# CVEs published 2019-04-18

62 CVEs were published on April 18, 2019: 0 critical, 11 high. 1 is now in CISA KEV. Days are UTC.

- [CVE-2019-11339](https://cve.now/CVE-2019-11339.md): The studio profile decoder in libavcodec/mpeg4videodec.c in FFmpeg 4.0 before 4.0.4 and 4.1 before 4.1.2 allows remote attackers to cause a (no CVSS)
- [CVE-2019-11338](https://cve.now/CVE-2019-11338.md): libavcodec/hevcdec.c in FFmpeg 3.4 and 4.1.2 mishandles detection of duplicate first slices, which allows remote attackers to cause a denial (no CVSS)
- [CVE-2019-11332](https://cve.now/CVE-2019-11332.md): MKCMS 5.0 allows remote attackers to take over arbitrary user accounts by posting a username and e-mail address to ucenter/repass.php, which (no CVSS)
- [CVE-2019-9161](https://cve.now/CVE-2019-9161.md): WAC on the Sangfor Sundray WLAN Controller version 3.7.4.2 and earlier has a Remote Code Execution issue allowing remote attackers to achiev (no CVSS)
- [CVE-2019-11331](https://cve.now/CVE-2019-11331.md): Network Time Protocol (NTP), as specified in RFC 5905, uses port 123 even for modes where a fixed port number is not required, which makes i (no CVSS)
- [CVE-2019-9160](https://cve.now/CVE-2019-9160.md): WAC on the Sangfor Sundray WLAN Controller version 3.7.4.2 and earlier has a backdoor account allowing a remote attacker to login to the sys (no CVSS)
- [CVE-2019-11015](https://cve.now/CVE-2019-11015.md): A vulnerability was found in the MIUI OS version 10.1.3.0 that allows a physically proximate attacker to bypass Lockscreen based authenticat (no CVSS)
- [CVE-2019-3719](https://cve.now/CVE-2019-3719.md): Dell SupportAssist Client versions prior to 3.2.0.90 contain a remote code execution vulnerability. (CVSS 7.1, Dell SupportAssist Client)
- [CVE-2019-3718](https://cve.now/CVE-2019-3718.md): Dell SupportAssist Client versions prior to 3.2.0.90 contain an improper origin validation vulnerability. (CVSS 7.6, Dell SupportAssist Client)
- [CVE-2019-10893](https://cve.now/CVE-2019-10893.md): CentOS-WebPanel.com (aka CWP) CentOS Web Panel 0.9.8.793 (Free/Open Source Version) and 0.9.8.753 (Pro) is vulnerable to Stored/Persistent X (no CVSS)
- [CVE-2018-20200](https://cve.now/CVE-2018-20200.md): CertificatePinner.java in OkHttp 3.x through 3.12.0 allows man-in-the-middle attackers to bypass certificate pinning by changing SSLContext (no CVSS)
- [CVE-2019-11084](https://cve.now/CVE-2019-11084.md): GAuth 0.9.9 beta has stored XSS that shows a popup repeatedly and discloses cookies. (no CVSS)
- [CVE-2019-9005](https://cve.now/CVE-2019-9005.md): The Cprime Power Scripts app before 4.0.14 for Atlassian Jira allows Directory Traversal. (no CVSS)
- [CVE-2019-11017](https://cve.now/CVE-2019-11017.md): On D-Link DI-524 V2.06RU devices, multiple Stored and Reflected XSS vulnerabilities were found in the Web Configuration: /spap.htm, /smap.ht (no CVSS)
- [CVE-2018-17289](https://cve.now/CVE-2018-17289.md): An XML external entity (XXE) vulnerability in Kofax Front Office Server Administration Console version 4.1.1.11.0.5212 allows remote authent (no CVSS)
- [CVE-2018-17288](https://cve.now/CVE-2018-17288.md): Kofax Front Office Server version 4.1.1.11.0.5212 (both Thin Client and Administration Console) suffers from multiple authenticated stored X (no CVSS)
- [CVE-2018-17287](https://cve.now/CVE-2018-17287.md): In Kofax Front Office Server Administration Console 4.1.1.11.0.5212, some fields, such as passwords, are obfuscated in the front-end, but th (no CVSS)
- [CVE-2019-3398](https://cve.now/CVE-2019-3398.md): Confluence Server and Data Center had a path traversal vulnerability in the downloadallattachments resource. (CVSS 8.8, KEV, Atlassian Confluence)
- [CVE-2019-11223](https://cve.now/CVE-2019-11223.md): An Unrestricted File Upload Vulnerability in the SupportCandy plugin through 2.0.0 for WordPress allows remote attackers to execute arbitrar (no CVSS)
- [CVE-2019-11035](https://cve.now/CVE-2019-11035.md): Heap over-read in PHP EXIF extension (CVSS 4.8, PHP Group PHP)
- [CVE-2019-11034](https://cve.now/CVE-2019-11034.md): Heap over-read in PHP EXIF extension (CVSS 4.8, PHP Group PHP)
