# CVEs published 2019-05-07

33 CVEs were published on May 7, 2019: 0 critical, 4 high. Days are UTC.

- [CVE-2019-10712](https://cve.now/CVE-2019-10712.md): The Web-GUI on WAGO Series 750-88x (750-330, 750-352, 750-829, 750-831, 750-852, 750-880, 750-881, 750-882, 750-884, 750-885, 750-889) and S (no CVSS)
- [CVE-2018-6243](https://cve.now/CVE-2018-6243.md): NVIDIA Tegra TLK Widevine Trust Application contains a vulnerability in which missing the input parameter checking of video metadata count m (no CVSS, NVIDIA Tegra TLK Widevine Trust Application)
- [CVE-2018-6634](https://cve.now/CVE-2018-6634.md): A vulnerability in Parsec Windows 142-0 and Parsec 'Linux Ubuntu 16.04 LTS Desktop' Build 142-1 allows unauthorized users to maintain access (no CVSS)
- [CVE-2019-7746](https://cve.now/CVE-2019-7746.md): JioFi 4 jmr1140 Amtel\_JMR1140\_R12.07 devices allow remote attackers to obtain an admin token by making a /cgi-bin/qcmap\_auth type=getuser re (no CVSS)
- [CVE-2019-7745](https://cve.now/CVE-2019-7745.md): JioFi 4 jmr1140 Amtel\_JMR1140\_R12.07 devices allow remote attackers to obtain the Wi-Fi password by making a cgi-bin/qcmap\_web\_cgi Page=GetW (no CVSS)
- [CVE-2019-7687](https://cve.now/CVE-2019-7687.md): cgi-bin/qcmap\_web\_cgi on JioFi 4 jmr1140 Amtel\_JMR1140\_R12.07 devices has POST based reflected XSS via the Page parameter. (no CVSS)
- [CVE-2019-7564](https://cve.now/CVE-2019-7564.md): An issue was discovered on Shenzhen Coship WM3300 WiFi Router 5.0.0.55 devices. (no CVSS)
- [CVE-2019-7541](https://cve.now/CVE-2019-7541.md): Rukovoditel through 2.4.1 allows XSS via a URL that lacks a module=users%2flogin substring. (no CVSS)
- [CVE-2019-7443](https://cve.now/CVE-2019-7443.md): KDE KAuth before 5.55 allows the passing of parameters with arbitrary types to helpers running as root over DBus via DBusHelperProxy.cpp. (no CVSS)
- [CVE-2019-10742](https://cve.now/CVE-2019-10742.md): Axios up to and including 0.18.0 allows attackers to cause a denial of service (application crash) by continuing to accepting content after (no CVSS, axios)
- [CVE-2019-4208](https://cve.now/CVE-2019-4208.md): IBM TRIRIGA Application Platform 3.5.3 and 3.6.0 is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. (CVSS 7.1, IBM TRIRIGA Application Platform)
- [CVE-2019-4207](https://cve.now/CVE-2019-4207.md): IBM TRIRIGA Application Platform 3.5.3 and 3.6.0 may disclose sensitive information only available to a local user that could be used in fur (CVSS 4.0, IBM TRIRIGA Application Platform)
- [CVE-2018-2008](https://cve.now/CVE-2018-2008.md): IBM TRIRIGA Application Platform 3.5.3 and 3.6.0 could disclose sensitive information to an authenticated user that could aid in further att (CVSS 4.3, IBM TRIRIGA Application Platform)
- [CVE-2018-2001](https://cve.now/CVE-2018-2001.md): IBM Cram Social Program Management 6.1.1, 6.2.0, 7.0.4, and 7.0.5 is vulnerable to cross-site request forgery which could allow an attacker (CVSS 4.3, IBM Cram Social Program Management)
- [CVE-2019-7427](https://cve.now/CVE-2019-7427.md): XSS exists in Zoho ManageEngine Netflow Analyzer Professional v7.0.0.2 in the Administration zone "/netflow/jspui/linkdownalertConfig.jsp" f (no CVSS)
