CVEs published April 25, 2019
69 CVEs were published on April 25, 2019: 0 critical, 7 high.
- Published
- 69
- Critical
- 0
- High
- 7
- Medium
- 17
- Low
- 1
- Unrated
- 44
- Now in CISA KEV
- 0
- Fix available
- 7
Most affected products
- IBM Sterling B2B Integrator
- 9
- HumanTalk Co DaviewIndy
- 5
- Dell EMC Open Manage System Administrator
- 2
- IBM Content Navigator
- 2
- Cloud Foundry CredHub · Cloud Foundry UAA Release +2
- 1
- Cloud Foundry UAA Release · Pivotal Application Service
- 1
- contao/contao · contao/core-bundle +1
- 1
- flarum/flarum
- 1
- Fortinet FortiManager
- 1
- github.com/envoyproxy/envoy
- 1
High 7
- CVE-2019-3801Java Projects using HTTP to fetch dependenciesCloud Foundry CredHub · Cloud Foundry UAA Release +2
- CVE-2019-3788UAA redirect-uri allows wildcard in the subdomainCloud Foundry UAA Release · Pivotal Application Service
- CVE-2019-9139DaviewIndy 8.98.7 and earlier versions have a Integer overflow vulnerability, triggered when the user opens a malformed PDF file that is misHumanTalk Co DaviewIndy
- CVE-2019-9138DaviewIndy 8.98.7 and earlier versions have a Integer overflow vulnerability, triggered when the user opens a malformed PhotoShop file that HumanTalk Co DaviewIndy
- CVE-2019-9137DaviewIndy 8.98.7 and earlier versions have a Integer overflow vulnerability, triggered when the user opens a malformed Image file that is mHumanTalk Co DaviewIndy
- CVE-2019-9136DaviewIndy 8.98.7 and earlier versions have a Heap-based overflow vulnerability, triggered when the user opens a malformed JPEG2000 format fHumanTalk Co DaviewIndy
- CVE-2019-9135DaviewIndy 8.98.7 and earlier versions have a Heap-based overflow vulnerability, triggered when the user opens a malformed DIB format file tHumanTalk Co DaviewIndy
Medium, low and unrated 62
- CVE-2018-19359GitLab Community and Enterprise Edition 8.9 and later and before 11.5.0-rc12, 11.4.6, and 11.3.10 has Incorrect Access Control.
- CVE-2019-3721Improper Range Header Processing VulnerabilityDell EMC Open Manage System Administrator
- CVE-2019-3720Directory Traversal VulnerabilityDell EMC Open Manage System Administrator
- CVE-2018-18643GitLab CE & EE 11.2 and later and before 11.5.0-rc12, 11.4.6, and 11.3.10 have Persistent XSS.
- CVE-2019-11488Incorrect Access Control in the Account Access / Password Reset Link in SimplyBook.me Enterprise before 2019-04-23 allows Unauthorized Attac
- CVE-2019-11489Incorrect Access Control in the Administrative Management Interface in SimplyBook.me Enterprise before 2019-04-23 allows Authenticated Low-P
- CVE-2018-16220Cross Site Scripting in different input fields (domain field and personal settings) in AudioCodes 405HD VoIP phone with firmware 2.2.12 allo
- CVE-2018-16219A missing password verification in the web interface in AudioCodes 405HD VoIP phone with firmware 2.2.12 allows an remote attacker (in the s
- CVE-2018-16216A command injection (missing input validation, escaping) in the monitoring or memory status web interface in AudioCodes 405HD (firmware 2.2.
- CVE-2018-18824WolfCMS v0.8.3.1 allows XSS via an SVG file to /?/admin/plugin/file_manager/browse/.
- CVE-2018-18823WolfCMS 0.8.3.1 allows XSS via an SVG file to /?/admin/plugin/file_manager/browse/.