- [CVE-2019-10300](https://cve.now/CVE-2019-10300.md): A cross-site request forgery vulnerability in Jenkins GitLab Plugin 1.5.11 and earlier in the GitLabConnectionConfig#doTestConnection form v (no CVSS, Jenkins project Jenkins GitLab Plugin · org.jenkins-ci.plug…)
- [CVE-2019-10301](https://cve.now/CVE-2019-10301.md): A missing permission check in Jenkins GitLab Plugin 1.5.11 and earlier in the GitLabConnectionConfig#doTestConnection form validation method (no CVSS, Jenkins project Jenkins GitLab Plugin · org.jenkins-ci.plug…)
- [CVE-2019-10302](https://cve.now/CVE-2019-10302.md): Jenkins jira-ext Plugin 0.8 and earlier stored credentials unencrypted in its global configuration file on the Jenkins master where they cou (no CVSS, Jenkins project Jenkins jira-ext Plugin · org.jenkins-ci.pl…)
- [CVE-2019-10303](https://cve.now/CVE-2019-10303.md): Jenkins Azure PublisherSettings Credentials Plugin 1.2 and earlier stored credentials unencrypted in the credentials.xml file on the Jenkins (no CVSS, Jenkins project Jenkins Azure PublisherSettings Credentials…)
- [CVE-2019-10304](https://cve.now/CVE-2019-10304.md): A cross-site request forgery vulnerability in Jenkins XebiaLabs XL Deploy Plugin in the Credential#doValidateUserNamePassword form validatio (no CVSS, Jenkins project Jenkins XebiaLabs XL Deploy Plugin · com.xe…)
- [CVE-2019-10305](https://cve.now/CVE-2019-10305.md): A missing permission check in Jenkins XebiaLabs XL Deploy Plugin in the Credential#doValidateUserNamePassword form validation method allows (no CVSS, Jenkins project Jenkins XebiaLabs XL Deploy Plugin · com.xe…)
- [CVE-2019-10306](https://cve.now/CVE-2019-10306.md): A sandbox bypass vulnerability in Jenkins ontrack Plugin 3.4 and earlier allowed attackers with control over ontrack DSL definitions to exec (no CVSS, Jenkins project Jenkins ontrack Plugin · org.jenkins-ci.plu…)
- [CVE-2019-8999](https://cve.now/CVE-2019-8999.md): An XML External Entity vulnerability in the UEM Core of BlackBerry UEM version(s) earlier than 12.10.1a could allow an attacker to potential (no CVSS, BlackBerry UEM)
- [CVE-2019-11322](https://cve.now/CVE-2019-11322.md): An issue was discovered in Motorola CX2 1.01 and M2 1.01. (no CVSS)
- [CVE-2019-11321](https://cve.now/CVE-2019-11321.md): An issue was discovered in Motorola CX2 1.01 and M2 1.01. (no CVSS)
- [CVE-2019-11320](https://cve.now/CVE-2019-11320.md): In Motorola CX2 1.01 and M2 1.01, users can access the router's /priv\_mgt.html web page to launch telnetd, as demonstrated by the 192.168.51 (no CVSS)
- [CVE-2019-11319](https://cve.now/CVE-2019-11319.md): An issue was discovered in Motorola CX2 1.01 and M2 1.01. (no CVSS)
- [CVE-2018-17168](https://cve.now/CVE-2018-17168.md): PrinterOn Enterprise 4.1.4 contains multiple Cross Site Request Forgery (CSRF) vulnerabilities in the Administration page. (no CVSS)
- [CVE-2016-10746](https://cve.now/CVE-2016-10746.md): libvirt-domain.c in libvirt before 1.3.1 supports virDomainGetTime API calls by guest agents with an RO connection, even though an RW connec (no CVSS)
- [CVE-2019-1841](https://cve.now/CVE-2019-1841.md): Cisco DNA Center Unintended Proxy Via SWIM Import Interface Vulnerability (CVSS 6.5, Cisco Digital Network Architecture Center)
- [CVE-2019-1837](https://cve.now/CVE-2019-1837.md): Cisco Unified Communications Manager Denial of Service Vulnerability (CVSS 5.3, Cisco Unified Communications Manager)
- [CVE-2019-1840](https://cve.now/CVE-2019-1840.md): Cisco Prime Network Registrar Denial of Service Vulnerability (CVSS 8.6, Cisco Prime Network Registrar)
- [CVE-2019-1831](https://cve.now/CVE-2019-1831.md): Cisco Email Security Appliance Content Filter Bypass Vulnerability (CVSS 5.8, Cisco Email Security Appliance)
- [CVE-2019-1834](https://cve.now/CVE-2019-1834.md): Cisco Aironet Series Access Points Denial of Service Vulnerability (CVSS 7.4, Cisco Aironet Access Point Software)
- [CVE-2019-1835](https://cve.now/CVE-2019-1835.md): Cisco Aironet Series Access Points Directory Traversal Vulnerability (CVSS 4.4, Cisco Aironet Access Point Software)
