CVEs published April 26, 2019
58 CVEs were published on April 26, 2019: 0 critical, 10 high. 2 are now in CISA KEV.
- Published
- 58
- Critical
- 0
- High
- 10
- Medium
- 2
- Low
- 0
- Unrated
- 46
- Now in CISA KEV
- 2
- Fix available
- 33
Most affected products
- Mozilla Firefox
- 14
- Mozilla Thunderbird · Mozilla Firefox ESR +1
- 9
- Dell EMC iDRAC
- 3
- Mozilla Thunderbird
- 3
- [freedesktop.org] systemd
- 2
- Firefox
- 2
- Mozilla Firefox · Mozilla Thunderbird
- 2
- Apache Software Foundation Apache Pluto · org.apache.portal…
- 1
- omniauth ruby gem · omniauth
- 1
- Oracle Tape Library ACSLS
- 1
High 10
- CVE-2019-3707WS-MAN Authentication Bypass VulnerabilityDell EMC iDRAC
- CVE-2019-3706Web Interface Authentication Bypass VulnerabilityDell EMC iDRAC
- CVE-2019-3705Buffer Overflow VulnerabilityDell EMC iDRAC
- CVE-2019-2725Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: Web Services).Oracle Tape Library ACSLS
- CVE-2019-11543XSS exists in the admin web console in Pulse Secure Pulse Connect Secure (PCS) 9.0RX before 9.0R3.4, 8.3RX before 8.3R7.1, and 8.1RX before
- CVE-2019-11542In Pulse Secure Pulse Connect Secure version 9.0RX before 9.0R3.4, 8.3RX before 8.3R7.1, 8.2RX before 8.2R12.1, and 8.1RX before 8.1R15.1 an
- CVE-2019-11541In Pulse Secure Pulse Connect Secure version 9.0RX before 9.0R3.4, 8.3RX before 8.3R7.1, and 8.2RX before 8.2R12.1, users using SAML authent
- CVE-2019-11540In Pulse Secure Pulse Connect Secure version 9.0RX before 9.0R3.4 and 8.3RX before 8.3R7.1 and Pulse Policy Secure version 9.0RX before 9.0R
- CVE-2019-11539In Pulse Secure Pulse Connect Secure version 9.0RX before 9.0R3.4, 8.3RX before 8.3R7.1, 8.2RX before 8.2R12.1, and 8.1RX before 8.1R15.1 an
- CVE-2019-11538In Pulse Secure Pulse Connect Secure version 9.0RX before 9.0R3.4, 8.3RX before 8.3R7.1, 8.2RX before 8.2R12.1, and 8.1RX before 8.1R15.1, a
Medium, low and unrated 48
- CVE-2019-11557The WebDorado Contact Form Builder plugin before 1.0.69 for WordPress allows CSRF via the wp-admin/admin-ajax.php action parameter, with res
- CVE-2019-11555The EAP-pwd implementation in hostapd (EAP server) before 2.8 and wpa_supplicant (EAP peer) before 2.8 does not validate fragmentation reass
- CVE-2019-3843It was discovered that a systemd service that uses DynamicUser property can create a SUID/SGID binary that would be allowed to run as the tr[freedesktop.org] systemd
- CVE-2019-3844It was discovered that a systemd service that uses DynamicUser property can get new privileges through the execution of SUID binaries, which[freedesktop.org] systemd
- CVE-2019-7476A vulnerability in SonicWall Global Management System (GMS), allow a remote user to gain access to the appliance using existing SSH key.SonicWall Global Management System
- CVE-2019-11533Cross-site scripting (XSS) vulnerability in ProjectSend before r1070 allows remote attackers to inject arbitrary web script or HTML.
- CVE-2019-11492ProjectSend before r1070 writes user passwords to the server logs.
- CVE-2018-18276XSS exists in the ProFiles 1.5 component for Joomla! via the name or path parameter when creating a new folder in the administrative panel.
- CVE-2018-15582Cross-Site Scripting (XSS) vulnerability in adm/sms_admin/num_book_write.php and adm/sms_admin/num_book_update.php in gnuboard5 before 5.3.1
- CVE-2018-15580Cross-Site Scripting (XSS) vulnerability in adm/contentformupdate.php in gnuboard5 before 5.3.1.6 allows remote attackers to inject arbitrar
- CVE-2018-15584Cross-Site Scripting (XSS) vulnerability in adm/boardgroup_form_update.php and adm/boardgroup_list_update.php in gnuboard5 before 5.3.1.6 al
- CVE-2018-15581Cross-Site Scripting (XSS) vulnerability in adm/faqmasterformupdate.php in gnuboard5 before 5.3.1.6 allows remote attackers to inject arbitr
- CVE-2019-11220An authentication flaw in Shenzhen Yunni Technology iLnkP2P allows remote attackers to actively intercept user-to-device traffic in cleartex
- CVE-2019-11219The algorithm used to generate device IDs (UIDs) for devices that utilize Shenzhen Yunni Technology iLnkP2P suffers from a predictability fl
- CVE-2019-6689An issue was discovered in Dillon Kane Tidal Workload Automation Agent 3.2.0.5 (formerly known as Cisco Workload Automation or CWA).
