# CVEs published 2019-05-02

26 CVEs were published on May 2, 2019: 1 critical, 1 high. 1 is now in CISA KEV. Days are UTC.

- [CVE-2019-11687](https://cve.now/CVE-2019-11687.md): An issue was discovered in the DICOM Part 10 File Format in the NEMA DICOM Standard 1995 through 2019b and continuing in current implementat (CVSS 7.8)
- [CVE-2019-9826](https://cve.now/CVE-2019-9826.md): The fulltext search component in phpBB before 3.2.6 allows Denial of Service. (no CVSS, phpbb/phpbb)
- [CVE-2018-10383](https://cve.now/CVE-2018-10383.md): Lantronix SecureLinx Spider (SLS) 2.2+ devices have XSS in the auth.asp login page. (no CVSS)
- [CVE-2018-16988](https://cve.now/CVE-2018-16988.md): An issue was discovered in Open XDMoD through 7.5.0. (no CVSS)
- [CVE-2018-16961](https://cve.now/CVE-2018-16961.md): An issue was discovered in Open XDMoD through 7.5.0. (no CVSS)
- [CVE-2018-16960](https://cve.now/CVE-2018-16960.md): An issue was discovered in Open XDMoD through 7.5.0. (no CVSS)
- [CVE-2018-16718](https://cve.now/CVE-2018-16718.md): An XSS vulnerability exists in wwwblast.c in the 2.0.7 through 2.2.26 legacy versions of the NCBI ToolBox via a crafted -z1 argument. (no CVSS)
- [CVE-2018-16717](https://cve.now/CVE-2018-16717.md): A heap-based buffer overflow exists in nph-viewgif.cgi in the 2.0.7 through 2.2.26 legacy versions of the NCBI ToolBox. (no CVSS)
- [CVE-2018-16716](https://cve.now/CVE-2018-16716.md): A path traversal vulnerability exists in viewcgi.c in the 2.0.7 through 2.2.26 legacy versions of the NCBI ToolBox, which may result in read (no CVSS)
- [CVE-2019-9017](https://cve.now/CVE-2019-9017.md): DWRCC in SolarWinds DameWare Mini Remote Control 10.0 x64 has a Buffer Overflow associated with the size field for the machine name. (no CVSS)
- [CVE-2019-11683](https://cve.now/CVE-2019-11683.md): udp\_gro\_receive\_segment in net/ipv4/udp\_offload.c in the Linux kernel 5.x before 5.0.13 allows remote attackers to cause a denial of service (no CVSS)
- [CVE-2019-3490](https://cve.now/CVE-2019-3490.md): A DOM based XSS vulnerability has been identified in the Netstorage component of Open Enterprise Server (OES) allowing a remote attacker to (no CVSS, OES Netstorage component of Open Enterprise Server)
- [CVE-2018-12404](https://cve.now/CVE-2018-12404.md): A cached side channel attack during handshakes using RSA encryption could allow for the decryption of encrypted content. (no CVSS, Mozilla Network Security Services)
- [CVE-2017-18374](https://cve.now/CVE-2017-18374.md): The ZyXEL P660HN-T1A v1 TCLinux Fw $7.3.15.0 v001 / 3.40(ULM.0)b31 router distributed by TrueOnline has two user accounts with default passw (no CVSS)
- [CVE-2017-18373](https://cve.now/CVE-2017-18373.md): The Billion 5200W-T TCLinux Fw $7.3.8.0 v008 130603 router distributed by TrueOnline has three user accounts with default passwords, includi (no CVSS)
- [CVE-2017-18372](https://cve.now/CVE-2017-18372.md): The Billion 5200W-T TCLinux Fw $7.3.8.0 v008 130603 router distributed by TrueOnline has a command injection vulnerability in the Time Setti (no CVSS)
- [CVE-2017-18371](https://cve.now/CVE-2017-18371.md): The ZyXEL P660HN-T1A v2 TCLinux Fw #7.3.37.6 router distributed by TrueOnline has three user accounts with default passwords, including two (no CVSS)
- [CVE-2017-18370](https://cve.now/CVE-2017-18370.md): The ZyXEL P660HN-T1A v2 TCLinux Fw #7.3.37.6 router distributed by TrueOnline has a command injection vulnerability in the Remote System Log (no CVSS)
- [CVE-2017-18369](https://cve.now/CVE-2017-18369.md): The Billion 5200W-T 1.02b.rc5.dt49 router distributed by TrueOnline has a command injection vulnerability in the Remote System Log forwardin (no CVSS)
- [CVE-2017-18368](https://cve.now/CVE-2017-18368.md): The ZyXEL P660HN-T1A v1 TCLinux Fw $7.3.15.0 v001 / 3.40(ULM.0)b31 router distributed by TrueOnline has a command injection vulnerability in (CVSS 9.8, KEV)
- [CVE-2018-2015](https://cve.now/CVE-2018-2015.md): IBM API Connect 2018.1 and 2018.4.1.4 could allow a remote attacker to hijack the clicking action of the victim. (CVSS 6.4, IBM API Connect)
- [CVE-2019-11682](https://cve.now/CVE-2019-11682.md): A buffer overflow in the SMTP response service in MailCarrier 2.51 allows the attacker to execute arbitrary code remotely via a long HELP co (no CVSS)
- [CVE-2019-11678](https://cve.now/CVE-2019-11678.md): The "default reports" feature in Zoho ManageEngine Firewall Analyzer before 12.3 Build 123218 is vulnerable to SQL Injection. (no CVSS)
- [CVE-2019-11677](https://cve.now/CVE-2019-11677.md): The Custom Report import function in Zoho ManageEngine Firewall Analyzer before 12.3 Build 123224 is vulnerable to XML External Entity (XXE) (no CVSS)
- [CVE-2019-11676](https://cve.now/CVE-2019-11676.md): The user defined DNS name in Zoho ManageEngine Firewall Analyzer before 12.3 Build 123224 is vulnerable to stored XSS attacks. (no CVSS)
- [CVE-2019-11675](https://cve.now/CVE-2019-11675.md): The groonga-httpd package 6.1.5-1 for Debian sets the /var/log/groonga ownership to the groonga account, which might let local users obtain (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2019-05-02
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.