- [CVE-2019-1826](https://cve.now/CVE-2019-1826.md): Cisco Aironet Series Access Points Quality of Service Denial of Service Vulnerability (CVSS 6.8, Cisco Aironet Access Point Software)
- [CVE-2019-1829](https://cve.now/CVE-2019-1829.md): Cisco Aironet Series Access Points Command Injection Vulnerability (CVSS 6.7, Cisco Aironet Access Point Software)
- [CVE-2019-1830](https://cve.now/CVE-2019-1830.md): Cisco Wireless LAN Controller Locally Significant Certificate Denial of Service Vulnerability (CVSS 4.9, Cisco Wireless LAN Controller)
- [CVE-2019-1802](https://cve.now/CVE-2019-1802.md): Cisco Firepower Management Center Persistent Cross-Site Scripting Vulnerability (no CVSS, Cisco Firepower Management Center)
- [CVE-2019-1805](https://cve.now/CVE-2019-1805.md): Cisco Wireless LAN Controller Secure Shell Unauthorized Access Vulnerability (CVSS 5.4, Cisco Wireless LAN Controller)
- [CVE-2019-1797](https://cve.now/CVE-2019-1797.md): Cisco Wireless LAN Controller Software Cross-Site Request Forgery Vulnerability (CVSS 8.1, Cisco Wireless LAN Controller)
- [CVE-2019-1800](https://cve.now/CVE-2019-1800.md): Cisco Wireless LAN Controller Software IAPP Message Handling Denial of Service Vulnerabilities (CVSS 7.4, Cisco Wireless LAN Controller)
- [CVE-2019-1796](https://cve.now/CVE-2019-1796.md): Cisco Wireless LAN Controller Software IAPP Message Handling Denial of Service Vulnerabilities (CVSS 7.4, Cisco Wireless LAN Controller)
- [CVE-2019-1799](https://cve.now/CVE-2019-1799.md): Cisco Wireless LAN Controller Software IAPP Message Handling Denial of Service Vulnerabilities (CVSS 7.4, Cisco Wireless LAN Controller)
- [CVE-2019-1794](https://cve.now/CVE-2019-1794.md): Cisco Directory Connector Search Order Hijacking Vulnerability (CVSS 5.1, Cisco Directory Connector)
- [CVE-2019-1792](https://cve.now/CVE-2019-1792.md): Cisco Umbrella Cross-Site Scripting Vulnerability (CVSS 6.1, Cisco Umbrella)
- [CVE-2019-1725](https://cve.now/CVE-2019-1725.md): Cisco UCS B-Series Blade Servers Local Management CLI Arbitrary File Creation or CLI Parameter Injection Vulnerability (CVSS 5.5, Cisco UCS B-Series Blade Server Software)
- [CVE-2019-1777](https://cve.now/CVE-2019-1777.md): Cisco Registered Envelope Service Stored Cross-Site Scripting Vulnerability (CVSS 5.4, Cisco Registered Envelope Service)
- [CVE-2019-1720](https://cve.now/CVE-2019-1720.md): Cisco Expressway Series and Cisco TelePresence Video Communication Server Denial of Service Vulnerability (CVSS 6.8, Cisco TelePresence Video Communication Server)
- [CVE-2019-1721](https://cve.now/CVE-2019-1721.md): Cisco Expressway Series and Cisco TelePresence Video Communication Server Denial of Service Vulnerability (CVSS 7.7, Cisco TelePresence Video Communication Server)
- [CVE-2019-1722](https://cve.now/CVE-2019-1722.md): Cisco Expressway Series and Cisco TelePresence Video Communication Server Cross-Site Request Forgery Vulnerability (CVSS 6.5, Cisco TelePresence Video Communication Server)
- [CVE-2019-1719](https://cve.now/CVE-2019-1719.md): Cisco Identity Services Engine Cross-Site Scripting Vulnerability (CVSS 6.1, Cisco Identity Services Engine Software)
- [CVE-2018-16877](https://cve.now/CVE-2018-16877.md): A flaw was found in the way pacemaker's client-server authentication was implemented in versions up to and including 2.0.0. (CVSS 8.8, ClusterLabs pacemaker)
- [CVE-2018-16878](https://cve.now/CVE-2018-16878.md): A flaw was found in pacemaker up to and including version 2.0.1. (CVSS 6.2, ClusterLabs pacemaker)
- [CVE-2019-11324](https://cve.now/CVE-2019-11324.md): The urllib3 library before 1.24.2 for Python mishandles certain cases where the desired set of CA certificates is different from the OS stor (no CVSS, urllib3)
- [CVE-2019-3885](https://cve.now/CVE-2019-3885.md): A use-after-free flaw was found in pacemaker up to and including version 2.0.1 which could result in certain sensitive information to be lea (CVSS 3.3, ClusterLabs pacemaker)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2019-04-18
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.