# CVEs published 2019-04-25

69 CVEs were published on April 25, 2019: 0 critical, 7 high. Days are UTC.

- [CVE-2018-19359](https://cve.now/CVE-2018-19359.md): GitLab Community and Enterprise Edition 8.9 and later and before 11.5.0-rc12, 11.4.6, and 11.3.10 has Incorrect Access Control. (no CVSS)
- [CVE-2019-3801](https://cve.now/CVE-2019-3801.md): Java Projects using HTTP to fetch dependencies (CVSS 8.7, Cloud Foundry CredHub · Cloud Foundry UAA Release +2)
- [CVE-2019-3788](https://cve.now/CVE-2019-3788.md): UAA redirect-uri allows wildcard in the subdomain (CVSS 8.7, Cloud Foundry UAA Release · Pivotal Application Service)
- [CVE-2019-3721](https://cve.now/CVE-2019-3721.md): Improper Range Header Processing Vulnerability (CVSS 4.3, Dell EMC Open Manage System Administrator)
- [CVE-2019-3720](https://cve.now/CVE-2019-3720.md): Directory Traversal Vulnerability (CVSS 4.9, Dell EMC Open Manage System Administrator)
- [CVE-2018-18643](https://cve.now/CVE-2018-18643.md): GitLab CE & EE 11.2 and later and before 11.5.0-rc12, 11.4.6, and 11.3.10 have Persistent XSS. (no CVSS)
- [CVE-2019-11488](https://cve.now/CVE-2019-11488.md): Incorrect Access Control in the Account Access / Password Reset Link in SimplyBook.me Enterprise before 2019-04-23 allows Unauthorized Attac (no CVSS)
- [CVE-2019-11489](https://cve.now/CVE-2019-11489.md): Incorrect Access Control in the Administrative Management Interface in SimplyBook.me Enterprise before 2019-04-23 allows Authenticated Low-P (no CVSS)
- [CVE-2018-16220](https://cve.now/CVE-2018-16220.md): Cross Site Scripting in different input fields (domain field and personal settings) in AudioCodes 405HD VoIP phone with firmware 2.2.12 allo (no CVSS)
- [CVE-2018-16219](https://cve.now/CVE-2018-16219.md): A missing password verification in the web interface in AudioCodes 405HD VoIP phone with firmware 2.2.12 allows an remote attacker (in the s (no CVSS)
- [CVE-2018-16216](https://cve.now/CVE-2018-16216.md): A command injection (missing input validation, escaping) in the monitoring or memory status web interface in AudioCodes 405HD (firmware 2.2. (no CVSS)
- [CVE-2018-18824](https://cve.now/CVE-2018-18824.md): WolfCMS v0.8.3.1 allows XSS via an SVG file to /?/admin/plugin/file\_manager/browse/. (no CVSS)
- [CVE-2018-18823](https://cve.now/CVE-2018-18823.md): WolfCMS 0.8.3.1 allows XSS via an SVG file to /?/admin/plugin/file\_manager/browse/. (no CVSS)
- [CVE-2018-14559](https://cve.now/CVE-2018-14559.md): An issue was discovered on Tenda AC7 devices with firmware through V15.03.06.44\_CN(AC7), AC9 devices with firmware through V15.03.05.19(6318 (no CVSS)
- [CVE-2018-14557](https://cve.now/CVE-2018-14557.md): An issue was discovered on Tenda AC7 devices with firmware through V15.03.06.44\_CN(AC7), AC9 devices with firmware through V15.03.05.19(6318 (no CVSS)
- [CVE-2018-16660](https://cve.now/CVE-2018-16660.md): A command injection vulnerability in PWS in Imperva SecureSphere 13.0.0.10 and 13.1.0.10 Gateway allows an attacker with authenticated acces (no CVSS)
- [CVE-2018-15003](https://cve.now/CVE-2018-15003.md): The Coolpad Defiant (Coolpad/cp3632a/cp3632a:7.1.1/NMF26F/099480857:user/release-keys) and the T-Mobile Revvl Plus (Coolpad/alchemy/alchemy: (no CVSS)
- [CVE-2018-15000](https://cve.now/CVE-2018-15000.md): The Vivo V7 Android device with a build fingerprint of vivo/1718/1718:7.1.2/N2G47H/compil11021857:user/release-keys contains a platform app (no CVSS)
