CVEs published April 29, 2019
26 CVEs were published on April 29, 2019: 0 critical, 0 high.
- Published
- 26
- Critical
- 0
- High
- 0
- Medium
- 4
- Low
- 0
- Unrated
- 22
- Now in CISA KEV
- 0
- Fix available
- 3
Most affected products
- IBM Jazz Reporting Service
- 2
- Check Point Endpoint Security client for Windows
- 1
- Facebook fizz
- 1
- Facebook HHVM
- 1
- Facebook Wangle
- 1
- FileZilla
- 1
- IBM API Connect
- 1
- IBM Emptoris Contract Management
- 1
- Micro Focus Network Automation and Micro Focus Network Oper…
- 1
- Mozilla Bugzilla
- 1
Medium, low and unrated 26
- CVE-2019-11599The coredump implementation in the Linux kernel before 5.0.10 does not use locking or other mechanisms to prevent vma layout or vma flags ch
- CVE-2019-4047IBM Jazz Reporting Service (JRS) 6.0.6 could allow an authenticated user to access the execution log files as a guest user, and obtain the iIBM Jazz Reporting Service
- CVE-2018-2007IBM API Connect 2018.1 and 2018.4.1.2 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensIBM API Connect
- CVE-2018-2004IBM Jazz Reporting Service (JRS) 6.0 through 6.0.6 is vulnerable to cross-site scripting.IBM Jazz Reporting Service
- CVE-2018-1961IBM Emptoris Contract Management 10.0.0 and 10.1.3.0 could disclose sensitive information from detailed information from error messages.IBM Emptoris Contract Management
- CVE-2019-3493A potential security vulnerability has been identified in Micro Focus Network Automation Software 9.20, 9.21, 10.00, 10.10, 10.20, 10.30, 10Micro Focus Network Automation and Micro Focus Network Oper…
- CVE-2018-5123A third party website can access information available to a user with access to a restricted bug entry using the image generation in report.Mozilla Bugzilla
- CVE-2019-3561Insufficient boundary checks for the strrpos and strripos functions allow access to out-of-bounds memory.Facebook HHVM
- CVE-2019-3562A remote web page could inject arbitrary HTML code into the Oculus Browser UI, allowing an attacker to spoof UI and potentially execute codeOculus Browser
- CVE-2019-3563Wangle's LineBasedFrameDecoder contains logic for identifying newlines which incorrectly advances a buffer, leading to a potential underflowFacebook Wangle
- CVE-2019-8454A local attacker can create a hard-link between a file to which the Check Point Endpoint Security client for Windows before E80.96 writes anCheck Point Endpoint Security client for Windows
- CVE-2019-11598In ImageMagick 7.0.8-40 Q16, there is a heap-based buffer over-read in the function WritePNMImage of coders/pnm.c, which allows an attacker
- CVE-2019-11597In ImageMagick 7.0.8-43 Q16, there is a heap-based buffer over-read in the function WriteTIFFImage of coders/tiff.c, which allows an attacke
- CVE-2019-11596In memcached before 1.5.14, a NULL pointer dereference was found in the "lru mode" and "lru temp_ttl" commands.
- CVE-2019-11595In uBlock before 0.9.5.15, the $rewrite filter option allows filter-list maintainers to run arbitrary code in a client-side session when a w
- CVE-2019-11594In AdBlock before 3.45.0, the $rewrite filter option allows filter-list maintainers to run arbitrary code in a client-side session when a we
- CVE-2019-11593In Adblock Plus before 3.5.2, the $rewrite filter option allows filter-list maintainers to run arbitrary code in a client-side session when
- CVE-2018-12384When handling a SSLv2-compatible ClientHello request, the server doesn't generate a new random value but sends an all-zero value instead.Network Security Services
- CVE-2019-5429Untrusted search path in FileZilla before 3.41.0-rc1 allows an attacker to gain privileges via a malicious 'fzsftp' binary in the user's homFileZilla
- CVE-2019-5492Element Plug-in for vCenter Server versions prior to 4.2.3 may disclose sensitive account information to an unauthenticated attacker.NetApp Element Plug-in for vCenter Server
- CVE-2019-11592WeBid 1.2.2 has reflected XSS via the id parameter to admin/deletenews.php, admin/editbannersuser.php, admin/editfaqscategory.php, or admin/
- CVE-2015-9285esoTalk 1.0.0g4 has XSS via the PATH_INFO to the conversations/ URI.
- CVE-2016-10749parse_string in cJSON.c in cJSON before 2016-10-02 has a buffer over-read, as demonstrated by a string that begins with a " character and en
- CVE-2019-11591The WebDorado Contact Form plugin before 1.13.5 for WordPress allows CSRF via the wp-admin/admin-ajax.php action parameter, with resultant l
- CVE-2019-11590The 10Web Form Maker plugin before 1.13.5 for WordPress allows CSRF via the wp-admin/admin-ajax.php action parameter, with resultant local f
- CVE-2019-3560An improperly performed length calculation on a buffer in PlaintextRecordLayer could lead to an infinite loop and denial-of-service based onFacebook fizz