# CVEs published 2019-04-20

11 CVEs were published on April 20, 2019: 0 critical, 0 high. Days are UTC.

- [CVE-2019-11371](https://cve.now/CVE-2019-11371.md): BWA (aka Burrow-Wheeler Aligner) 0.7.17 r1198 has a Buffer Overflow via a long prefix that is mishandled in bns\_fasta2bntseq and bns\_dump at (no CVSS)
- [CVE-2019-11378](https://cve.now/CVE-2019-11378.md): An issue was discovered in ProjectSend r1053. (no CVSS)
- [CVE-2019-11377](https://cve.now/CVE-2019-11377.md): wcms/wex/finder/action.php in WCMS v0.3.2 has a Arbitrary File Upload Vulnerability via developer/finder because .php is a valid extension a (no CVSS)
- [CVE-2019-11376](https://cve.now/CVE-2019-11376.md): SOY CMS v3.0.2 allows remote attackers to execute arbitrary PHP code via a \<?php substring in the second text box. (no CVSS)
- [CVE-2019-11375](https://cve.now/CVE-2019-11375.md): Msvod v10 has a CSRF vulnerability to change user information via the admin/member/edit.html URI. (no CVSS)
- [CVE-2019-11374](https://cve.now/CVE-2019-11374.md): 74CMS v5.0.1 has a CSRF vulnerability to add a new admin user via the index.php?m=Admin&c=admin&a=add URI. (no CVSS)
- [CVE-2019-11373](https://cve.now/CVE-2019-11373.md): An out-of-bounds read in File\_\_Analyze::Get\_L8 in File\_\_Analyze\_Buffer.cpp in MediaInfoLib in MediaArea MediaInfo 18.12 leads to a crash. (no CVSS)
- [CVE-2019-11372](https://cve.now/CVE-2019-11372.md): An out-of-bounds read in MediaInfoLib::File\_\_Tags\_Helper::Synched\_Test in Tag/File\_\_Tags.cpp in MediaInfoLib in MediaArea MediaInfo 18.12 le (no CVSS)
- [CVE-2019-11366](https://cve.now/CVE-2019-11366.md): An issue was discovered in atftpd in atftp 0.7.1. (no CVSS)
- [CVE-2019-11365](https://cve.now/CVE-2019-11365.md): An issue was discovered in atftpd in atftp 0.7.1. (no CVSS)
- [CVE-2019-11362](https://cve.now/CVE-2019-11362.md): app/controllers/frontend/PostController.php in ROCBOSS V2.2.1 has SQL injection via the Post:doReward score paramter, as demonstrated by the (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2019-04-20
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.