CVEs published April 22, 2019
52 CVEs were published on April 22, 2019: 1 critical, 5 high.
- Published
- 52
- Critical
- 1
- High
- 5
- Medium
- 11
- Low
- 10
- Unrated
- 25
- Now in CISA KEV
- 0
- Fix available
- 23
Most affected products
- The Eclipse Foundation Eclipse Jetty · org.eclipse.jetty:je…
- 3
- Ubuntu MAAS
- 3
- Ubuntu Unity8
- 2
- apparmor
- 1
- c3p0 · com.mchange:c3p0
- 1
- Check Point ZoneAlarm
- 1
- Gnome Ekiga
- 1
- IBM System x BIOS · IBM BladeCenter BIOS
- 1
- Kubernetes · k8s.io/client-go
- 1
- Kubernetes · k8s.io/kubernetes
- 1
Critical 1
High 5
- CVE-2016-1587The Snapweb interface before version 0.21.2 was exposing controls to install or remove snap packages without controlling the identity of theUbuntu snapweb
- CVE-2015-1341Apport privilege escalation through Python module importsUbuntu Apport
- CVE-2015-1340chmod race in doUidshiftIntoContainerUbuntu LXD · github.com/lxc/lxd
- CVE-2014-1426get_file_by_name does not check ownerUbuntu maas
- CVE-2019-3899It was found that default configuration of Heketi does not require any authentication potentially exposing the management interface to misusThe Heketi Project heketi
Medium, low and unrated 46
- CVE-2019-8452A hard-link created from log file archive of Check Point ZoneAlarm up to 15.4.062 or Check Point Endpoint Security client for Windows beforeCheck Point ZoneAlarm
- CVE-2019-0218A vulnerability was discovered wherein a specially crafted URL could enable reflected XSS via JavaScript in the pony mail interface.The Apache Software Foundation Apache Pony Mail
- CVE-2019-11383An issue was discovered in the Medha WiFi FTP Server application 1.8.3 for Android.
- CVE-2019-11384The Zalora application 6.15.1 for Android stores confidential information insecurely on the system (i.e.
- CVE-2019-5427c3p0 version < 0.9.5.4 may be exploited by a billion laughs attack when loading XML configuration due to missing protections against recursic3p0 · com.mchange:c3p0
- CVE-2019-11461An issue was discovered in GNOME Nautilus 3.30 prior to 3.30.6 and 3.32 prior to 3.32.1.
- CVE-2019-11460An issue was discovered in GNOME gnome-desktop 3.26, 3.28, and 3.30 prior to 3.30.2.2, and 3.32 prior to 3.32.1.1.
- CVE-2019-11459The tiff_document_render() and tiff_document_get_thumbnail() functions in the TIFF document backend in GNOME Evince through 3.32.0 did not h
- CVE-2019-10248Eclipse Vorto versions prior to 0.11 resolved Maven build artifacts for the Xtext project over HTTP instead of HTTPS.The Eclipse Foundation Eclipse Vorto · org.eclipse.vorto:or…
- CVE-2019-10241In Eclipse Jetty version 9.2.26 and older, 9.3.25 and older, and 9.4.15 and older, the server is vulnerable to XSS conditions if a remote clThe Eclipse Foundation Eclipse Jetty · org.eclipse.jetty:je…
- CVE-2019-10246In Eclipse Jetty version 9.2.27, 9.3.26, and 9.4.16, the server running on Windows is vulnerable to exposure of the fully qualified Base ResThe Eclipse Foundation Eclipse Jetty · org.eclipse.jetty:je…
- CVE-2019-10247In Eclipse Jetty version 7.x, 8.x, 9.2.27 and older, 9.3.26 and older, and 9.4.16 and older, the server running on any OS and Jetty version The Eclipse Foundation Eclipse Jetty · org.eclipse.jetty:je…
- CVE-2019-9955On Zyxel ATP200, ATP500, ATP800, USG20-VPN, USG20W-VPN, USG40, USG40W, USG60, USG60W, USG110, USG210, USG310, USG1100, USG1900, USG2200-VPN,
- CVE-2016-1586A malicious webview could install long-lived unload handlers that re-use an incognito BrowserContext that is queued for destruction in versiUbuntu Oxide