- [CVE-2018-14999](https://cve.now/CVE-2018-14999.md): The Leagoo P1 device with a build fingerprint of sp7731c\_1h10\_32v4\_bird:6.0/MRA58K/android.20170629.214736:user/release-keys contains a pre- (no CVSS)
- [CVE-2018-14997](https://cve.now/CVE-2018-14997.md): The Leagoo P1 Android device with a build fingerprint of sp7731c\_1h10\_32v4\_bird:6.0/MRA58K/android.20170629.214736:user/release-keys contain (no CVSS)
- [CVE-2018-14996](https://cve.now/CVE-2018-14996.md): The Oppo F5 Android device with a build fingerprint of OPPO/CPH1723/CPH1723:7.1.1/N6F26Q/1513597833:user/release-keys contains a pre-install (no CVSS)
- [CVE-2018-14994](https://cve.now/CVE-2018-14994.md): The Essential Phone Android device with a build fingerprint of essential/mata/mata:8.1.0/OPM1.180104.166/297:user/release-keys contains a pr (no CVSS)
- [CVE-2018-14993](https://cve.now/CVE-2018-14993.md): The ASUS Zenfone V Live Android device with a build fingerprint of asus/VZW\_ASUS\_A009/ASUS\_A009:7.1.1/NMF26F/14.0610.1802.78-20180313:user/r (no CVSS)
- [CVE-2018-14991](https://cve.now/CVE-2018-14991.md): The Coolpad Defiant device with a build fingerprint of Coolpad/cp3632a/cp3632a:7.1.1/NMF26F/099480857:user/release-keys, the ZTE ZMAX Pro wi (no CVSS)
- [CVE-2018-14990](https://cve.now/CVE-2018-14990.md): The Coolpad Defiant device with a build fingerprint of Coolpad/cp3632a/cp3632a:7.1.1/NMF26F/099480857:user/release-keys, the ZTE ZMAX Pro wi (no CVSS)
- [CVE-2018-14989](https://cve.now/CVE-2018-14989.md): The Plum Compass Android device with a build fingerprint of PLUM/c179\_hwf\_221/c179\_hwf\_221:6.0/MRA58K/W16.51.5-22:user/release-keys contains (no CVSS)
- [CVE-2018-14983](https://cve.now/CVE-2018-14983.md): The Sony Xperia L1 Android device with a build fingerprint of Sony/G3313/G3313:7.0/43.0.A.6.49/2867558199:user/release-keys contains the and (no CVSS)
- [CVE-2018-14980](https://cve.now/CVE-2018-14980.md): The ASUS ZenFone 3 Max Android device with a build fingerprint of asus/US\_Phone/ASUS\_X008\_1:7.0/NRD90M/US\_Phone-14.14.1711.92-20171208:user/ (no CVSS)
- [CVE-2018-18367](https://cve.now/CVE-2018-18367.md): Symantec Endpoint Protection Manager (SEPM) prior to and including 12.1 RU6 MP9 and prior to 14.2 RU1 may be susceptible to a DLL Preloading (no CVSS, Symantec Endpoint Protection Manager)
- [CVE-2018-18366](https://cve.now/CVE-2018-18366.md): Symantec Norton Security prior to 22.16.3, SEP (Windows client) prior to and including 12.1 RU6 MP9, and prior to 14.2 RU1, SEP SBE prior to (no CVSS, Symantec Norton Security · Symantec SEP)
- [CVE-2018-18285](https://cve.now/CVE-2018-18285.md): SQL injection vulnerabilities in CMG Suite 8.4 SP2 and earlier, could allow an unauthenticated attacker to conduct an SQL injection attack d (no CVSS)
- [CVE-2018-18286](https://cve.now/CVE-2018-18286.md): SQL injection vulnerabilities in CMG Suite 8.4 SP2 and earlier, could allow an unauthenticated attacker to conduct an SQL injection attack d (no CVSS)
- [CVE-2018-12244](https://cve.now/CVE-2018-12244.md): SEP (Mac client) prior to and including 12.1 RU6 MP9 and prior to 14.2 RU1 may be susceptible to a CSV/DDE injection (also known as formula (no CVSS, Symantec Endpoint Protection)
- [CVE-2019-11537](https://cve.now/CVE-2019-11537.md): In osTicket before 1.12, XSS exists via /upload/file.php, /upload/scp/users.php?do=import-users, and /upload/scp/ajax.php/users/import if an (no CVSS)
- [CVE-2019-9669](https://cve.now/CVE-2019-9669.md): The Wordfence plugin 7.2.3 for WordPress allows XSS via a unique attack vector. (no CVSS)
