CVEs published April 24, 2019
42 CVEs were published on April 24, 2019: 1 critical, 6 high.
- Published
- 42
- Critical
- 1
- High
- 6
- Medium
- 4
- Low
- 1
- Unrated
- 30
- Now in CISA KEV
- 0
- Fix available
- 9
Most affected products
- TIBCO Software TIBCO ActiveMatrix BPM · TIBCO Software T… +4
- 3
- TIBCO Software TIBCO ActiveMatrix BPM · TIBCO Software TIBC…
- 3
- tensorflow · tensorflow-gpu +1
- 2
- tensorflow-cpu · tensorflow +1
- 2
- Cloud Foundry BOSH Backup and Restore
- 1
- Cloud Foundry CF Routing
- 1
- github.com/seccomp/libseccomp-golang
- 1
- librenms/librenms
- 1
- Pivotal Apps Manager
- 1
- Red Hat keycloak · org.keycloak:keycloak-core
- 1
Critical 1
High 6
- CVE-2019-8993TIBCO Active Matrix Service Grid Administrator Unauthenticated Download of Sensitive FileTIBCO Software TIBCO ActiveMatrix BPM · TIBCO Software T… +4
- CVE-2019-8991TIBCO Active Matrix Service Grid Administrator With Multiple Cross-Site Scripting and Cross-Site Request Forgery VulnerabilitiesTIBCO Software TIBCO ActiveMatrix BPM · TIBCO Software T… +4
- CVE-2019-11203TIBCO ActiveMatrix BPM Cross-Site Scripting and Cross-Site Request Forgery VulnerabilitiesTIBCO Software TIBCO ActiveMatrix BPM · TIBCO Software TIBC…
- CVE-2019-3793Invitations Service supports HTTP connectionsPivotal Apps Manager
- CVE-2019-3789Gorouter allows space developer to hijack route services hosted outside the platformCloud Foundry CF Routing
- CVE-2019-3786BBR could run arbitrary scripts on deployment VMsCloud Foundry BOSH Backup and Restore
Medium, low and unrated 35
- CVE-2018-7575Google TensorFlow 1.7.x and earlier is affected by a Buffer Overflow vulnerability.tensorflow-cpu · tensorflow +1
- CVE-2019-11506In GraphicsMagick from version 1.3.30 to 1.4 snapshot-20190403 Q8, there is a heap-based buffer overflow in the function WriteMATLABImage of
- CVE-2019-11505In GraphicsMagick from version 1.3.8 to 1.4 snapshot-20190403 Q8, there is a heap-based buffer overflow in the function WritePDBImage of cod
- CVE-2019-8995TIBCO ActiveMatrix BPM Open Redirect VulnerabilityTIBCO Software TIBCO ActiveMatrix BPM · TIBCO Software TIBC…
- CVE-2019-8994TIBCO ActiveMatrix BPM Escalation of Privileges VulnerabilityTIBCO Software TIBCO ActiveMatrix BPM · TIBCO Software TIBC…
- CVE-2019-11504Zotonic before version 0.47 has mod_admin XSS.
- CVE-2018-18251Deltek Vision 7.x before 7.6 permits the execution of any attacker supplied SQL statement through a custom RPC over HTTP protocol.
- CVE-2018-20434LibreNMS 1.46 allows remote attackers to execute arbitrary OS commands by using the $_POST['community'] parameter to html/pages/addhost.inc.librenms/librenms
- CVE-2019-11503snap-confine as included in snapd before 2.39 did not guard against symlink races when performing the chdir() to the current working directo
- CVE-2019-11502snap-confine in snapd before 2.38 incorrectly set the ownership of a snap application to the uid and gid of the first calling user.
- CVE-2017-18367libseccomp-golang 0.9.0 and earlier incorrectly generates BPFs that OR multiple arguments rather than ANDing them.github.com/seccomp/libseccomp-golang
- CVE-2019-11218Improper handling of extra parameters in the AccountController (User Profile edit) in Jakub Chodounsky Bonobo Git Server before 6.5.0 allows
- CVE-2019-11217The GitController in Jakub Chodounsky Bonobo Git Server before 6.5.0 allows execution of arbitrary commands in the context of the web server
- CVE-2019-10008Zoho ManageEngine ServiceDesk 9.3 allows session hijacking and privilege escalation because an established guest session is automatically co
- CVE-2019-9951Western Digital My Cloud, My Cloud Mirror Gen2, My Cloud EX2 Ultra, My Cloud EX2100, My Cloud EX4100, My Cloud DL2100, My Cloud DL4100, My C
- CVE-2019-9950Western Digital My Cloud, My Cloud Mirror Gen2, My Cloud EX2 Ultra, My Cloud EX2100, My Cloud EX4100, My Cloud DL2100, My Cloud DL4100, My C
- CVE-2019-10691The JSON encoder in Dovecot before 2.3.5.2 allows attackers to repeatedly crash the authentication service by attempting to authenticate wit
- CVE-2019-9635NULL pointer dereference in Google TensorFlow before 1.12.2 could cause a denial of service via an invalid GIF file.tensorflow-cpu · tensorflow +1
- CVE-2018-10055Invalid memory access and/or a heap buffer overflow in the TensorFlow XLA compiler in Google TensorFlow before 1.7.1 could cause a crash or tensorflow · tensorflow-gpu +1
- CVE-2018-7577Memcpy parameter overlap in Google Snappy library 1.1.4, as used in Google TensorFlow before 1.7.1, could result in a crash or read from othtensorflow · tensorflow-gpu +1
- CVE-2019-3882A flaw was found in the Linux kernel's vfio interface implementation that permits violation of the user's locked memory limit.The Linux Foundation kernel
- CVE-2019-3868Keycloak up to version 6.0.0 allows the end user token (access or id token JWT) to be used as the session cookie for browser sessions for OIRed Hat keycloak · org.keycloak:keycloak-core
- CVE-2019-11032In EasyToRecruit (E2R) before 2.11, the upload feature and the Candidate Profile Management feature are prone to Cross Site Scripting (XSS)
- CVE-2019-9928GStreamer before 1.16.0 has a heap-based buffer overflow in the RTSP connection parser via a crafted response from a server, potentially all
- CVE-2019-7213SmarterTools SmarterMail 16.x before build 6985 allows directory traversal.
- CVE-2019-7212SmarterTools SmarterMail 16.x before build 6985 has hardcoded secret keys.
- CVE-2019-11081A default username and password in Dentsply Sirona Sidexis 4.3.1 and earlier allows an attacker to gain administrative access to the applica
- CVE-2019-7211SmarterTools SmarterMail 16.x before build 6995 has stored XSS.
- CVE-2019-10239Robotronic RunAsSpc 3.7.0.0 protects stored credentials insufficiently, which allows locally authenticated attackers (under the same user co
- CVE-2018-13443EOS.IO jit-wasm 4.1 has a heap-based buffer overflow via a crafted wast file.
- CVE-2019-9734Aquarius CMS through 4.3.5 writes POST and GET parameters (including passwords) to a log file due to an overwriting of configuration paramet
- CVE-2019-9724aquaverde Aquarius CMS through 4.3.5 allows Information Exposure through Log Files because of an error in the Log-File writer component.
- CVE-2019-11498WavpackSetConfiguration64 in pack_utils.c in libwavpack.a in WavPack through 5.1.0 has a "Conditional jump or move depends on uninitialised
- CVE-2019-11490An issue was discovered in Npcap 0.992.
- CVE-2019-7214SmarterTools SmarterMail 16.x before build 6985 allows deserialization of untrusted data.