# CVEs published 2019-04-29

26 CVEs were published on April 29, 2019: 0 critical, 0 high. Days are UTC.

- [CVE-2019-11599](https://cve.now/CVE-2019-11599.md): The coredump implementation in the Linux kernel before 5.0.10 does not use locking or other mechanisms to prevent vma layout or vma flags ch (no CVSS)
- [CVE-2019-4047](https://cve.now/CVE-2019-4047.md): IBM Jazz Reporting Service (JRS) 6.0.6 could allow an authenticated user to access the execution log files as a guest user, and obtain the i (CVSS 4.3, IBM Jazz Reporting Service)
- [CVE-2018-2007](https://cve.now/CVE-2018-2007.md): IBM API Connect 2018.1 and 2018.4.1.2 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sens (CVSS 5.9, IBM API Connect)
- [CVE-2018-2004](https://cve.now/CVE-2018-2004.md): IBM Jazz Reporting Service (JRS) 6.0 through 6.0.6 is vulnerable to cross-site scripting. (CVSS 5.4, IBM Jazz Reporting Service)
- [CVE-2018-1961](https://cve.now/CVE-2018-1961.md): IBM Emptoris Contract Management 10.0.0 and 10.1.3.0 could disclose sensitive information from detailed information from error messages. (CVSS 5.3, IBM Emptoris Contract Management)
- [CVE-2019-3493](https://cve.now/CVE-2019-3493.md): A potential security vulnerability has been identified in Micro Focus Network Automation Software 9.20, 9.21, 10.00, 10.10, 10.20, 10.30, 10 (no CVSS, Micro Focus Network Automation and Micro Focus Network Oper…)
- [CVE-2018-5123](https://cve.now/CVE-2018-5123.md): A third party website can access information available to a user with access to a restricted bug entry using the image generation in report. (no CVSS, Mozilla Bugzilla)
- [CVE-2019-3561](https://cve.now/CVE-2019-3561.md): Insufficient boundary checks for the strrpos and strripos functions allow access to out-of-bounds memory. (no CVSS, Facebook HHVM)
- [CVE-2019-3562](https://cve.now/CVE-2019-3562.md): A remote web page could inject arbitrary HTML code into the Oculus Browser UI, allowing an attacker to spoof UI and potentially execute code (no CVSS, Oculus Browser)
- [CVE-2019-3563](https://cve.now/CVE-2019-3563.md): Wangle's LineBasedFrameDecoder contains logic for identifying newlines which incorrectly advances a buffer, leading to a potential underflow (no CVSS, Facebook Wangle)
- [CVE-2019-8454](https://cve.now/CVE-2019-8454.md): A local attacker can create a hard-link between a file to which the Check Point Endpoint Security client for Windows before E80.96 writes an (no CVSS, Check Point Endpoint Security client for Windows)
- [CVE-2019-11598](https://cve.now/CVE-2019-11598.md): In ImageMagick 7.0.8-40 Q16, there is a heap-based buffer over-read in the function WritePNMImage of coders/pnm.c, which allows an attacker (no CVSS)
- [CVE-2019-11597](https://cve.now/CVE-2019-11597.md): In ImageMagick 7.0.8-43 Q16, there is a heap-based buffer over-read in the function WriteTIFFImage of coders/tiff.c, which allows an attacke (no CVSS)
- [CVE-2019-11596](https://cve.now/CVE-2019-11596.md): In memcached before 1.5.14, a NULL pointer dereference was found in the "lru mode" and "lru temp\_ttl" commands. (no CVSS)
- [CVE-2019-11595](https://cve.now/CVE-2019-11595.md): In uBlock before 0.9.5.15, the $rewrite filter option allows filter-list maintainers to run arbitrary code in a client-side session when a w (no CVSS)
- [CVE-2019-11594](https://cve.now/CVE-2019-11594.md): In AdBlock before 3.45.0, the $rewrite filter option allows filter-list maintainers to run arbitrary code in a client-side session when a we (no CVSS)
- [CVE-2019-11593](https://cve.now/CVE-2019-11593.md): In Adblock Plus before 3.5.2, the $rewrite filter option allows filter-list maintainers to run arbitrary code in a client-side session when (no CVSS)
- [CVE-2018-12384](https://cve.now/CVE-2018-12384.md): When handling a SSLv2-compatible ClientHello request, the server doesn't generate a new random value but sends an all-zero value instead. (no CVSS, Network Security Services)
- [CVE-2019-5429](https://cve.now/CVE-2019-5429.md): Untrusted search path in FileZilla before 3.41.0-rc1 allows an attacker to gain privileges via a malicious 'fzsftp' binary in the user's hom (no CVSS, FileZilla)
- [CVE-2019-5492](https://cve.now/CVE-2019-5492.md): Element Plug-in for vCenter Server versions prior to 4.2.3 may disclose sensitive account information to an unauthenticated attacker. (no CVSS, NetApp Element Plug-in for vCenter Server)
- [CVE-2019-11592](https://cve.now/CVE-2019-11592.md): WeBid 1.2.2 has reflected XSS via the id parameter to admin/deletenews.php, admin/editbannersuser.php, admin/editfaqscategory.php, or admin/ (no CVSS)
- [CVE-2015-9285](https://cve.now/CVE-2015-9285.md): esoTalk 1.0.0g4 has XSS via the PATH\_INFO to the conversations/ URI. (no CVSS)
- [CVE-2016-10749](https://cve.now/CVE-2016-10749.md): parse\_string in cJSON.c in cJSON before 2016-10-02 has a buffer over-read, as demonstrated by a string that begins with a " character and en (no CVSS)
- [CVE-2019-11591](https://cve.now/CVE-2019-11591.md): The WebDorado Contact Form plugin before 1.13.5 for WordPress allows CSRF via the wp-admin/admin-ajax.php action parameter, with resultant l (no CVSS)
- [CVE-2019-11590](https://cve.now/CVE-2019-11590.md): The 10Web Form Maker plugin before 1.13.5 for WordPress allows CSRF via the wp-admin/admin-ajax.php action parameter, with resultant local f (no CVSS)
- [CVE-2019-3560](https://cve.now/CVE-2019-3560.md): An improperly performed length calculation on a buffer in PlaintextRecordLayer could lead to an infinite loop and denial-of-service based on (no CVSS, Facebook fizz)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2019-04-29
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.