- [CVE-2019-10955](https://cve.now/CVE-2019-10955.md): In Rockwell Automation MicroLogix 1400 Controllers Series A, All Versions Series B, v15.002 and earlier, MicroLogix 1100 Controllers v14.00 (CVSS 6.1, Rockwell Automation MicroLogix 1400 Controllers · Rockwe… +3)
- [CVE-2019-9139](https://cve.now/CVE-2019-9139.md): DaviewIndy 8.98.7 and earlier versions have a Integer overflow vulnerability, triggered when the user opens a malformed PDF file that is mis (CVSS 7.8, HumanTalk Co DaviewIndy)
- [CVE-2019-9138](https://cve.now/CVE-2019-9138.md): DaviewIndy 8.98.7 and earlier versions have a Integer overflow vulnerability, triggered when the user opens a malformed PhotoShop file that (CVSS 7.8, HumanTalk Co DaviewIndy)
- [CVE-2019-9137](https://cve.now/CVE-2019-9137.md): DaviewIndy 8.98.7 and earlier versions have a Integer overflow vulnerability, triggered when the user opens a malformed Image file that is m (CVSS 7.8, HumanTalk Co DaviewIndy)
- [CVE-2018-1360](https://cve.now/CVE-2018-1360.md): A cleartext transmission of sensitive information vulnerability in Fortinet FortiManager 5.2.0 through 5.2.7, 5.4.0 and 5.4.1 may allow an u (no CVSS, Fortinet FortiManager)
- [CVE-2018-19442](https://cve.now/CVE-2018-19442.md): A Buffer Overflow in Network::AuthenticationClient::VerifySignature in /bin/astro in Neato Botvac Connected 2.2.0 allows a remote attacker t (no CVSS)
- [CVE-2019-9136](https://cve.now/CVE-2019-9136.md): DaviewIndy 8.98.7 and earlier versions have a Heap-based overflow vulnerability, triggered when the user opens a malformed JPEG2000 format f (CVSS 7.8, HumanTalk Co DaviewIndy)
- [CVE-2018-18369](https://cve.now/CVE-2018-18369.md): Norton Security (Windows client) prior to 22.16.3 and SEP SBE (Windows client) prior to Cloud Agent 3.00.31.2817, NIS-22.15.2.22 & SEP-12.1. (no CVSS, Symantec Norton Security · Symantec Endpoint Protection Sma…)
- [CVE-2019-9135](https://cve.now/CVE-2019-9135.md): DaviewIndy 8.98.7 and earlier versions have a Heap-based overflow vulnerability, triggered when the user opens a malformed DIB format file t (CVSS 7.8, HumanTalk Co DaviewIndy)
- [CVE-2017-16558](https://cve.now/CVE-2017-16558.md): Contao 3.0.0 to 3.5.30 and 4.0.0 to 4.4.7 contains an SQL injection vulnerability in the back end as well as in the listing module. (no CVSS, contao/contao · contao/core-bundle +1)
- [CVE-2018-20053](https://cve.now/CVE-2018-20053.md): An issue was discovered on Cerner Connectivity Engine (CCE) 4 devices. (no CVSS)
- [CVE-2018-20052](https://cve.now/CVE-2018-20052.md): An issue was discovered on Cerner Connectivity Engine (CCE) 4 devices. (no CVSS)
- [CVE-2019-9901](https://cve.now/CVE-2019-9901.md): Envoy 1.9.0 and before does not normalize HTTP URL paths. (CVSS 6.5, github.com/envoyproxy/envoy)
- [CVE-2019-9900](https://cve.now/CVE-2019-9900.md): When parsing HTTP/1.x header values, Envoy 1.9.0 and before does not reject embedded zero characters (NUL, ASCII 0x0). (CVSS 6.5)
- [CVE-2019-3900](https://cve.now/CVE-2019-3900.md): An infinite loop issue was found in the vhost\_net kernel module in Linux Kernel up to and including v5.1-rc6, while handling incoming packet (CVSS 6.3, Red Hat Kernel)
- [CVE-2019-4238](https://cve.now/CVE-2019-4238.md): IBM InfoSphere Information Server 11.3, 11.5, and 11.7 is vulnerable to cross-site scripting. (CVSS 5.4, IBM InfoSphere Information Server)
