remote code execution vulnerability.Dell SupportAssist Client
- CVE-2019-3718Dell SupportAssist Client versions prior to 3.2.0.90 contain an improper origin validation vulnerability.Dell SupportAssist Client
- CVE-2019-3398Confluence Server and Data Center had a path traversal vulnerability in the downloadallattachments resource.Atlassian Confluence
- CVE-2019-1840Cisco Prime Network Registrar Denial of Service VulnerabilityCisco Prime Network Registrar
- CVE-2019-1834Cisco Aironet Series Access Points Denial of Service VulnerabilityCisco Aironet Access Point Software
- CVE-2019-1797Cisco Wireless LAN Controller Software Cross-Site Request Forgery VulnerabilityCisco Wireless LAN Controller
- CVE-2019-1800Cisco Wireless LAN Controller Software IAPP Message Handling Denial of Service VulnerabilitiesCisco Wireless LAN Controller
- CVE-2019-1796Cisco Wireless LAN Controller Software IAPP Message Handling Denial of Service VulnerabilitiesCisco Wireless LAN Controller
- CVE-2019-1799Cisco Wireless LAN Controller Software IAPP Message Handling Denial of Service VulnerabilitiesCisco Wireless LAN Controller
- CVE-2019-1721Cisco Expressway Series and Cisco TelePresence Video Communication Server Denial of Service VulnerabilityCisco TelePresence Video Communication Server
- CVE-2018-16877A flaw was found in the way pacemaker's client-server authentication was implemented in versions up to and including 2.0.0.ClusterLabs pacemaker
Medium, low and unrated 51
- CVE-2019-11339The studio profile decoder in libavcodec/mpeg4videodec.c in FFmpeg 4.0 before 4.0.4 and 4.1 before 4.1.2 allows remote attackers to cause a
- CVE-2019-11338libavcodec/hevcdec.c in FFmpeg 3.4 and 4.1.2 mishandles detection of duplicate first slices, which allows remote attackers to cause a denial
- CVE-2019-11332MKCMS 5.0 allows remote attackers to take over arbitrary user accounts by posting a username and e-mail address to ucenter/repass.php, which
- CVE-2019-9161WAC on the Sangfor Sundray WLAN Controller version 3.7.4.2 and earlier has a Remote Code Execution issue allowing remote attackers to achiev
- CVE-2019-11331Network Time Protocol (NTP), as specified in RFC 5905, uses port 123 even for modes where a fixed port number is not required, which makes i
- CVE-2019-9160WAC on the Sangfor Sundray WLAN Controller version 3.7.4.2 and earlier has a backdoor account allowing a remote attacker to login to the sys
- CVE-2019-11015A vulnerability was found in the MIUI OS version 10.1.3.0 that allows a physically proximate attacker to bypass Lockscreen based authenticat
- CVE-2019-10893CentOS-WebPanel.com (aka CWP) CentOS Web Panel 0.9.8.793 (Free/Open Source Version) and 0.9.8.753 (Pro) is vulnerable to Stored/Persistent X
- CVE-2018-20200CertificatePinner.java in OkHttp 3.x through 3.12.0 allows man-in-the-middle attackers to bypass certificate pinning by changing SSLContext
- CVE-2019-11084GAuth 0.9.9 beta has stored XSS that shows a popup repeatedly and discloses cookies.
- CVE-2019-9005The Cprime Power Scripts app before 4.0.14 for Atlassian Jira allows Directory Traversal.
- CVE-2019-11017On D-Link DI-524 V2.06RU devices, multiple Stored and Reflected XSS vulnerabilities were found in the Web Configuration: /spap.htm, /smap.ht
- CVE-2018-17289An XML external entity (XXE) vulnerability in Kofax Front Office Server Administration Console version 4.1.1.11.0.5212 allows remote authent
- CVE-2018-17288Kofax Front Office Server version 4.1.1.11.0.5212 (both Thin Client and Administration Console) suffers from multiple authenticated stored X
- CVE-2018-17287In Kofax Front Office Server Administration Console 4.1.1.11.0.5212, some fields, such as passwords, are obfuscated in the front-end, but th
- CVE-2019-11223An Unrestricted File Upload Vulnerability in the SupportCandy plugin through 2.0.0 for WordPress allows remote attackers to execute arbitrar
- CVE-2019-11035Heap over-read in PHP EXIF extensionPHP Group PHP
- CVE-2019-11034Heap over-read in PHP EXIF extensionPHP Group PHP
- CVE-2019-10300A cross-site request forgery vulnerability in Jenkins GitLab Plugin 1.5.11 and earlier in the GitLabConnectionConfig#doTestConnection form vJenkins project Jenkins GitLab Plugin · org.jenkins-ci.plug…
- CVE-2019-10301A missing permission check in Jenkins GitLab Plugin 1.5.11 and earlier in the GitLabConnectionConfig#doTestConnection form validation methodJenkins project Jenkins GitLab Plugin · org.jenkins-ci.plug…
