CVEs published May 7, 2019
33 CVEs were published on May 7, 2019: 0 critical, 4 high.
- Published
- 33
- Critical
- 0
- High
- 4
- Medium
- 4
- Low
- 0
- Unrated
- 25
- Now in CISA KEV
- 0
- Fix available
- 2
Most affected products
- IBM TRIRIGA Application Platform
- 3
- axios
- 1
- IBM Cram Social Program Management
- 1
- io.ratpack:ratpack-session · io.ratpack:ratpack-java +1
- 1
- NVIDIA Tegra TLK Widevine Trust Application
- 1
High 4
- CVE-2019-4208IBM TRIRIGA Application Platform 3.5.3 and 3.6.0 is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data.IBM TRIRIGA Application Platform
- CVE-2018-13994The WebUI of PHOENIX CONTACT FL SWITCH 3xxx, 4xxx, 48xx versions 1.0 to 1.34 is vulnerable to a denial-of-service attack by making more than
- CVE-2018-13993The WebUI of PHOENIX CONTACT FL SWITCH 3xxx, 4xxx, 48xx versions 1.0 to 1.34 is prone to CSRF.
- CVE-2018-13992The WebUI of PHOENIX CONTACT FL SWITCH 3xxx, 4xxx, 48xx versions 1.0 to 1.34 allows for plaintext transmission (HTTP) of user credentials by
Medium, low and unrated 29
- CVE-2019-10712The Web-GUI on WAGO Series 750-88x (750-330, 750-352, 750-829, 750-831, 750-852, 750-880, 750-881, 750-882, 750-884, 750-885, 750-889) and S
- CVE-2018-6243NVIDIA Tegra TLK Widevine Trust Application contains a vulnerability in which missing the input parameter checking of video metadata count mNVIDIA Tegra TLK Widevine Trust Application
- CVE-2018-6634A vulnerability in Parsec Windows 142-0 and Parsec 'Linux Ubuntu 16.04 LTS Desktop' Build 142-1 allows unauthorized users to maintain access
- CVE-2019-7746JioFi 4 jmr1140 Amtel_JMR1140_R12.07 devices allow remote attackers to obtain an admin token by making a /cgi-bin/qcmap_auth type=getuser re
- CVE-2019-7745JioFi 4 jmr1140 Amtel_JMR1140_R12.07 devices allow remote attackers to obtain the Wi-Fi password by making a cgi-bin/qcmap_web_cgi Page=GetW
- CVE-2019-7687cgi-bin/qcmap_web_cgi on JioFi 4 jmr1140 Amtel_JMR1140_R12.07 devices has POST based reflected XSS via the Page parameter.
- CVE-2019-7564An issue was discovered on Shenzhen Coship WM3300 WiFi Router 5.0.0.55 devices.
- CVE-2019-7541Rukovoditel through 2.4.1 allows XSS via a URL that lacks a module=users%2flogin substring.
- CVE-2019-7443KDE KAuth before 5.55 allows the passing of parameters with arbitrary types to helpers running as root over DBus via DBusHelperProxy.cpp.
- CVE-2019-10742Axios up to and including 0.18.0 allows attackers to cause a denial of service (application crash) by continuing to accepting content after axios
- CVE-2019-4207IBM TRIRIGA Application Platform 3.5.3 and 3.6.0 may disclose sensitive information only available to a local user that could be used in furIBM TRIRIGA Application Platform
- CVE-2018-2008IBM TRIRIGA Application Platform 3.5.3 and 3.6.0 could disclose sensitive information to an authenticated user that could aid in further attIBM TRIRIGA Application Platform
- CVE-2018-2001IBM Cram Social Program Management 6.1.1, 6.2.0, 7.0.4, and 7.0.5 is vulnerable to cross-site request forgery which could allow an attacker IBM Cram Social Program Management
- CVE-2019-7427XSS exists in Zoho ManageEngine Netflow Analyzer Professional v7.0.0.2 in the Administration zone "/netflow/jspui/linkdownalertConfig.jsp" f
- CVE-2019-7426XSS exists in Zoho ManageEngine Netflow Analyzer Professional v7.0.0.2 in the Administration zone "/netflow/jspui/linkdownalertConfig.jsp" f
- CVE-2018-20503Allied Telesis 8100L/8 devices allow XSS via the edit-ipv4_interface.php vlanid or subnet_mask parameter.
- CVE-2018-19456The WP Backup+ (aka WPbackupplus) plugin through 2018-11-22 for WordPress allows remote attackers to obtain sensitive information from serve
- CVE-2018-14485BlogEngine.NET 3.3 allows XXE attacks via the POST body to metaweblog.axd.
- CVE-2018-14478ecard.php in Coppermine Photo Gallery (CPG) 1.5.46 has XSS via the sender_name, recipient_email, greetings, or recipient_name parameter.
- CVE-2018-13991The WebUI of PHOENIX CONTACT FL SWITCH 3xxx, 4xxx, 48xx versions 1.0 to 1.34 leaks private information in firmware images.
- CVE-2019-11629Sonatype Nexus Repository Manager 2.x before 2.14.13 allows XSS.
- CVE-2019-10869Path Traversal and Unrestricted File Upload exists in the Ninja Forms plugin before 3.0.23 for WordPress (when the Uploads add-on is activat
- CVE-2019-9708An issue was discovered in Mahara 17.10 before 17.10.8, 18.04 before 18.04.4, and 18.10 before 18.10.1.
- CVE-2019-11560A buffer overflow vulnerability in the streaming server provided by hisilicon in HI3516 models allows an unauthenticated attacker to remotel
- CVE-2019-9709An issue was discovered in Mahara 17.10 before 17.10.8, 18.04 before 18.04.4, and 18.10 before 18.10.1.
- CVE-2019-11811An issue was discovered in the Linux kernel before 5.0.4.
- CVE-2018-20836An issue was discovered in the Linux kernel before 4.20.
- CVE-2019-11810An issue was discovered in the Linux kernel before 5.0.7.
- CVE-2019-11808Ratpack versions before 1.6.1 generate a session ID using a cryptographically weak PRNG in the JDK's ThreadLocalRandom.io.ratpack:ratpack-session · io.ratpack:ratpack-java +1