- [CVE-2019-4222](https://cve.now/CVE-2019-4222.md): IBM Sterling B2B Integrator Standard Edition 6.0.0.0 and 6.0.0.1 could allow an authenticated user to view process definition of a business (CVSS 4.3, IBM Sterling B2B Integrator)
- [CVE-2019-4148](https://cve.now/CVE-2019-4148.md): IBM Sterling B2B Integrator Standard Edition 6.0.0.0 and 6.0.0.1 is vulnerable to cross-site scripting. (CVSS 4.0, IBM Sterling B2B Integrator)
- [CVE-2019-4146](https://cve.now/CVE-2019-4146.md): IBM Sterling B2B Integrator Standard Edition 6.0.0.0 and 6.0.0.1 could allow an authenticated user to obtain sensitive document information (CVSS 3.1, IBM Sterling B2B Integrator)
- [CVE-2019-4092](https://cve.now/CVE-2019-4092.md): IBM Content Navigator 2.0.3 and 3.0CD could allow a remote attacker to conduct phishing attacks, using an open redirect attack. (CVSS 6.8, IBM Content Navigator)
- [CVE-2019-4077](https://cve.now/CVE-2019-4077.md): IBM Sterling B2B Integrator Standard Edition 6.0.0.0 and 6.0.0.1 is vulnerable to cross-site scripting. (CVSS 5.4, IBM Sterling B2B Integrator)
- [CVE-2019-4076](https://cve.now/CVE-2019-4076.md): IBM Sterling B2B Integrator Standard Edition 6.0.0.0 and 6.0.0.1 is vulnerable to cross-site scripting. (CVSS 5.4, IBM Sterling B2B Integrator)
- [CVE-2019-4075](https://cve.now/CVE-2019-4075.md): IBM Sterling B2B Integrator Standard Edition 6.0.0.0 and 6.0.0.1 is vulnerable to cross-site scripting. (CVSS 5.4, IBM Sterling B2B Integrator)
- [CVE-2019-4074](https://cve.now/CVE-2019-4074.md): IBM Sterling B2B Integrator Standard Edition 6.0.0.0 and 6.0.0.1 is vulnerable to cross-site scripting. (CVSS 5.4, IBM Sterling B2B Integrator)
- [CVE-2019-4073](https://cve.now/CVE-2019-4073.md): IBM Sterling B2B Integrator Standard Edition 6.0.0.0 and 6.0.0.1 is vulnerable to cross-site scripting. (CVSS 5.4, IBM Sterling B2B Integrator)
- [CVE-2019-4033](https://cve.now/CVE-2019-4033.md): IBM Content Navigator 2.0.3 and 3.0CD is vulnerable to cross-site scripting. (CVSS 5.4, IBM Content Navigator)
- [CVE-2018-1720](https://cve.now/CVE-2018-1720.md): IBM Sterling B2B Integrator Standard Edition 5.2.0.1, 5.2.6.3\_6, 6.0.0.0, and 6.0.0.1 uses weaker than expected cryptographic algorithms tha (CVSS 5.9, IBM Sterling B2B Integrator)
- [CVE-2018-20823](https://cve.now/CVE-2018-20823.md): The gyroscope on Xiaomi Mi 5s devices allows attackers to cause a denial of service (resonance and false data) via a 20.4 kHz audio signal, (no CVSS)
- [CVE-2019-11519](https://cve.now/CVE-2019-11519.md): Libraries/Nop.Services/Localization/LocalizationService.cs in nopCommerce through 4.10 allows XXE via the "Configurations -\> Languages -\> Ed (no CVSS)
- [CVE-2019-11518](https://cve.now/CVE-2019-11518.md): An issue was discovered in SEMCMS 3.8. (no CVSS)
- [CVE-2019-11515](https://cve.now/CVE-2019-11515.md): core/classes/db\_backup.php in Gila CMS 1.10.1 allows admin/db\_backup?download= absolute path traversal to read arbitrary files. (no CVSS)
- [CVE-2019-11514](https://cve.now/CVE-2019-11514.md): User/Command/ConfirmEmailHandler.php in Flarum before 0.1.0-beta.8 mishandles invalidation of user email tokens. (no CVSS, flarum/flarum)
- [CVE-2019-11513](https://cve.now/CVE-2019-11513.md): The File Manager in CMS Made Simple through 2.2.10 has Reflected XSS via the "New name" field in a Rename action. (no CVSS)
- [CVE-2019-11511](https://cve.now/CVE-2019-11511.md): Zoho ManageEngine ADSelfService Plus before build 5708 has XSS via the mobile app API. (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2019-04-25
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.