# CVEs published 2019-04-22

52 CVEs were published on April 22, 2019: 1 critical, 5 high. Days are UTC.

- [CVE-2019-8452](https://cve.now/CVE-2019-8452.md): A hard-link created from log file archive of Check Point ZoneAlarm up to 15.4.062 or Check Point Endpoint Security client for Windows before (no CVSS, Check Point ZoneAlarm)
- [CVE-2019-0218](https://cve.now/CVE-2019-0218.md): A vulnerability was discovered wherein a specially crafted URL could enable reflected XSS via JavaScript in the pony mail interface. (no CVSS, The Apache Software Foundation Apache Pony Mail)
- [CVE-2019-11383](https://cve.now/CVE-2019-11383.md): An issue was discovered in the Medha WiFi FTP Server application 1.8.3 for Android. (no CVSS)
- [CVE-2019-11384](https://cve.now/CVE-2019-11384.md): The Zalora application 6.15.1 for Android stores confidential information insecurely on the system (i.e. (no CVSS)
- [CVE-2019-5427](https://cve.now/CVE-2019-5427.md): c3p0 version \< 0.9.5.4 may be exploited by a billion laughs attack when loading XML configuration due to missing protections against recursi (no CVSS, c3p0 · com.mchange:c3p0)
- [CVE-2019-11461](https://cve.now/CVE-2019-11461.md): An issue was discovered in GNOME Nautilus 3.30 prior to 3.30.6 and 3.32 prior to 3.32.1. (no CVSS)
- [CVE-2019-11460](https://cve.now/CVE-2019-11460.md): An issue was discovered in GNOME gnome-desktop 3.26, 3.28, and 3.30 prior to 3.30.2.2, and 3.32 prior to 3.32.1.1. (no CVSS)
- [CVE-2019-11459](https://cve.now/CVE-2019-11459.md): The tiff\_document\_render() and tiff\_document\_get\_thumbnail() functions in the TIFF document backend in GNOME Evince through 3.32.0 did not h (no CVSS)
- [CVE-2019-10248](https://cve.now/CVE-2019-10248.md): Eclipse Vorto versions prior to 0.11 resolved Maven build artifacts for the Xtext project over HTTP instead of HTTPS. (no CVSS, The Eclipse Foundation Eclipse Vorto · org.eclipse.vorto:or…)
- [CVE-2019-10241](https://cve.now/CVE-2019-10241.md): In Eclipse Jetty version 9.2.26 and older, 9.3.25 and older, and 9.4.15 and older, the server is vulnerable to XSS conditions if a remote cl (no CVSS, The Eclipse Foundation Eclipse Jetty · org.eclipse.jetty:je…)
- [CVE-2019-10246](https://cve.now/CVE-2019-10246.md): In Eclipse Jetty version 9.2.27, 9.3.26, and 9.4.16, the server running on Windows is vulnerable to exposure of the fully qualified Base Res (no CVSS, The Eclipse Foundation Eclipse Jetty · org.eclipse.jetty:je…)
- [CVE-2019-10247](https://cve.now/CVE-2019-10247.md): In Eclipse Jetty version 7.x, 8.x, 9.2.27 and older, 9.3.26 and older, and 9.4.16 and older, the server running on any OS and Jetty version (no CVSS, The Eclipse Foundation Eclipse Jetty · org.eclipse.jetty:je…)
- [CVE-2019-9955](https://cve.now/CVE-2019-9955.md): On Zyxel ATP200, ATP500, ATP800, USG20-VPN, USG20W-VPN, USG40, USG40W, USG60, USG60W, USG110, USG210, USG310, USG1100, USG1900, USG2200-VPN, (no CVSS)
- [CVE-2016-1587](https://cve.now/CVE-2016-1587.md): The Snapweb interface before version 0.21.2 was exposing controls to install or remove snap packages without controlling the identity of the (CVSS 7.1, Ubuntu snapweb)
- [CVE-2016-1586](https://cve.now/CVE-2016-1586.md): A malicious webview could install long-lived unload handlers that re-use an incognito BrowserContext that is queued for destruction in versi (CVSS 1.8, Ubuntu Oxide)
- [CVE-2016-1585](https://cve.now/CVE-2016-1585.md): AppArmor mount rules grant excessive permissions (CVSS 3.9, apparmor)
- [CVE-2016-1584](https://cve.now/CVE-2016-1584.md): Unity8 converged application lifecycle allows background applications to use on-screen keyboard when not top-most (CVSS 1.6, Ubuntu Unity8)
- [CVE-2016-1579](https://cve.now/CVE-2016-1579.md): UDM doesn't check for confinement before running post-processing commands (CVSS 6.7, Ubuntu Download Manager)
- [CVE-2016-1573](https://cve.now/CVE-2016-1573.md): Using a specially crafted fallback art property, scopes can execute arbitrary QML code in context of unity8-dash (CVSS 4.8, Ubuntu Unity8)
- [CVE-2015-1343](https://cve.now/CVE-2015-1343.md): unity-scope-gdrive search feature logs search terms to syslog (CVSS 2.0, Ubuntu unity-scope-gdrive)
- [CVE-2015-1341](https://cve.now/CVE-2015-1341.md): Apport privilege escalation through Python module imports (CVSS 7.4, Ubuntu Apport)
- [CVE-2015-1340](https://cve.now/CVE-2015-1340.md): chmod race in doUidshiftIntoContainer (CVSS 7.0, Ubuntu LXD · github.com/lxc/lxd)
- [CVE-2015-1327](https://cve.now/CVE-2015-1327.md): Content-hub DBUS API doesn't prevent confined apps from passing paths to files without access (CVSS 3.9, Ubuntu Content Hub)
