# CVEs published 2019-05-08

40 CVEs were published on May 8, 2019: 2 critical, 2 high. 1 is now in CISA KEV. Days are UTC.

- [CVE-2019-7442](https://cve.now/CVE-2019-7442.md): An XML external entity (XXE) vulnerability in the Password Vault Web Access (PVWA) of CyberArk Enterprise Password Vault \<=10.7 allows remot (no CVSS)
- [CVE-2019-9698](https://cve.now/CVE-2019-9698.md): Symantec AV Engine, prior to 13.0.9r17, may be susceptible to an arbitrary file deletion issue, which is a type of vulnerability that could (no CVSS, Symantec AV Engine)
- [CVE-2019-8285](https://cve.now/CVE-2019-8285.md): Kaspersky Lab Antivirus Engine version before 04.apr.2019 has a heap-based buffer overflow vulnerability that potentially allow arbitrary co (no CVSS, Kaspersky Lab Antivirus Engine)
- [CVE-2019-11398](https://cve.now/CVE-2019-11398.md): Multiple cross-site scripting (XSS) vulnerabilities in UliCMS 2019.2 and 2019.1 allow remote attackers to inject arbitrary web script or HTM (no CVSS)
- [CVE-2019-11406](https://cve.now/CVE-2019-11406.md): Subrion CMS 4.2.1 allows \_core/en/contacts/ XSS via the name, email, or phone parameter. (no CVSS)
- [CVE-2019-11458](https://cve.now/CVE-2019-11458.md): An issue was discovered in SmtpTransport in CakePHP 3.7.6. (no CVSS, cakephp/cakephp)
- [CVE-2019-11494](https://cve.now/CVE-2019-11494.md): In the IMAP Server in Dovecot 2.3.3 through 2.3.5.2, the submission-login service crashes when the client disconnects prematurely during the (CVSS 7.5)
- [CVE-2019-11499](https://cve.now/CVE-2019-11499.md): In the IMAP Server in Dovecot 2.3.3 through 2.3.5.2, the submission-login component crashes if AUTH PLAIN is attempted over a TLS secured ch (no CVSS)
- [CVE-2019-5021](https://cve.now/CVE-2019-5021.md): Versions of the Official Alpine Linux Docker images (since v3.3) contain a NULL password for the \`root\` user. (CVSS 9.8, Alpine Linux)
- [CVE-2019-11507](https://cve.now/CVE-2019-11507.md): In Pulse Secure Pulse Connect Secure (PCS) 8.3.x before 8.3R7.1 and 9.0.x before 9.0R3, an XSS issue has been found on the Application Launc (CVSS 5.8)
- [CVE-2019-11508](https://cve.now/CVE-2019-11508.md): In Pulse Secure Pulse Connect Secure (PCS) before 8.1R15.1, 8.2 before 8.2R12.1, 8.3 before 8.3R7.1, and 9.0 before 9.0R3.4, an authenticate (CVSS 8.6)
- [CVE-2019-5014](https://cve.now/CVE-2019-5014.md): An exploitable improper access control vulnerability exists in the bluetooth low energy functionality of Winco Fireworks FireFly FW-1007 V2. (CVSS 6.5, Winco Firefly)
- [CVE-2019-2054](https://cve.now/CVE-2019-2054.md): In the seccomp implementation prior to kernel version 4.8, there is a possible seccomp bypass due to seccomp policies that allow the use of (no CVSS, Android)
- [CVE-2019-2053](https://cve.now/CVE-2019-2053.md): In wnm\_parse\_neighbor\_report\_elem of wnm\_sta.c, there is a possible out-of-bounds read due to missing bounds check. (no CVSS, Android)
- [CVE-2019-2052](https://cve.now/CVE-2019-2052.md): In VisitPointers of heap.cc, there is a possible out-of-bounds read due to type confusion. (no CVSS, Android)
- [CVE-2019-2051](https://cve.now/CVE-2019-2051.md): In heap of spaces.h, there is a possible out of bounds read due to improper input validation. (no CVSS, Android)
- [CVE-2019-2050](https://cve.now/CVE-2019-2050.md): In tearDownClientInterface of WificondControl.java, there is a possible use after free due to improper locking. (no CVSS, Android)
- [CVE-2019-2049](https://cve.now/CVE-2019-2049.md): In SendMediaUpdate and SendFolderUpdate of avrcp\_service.cc, there is a possible memory corruption due to a use after free. (no CVSS, Android)
- [CVE-2019-2047](https://cve.now/CVE-2019-2047.md): In UpdateLoadElement of ic.cc, there is a possible out-of-bounds write due to type confusion. (no CVSS, Android)
