# CVEs published 2019-04-24

42 CVEs were published on April 24, 2019: 1 critical, 6 high. Days are UTC.

- [CVE-2018-7575](https://cve.now/CVE-2018-7575.md): Google TensorFlow 1.7.x and earlier is affected by a Buffer Overflow vulnerability. (no CVSS, tensorflow-cpu · tensorflow +1)
- [CVE-2019-11506](https://cve.now/CVE-2019-11506.md): In GraphicsMagick from version 1.3.30 to 1.4 snapshot-20190403 Q8, there is a heap-based buffer overflow in the function WriteMATLABImage of (no CVSS)
- [CVE-2019-11505](https://cve.now/CVE-2019-11505.md): In GraphicsMagick from version 1.3.8 to 1.4 snapshot-20190403 Q8, there is a heap-based buffer overflow in the function WritePDBImage of cod (no CVSS)
- [CVE-2019-8995](https://cve.now/CVE-2019-8995.md): TIBCO ActiveMatrix BPM Open Redirect Vulnerability (CVSS 4.7, TIBCO Software TIBCO ActiveMatrix BPM · TIBCO Software TIBC…)
- [CVE-2019-8994](https://cve.now/CVE-2019-8994.md): TIBCO ActiveMatrix BPM Escalation of Privileges Vulnerability (CVSS 5.4, TIBCO Software TIBCO ActiveMatrix BPM · TIBCO Software TIBC…)
- [CVE-2019-8993](https://cve.now/CVE-2019-8993.md): TIBCO Active Matrix Service Grid Administrator Unauthenticated Download of Sensitive File (CVSS 8.6, TIBCO Software TIBCO ActiveMatrix BPM · TIBCO Software T… +4)
- [CVE-2019-8992](https://cve.now/CVE-2019-8992.md): TIBCO Active Matrix Service Grid Administrator Remote Code Execution (CVSS 9.9, TIBCO Software TIBCO ActiveMatrix BPM · TIBCO Software T… +4)
- [CVE-2019-8991](https://cve.now/CVE-2019-8991.md): TIBCO Active Matrix Service Grid Administrator With Multiple Cross-Site Scripting and Cross-Site Request Forgery Vulnerabilities (CVSS 8.8, TIBCO Software TIBCO ActiveMatrix BPM · TIBCO Software T… +4)
- [CVE-2019-11203](https://cve.now/CVE-2019-11203.md): TIBCO ActiveMatrix BPM Cross-Site Scripting and Cross-Site Request Forgery Vulnerabilities (CVSS 8.8, TIBCO Software TIBCO ActiveMatrix BPM · TIBCO Software TIBC…)
- [CVE-2019-11504](https://cve.now/CVE-2019-11504.md): Zotonic before version 0.47 has mod\_admin XSS. (no CVSS)
- [CVE-2018-18251](https://cve.now/CVE-2018-18251.md): Deltek Vision 7.x before 7.6 permits the execution of any attacker supplied SQL statement through a custom RPC over HTTP protocol. (no CVSS)
- [CVE-2018-20434](https://cve.now/CVE-2018-20434.md): LibreNMS 1.46 allows remote attackers to execute arbitrary OS commands by using the $\_POST\['community'\] parameter to html/pages/addhost.inc. (no CVSS, librenms/librenms)
- [CVE-2019-11503](https://cve.now/CVE-2019-11503.md): snap-confine as included in snapd before 2.39 did not guard against symlink races when performing the chdir() to the current working directo (no CVSS)
- [CVE-2019-11502](https://cve.now/CVE-2019-11502.md): snap-confine in snapd before 2.38 incorrectly set the ownership of a snap application to the uid and gid of the first calling user. (no CVSS)
- [CVE-2017-18367](https://cve.now/CVE-2017-18367.md): libseccomp-golang 0.9.0 and earlier incorrectly generates BPFs that OR multiple arguments rather than ANDing them. (no CVSS, github.com/seccomp/libseccomp-golang)
- [CVE-2019-11218](https://cve.now/CVE-2019-11218.md): Improper handling of extra parameters in the AccountController (User Profile edit) in Jakub Chodounsky Bonobo Git Server before 6.5.0 allows (no CVSS)
- [CVE-2019-11217](https://cve.now/CVE-2019-11217.md): The GitController in Jakub Chodounsky Bonobo Git Server before 6.5.0 allows execution of arbitrary commands in the context of the web server (no CVSS)
- [CVE-2019-10008](https://cve.now/CVE-2019-10008.md): Zoho ManageEngine ServiceDesk 9.3 allows session hijacking and privilege escalation because an established guest session is automatically co (no CVSS)
- [CVE-2019-9951](https://cve.now/CVE-2019-9951.md): Western Digital My Cloud, My Cloud Mirror Gen2, My Cloud EX2 Ultra, My Cloud EX2100, My Cloud EX4100, My Cloud DL2100, My Cloud DL4100, My C (no CVSS)
- [CVE-2019-9950](https://cve.now/CVE-2019-9950.md): Western Digital My Cloud, My Cloud Mirror Gen2, My Cloud EX2 Ultra, My Cloud EX2100, My Cloud EX4100, My Cloud DL2100, My Cloud DL4100, My C (no CVSS)
