CVEs published April 30, 2019
77 CVEs were published on April 30, 2019: 1 critical, 3 high. 2 are now in CISA KEV.
- Published
- 77
- Critical
- 1
- High
- 3
- Medium
- 1
- Low
- 0
- Unrated
- 72
- Now in CISA KEV
- 2
- Fix available
- 17
Most affected products
- Crestron AirMedia
- 13
- Jenkins project Jenkins Ansible Tower Plugin · org.jenkins-…
- 3
- Apache Archiva · org.apache.archiva:archiva
- 2
- Crestron AirMedia, Barco WePresent, Extron ShareLink, Teq A…
- 2
- Fujifilm FCR Capsula X/ Carbon X
- 2
- Jenkins project Jenkins Static Analysis Utilities Plugin ·…
- 2
- Apache Camel · org.apache.camel:camel-core
- 1
- Atlassian Application Links
- 1
- Atlassian Jira
- 1
- IBM StoredIQ
- 1
Critical 1
High 3
- CVE-2019-9621Zimbra Collaboration Suite before 8.6 patch 13, 8.7.x before 8.7.11 patch 10, and 8.8.x before 8.8.10 patch 7 or 8.8.x before 8.8.11 patch 3
- CVE-2019-5624Rapid7 Metasploit Framework Zip Import Directory TraversalRapid7 Metasploit Framework
- CVE-2019-4166IBM StoredIQ 7.6 could allow a remote attacker to conduct phishing attacks, using an open redirect attack.IBM StoredIQ
Medium, low and unrated 73
- CVE-2019-11627gpg-key2ps in signing-party 1.1.x and 2.x before 2.10-1 contains an unsafe shell call enabling shell injection via a User ID.
- CVE-2019-0214In Apache Archiva 2.0.0 - 2.2.3, it is possible to write files to the archiva server at arbitrary locations by using the artifact upload mecApache Archiva · org.apache.archiva:archiva
- CVE-2019-0213In Apache Archiva before 2.2.4, it may be possible to store malicious XSS code into central configuration entries, i.e.Apache Archiva · org.apache.archiva:archiva
- CVE-2019-0194Apache Camel's File is vulnerable to directory traversal.Apache Camel · org.apache.camel:camel-core
- CVE-2019-3939Crestron AM-100 with firmware 1.6.0.2 and AM-101 with firmware 2.7.0.2 use default credentials admin/admin and moderator/moderator for the wCrestron AirMedia
- CVE-2019-3938Crestron AM-100 with firmware 1.6.0.2 and AM-101 with firmware 2.7.0.2 stores usernames, passwords, and other configuration options in the fCrestron AirMedia
- CVE-2019-3937Crestron AM-100 with firmware 1.6.0.2 and AM-101 with firmware 2.7.0.2 stores usernames, passwords, slideshow passcode, and other configuratCrestron AirMedia
- CVE-2019-3936Crestron AM-100 with firmware 1.6.0.2 and AM-101 with firmware 2.7.0.2 is vulnerable to denial of service via a crafted request to TCP port Crestron AirMedia
- CVE-2019-3935Crestron AM-100 with firmware 1.6.0.2 and AM-101 with firmware 2.7.0.2 allows anyone to act as a moderator to a slide show via crafted HTTP Crestron AirMedia
- CVE-2019-3934Crestron AM-100 with firmware 1.6.0.2 and AM-101 with firmware 2.7.0.2 allows anyone to bypass the presentation code sending a crafted HTTP Crestron AirMedia
- CVE-2019-3933Crestron AM-100 with firmware 1.6.0.2 and AM-101 with firmware 2.7.0.2 allows anyone to bypass the presentation code simply by requesting /iCrestron AirMedia
- CVE-2019-3932Crestron AM-100 with firmware 1.6.0.2 and AM-101 with firmware 2.7.0.2 are vulnerable to authentication bypass due to a hard-coded password Crestron AirMedia
- CVE-2019-3931Crestron AM-100 with firmware 1.6.0.2 and AM-101 with firmware 2.7.0.2 are vulnerable to argumention injection to the curl binary via crafteCrestron AirMedia
- CVE-2019-3930The Crestron AM-100 firmware 1.6.0.2, Crestron AM-101 firmware 2.7.0.1, Barco wePresent WiPG-1000P firmware 2.3.0.10, Barco wePresent WiPG-1Crestron AirMedia, Barco WePresent, Extron ShareLink, Teq A…
- CVE-2019-3928Crestron AM-100 with firmware 1.6.0.2 and AM-101 with firmware 2.7.0.2 allow any user to obtain the presentation passcode via the iso.3.6.1.Crestron AirMedia
- CVE-2019-3927Crestron AM-100 with firmware 1.6.0.2 and AM-101 with firmware 2.7.0.2 anyone can change the administrator and moderator passwords via the iCrestron AirMedia
- CVE-2019-3926Crestron AM-100 with firmware 1.6.0.2 and AM-101 with firmware 2.7.0.2 are vulnerable to command injection via SNMP OID iso.3.6.1.4.1.3212.1Crestron AirMedia
- CVE-2019-3925Crestron AM-100 with firmware 1.6.0.2 and AM-101 with firmware 2.7.0.2 are vulnerable to command injection via SNMP OID iso.3.6.1.4.1.3212.1Crestron AirMedia
- CVE-2019-11626routers/ajaxRouter.php in doorGets 7.0 has a web site physical path leakage vulnerability, as demonstrated by an ajax/index.php?uri=1234%5c
- CVE-2019-11625doorGets 7.0 has a SQL injection vulnerability in /doorgets/app/requests/user/emailingRequest.php.