- [CVE-2019-2046](https://cve.now/CVE-2019-2046.md): In CalculateInstanceSizeForDerivedClass of objects.cc, there is possible memory corruption due to an integer overflow. (no CVSS, Android)
- [CVE-2019-2045](https://cve.now/CVE-2019-2045.md): In JSCallTyper of typer.cc, there is an out of bounds write due to an incorrect bounds check. (no CVSS, Android)
- [CVE-2019-2044](https://cve.now/CVE-2019-2044.md): In MakeMP\>G4VideoCodecSpecificData of APacketSource.cpp, there is a possible out-of-bounds write due to an incorrect bounds check. (no CVSS, Android)
- [CVE-2019-2043](https://cve.now/CVE-2019-2043.md): In SmsDefaultDialog.onStart of SmsDefaultDialog.java, there is a possible escalation of privilege due to an overlay attack. (no CVSS, Android)
- [CVE-2019-11510](https://cve.now/CVE-2019-11510.md): In Pulse Secure Pulse Connect Secure (PCS) 8.2 before 8.2R12.1, 8.3 before 8.3R7.1, and 9.0 before 9.0R3.4, an unauthenticated remote attack (CVSS 9.9, KEV)
- [CVE-2019-11550](https://cve.now/CVE-2019-11550.md): Citrix SD-WAN 10.2.x before 10.2.1 and NetScaler SD-WAN 10.0.x before 10.0.7 have Improper Certificate Validation. (no CVSS)
- [CVE-2019-11561](https://cve.now/CVE-2019-11561.md): The Chuango 433 MHz burglar-alarm product line is vulnerable to a Denial of Service attack. (no CVSS)
- [CVE-2019-11564](https://cve.now/CVE-2019-11564.md): A cross-site scripting (XSS) vulnerability in HumHub 1.3.12 allows remote attackers to inject arbitrary web script or HTML via a /protected/ (no CVSS)
- [CVE-2019-11819](https://cve.now/CVE-2019-11819.md): Alkacon OpenCMS v10.5.4 and before is affected by CSV (aka Excel Macro) Injection in the module New User (/opencms/system/workplace/admin/ac (no CVSS, org.opencms:opencms-core)
- [CVE-2019-11818](https://cve.now/CVE-2019-11818.md): Alkacon OpenCMS v10.5.4 and before is affected by stored cross site scripting (XSS) in the module New User (/opencms/system/workplace/admin/ (no CVSS, org.opencms:opencms-core)
- [CVE-2019-11642](https://cve.now/CVE-2019-11642.md): A log poisoning vulnerability has been discovered in the OneShield Policy (Dragon Core) framework before 5.1.10. (no CVSS)
- [CVE-2019-11643](https://cve.now/CVE-2019-11643.md): Persistent XSS has been found in the OneShield Policy (Dragon Core) framework before 5.1.10. (no CVSS)
- [CVE-2018-5408](https://cve.now/CVE-2018-5408.md): PrinterLogic Print Management Software fails to validate the management portal SSL certificates (no CVSS, PrinterLogic Management Software)
- [CVE-2018-5409](https://cve.now/CVE-2018-5409.md): PrinterLogic Print Management Software updates and executes the code without origin and code verification (no CVSS, PrinterLogic Management Software)
- [CVE-2019-9505](https://cve.now/CVE-2019-9505.md): PrinterLogic Print Management Software does not sanitize special characters (no CVSS, PrinterLogic Management Software)
- [CVE-2019-11815](https://cve.now/CVE-2019-11815.md): An issue was discovered in rds\_tcp\_kill\_sock in net/rds/tcp.c in the Linux kernel before 5.0.8. (no CVSS)
- [CVE-2019-8349](https://cve.now/CVE-2019-8349.md): Multiple cross-site scripting (XSS) vulnerabilities in HTMLy 2.7.4 allow remote attackers to inject arbitrary web script or HTML via the (1) (no CVSS)
- [CVE-2019-8387](https://cve.now/CVE-2019-8387.md): MASTER IPCAMERA01 3.3.4.2103 devices allow Remote Command Execution, related to the thttpd component. (no CVSS)
- [CVE-2019-11814](https://cve.now/CVE-2019-11814.md): An issue was discovered in app/webroot/js/misp.js in MISP before 2.4.107. (no CVSS)
- [CVE-2019-11813](https://cve.now/CVE-2019-11813.md): An issue was discovered in app/View/Elements/Events/View/value\_field.ctp in MISP before 2.4.107. (no CVSS)
- [CVE-2019-11812](https://cve.now/CVE-2019-11812.md): A persistent XSS issue was discovered in app/View/Helper/CommandHelper.php in MISP before 2.4.107. (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2019-05-08
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.