- [CVE-2019-10691](https://cve.now/CVE-2019-10691.md): The JSON encoder in Dovecot before 2.3.5.2 allows attackers to repeatedly crash the authentication service by attempting to authenticate wit (no CVSS)
- [CVE-2019-9635](https://cve.now/CVE-2019-9635.md): NULL pointer dereference in Google TensorFlow before 1.12.2 could cause a denial of service via an invalid GIF file. (no CVSS, tensorflow-cpu · tensorflow +1)
- [CVE-2018-10055](https://cve.now/CVE-2018-10055.md): Invalid memory access and/or a heap buffer overflow in the TensorFlow XLA compiler in Google TensorFlow before 1.7.1 could cause a crash or (no CVSS, tensorflow · tensorflow-gpu +1)
- [CVE-2018-7577](https://cve.now/CVE-2018-7577.md): Memcpy parameter overlap in Google Snappy library 1.1.4, as used in Google TensorFlow before 1.7.1, could result in a crash or read from oth (no CVSS, tensorflow · tensorflow-gpu +1)
- [CVE-2019-3882](https://cve.now/CVE-2019-3882.md): A flaw was found in the Linux kernel's vfio interface implementation that permits violation of the user's locked memory limit. (CVSS 4.7, The Linux Foundation kernel)
- [CVE-2019-3868](https://cve.now/CVE-2019-3868.md): Keycloak up to version 6.0.0 allows the end user token (access or id token JWT) to be used as the session cookie for browser sessions for OI (CVSS 3.8, Red Hat keycloak · org.keycloak:keycloak-core)
- [CVE-2019-3793](https://cve.now/CVE-2019-3793.md): Invitations Service supports HTTP connections (CVSS 8.1, Pivotal Apps Manager)
- [CVE-2019-3789](https://cve.now/CVE-2019-3789.md): Gorouter allows space developer to hijack route services hosted outside the platform (CVSS 8.8, Cloud Foundry CF Routing)
- [CVE-2019-3786](https://cve.now/CVE-2019-3786.md): BBR could run arbitrary scripts on deployment VMs (CVSS 7.7, Cloud Foundry BOSH Backup and Restore)
- [CVE-2019-11032](https://cve.now/CVE-2019-11032.md): In EasyToRecruit (E2R) before 2.11, the upload feature and the Candidate Profile Management feature are prone to Cross Site Scripting (XSS) (CVSS 6.1)
- [CVE-2019-9928](https://cve.now/CVE-2019-9928.md): GStreamer before 1.16.0 has a heap-based buffer overflow in the RTSP connection parser via a crafted response from a server, potentially all (no CVSS)
- [CVE-2019-7213](https://cve.now/CVE-2019-7213.md): SmarterTools SmarterMail 16.x before build 6985 allows directory traversal. (no CVSS)
- [CVE-2019-7212](https://cve.now/CVE-2019-7212.md): SmarterTools SmarterMail 16.x before build 6985 has hardcoded secret keys. (no CVSS)
- [CVE-2019-11081](https://cve.now/CVE-2019-11081.md): A default username and password in Dentsply Sirona Sidexis 4.3.1 and earlier allows an attacker to gain administrative access to the applica (no CVSS)
- [CVE-2019-7211](https://cve.now/CVE-2019-7211.md): SmarterTools SmarterMail 16.x before build 6995 has stored XSS. (no CVSS)
- [CVE-2019-10239](https://cve.now/CVE-2019-10239.md): Robotronic RunAsSpc 3.7.0.0 protects stored credentials insufficiently, which allows locally authenticated attackers (under the same user co (no CVSS)
- [CVE-2018-13443](https://cve.now/CVE-2018-13443.md): EOS.IO jit-wasm 4.1 has a heap-based buffer overflow via a crafted wast file. (no CVSS)
- [CVE-2019-9734](https://cve.now/CVE-2019-9734.md): Aquarius CMS through 4.3.5 writes POST and GET parameters (including passwords) to a log file due to an overwriting of configuration paramet (no CVSS)
- [CVE-2019-9724](https://cve.now/CVE-2019-9724.md): aquaverde Aquarius CMS through 4.3.5 allows Information Exposure through Log Files because of an error in the Log-File writer component. (no CVSS)
- [CVE-2019-11498](https://cve.now/CVE-2019-11498.md): WavpackSetConfiguration64 in pack\_utils.c in libwavpack.a in WavPack through 5.1.0 has a "Conditional jump or move depends on uninitialised (no CVSS)
- [CVE-2019-11490](https://cve.now/CVE-2019-11490.md): An issue was discovered in Npcap 0.992. (no CVSS)
- [CVE-2019-7214](https://cve.now/CVE-2019-7214.md): SmarterTools SmarterMail 16.x before build 6985 allows deserialization of untrusted data. (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2019-04-24
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.