CVEs published May 6, 2019
47 CVEs were published on May 6, 2019: 0 critical, 2 high. 1 is now in CISA KEV.
- Published
- 47
- Critical
- 0
- High
- 2
- Medium
- 0
- Low
- 1
- Unrated
- 44
- Now in CISA KEV
- 1
- Fix available
- 9
Most affected products
- Sierra Wireless
- 12
- Qualcomm Technologies Snapdragon Automobile, Snapdragon Mob…
- 6
- Facebook Thrift
- 4
- Apache Commons Imaging · org.apache.sanselan:sanselan
- 2
- Qualcomm Technologies Snapdragon Mobile
- 2
- Revive Adserver
- 2
- Facebook Thrift · github.com/facebook/fbthrift
- 1
- impresscms/impresscms
- 1
- mqtt-packet
- 1
- Qualcomm Technologies Small Cell SoC, Snapdragon Mobile, Sn…
- 1
High 2
- CVE-2018-13990The WebUI of PHOENIX CONTACT FL SWITCH 3xxx, 4xxx, 48xx versions prior to 1.35 is vulnerable to brute-force attacks, because of Improper Res
- CVE-2018-4063An exploitable remote code execution vulnerability exists in the upload.cgi functionality of Sierra Wireless AirLink ES450 FW 4.9.3.Sierra Wireless
Medium, low and unrated 45
- CVE-2017-18279Lack of check of buffer length before copying can lead to buffer overflow in camera module in Small Cell SoC, Snapdragon Mobile, Snapdragon Qualcomm Technologies Small Cell SoC, Snapdragon Mobile, Sn…
- CVE-2017-18278An integer underflow may occur due to lack of check when received data length from font_mgr_qsee_request_service is bigger than the minimal Qualcomm Technologies Snapdragon Automobile, Snapdragon Mob…
- CVE-2017-18276Secure camera logic allows display/secure camera controllers to access HLOS memory during secure display or camera session in Snapdragon MobQualcomm Technologies Snapdragon Mobile, Snapdragon Wear
- CVE-2017-18275A new account can be inserted into simContacts service using Android command line tool in Snapdragon Automobile, Snapdragon Mobile, SnapdragQualcomm Technologies Snapdragon Automobile, Snapdragon Mob…
- CVE-2017-18274While iterating through the models contained in a fixed-size array in the actData structure, which also stores an incorrect number of modelsQualcomm Technologies Snapdragon Automobile, Snapdragon Mob…
- CVE-2017-18173In case of using an invalid android verified boot signature with very large length, an integer underflow occurs in Snapdragon Mobile in SD 4Qualcomm Technologies Snapdragon Mobile
- CVE-2017-18157A Use After Free Condition can occur in Thermal Engine in Snapdragon Automobile, Snapdragon Mobile, Snapdragon Wear in MDM9206, MDM9607, MDMQualcomm Technologies Snapdragon Automobile, Snapdragon Mob…
- CVE-2017-18156While processing camera buffers in camera driver, a use after free condition can occur in Snapdragon Automobile, Snapdragon Mobile, SnapdragQualcomm Technologies Snapdragon Automobile, Snapdragon Mob…
- CVE-2017-15841When HOST sends a Special command ID packet, Controller triggers a RAM Dump and FW reset in Snapdragon Mobile in version SD 410/12, SD 425, Qualcomm Technologies Snapdragon Mobile
- CVE-2017-18131In QTEE, an incorrect fuse value can be blown in Snapdragon Automobile, Snapdragon Mobile, Snapdragon Wear in version MDM9206, MDM9607, MSM8Qualcomm Technologies Snapdragon Automobile, Snapdragon Mob…
- CVE-2019-11569Veeam ONE Reporter 9.5.0.3201 allows CSRF.
- CVE-2019-10999The D-Link DCS series of Wi-Fi cameras contains a stack-based buffer overflow in alphapd, the camera's web server.
- CVE-2018-18979An issue was discovered in the Ascensia Contour NEXT ONE application for Android before 2019-01-15.
- CVE-2018-18978An issue was discovered in the Ascensia Contour NEXT ONE application for Android before 2019-01-15.
- CVE-2018-18977An issue was discovered in the Ascensia Contour NEXT ONE application for Android before 2019-01-15.
- CVE-2018-18976An issue was discovered in the Ascensia Contour NEXT ONE application for iOS and Android before 2019-01-15.
- CVE-2018-18975An issue was discovered in the Ascensia Contour NEXT ONE app for iOS before 2019-01-15.