- CVE-2019-10302Jenkins jira-ext Plugin 0.8 and earlier stored credentials unencrypted in its global configuration file on the Jenkins master where they couJenkins project Jenkins jira-ext Plugin · org.jenkins-ci.pl…
- CVE-2019-10303Jenkins Azure PublisherSettings Credentials Plugin 1.2 and earlier stored credentials unencrypted in the credentials.xml file on the JenkinsJenkins project Jenkins Azure PublisherSettings Credentials…
- CVE-2019-10304A cross-site request forgery vulnerability in Jenkins XebiaLabs XL Deploy Plugin in the Credential#doValidateUserNamePassword form validatioJenkins project Jenkins XebiaLabs XL Deploy Plugin · com.xe…
- CVE-2019-10305A missing permission check in Jenkins XebiaLabs XL Deploy Plugin in the Credential#doValidateUserNamePassword form validation method allows Jenkins project Jenkins XebiaLabs XL Deploy Plugin · com.xe…
- CVE-2019-10306A sandbox bypass vulnerability in Jenkins ontrack Plugin 3.4 and earlier allowed attackers with control over ontrack DSL definitions to execJenkins project Jenkins ontrack Plugin · org.jenkins-ci.plu…
- CVE-2019-8999An XML External Entity vulnerability in the UEM Core of BlackBerry UEM version(s) earlier than 12.10.1a could allow an attacker to potentialBlackBerry UEM
- CVE-2019-11322An issue was discovered in Motorola CX2 1.01 and M2 1.01.
- CVE-2019-11321An issue was discovered in Motorola CX2 1.01 and M2 1.01.
- CVE-2019-11320In Motorola CX2 1.01 and M2 1.01, users can access the router's /priv_mgt.html web page to launch telnetd, as demonstrated by the 192.168.51
- CVE-2019-11319An issue was discovered in Motorola CX2 1.01 and M2 1.01.
- CVE-2018-17168PrinterOn Enterprise 4.1.4 contains multiple Cross Site Request Forgery (CSRF) vulnerabilities in the Administration page.
- CVE-2016-10746libvirt-domain.c in libvirt before 1.3.1 supports virDomainGetTime API calls by guest agents with an RO connection, even though an RW connec
- CVE-2019-1841Cisco DNA Center Unintended Proxy Via SWIM Import Interface VulnerabilityCisco Digital Network Architecture Center
- CVE-2019-1837Cisco Unified Communications Manager Denial of Service VulnerabilityCisco Unified Communications Manager
- CVE-2019-1831Cisco Email Security Appliance Content Filter Bypass VulnerabilityCisco Email Security Appliance
- CVE-2019-1835Cisco Aironet Series Access Points Directory Traversal VulnerabilityCisco Aironet Access Point Software
- CVE-2019-1826Cisco Aironet Series Access Points Quality of Service Denial of Service VulnerabilityCisco Aironet Access Point Software
- CVE-2019-1829Cisco Aironet Series Access Points Command Injection VulnerabilityCisco Aironet Access Point Software
- CVE-2019-1830Cisco Wireless LAN Controller Locally Significant Certificate Denial of Service VulnerabilityCisco Wireless LAN Controller
- CVE-2019-1802Cisco Firepower Management Center Persistent Cross-Site Scripting VulnerabilityCisco Firepower Management Center
- CVE-2019-1805Cisco Wireless LAN Controller Secure Shell Unauthorized Access VulnerabilityCisco Wireless LAN Controller
- CVE-2019-1794Cisco Directory Connector Search Order Hijacking VulnerabilityCisco Directory Connector
- CVE-2019-1792Cisco Umbrella Cross-Site Scripting VulnerabilityCisco Umbrella
- CVE-2019-1725Cisco UCS B-Series Blade Servers Local Management CLI Arbitrary File Creation or CLI Parameter Injection VulnerabilityCisco UCS B-Series Blade Server Software
- CVE-2019-1777Cisco Registered Envelope Service Stored Cross-Site Scripting VulnerabilityCisco Registered Envelope Service
- CVE-2019-1720Cisco Expressway Series and Cisco TelePresence Video Communication Server Denial of Service VulnerabilityCisco TelePresence Video Communication Server
- CVE-2019-1722Cisco Expressway Series and Cisco TelePresence Video Communication Server Cross-Site Request Forgery VulnerabilityCisco TelePresence Video Communication Server
- CVE-2019-1719Cisco Identity Services Engine Cross-Site Scripting VulnerabilityCisco Identity Services Engine Software
- CVE-2018-16878A flaw was found in pacemaker up to and including version 2.0.1.ClusterLabs pacemaker
- CVE-2019-11324The urllib3 library before 1.24.2 for Python mishandles certain cases where the desired set of CA certificates is different from the OS storurllib3
- CVE-2019-3885A use-after-free flaw was found in pacemaker up to and including version 2.0.1 which could result in certain sensitive information to be leaClusterLabs pacemaker