- CVE-2018-14559An issue was discovered on Tenda AC7 devices with firmware through V15.03.06.44_CN(AC7), AC9 devices with firmware through V15.03.05.19(6318
- CVE-2018-14557An issue was discovered on Tenda AC7 devices with firmware through V15.03.06.44_CN(AC7), AC9 devices with firmware through V15.03.05.19(6318
- CVE-2018-16660A command injection vulnerability in PWS in Imperva SecureSphere 13.0.0.10 and 13.1.0.10 Gateway allows an attacker with authenticated acces
- CVE-2018-15003The Coolpad Defiant (Coolpad/cp3632a/cp3632a:7.1.1/NMF26F/099480857:user/release-keys) and the T-Mobile Revvl Plus (Coolpad/alchemy/alchemy:
- CVE-2018-15000The Vivo V7 Android device with a build fingerprint of vivo/1718/1718:7.1.2/N2G47H/compil11021857:user/release-keys contains a platform app
- CVE-2018-14999The Leagoo P1 device with a build fingerprint of sp7731c_1h10_32v4_bird:6.0/MRA58K/android.20170629.214736:user/release-keys contains a pre-
- CVE-2018-14997The Leagoo P1 Android device with a build fingerprint of sp7731c_1h10_32v4_bird:6.0/MRA58K/android.20170629.214736:user/release-keys contain
- CVE-2018-14996The Oppo F5 Android device with a build fingerprint of OPPO/CPH1723/CPH1723:7.1.1/N6F26Q/1513597833:user/release-keys contains a pre-install
- CVE-2018-14994The Essential Phone Android device with a build fingerprint of essential/mata/mata:8.1.0/OPM1.180104.166/297:user/release-keys contains a pr
- CVE-2018-14993The ASUS Zenfone V Live Android device with a build fingerprint of asus/VZW_ASUS_A009/ASUS_A009:7.1.1/NMF26F/14.0610.1802.78-20180313:user/r
- CVE-2018-14991The Coolpad Defiant device with a build fingerprint of Coolpad/cp3632a/cp3632a:7.1.1/NMF26F/099480857:user/release-keys, the ZTE ZMAX Pro wi
- CVE-2018-14990The Coolpad Defiant device with a build fingerprint of Coolpad/cp3632a/cp3632a:7.1.1/NMF26F/099480857:user/release-keys, the ZTE ZMAX Pro wi
- CVE-2018-14989The Plum Compass Android device with a build fingerprint of PLUM/c179_hwf_221/c179_hwf_221:6.0/MRA58K/W16.51.5-22:user/release-keys contains
- CVE-2018-14983The Sony Xperia L1 Android device with a build fingerprint of Sony/G3313/G3313:7.0/43.0.A.6.49/2867558199:user/release-keys contains the and
- CVE-2018-14980The ASUS ZenFone 3 Max Android device with a build fingerprint of asus/US_Phone/ASUS_X008_1:7.0/NRD90M/US_Phone-14.14.1711.92-20171208:user/
- CVE-2018-18367Symantec Endpoint Protection Manager (SEPM) prior to and including 12.1 RU6 MP9 and prior to 14.2 RU1 may be susceptible to a DLL PreloadingSymantec Endpoint Protection Manager
- CVE-2018-18366Symantec Norton Security prior to 22.16.3, SEP (Windows client) prior to and including 12.1 RU6 MP9, and prior to 14.2 RU1, SEP SBE prior toSymantec Norton Security · Symantec SEP
- CVE-2018-18285SQL injection vulnerabilities in CMG Suite 8.4 SP2 and earlier, could allow an unauthenticated attacker to conduct an SQL injection attack d
- CVE-2018-18286SQL injection vulnerabilities in CMG Suite 8.4 SP2 and earlier, could allow an unauthenticated attacker to conduct an SQL injection attack d
- CVE-2018-12244SEP (Mac client) prior to and including 12.1 RU6 MP9 and prior to 14.2 RU1 may be susceptible to a CSV/DDE injection (also known as formula Symantec Endpoint Protection
- CVE-2019-11537In osTicket before 1.12, XSS exists via /upload/file.php, /upload/scp/users.php?do=import-users, and /upload/scp/ajax.php/users/import if an
- CVE-2019-9669The Wordfence plugin 7.2.3 for WordPress allows XSS via a unique attack vector.
- CVE-2019-10955In Rockwell Automation MicroLogix 1400 Controllers Series A, All Versions Series B, v15.002 and earlier, MicroLogix 1100 Controllers v14.00 Rockwell Automation MicroLogix 1400 Controllers · Rockwe… +3
- CVE-2018-1360A cleartext transmission of sensitive information vulnerability in Fortinet FortiManager 5.2.0 through 5.2.7, 5.4.0 and 5.4.1 may allow an uFortinet FortiManager
- CVE-2018-19442A Buffer Overflow in Network::AuthenticationClient::VerifySignature in /bin/astro in Neato Botvac Connected 2.2.0 allows a remote attacker t
- CVE-2018-18369Norton Security (Windows client) prior to 22.16.3 and SEP SBE (Windows client) prior to Cloud Agent 3.00.31.2817, NIS-22.15.2.22 & SEP-12.1.Symantec Norton Security · Symantec Endpoint Protection Sma…
- CVE-2017-16558Contao 3.0.0 to 3.5.30 and 4.0.0 to 4.4.7 contains an SQL injection vulnerability in the back end as well as in the listing module.contao/contao · contao/core-bundle +1
- CVE-2018-20053An issue was discovered on Cerner Connectivity Engine (CCE) 4 devices.