- [CVE-2015-1326](https://cve.now/CVE-2015-1326.md): python-dbusmock arbitrary code execution or file overwrite when templates are loaded from /tmp (CVSS 5.7, Ubuntu python-dbusmock · python-dbusmock)
- [CVE-2015-1320](https://cve.now/CVE-2015-1320.md): Probe-and-enlist for SeaMicro chassis writes password to the log (CVSS 5.5, Ubuntu MAAS)
- [CVE-2015-1316](https://cve.now/CVE-2015-1316.md): Juju Joyent provider uploads user's private ssh key by default (CVSS 6.4, Ubuntu Juju)
- [CVE-2014-1428](https://cve.now/CVE-2014-1428.md): uuid.uuid1() is not suitable as an unguessable identifier/token (CVSS 2.0, Ubuntu MAAS)
- [CVE-2014-1427](https://cve.now/CVE-2014-1427.md): MAAS API vulnerable to CSRF attack (CVSS 9.6, Ubuntu MAAS)
- [CVE-2014-1426](https://cve.now/CVE-2014-1426.md): get\_file\_by\_name does not check owner (CVSS 8.6, Ubuntu maas)
- [CVE-2011-3151](https://cve.now/CVE-2011-3151.md): SELinux initscript misuse of touch (CVSS 5.2)
- [CVE-2011-3147](https://cve.now/CVE-2011-3147.md): qcow format could expose host filesystem information (CVSS 2.8, nova)
- [CVE-2011-3145](https://cve.now/CVE-2011-3145.md): mount.ecrpytfs\_private sets group owner of /etc/mtab to user's primary group (CVSS 3.8)
- [CVE-2011-1830](https://cve.now/CVE-2011-1830.md): Ekiga attempts to dlopen /tmp/ekiga\_test.so (CVSS 5.7, Gnome Ekiga)
- [CVE-2019-11456](https://cve.now/CVE-2019-11456.md): Gila CMS 1.10.1 allows fm/save CSRF for executing arbitrary PHP code. (no CVSS)
- [CVE-2019-3902](https://cve.now/CVE-2019-3902.md): A flaw was found in Mercurial before 4.9. (CVSS 5.1, The Mercurial Project mercurial · mercurial)
- [CVE-2019-3901](https://cve.now/CVE-2019-3901.md): A race condition in perf\_event\_open() allows local attackers to leak sensitive data from setuid programs. (CVSS 5.6, The Linux Foundation kernel)
- [CVE-2019-6157](https://cve.now/CVE-2019-6157.md): In various firmware versions of Lenovo System x, the integrated management module II (IMM2)'s first failure data capture (FFDC) includes the (CVSS 6.5, Lenovo System x)
- [CVE-2019-6155](https://cve.now/CVE-2019-6155.md): A potential vulnerability was found in an SMI handler in various BIOS versions of certain legacy IBM System x and IBM BladeCenter systems th (CVSS 4.1, IBM System x BIOS · IBM BladeCenter BIOS)
- [CVE-2019-3899](https://cve.now/CVE-2019-3899.md): It was found that default configuration of Heketi does not require any authentication potentially exposing the management interface to misus (CVSS 7.3, The Heketi Project heketi)
- [CVE-2019-11455](https://cve.now/CVE-2019-11455.md): A buffer over-read in Util\_urlDecode in util.c in Tildeslash Monit before 5.25.3 allows a remote authenticated attacker to retrieve the cont (no CVSS)
- [CVE-2019-11454](https://cve.now/CVE-2019-11454.md): Persistent cross-site scripting (XSS) in http/cervlet.c in Tildeslash Monit before 5.25.3 allows a remote unauthenticated attacker to introd (no CVSS)
- [CVE-2019-11243](https://cve.now/CVE-2019-11243.md): In Kubernetes v1.12.0-v1.12.4 and v1.13.0, the rest.AnonymousClientConfig() method returns a copy of the provided config, with credentials r (CVSS 3.1, Kubernetes · k8s.io/kubernetes)
- [CVE-2019-11244](https://cve.now/CVE-2019-11244.md): kubectl creates world-writeable cached schema files (CVSS 3.3, Kubernetes · k8s.io/client-go)
- [CVE-2019-11452](https://cve.now/CVE-2019-11452.md): whatsns 4.0 allows index.php?admin\_category/remove.html cid\[\] SQL injection. (no CVSS)
- [CVE-2019-11451](https://cve.now/CVE-2019-11451.md): whatsns 4.0 allows index.php?inform/add.html qid SQL injection. (no CVSS)
- [CVE-2019-11450](https://cve.now/CVE-2019-11450.md): whatsns 4.0 allows index.php?question/ajaxadd.html title SQL injection. (no CVSS)
- [CVE-2019-11449](https://cve.now/CVE-2019-11449.md): I, Librarian 4.10 has XSS via the notes.php notes parameter. (no CVSS)
- [CVE-2019-11448](https://cve.now/CVE-2019-11448.md): An issue was discovered in Zoho ManageEngine Applications Manager 11.0 through 14.0. (no CVSS)
- [CVE-2019-11447](https://cve.now/CVE-2019-11447.md): An issue was discovered in CutePHP CuteNews 2.1.2. (no CVSS)
- [CVE-2019-11446](https://cve.now/CVE-2019-11446.md): An issue was discovered in ATutor through 2.2.4. (no CVSS)
- [CVE-2019-11445](https://cve.now/CVE-2019-11445.md): OpenKM 6.3.2 through 6.3.7 allows an attacker to upload a malicious JSP file into the /okm:root directories and move that file to the home d (no CVSS)
- [CVE-2019-11444](https://cve.now/CVE-2019-11444.md): An issue was discovered in Liferay Portal CE 7.1.2 GA3. (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2019-04-22
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.