CVEs published May 8, 2019
40 CVEs were published on May 8, 2019: 2 critical, 2 high. 1 is now in CISA KEV.
- Published
- 40
- Critical
- 2
- High
- 2
- Medium
- 2
- Low
- 0
- Unrated
- 34
- Now in CISA KEV
- 1
- Fix available
- 3
Most affected products
- Android
- 11
- PrinterLogic Management Software
- 3
- org.opencms:opencms-core
- 2
- Alpine Linux
- 1
- cakephp/cakephp
- 1
- Kaspersky Lab Antivirus Engine
- 1
- Symantec AV Engine
- 1
- Winco Firefly
- 1
Critical 2
High 2
- CVE-2019-11494In the IMAP Server in Dovecot 2.3.3 through 2.3.5.2, the submission-login service crashes when the client disconnects prematurely during the
- CVE-2019-11508In Pulse Secure Pulse Connect Secure (PCS) before 8.1R15.1, 8.2 before 8.2R12.1, 8.3 before 8.3R7.1, and 9.0 before 9.0R3.4, an authenticate
Medium, low and unrated 36
- CVE-2019-7442An XML external entity (XXE) vulnerability in the Password Vault Web Access (PVWA) of CyberArk Enterprise Password Vault <=10.7 allows remot
- CVE-2019-9698Symantec AV Engine, prior to 13.0.9r17, may be susceptible to an arbitrary file deletion issue, which is a type of vulnerability that could Symantec AV Engine
- CVE-2019-8285Kaspersky Lab Antivirus Engine version before 04.apr.2019 has a heap-based buffer overflow vulnerability that potentially allow arbitrary coKaspersky Lab Antivirus Engine
- CVE-2019-11398Multiple cross-site scripting (XSS) vulnerabilities in UliCMS 2019.2 and 2019.1 allow remote attackers to inject arbitrary web script or HTM
- CVE-2019-11406Subrion CMS 4.2.1 allows _core/en/contacts/ XSS via the name, email, or phone parameter.
- CVE-2019-11458An issue was discovered in SmtpTransport in CakePHP 3.7.6.cakephp/cakephp
- CVE-2019-11499In the IMAP Server in Dovecot 2.3.3 through 2.3.5.2, the submission-login component crashes if AUTH PLAIN is attempted over a TLS secured ch
- CVE-2019-11507In Pulse Secure Pulse Connect Secure (PCS) 8.3.x before 8.3R7.1 and 9.0.x before 9.0R3, an XSS issue has been found on the Application Launc
- CVE-2019-5014An exploitable improper access control vulnerability exists in the bluetooth low energy functionality of Winco Fireworks FireFly FW-1007 V2.Winco Firefly
- CVE-2019-2054In the seccomp implementation prior to kernel version 4.8, there is a possible seccomp bypass due to seccomp policies that allow the use of Android
- CVE-2019-2053In wnm_parse_neighbor_report_elem of wnm_sta.c, there is a possible out-of-bounds read due to missing bounds check.Android
- CVE-2019-2052In VisitPointers of heap.cc, there is a possible out-of-bounds read due to type confusion.Android
- CVE-2019-2051In heap of spaces.h, there is a possible out of bounds read due to improper input validation.Android
- CVE-2019-2050In tearDownClientInterface of WificondControl.java, there is a possible use after free due to improper locking.Android
- CVE-2019-2049In SendMediaUpdate and SendFolderUpdate of avrcp_service.cc, there is a possible memory corruption due to a use after free.Android
- CVE-2019-2047In UpdateLoadElement of ic.cc, there is a possible out-of-bounds write due to type confusion.Android
- CVE-2019-2046In CalculateInstanceSizeForDerivedClass of objects.cc, there is possible memory corruption due to an integer overflow.Android
- CVE-2019-2045In JSCallTyper of typer.cc, there is an out of bounds write due to an incorrect bounds check.Android
- CVE-2019-2044In MakeMP>G4VideoCodecSpecificData of APacketSource.cpp, there is a possible out-of-bounds write due to an incorrect bounds check.Android
- CVE-2019-2043In SmsDefaultDialog.onStart of SmsDefaultDialog.java, there is a possible escalation of privilege due to an overlay attack.Android
- CVE-2019-11550Citrix SD-WAN 10.2.x before 10.2.1 and NetScaler SD-WAN 10.0.x before 10.0.7 have Improper Certificate Validation.
- CVE-2019-11561The Chuango 433 MHz burglar-alarm product line is vulnerable to a Denial of Service attack.
- CVE-2019-11564A cross-site scripting (XSS) vulnerability in HumHub 1.3.12 allows remote attackers to inject arbitrary web script or HTML via a /protected/
- CVE-2019-11819Alkacon OpenCMS v10.5.4 and before is affected by CSV (aka Excel Macro) Injection in the module New User (/opencms/system/workplace/admin/acorg.opencms:opencms-core
- CVE-2019-11818Alkacon OpenCMS v10.5.4 and before is affected by stored cross site scripting (XSS) in the module New User (/opencms/system/workplace/admin/org.opencms:opencms-core
- CVE-2019-11642A log poisoning vulnerability has been discovered in the OneShield Policy (Dragon Core) framework before 5.1.10.
- CVE-2019-11643Persistent XSS has been found in the OneShield Policy (Dragon Core) framework before 5.1.10.
- CVE-2018-5408PrinterLogic Print Management Software fails to validate the management portal SSL certificatesPrinterLogic Management Software
- CVE-2018-5409PrinterLogic Print Management Software updates and executes the code without origin and code verificationPrinterLogic Management Software
- CVE-2019-9505PrinterLogic Print Management Software does not sanitize special charactersPrinterLogic Management Software
- CVE-2019-11815An issue was discovered in rds_tcp_kill_sock in net/rds/tcp.c in the Linux kernel before 5.0.8.
- CVE-2019-8349Multiple cross-site scripting (XSS) vulnerabilities in HTMLy 2.7.4 allow remote attackers to inject arbitrary web script or HTML via the (1)
- CVE-2019-8387MASTER IPCAMERA01 3.3.4.2103 devices allow Remote Command Execution, related to the thttpd component.
- CVE-2019-11814An issue was discovered in app/webroot/js/misp.js in MISP before 2.4.107.
- CVE-2019-11813An issue was discovered in app/View/Elements/Events/View/value_field.ctp in MISP before 2.4.107.
- CVE-2019-11812A persistent XSS issue was discovered in app/View/Helper/CommandHelper.php in MISP before 2.4.107.