- CVE-2018-20052An issue was discovered on Cerner Connectivity Engine (CCE) 4 devices.
- CVE-2019-9901Envoy 1.9.0 and before does not normalize HTTP URL paths.github.com/envoyproxy/envoy
- CVE-2019-9900When parsing HTTP/1.x header values, Envoy 1.9.0 and before does not reject embedded zero characters (NUL, ASCII 0x0).
- CVE-2019-3900An infinite loop issue was found in the vhost_net kernel module in Linux Kernel up to and including v5.1-rc6, while handling incoming packetRed Hat Kernel
- CVE-2019-4238IBM InfoSphere Information Server 11.3, 11.5, and 11.7 is vulnerable to cross-site scripting.IBM InfoSphere Information Server
- CVE-2019-4222IBM Sterling B2B Integrator Standard Edition 6.0.0.0 and 6.0.0.1 could allow an authenticated user to view process definition of a business IBM Sterling B2B Integrator
- CVE-2019-4148IBM Sterling B2B Integrator Standard Edition 6.0.0.0 and 6.0.0.1 is vulnerable to cross-site scripting.IBM Sterling B2B Integrator
- CVE-2019-4146IBM Sterling B2B Integrator Standard Edition 6.0.0.0 and 6.0.0.1 could allow an authenticated user to obtain sensitive document information IBM Sterling B2B Integrator
- CVE-2019-4092IBM Content Navigator 2.0.3 and 3.0CD could allow a remote attacker to conduct phishing attacks, using an open redirect attack.IBM Content Navigator
- CVE-2019-4077IBM Sterling B2B Integrator Standard Edition 6.0.0.0 and 6.0.0.1 is vulnerable to cross-site scripting.IBM Sterling B2B Integrator
- CVE-2019-4076IBM Sterling B2B Integrator Standard Edition 6.0.0.0 and 6.0.0.1 is vulnerable to cross-site scripting.IBM Sterling B2B Integrator
- CVE-2019-4075IBM Sterling B2B Integrator Standard Edition 6.0.0.0 and 6.0.0.1 is vulnerable to cross-site scripting.IBM Sterling B2B Integrator
- CVE-2019-4074IBM Sterling B2B Integrator Standard Edition 6.0.0.0 and 6.0.0.1 is vulnerable to cross-site scripting.IBM Sterling B2B Integrator
- CVE-2019-4073IBM Sterling B2B Integrator Standard Edition 6.0.0.0 and 6.0.0.1 is vulnerable to cross-site scripting.IBM Sterling B2B Integrator
- CVE-2019-4033IBM Content Navigator 2.0.3 and 3.0CD is vulnerable to cross-site scripting.IBM Content Navigator
- CVE-2018-1720IBM Sterling B2B Integrator Standard Edition 5.2.0.1, 5.2.6.3_6, 6.0.0.0, and 6.0.0.1 uses weaker than expected cryptographic algorithms thaIBM Sterling B2B Integrator
- CVE-2018-20823The gyroscope on Xiaomi Mi 5s devices allows attackers to cause a denial of service (resonance and false data) via a 20.4 kHz audio signal,
- CVE-2019-11519Libraries/Nop.Services/Localization/LocalizationService.cs in nopCommerce through 4.10 allows XXE via the "Configurations -> Languages -> Ed
- CVE-2019-11518An issue was discovered in SEMCMS 3.8.
- CVE-2019-11515core/classes/db_backup.php in Gila CMS 1.10.1 allows admin/db_backup?download= absolute path traversal to read arbitrary files.
- CVE-2019-11514User/Command/ConfirmEmailHandler.php in Flarum before 0.1.0-beta.8 mishandles invalidation of user email tokens.flarum/flarum
- CVE-2019-11513The File Manager in CMS Made Simple through 2.2.10 has Reflected XSS via the "New name" field in a Rename action.
- CVE-2019-11511Zoho ManageEngine ADSelfService Plus before build 5708 has XSS via the mobile app API.