- CVE-2016-1585AppArmor mount rules grant excessive permissionsapparmor
- CVE-2016-1584Unity8 converged application lifecycle allows background applications to use on-screen keyboard when not top-mostUbuntu Unity8
- CVE-2016-1579UDM doesn't check for confinement before running post-processing commandsUbuntu Download Manager
- CVE-2016-1573Using a specially crafted fallback art property, scopes can execute arbitrary QML code in context of unity8-dashUbuntu Unity8
- CVE-2015-1343unity-scope-gdrive search feature logs search terms to syslogUbuntu unity-scope-gdrive
- CVE-2015-1327Content-hub DBUS API doesn't prevent confined apps from passing paths to files without accessUbuntu Content Hub
- CVE-2015-1326python-dbusmock arbitrary code execution or file overwrite when templates are loaded from /tmpUbuntu python-dbusmock · python-dbusmock
- CVE-2015-1320Probe-and-enlist for SeaMicro chassis writes password to the logUbuntu MAAS
- CVE-2015-1316Juju Joyent provider uploads user's private ssh key by defaultUbuntu Juju
- CVE-2014-1428uuid.uuid1() is not suitable as an unguessable identifier/tokenUbuntu MAAS
- CVE-2011-3151SELinux initscript misuse of touch
- CVE-2011-3147qcow format could expose host filesystem informationnova
- CVE-2011-3145mount.ecrpytfs_private sets group owner of /etc/mtab to user's primary group
- CVE-2011-1830Ekiga attempts to dlopen /tmp/ekiga_test.soGnome Ekiga
- CVE-2019-11456Gila CMS 1.10.1 allows fm/save CSRF for executing arbitrary PHP code.
- CVE-2019-3902A flaw was found in Mercurial before 4.9.The Mercurial Project mercurial · mercurial
- CVE-2019-3901A race condition in perf_event_open() allows local attackers to leak sensitive data from setuid programs.The Linux Foundation kernel
- CVE-2019-6157In various firmware versions of Lenovo System x, the integrated management module II (IMM2)'s first failure data capture (FFDC) includes theLenovo System x
- CVE-2019-6155A potential vulnerability was found in an SMI handler in various BIOS versions of certain legacy IBM System x and IBM BladeCenter systems thIBM System x BIOS · IBM BladeCenter BIOS
- CVE-2019-11455A buffer over-read in Util_urlDecode in util.c in Tildeslash Monit before 5.25.3 allows a remote authenticated attacker to retrieve the cont
- CVE-2019-11454Persistent cross-site scripting (XSS) in http/cervlet.c in Tildeslash Monit before 5.25.3 allows a remote unauthenticated attacker to introd
- CVE-2019-11243In Kubernetes v1.12.0-v1.12.4 and v1.13.0, the rest.AnonymousClientConfig() method returns a copy of the provided config, with credentials rKubernetes · k8s.io/kubernetes
- CVE-2019-11244kubectl creates world-writeable cached schema filesKubernetes · k8s.io/client-go
- CVE-2019-11452whatsns 4.0 allows index.php?admin_category/remove.html cid[] SQL injection.
- CVE-2019-11451whatsns 4.0 allows index.php?inform/add.html qid SQL injection.
- CVE-2019-11450whatsns 4.0 allows index.php?question/ajaxadd.html title SQL injection.
- CVE-2019-11449I, Librarian 4.10 has XSS via the notes.php notes parameter.
- CVE-2019-11448An issue was discovered in Zoho ManageEngine Applications Manager 11.0 through 14.0.
- CVE-2019-11447An issue was discovered in CutePHP CuteNews 2.1.2.
- CVE-2019-11446An issue was discovered in ATutor through 2.2.4.
- CVE-2019-11445OpenKM 6.3.2 through 6.3.7 allows an attacker to upload a malicious JSP file into the /okm:root directories and move that file to the home d
- CVE-2019-11444An issue was discovered in Liferay Portal CE 7.1.2 GA3.