- CVE-2019-11624doorGets 7.0 has an arbitrary file deletion vulnerability in /doorgets/app/requests/user/configurationRequest.php.
- CVE-2019-11623doorGets 7.0 has a SQL injection vulnerability in /doorgets/app/requests/user/configurationRequest.php when action=siteweb.
- CVE-2019-11622doorGets 7.0 has a SQL injection vulnerability in /doorgets/app/requests/user/modulecategoryRequest.php.
- CVE-2019-11621doorGets 7.0 has a SQL injection vulnerability in /doorgets/app/requests/user/configurationRequest.php when action=network.
- CVE-2019-11620doorGets 7.0 has a SQL injection vulnerability in /doorgets/app/requests/user/modulecategoryRequest.php.
- CVE-2019-11619doorGets 7.0 has a SQL injection vulnerability in /doorgets/app/requests/user/configurationRequest.php when action=analytics.
- CVE-2019-11618doorGets 7.0 has a default administrator credential vulnerability.
- CVE-2019-11617doorGets 7.0 has a CSRF vulnerability in /doorgets/app/requests/user/configurationRequest.php.
- CVE-2019-11616doorGets 7.0 has a sensitive information disclosure vulnerability in /setup/temp/admin.php and /setup/temp/database.php.
- CVE-2019-11615/fileman/php/upload.php in doorGets 7.0 has an arbitrary file upload vulnerability.
- CVE-2019-11614doorGets 7.0 has a SQL injection vulnerability in /doorgets/app/views/ajax/commentView.php.
- CVE-2019-11613doorGets 7.0 has a SQL injection vulnerability in /doorgets/app/views/ajax/contactView.php.
- CVE-2019-11612doorGets 7.0 has an arbitrary file deletion vulnerability in /fileman/php/deletefile.php.
- CVE-2019-11611doorGets 7.0 has a sensitive information disclosure vulnerability in /fileman/php/download.php.
- CVE-2019-11610doorGets 7.0 has a sensitive information disclosure vulnerability in /fileman/php/downloaddir.php.
- CVE-2019-11609doorGets 7.0 has a sensitive information disclosure vulnerability in /fileman/php/movefile.php.
- CVE-2019-11608doorGets 7.0 has a sensitive information disclosure vulnerability in /fileman/php/renamefile.php.
- CVE-2019-11607doorGets 7.0 has a sensitive information disclosure vulnerability in /fileman/php/copydir.php.
- CVE-2019-11606doorGets 7.0 has a sensitive information disclosure vulnerability in /fileman/php/copyfile.php.
- CVE-2018-14930An issue was discovered in the Armor module in Polaris FT Intellect Core Banking 9.7.1.
- CVE-2018-14874An issue was discovered in the Armor module in Polaris FT Intellect Core Banking 9.7.1.
- CVE-2018-14875An issue was discovered in the Core and Portal modules in Polaris FT Intellect Core Banking 9.7.1.
- CVE-2018-14931An issue was discovered in the Core and Portal modules in Polaris FT Intellect Core Banking 9.7.1.
- CVE-2018-15208BPC SmartVista 2 has Session Fixation via the JSESSIONID parameter.
- CVE-2018-15207BPC SmartVista 2 has Improper Access Control in the SVFE module, where it fails to appropriately restrict access: a normal user is able to a
- CVE-2018-15206BPC SmartVista 2 has CSRF via SVFE2/pages/admpages/roles/createrole.jsf.
- CVE-2019-11193The FileManager in InfinitumIT DirectAdmin through v1.561 has XSS via CMD_FILE_MANAGER, CMD_SHOW_USER, and CMD_SHOW_RESELLER; an attacker ca
- CVE-2019-9486STRATO HiDrive Desktop Client 5.0.1.0 for Windows suffers from a SYSTEM privilege escalation vulnerability through the HiDriveMaintenanceSer
- CVE-2018-20835A vulnerability was found in tar-fs before 1.16.2.tar-fs
- CVE-2018-20834A vulnerability was found in node-tar before version 4.4.2 (excluding version 2.2.2).tar
- CVE-2019-10131An off-by-one read vulnerability was discovered in ImageMagick before version 7.0.7-28 in the formatIPTCfromBuffer function in coders/meta.cImageMagick
- CVE-2019-10272An issue was discovered in Weaver e-cology 9.0.
