CVEs published May 2, 2019
26 CVEs were published on May 2, 2019: 1 critical, 1 high. 1 is now in CISA KEV.
- Published
- 26
- Critical
- 1
- High
- 1
- Medium
- 1
- Low
- 0
- Unrated
- 23
- Now in CISA KEV
- 1
- Fix available
- 1
Most affected products
- IBM API Connect
- 1
- Mozilla Network Security Services
- 1
- OES Netstorage component of Open Enterprise Server
- 1
- phpbb/phpbb
- 1
Critical 1
High 1
Medium, low and unrated 24
- CVE-2019-9826The fulltext search component in phpBB before 3.2.6 allows Denial of Service.phpbb/phpbb
- CVE-2018-10383Lantronix SecureLinx Spider (SLS) 2.2+ devices have XSS in the auth.asp login page.
- CVE-2018-16988An issue was discovered in Open XDMoD through 7.5.0.
- CVE-2018-16961An issue was discovered in Open XDMoD through 7.5.0.
- CVE-2018-16960An issue was discovered in Open XDMoD through 7.5.0.
- CVE-2018-16718An XSS vulnerability exists in wwwblast.c in the 2.0.7 through 2.2.26 legacy versions of the NCBI ToolBox via a crafted -z1 argument.
- CVE-2018-16717A heap-based buffer overflow exists in nph-viewgif.cgi in the 2.0.7 through 2.2.26 legacy versions of the NCBI ToolBox.
- CVE-2018-16716A path traversal vulnerability exists in viewcgi.c in the 2.0.7 through 2.2.26 legacy versions of the NCBI ToolBox, which may result in read
- CVE-2019-9017DWRCC in SolarWinds DameWare Mini Remote Control 10.0 x64 has a Buffer Overflow associated with the size field for the machine name.
- CVE-2019-11683udp_gro_receive_segment in net/ipv4/udp_offload.c in the Linux kernel 5.x before 5.0.13 allows remote attackers to cause a denial of service
- CVE-2019-3490A DOM based XSS vulnerability has been identified in the Netstorage component of Open Enterprise Server (OES) allowing a remote attacker to OES Netstorage component of Open Enterprise Server
- CVE-2018-12404A cached side channel attack during handshakes using RSA encryption could allow for the decryption of encrypted content.Mozilla Network Security Services
- CVE-2017-18374The ZyXEL P660HN-T1A v1 TCLinux Fw $7.3.15.0 v001 / 3.40(ULM.0)b31 router distributed by TrueOnline has two user accounts with default passw
- CVE-2017-18373The Billion 5200W-T TCLinux Fw $7.3.8.0 v008 130603 router distributed by TrueOnline has three user accounts with default passwords, includi
- CVE-2017-18372The Billion 5200W-T TCLinux Fw $7.3.8.0 v008 130603 router distributed by TrueOnline has a command injection vulnerability in the Time Setti
- CVE-2017-18371The ZyXEL P660HN-T1A v2 TCLinux Fw #7.3.37.6 router distributed by TrueOnline has three user accounts with default passwords, including two
- CVE-2017-18370The ZyXEL P660HN-T1A v2 TCLinux Fw #7.3.37.6 router distributed by TrueOnline has a command injection vulnerability in the Remote System Log
- CVE-2017-18369The Billion 5200W-T 1.02b.rc5.dt49 router distributed by TrueOnline has a command injection vulnerability in the Remote System Log forwardin
- CVE-2018-2015IBM API Connect 2018.1 and 2018.4.1.4 could allow a remote attacker to hijack the clicking action of the victim.IBM API Connect
- CVE-2019-11682A buffer overflow in the SMTP response service in MailCarrier 2.51 allows the attacker to execute arbitrary code remotely via a long HELP co
- CVE-2019-11678The "default reports" feature in Zoho ManageEngine Firewall Analyzer before 12.3 Build 123218 is vulnerable to SQL Injection.
- CVE-2019-11677The Custom Report import function in Zoho ManageEngine Firewall Analyzer before 12.3 Build 123224 is vulnerable to XML External Entity (XXE)
- CVE-2019-11676The user defined DNS name in Zoho ManageEngine Firewall Analyzer before 12.3 Build 123224 is vulnerable to stored XSS attacks.
- CVE-2019-11675The groonga-httpd package 6.1.5-1 for Debian sets the /var/log/groonga ownership to the groonga account, which might let local users obtain