- CVE-2018-4067An exploitable information disclosure vulnerability exists in the ACEManager template_load.cgi functionality of Sierra Wireless AirLink ES45Sierra Wireless
- CVE-2018-4066An exploitable cross-site request forgery vulnerability exists in the ACEManager functionality of Sierra Wireless AirLink ES450 FW 4.9.3.Sierra Wireless
- CVE-2018-4062A hard-coded credentials vulnerability exists in the snmpd function of the Sierra Wireless AirLink ES450 FW 4.9.3.Sierra Wireless
- CVE-2018-4073An exploitable Permission Assignment vulnerability exists in the ACEManager EmbeddedAceSet_Task.cgi functionality of Sierra Wireless AirLinkSierra Wireless
- CVE-2018-4072An exploitable Permission Assignment vulnerability exists in the ACEManager EmbeddedAceSet_Task.cgi functionality of Sierra Wireless AirLinkSierra Wireless
- CVE-2018-13983ImpressCMS 1.3.10 has XSS via the PATH_INFO to htdocs/install/index.php, htdocs/install/page_langselect.php, or htdocs/install/page_modcheckimpresscms/impresscms
- CVE-2018-4071An exploitable Information Disclosure vulnerability exists in the ACEManager EmbeddedAceGet_Task.cgi functionality of Sierra Wireless AirLinSierra Wireless
- CVE-2018-4070An exploitable Information Disclosure vulnerability exists in the ACEManager EmbeddedAceGet_Task.cgi functionality of Sierra Wireless AirLinSierra Wireless
- CVE-2018-4065An exploitable cross-site scripting vulnerability exists in the ACEManager ping_result.cgi functionality of Sierra Wireless AirLink ES450 FWSierra Wireless
- CVE-2018-4061An exploitable command injection vulnerability exists in the ACEManager iplogging.cgi functionality of Sierra Wireless AirLink ES450 FW 4.9.Sierra Wireless
- CVE-2018-4068An exploitable information disclosure vulnerability exists in the ACEManager functionality of Sierra Wireless AirLink ES450 FW 4.9.3.Sierra Wireless
- CVE-2019-11807The WooCommerce Checkout Manager plugin before 4.3 for WordPress allows media deletion via the wp-admin/admin-ajax.php?action=update_attachm
- CVE-2018-4069An information disclosure vulnerability exists in the ACEManager authentication functionality of Sierra Wireless AirLink ES450 FW 4.9.3.Sierra Wireless
- CVE-2018-17202Certain input files could make the code to enter into an infinite loop when Apache Sanselan 0.97-incubator was used to parse them, which couApache Commons Imaging · org.apache.sanselan:sanselan
- CVE-2018-17201Certain input files could make the code hang when Apache Sanselan 0.97-incubator was used to parse them, which could be used in a DoS attackApache Commons Imaging · org.apache.sanselan:sanselan
- CVE-2019-5430In UniFi Video 3.10.0 and prior, due to the lack of CSRF protection, it is possible to abuse the Web API to make changes on the server confiUniFi Video Server
- CVE-2019-5434An attacker could send a specifically crafted payload to the XML-RPC invocation script and trigger the unserialize() call on the "what" paraRevive Adserver
- CVE-2019-5433A user having access to the UI of a Revive Adserver instance could be tricked into clicking on a specifically crafted admin account-switch.pRevive Adserver
- CVE-2019-5432A specifically malformed MQTT Subscribe packet crashes MQTT Brokers using the mqtt-packet module versions < 3.5.1, 4.0.0 - 4.1.3, 5.0.0 - 5.mqtt-packet
- CVE-2019-5431This vulnerability was caused by an incomplete fix to CVE-2017-0911.Twitter Kit for iOS
- CVE-2019-10249All Xtext & Xtend versions prior to 2.18.0 were built using HTTP instead of HTTPS file transfer and thus the built artifacts may have been cThe Eclipse Foundation Eclipse Xtext · org.eclipse.xtext… +1
- CVE-2019-3799Directory Traversal with spring-cloud-config-serverSpring Cloud Config · org.springframework.cloud:spring-clou…
- CVE-2019-3797Additional information exposure with Spring Data JPA derived queriesSpring Boot · org.springframework.data:spring-data-jpa
- CVE-2019-3552C++ Facebook Thrift servers (using cpp2) would not error upon receiving messages with containers of fields of unknown type.Facebook Thrift
- CVE-2019-3558Python Facebook Thrift servers would not error upon receiving messages with containers of fields of unknown type.Facebook Thrift
- CVE-2019-3559Java Facebook Thrift servers would not error upon receiving messages with containers of fields of unknown type.Facebook Thrift
- CVE-2019-3564Go Facebook Thrift servers would not error upon receiving messages with containers of fields of unknown type.Facebook Thrift · github.com/facebook/fbthrift
- CVE-2019-3565Legacy C++ Facebook Thrift servers (using cpp instead of cpp2) would not error upon receiving messages with containers of fields of unknown Facebook Thrift