- [CVE-2019-7426](https://cve.now/CVE-2019-7426.md): XSS exists in Zoho ManageEngine Netflow Analyzer Professional v7.0.0.2 in the Administration zone "/netflow/jspui/linkdownalertConfig.jsp" f (no CVSS)
- [CVE-2018-20503](https://cve.now/CVE-2018-20503.md): Allied Telesis 8100L/8 devices allow XSS via the edit-ipv4\_interface.php vlanid or subnet\_mask parameter. (no CVSS)
- [CVE-2018-19456](https://cve.now/CVE-2018-19456.md): The WP Backup+ (aka WPbackupplus) plugin through 2018-11-22 for WordPress allows remote attackers to obtain sensitive information from serve (no CVSS)
- [CVE-2018-14485](https://cve.now/CVE-2018-14485.md): BlogEngine.NET 3.3 allows XXE attacks via the POST body to metaweblog.axd. (no CVSS)
- [CVE-2018-14478](https://cve.now/CVE-2018-14478.md): ecard.php in Coppermine Photo Gallery (CPG) 1.5.46 has XSS via the sender\_name, recipient\_email, greetings, or recipient\_name parameter. (no CVSS)
- [CVE-2018-13994](https://cve.now/CVE-2018-13994.md): The WebUI of PHOENIX CONTACT FL SWITCH 3xxx, 4xxx, 48xx versions 1.0 to 1.34 is vulnerable to a denial-of-service attack by making more than (CVSS 7.5)
- [CVE-2018-13993](https://cve.now/CVE-2018-13993.md): The WebUI of PHOENIX CONTACT FL SWITCH 3xxx, 4xxx, 48xx versions 1.0 to 1.34 is prone to CSRF. (CVSS 8.8)
- [CVE-2018-13992](https://cve.now/CVE-2018-13992.md): The WebUI of PHOENIX CONTACT FL SWITCH 3xxx, 4xxx, 48xx versions 1.0 to 1.34 allows for plaintext transmission (HTTP) of user credentials by (CVSS 8.2)
- [CVE-2018-13991](https://cve.now/CVE-2018-13991.md): The WebUI of PHOENIX CONTACT FL SWITCH 3xxx, 4xxx, 48xx versions 1.0 to 1.34 leaks private information in firmware images. (CVSS 5.3)
- [CVE-2019-11629](https://cve.now/CVE-2019-11629.md): Sonatype Nexus Repository Manager 2.x before 2.14.13 allows XSS. (no CVSS)
- [CVE-2019-10869](https://cve.now/CVE-2019-10869.md): Path Traversal and Unrestricted File Upload exists in the Ninja Forms plugin before 3.0.23 for WordPress (when the Uploads add-on is activat (no CVSS)
- [CVE-2019-9708](https://cve.now/CVE-2019-9708.md): An issue was discovered in Mahara 17.10 before 17.10.8, 18.04 before 18.04.4, and 18.10 before 18.10.1. (no CVSS)
- [CVE-2019-11560](https://cve.now/CVE-2019-11560.md): A buffer overflow vulnerability in the streaming server provided by hisilicon in HI3516 models allows an unauthenticated attacker to remotel (no CVSS)
- [CVE-2019-9709](https://cve.now/CVE-2019-9709.md): An issue was discovered in Mahara 17.10 before 17.10.8, 18.04 before 18.04.4, and 18.10 before 18.10.1. (no CVSS)
- [CVE-2019-11811](https://cve.now/CVE-2019-11811.md): An issue was discovered in the Linux kernel before 5.0.4. (no CVSS)
- [CVE-2018-20836](https://cve.now/CVE-2018-20836.md): An issue was discovered in the Linux kernel before 4.20. (no CVSS)
- [CVE-2019-11810](https://cve.now/CVE-2019-11810.md): An issue was discovered in the Linux kernel before 5.0.7. (no CVSS)
- [CVE-2019-11808](https://cve.now/CVE-2019-11808.md): Ratpack versions before 1.6.1 generate a session ID using a cryptographically weak PRNG in the JDK's ThreadLocalRandom. (no CVSS, io.ratpack:ratpack-session · io.ratpack:ratpack-java +1)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2019-05-07
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.