- CVE-2019-9806A vulnerability exists during authorization prompting for FTP transaction where successive modal prompts are displayed and cannot be immediaMozilla Firefox
- CVE-2018-18509A flaw during verification of certain S/MIME signatures causes emails to be shown in Thunderbird as having a valid digital signature, even iMozilla Thunderbird
- CVE-2018-18510The about:crashcontent and about:crashparent pages can be triggered by web content.Mozilla Firefox
- CVE-2018-18511Cross-origin images can be read from a canvas element in violation of the same-origin policy using the transferFromImageBitmap method.Mozilla Firefox
- CVE-2018-18512A use-after-free vulnerability can occur while playing a sound notification in Thunderbird.Mozilla Thunderbird
- CVE-2018-18513A crash can occur when processing a crafted S/MIME message or an XPI package containing a crafted signature.Mozilla Thunderbird
- CVE-2019-9788Mozilla developers and community members reported memory safety bugs present in Firefox 65, Firefox ESR 60.5, and Thunderbird 60.5.Mozilla Thunderbird · Mozilla Firefox ESR +1
- CVE-2019-9789Mozilla developers and community members reported memory safety bugs present in Firefox 65.Mozilla Firefox
- CVE-2019-9790A use-after-free vulnerability can occur when a raw pointer to a DOM element on a page is obtained using JavaScript and the element is then Mozilla Thunderbird · Mozilla Firefox ESR +1
- CVE-2019-9791The type inference system allows the compilation of functions that can cause type confusions between arbitrary objects when compiled throughMozilla Thunderbird · Mozilla Firefox ESR +1
- CVE-2019-9792The IonMonkey just-in-time (JIT) compiler can leak an internal JS_OPTIMIZED_OUT magic value to the running script during a bailout.Mozilla Thunderbird · Mozilla Firefox ESR +1
- CVE-2019-9793A mechanism was discovered that removes some bounds checking for string, array, or typed array accesses if Spectre mitigations have been disMozilla Thunderbird · Mozilla Firefox ESR +1
- CVE-2019-9794A vulnerability was discovered where specific command line arguments are not properly discarded during Firefox invocation as a shell handlerMozilla Thunderbird · Mozilla Firefox ESR +1
- CVE-2019-9795A vulnerability where type-confusion in the IonMonkey just-in-time (JIT) compiler could potentially be used by malicious JavaScript to triggMozilla Thunderbird · Mozilla Firefox ESR +1
- CVE-2019-9796A use-after-free vulnerability can occur when the SMIL animation controller incorrectly registers with the refresh driver twice when only a Mozilla Thunderbird · Mozilla Firefox ESR +1
- CVE-2019-9797Cross-origin images can be read in violation of the same-origin policy by exporting an image after using createImageBitmap to read the imageMozilla Firefox
- CVE-2019-9798On Android systems, Firefox can load a library from APITRACE_LIB, which is writable by all users and applications.Mozilla Firefox
- CVE-2019-9799Insufficient bounds checking of data during inter-process communication might allow a compromised content process to be able to read memory Mozilla Firefox
- CVE-2019-9801Firefox will accept any registered Program ID as an external protocol handler and offer to launch this local application when given a matchiMozilla Thunderbird · Mozilla Firefox ESR +1
- CVE-2019-9802If a Sandbox content process is compromised, it can initiate an FTP download which will then use a child process to render the downloaded daMozilla Firefox
- CVE-2019-9803The Upgrade-Insecure-Requests (UIR) specification states that if UIR is enabled through Content Security Policy (CSP), navigation to a same-Mozilla Firefox
- CVE-2019-9804In Firefox Developer Tools it is possible that pasting the result of the 'Copy as cURL' command into a command shell on macOS will cause theMozilla Firefox
- CVE-2019-9805A latent vulnerability exists in the Prio library where data may be read from uninitialized memory for some functions, leading to potential Mozilla Firefox
- CVE-2019-9807When arbitrary text is sent over an FTP connection and a page reload is initiated, it is possible to create a modal alert message with this Mozilla Firefox
- CVE-2019-9808If WebRTC permission is requested from documents with data: or blob: URLs, the permission notifications do not properly display the originatMozilla Firefox
- CVE-2019-9809If the source for resources on a page is through an FTP connection, it is possible to trigger a series of modal alert messages for these resMozilla Firefox
- CVE-2019-9810Incorrect alias information in IonMonkey JIT compiler for Array.prototype.slice method may lead to missing bounds check and a buffer overfloMozilla Firefox · Mozilla Thunderbird
- CVE-2019-9813Incorrect handling of __proto__ mutations may lead to type confusion in IonMonkey JIT code and can be leveraged for arbitrary memory read anMozilla Firefox · Mozilla Thunderbird
- CVE-2018-5124Unsanitized output in the browser UI leaves HTML tags in place and can result in arbitrary code execution in Firefox before version 58.0.1.Firefox
- CVE-2019-0186The input fields of the Apache Pluto "Chat Room" demo portlet 3.0.0 and 3.0.1 are vulnerable to Cross-Site Scripting (XSS) attacks.Apache Software Foundation Apache Pluto · org.apache.portal…
- CVE-2015-9284The request phase of the OmniAuth Ruby gem (1.9.1 and earlier) is vulnerable to Cross-Site Request Forgery when used as part of the Ruby on omniauth ruby gem · omniauth
- CVE-2018-5179A service worker can send the activate event on itself periodically which allows it to run perpetually, allowing it to monitor activity by uFirefox
- CVE-2019-11493VeryPDF 4.1 has a Memory Overflow leading to Code Execution because pdfocx!CxImageTIF::operator in pdfocx.ocx (used by pdfeditor.exe and pdf