# CVEs published 2019-04-19

29 CVEs were published on April 19, 2019: 0 critical, 1 high. Days are UTC.

- [CVE-2019-11359](https://cve.now/CVE-2019-11359.md): Cross-site scripting (XSS) vulnerability in display.php in I, Librarian 4.10 allows remote attackers to inject arbitrary web script or HTML (no CVSS)
- [CVE-2018-20817](https://cve.now/CVE-2018-20817.md): SV\_SteamAuthClient in various Activision Infinity Ward Call of Duty games before 2015-08-11 is missing a size check when reading authBlob da (no CVSS)
- [CVE-2019-11354](https://cve.now/CVE-2019-11354.md): The client in Electronic Arts (EA) Origin 10.5.36 on Windows allows template injection in the title parameter of the Origin2 URI handler. (no CVSS)
- [CVE-2019-11351](https://cve.now/CVE-2019-11351.md): TeamSpeak 3 Client before 3.2.5 allows remote code execution in the Qt framework. (no CVSS)
- [CVE-2019-11350](https://cve.now/CVE-2019-11350.md): CloudBees Jenkins Operations Center 2.150.2.3, when an expired trial license exists, allows Cleartext Password Storage and Retrieval via the (no CVSS)
- [CVE-2019-2037](https://cve.now/CVE-2019-2037.md): In l2cu\_send\_peer\_config\_rej of l2c\_utils.cc, there is a possible out-of-bound read due to an incorrect bounds check. (no CVSS, Android)
- [CVE-2019-2041](https://cve.now/CVE-2019-2041.md): In the configuration of NFC modules on certain devices, there is a possible failure to distinguish individual devices due to an insecure def (no CVSS, Android)
- [CVE-2019-2032](https://cve.now/CVE-2019-2032.md): In SetScanResponseData of ble\_advertiser\_hci\_interface.cc, there is a possible out-of-bound write due to a missing bounds check. (no CVSS, Android)
- [CVE-2019-2029](https://cve.now/CVE-2019-2029.md): In btm\_proc\_smp\_cback of tm\_ble.cc, there is a possible memory corruption due to a use after free. (no CVSS, Android)
- [CVE-2019-2040](https://cve.now/CVE-2019-2040.md): In rw\_i93\_process\_ext\_sys\_info of rw\_i93.cc, there is a possible out-of-bound read due to a missing bounds check. (no CVSS, Android)
- [CVE-2019-2039](https://cve.now/CVE-2019-2039.md): In rw\_i93\_sm\_detect\_ndef of rw\_i93.cc, there is a possible out-of-bound read due to a missing bounds check. (no CVSS, Android)
- [CVE-2019-2038](https://cve.now/CVE-2019-2038.md): In rw\_i93\_process\_sys\_info of rw\_i93.cc, there is a possible out-of-bound read due to a missing bounds check. (no CVSS, Android)
- [CVE-2019-2035](https://cve.now/CVE-2019-2035.md): In rw\_i93\_sm\_update\_ndef of rw\_i93.cc, there is a possible out-of-bound write due to a missing bounds check. (no CVSS, Android)
- [CVE-2019-2034](https://cve.now/CVE-2019-2034.md): In rw\_i93\_sm\_read\_ndef of rw\_i93.cc, there is a possible out-of-bounds write due to an integer overflow. (no CVSS, Android)
- [CVE-2019-2033](https://cve.now/CVE-2019-2033.md): In create\_hdr of dnssd\_clientstub.c, there is a possible use after free. (no CVSS, Android)
- [CVE-2019-2031](https://cve.now/CVE-2019-2031.md): In rw\_t3t\_act\_handle\_check\_ndef\_rsp of rw\_t3t.cc, there is a possible out-of-bound write due to a missing bounds check. (no CVSS, Android)
- [CVE-2019-2030](https://cve.now/CVE-2019-2030.md): In removeInterfaceAddress of NetworkController.cpp, there is a possible use after free. (no CVSS, Android)
- [CVE-2019-2028](https://cve.now/CVE-2019-2028.md): In numerous hand-crafted functions in libmpeg2, NEON registers are not preserved. (no CVSS, Android)
- [CVE-2019-2027](https://cve.now/CVE-2019-2027.md): In floor0\_inverse1 of floor0.c, there is a possible out of bounds write due to an incorrect bounds check. (no CVSS, Android)
- [CVE-2019-2026](https://cve.now/CVE-2019-2026.md): In updateAssistMenuItems of Editor.java, there is a possible escape from the Setup Wizard due to a missing permission check. (no CVSS, Android)
- [CVE-2019-9841](https://cve.now/CVE-2019-9841.md): Vesta Control Panel 0.9.8-23 allows XSS via a crafted URL. (no CVSS)
- [CVE-2019-11344](https://cve.now/CVE-2019-11344.md): data/inc/files.php in Pluck 4.7.8 allows remote attackers to execute arbitrary code by uploading a .htaccess file that specifies SetHandler (no CVSS)
- [CVE-2019-5008](https://cve.now/CVE-2019-5008.md): hw/sparc64/sun4u.c in QEMU 3.1.50 is vulnerable to a NULL pointer dereference, which allows the attacker to cause a denial of service via a (no CVSS)
- [CVE-2019-10886](https://cve.now/CVE-2019-10886.md): An incorrect access control exists in the Sony Photo Sharing Plus application in the firmware before PKG6.5629 version (for the X7500D TV an (no CVSS)
- [CVE-2019-4055](https://cve.now/CVE-2019-4055.md): IBM MQ 8.0.0.0 through 8.0.0.10, 9.0.0.0 through 9.0.0.5, and 9.1.0.0 through 9.1.1 is vulnerable to a denial of service attack within the T (CVSS 7.5, IBM MQ)
- [CVE-2018-1729](https://cve.now/CVE-2018-1729.md): IBM QRadar SIEM 7.3 discloses sensitive information to unauthorized users. (CVSS 5.3, IBM QRadar SIEM)
- [CVE-2019-10245](https://cve.now/CVE-2019-10245.md): In Eclipse OpenJ9 prior to the 0.14.0 release, the Java bytecode verifier incorrectly allows a method to execute past the end of bytecode ar (no CVSS, The Eclipse Foundation Eclipse OpenJ9)
- [CVE-2019-11340](https://cve.now/CVE-2019-11340.md): util/emailutils.py in Matrix Sydent before 1.0.2 mishandles registration restrictions that are based on e-mail domain, if the allowed\_local\_ (no CVSS, matrix-sydent)
- [CVE-2019-11358](https://cve.now/CVE-2019-11358.md): jQuery before 3.4.0, as used in Drupal, Backdrop CMS, and other products, mishandles jQuery.extend(true, {}, ...) because of Object.prototyp (no CVSS, jquery · jquery-rails +4)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2019-04-19
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.