- CVE-2018-19374Zoho ManageEngine ADManager Plus 6.6 Build 6657 allows local users to gain privileges (after a reboot) by placing a Trojan horse file into t
- CVE-2018-20510The print_binder_transaction_ilocked function in drivers/android/binder.c in the Linux kernel 4.14.90 allows local users to obtain sensitive
- CVE-2018-20509The print_binder_ref_olocked function in drivers/android/binder.c in the Linux kernel 4.14.90 allows local users to obtain sensitive address
- CVE-2019-10950Fujifilm FCR Capsula X/ Carbon X/ FCR XC-2, model versions CR-IR 357 FCR Carbon X, CR-IR 357 FCR XC-2, FCR-IR 357 FCR Capsula X provide inseFujifilm FCR Capsula X/ Carbon X
- CVE-2019-10948Fujifilm FCR Capsula X/ Carbon X/ FCR XC-2, model versions CR-IR 357 FCR Carbon X, CR-IR 357 FCR XC-2, FCR-IR 357 FCR Capsula X are susceptiFujifilm FCR Capsula X/ Carbon X
- CVE-2019-3399The BrowseProjects.jspa resource in Jira before version 7.13.2, and from version 8.0.0 before version 8.0.2 allows remote attackers to see iAtlassian Jira
- CVE-2018-20239Application Links before version 5.0.11, from version 5.1.0 before 5.2.10, from version 5.3.0 before 5.3.6, from version 5.4.0 before 5.4.12Atlassian Application Links
- CVE-2019-6494IMFForceDelete.sys in IObit Malware Fighter 6.2 allows a low privileged user to send IOCTL 0x8016E000 along with a user defined string to a
- CVE-2015-9286Controllers.outgoing in controllers/index.js in NodeBB before 0.7.3 has outgoing XSS.nodebb
- CVE-2019-10316Jenkins Aqua MicroScanner Plugin 1.0.5 and earlier stored credentials unencrypted in its global configuration file on the Jenkins master wheJenkins project Jenkins Aqua MicroScanner Plugin · org.jenk…
- CVE-2019-10317Jenkins SiteMonitor Plugin 0.5 and earlier disabled SSL/TLS and hostname verification globally for the Jenkins master JVM.Jenkins project Jenkins SiteMonitor Plugin · org.jvnet.huds…
- CVE-2019-10318Jenkins Azure AD Plugin 0.3.3 and earlier stored the client secret unencrypted in the global config.xml configuration file on the Jenkins maJenkins project Jenkins Azure AD Plugin · org.jenkins-ci.pl…
- CVE-2019-10307A cross-site request forgery vulnerability in Jenkins Static Analysis Utilities Plugin 1.95 and earlier in the DefaultGraphConfigurationViewJenkins project Jenkins Static Analysis Utilities Plugin ·…
- CVE-2019-10308A missing permission check in Jenkins Static Analysis Utilities Plugin 1.95 and earlier in the DefaultGraphConfigurationView#doSave form hanJenkins project Jenkins Static Analysis Utilities Plugin ·…
- CVE-2019-10309Jenkins Self-Organizing Swarm Plug-in Modules Plugin clients that use UDP broadcasts to discover Jenkins masters do not prevent XML ExternalJenkins project Jenkins Self-Organizing Swarm Plug-in Modul…
- CVE-2019-10310A cross-site request forgery vulnerability in Jenkins Ansible Tower Plugin 0.9.1 and earlier in the TowerInstallation.TowerInstallationDescrJenkins project Jenkins Ansible Tower Plugin · org.jenkins-…
- CVE-2019-10311A missing permission check in Jenkins Ansible Tower Plugin 0.9.1 and earlier in the TowerInstallation.TowerInstallationDescriptor#doTestToweJenkins project Jenkins Ansible Tower Plugin · org.jenkins-…
- CVE-2019-10312A missing permission check in Jenkins Ansible Tower Plugin 0.9.1 and earlier in the TowerInstallation.TowerInstallationDescriptor#doFillToweJenkins project Jenkins Ansible Tower Plugin · org.jenkins-…
- CVE-2019-10313Jenkins Twitter Plugin stores credentials unencrypted in its global configuration file on the Jenkins master where they can be viewed by useJenkins project Jenkins Twitter Plugin · org.jenkins-ci.plu…
- CVE-2019-10314Jenkins Koji Plugin disables SSL/TLS and hostname verification globally for the Jenkins master JVM.Jenkins project Jenkins Koji Plugin · org.jenkins-ci.plugin…
- CVE-2019-10315Jenkins GitHub Authentication Plugin 0.31 and earlier did not use the state parameter of OAuth to prevent CSRF.Jenkins project Jenkins GitHub Authentication Plugin · org.…