CVEs published May 9, 2019
42 CVEs were published on May 9, 2019: 0 critical, 0 high.
- Published
- 42
- Critical
- 0
- High
- 0
- Medium
- 3
- Low
- 0
- Unrated
- 39
- Now in CISA KEV
- 0
- Fix available
- 8
Most affected products
- GE Communicator
- 5
- IBM Spectrum Control Standard Edition
- 2
- Apache Karaf · org.apache.karaf.config:org.apache.karaf.con…
- 1
- Document Foundation LibreOffice
- 1
- drupal/core · typo3/phar-stream-wrapper +1
- 1
- golang.org/x/crypto
- 1
- matrix-sydent · matrix-synapse
- 1
- myQNAPcloud Connect
- 1
- NetIQ Identity Manager
- 1
- Palo Alto Networks Demisto
- 1
Medium, low and unrated 42
- CVE-2018-20837include/admin/Menu/Ajax.php in Typesetter 5.1 has index.php/Admin/Menu/Ajax?cmd=AddHidden title XSS.
- CVE-2019-11870Serendipity before 2.1.5 has XSS via EXIF data that is mishandled in the templates/2k11/admin/media_choose.tpl Editor Preview feature or the
- CVE-2019-11869The Yuzo Related Posts plugin 5.12.94 for WordPress has XSS because it mistakenly expects that is_admin() verifies that the request comes fr
- CVE-2019-7652TheHive Project UnshortenLink analyzer before 1.1, included in Cortex-Analyzers before 1.15.2, has SSRF.
- CVE-2016-1600The ServiceNow driver in NetIQ Identity Manager versions prior to 4.6 are susceptible to an information disclosure vulnerability.NetIQ Identity Manager
- CVE-2019-1568Cross-site scripting (XSS) vulnerability in Palo Alto Networks Demisto 4.5 build 40249 may allow an unauthenticated attacker to run arbitrarPalo Alto Networks Demisto
- CVE-2017-12757Certain Ambit Technologies Pvt.
- CVE-2017-12758https://www.joomlaextensions.co.in/ Joomla! Component Appointment 1.1 is affected by: SQL Injection.
- CVE-2017-12759Ynet Interactive - http://demo.ynetinteractive.com/soa/ SOA School Management 3.0 is affected by: SQL Injection.
- CVE-2017-12760Ynet Interactive - http://demo.ynetinteractive.com/mobiketa/ Mobiketa 4.0 is affected by: SQL Injection.
- CVE-2017-12761http://codecanyon.net/user/Endober WebFile Explorer 1.0 is affected by: SQL Injection.
- CVE-2019-11842An issue was discovered in Matrix Sydent before 1.0.3 and Synapse before 0.99.3.1.matrix-sydent · matrix-synapse
- CVE-2017-12839A heap-based buffer over-read in the getbits function in src/libmpg123/getbits.h in mpg123 through 1.25.5 allows remote attackers to cause a
- CVE-2017-12778The UI Lock feature in qBittorrent version 3.3.15 is vulnerable to Authentication Bypass, which allows Attack to gain unauthorized access to
- CVE-2017-12790Metinfo 5.3.18 is affected by: Cross Site Request Forgery (CSRF).
- CVE-2017-12804The iwgif_init_screen function in imagew-gif.c:510 in ImageWorsener 1.3.2 allows remote attackers to cause a denial of service (hmemory exha
- CVE-2017-12805In ImageMagick 7.0.6-6, a memory exhaustion vulnerability was found in the function ReadTIFFImage, which allows attackers to cause a denial
- CVE-2017-12806In ImageMagick 7.0.6-6, a memory exhaustion vulnerability was found in the function format8BIM, which allows attackers to cause a denial of
- CVE-2019-4072IBM Tivoli Storage Productivity Center (IBM Spectrum Control Standard Edition 5.2.1 through 5.2.17) allows users to remain idle within the aIBM Spectrum Control Standard Edition
- CVE-2019-4071IBM Tivoli Storage Productivity Center (IBM Spectrum Control Standard Edition 5.2.1 through 5.2.17) could allow a remote attacker to executeIBM Spectrum Control Standard Edition
- CVE-2019-7181Buffer Overflow vulnerability in myQNAPcloud Connect 1.3.3.0925 and earlier could allow remote attackers to crash the program.myQNAPcloud Connect
- CVE-2017-12788Multiple cross-site scripting (XSS) vulnerabilities in admin/index.php in Metinfo 5.3.18 allows remote attackers to inject arbitrary web scr
- CVE-2019-6566GE Communicator, all versions prior to 4.0.517, allows a non-administrative user to replace the uninstaller with a malicious version, which GE Communicator
- CVE-2019-6544GE Communicator, all versions prior to 4.0.517, has a service running with system privileges that may allow an unprivileged user to perform GE Communicator
- CVE-2019-6548GE Communicator, all versions prior to 4.0.517, contains two backdoor accounts with hardcoded credentials, which may allow control over the GE Communicator
- CVE-2019-6546GE Communicator, all versions prior to 4.0.517, allows an attacker to place malicious files within the working directory of the program, whiGE Communicator
- CVE-2019-6564GE Communicator, all versions prior to 4.0.517, allows a non-administrative user to place malicious files within the installer file directorGE Communicator
- CVE-2019-9847Executable hyperlink targets executed unconditionally on activationDocument Foundation LibreOffice
- CVE-2019-11323HAProxy before 1.9.7 mishandles a reload with rotated keys, which triggers use of uninitialized, and very predictable, HMAC keys.
- CVE-2019-11353The EnGenius EWS660AP router with firmware 2.0.284 allows an attacker to execute arbitrary commands using the built-in ping and traceroute u
- CVE-2019-0226Apache Karaf Config service provides a install method (via service or MBean) that could be used to travel in any directory and overwrite exiApache Karaf · org.apache.karaf.config:org.apache.karaf.con…
- CVE-2019-11839njs through 0.3.1, used in NGINX, has a heap-based buffer overflow in Array.prototype.push after a resize, related to njs_array_prototype_pu
- CVE-2019-11838njs through 0.3.1, used in NGINX, has a heap-based buffer overflow in Array.prototype.splice after a resize, related to njs_array_prototype_
- CVE-2019-11837njs through 0.3.1, used in NGINX, has a segmentation fault in String.prototype.toBytes for negative arguments, related to nxt_utf8_next in n
- CVE-2019-11836The Rediffmail (aka com.rediff.mail.and) application 2.2.6 for Android has cleartext mail content in file storage, persisting after a logout
- CVE-2019-11820Information exposure through process environment vulnerability in Synology Calendar before 2.3.3-0620 allows local users to obtain credentiaSynology Calendar
- CVE-2019-11835cJSON before 1.7.11 allows out-of-bounds access, related to multiline comments.
- CVE-2019-11834cJSON before 1.7.11 allows out-of-bounds access, related to \x00 in a string literal.
- CVE-2019-11832TYPO3 8.x before 8.7.25 and 9.x before 9.5.6 allows remote code execution because it does not properly configure the applications used for itypo3/cms-core · typo3/cms
- CVE-2019-11831The PharStreamWrapper (aka phar-stream-wrapper) package 2.x before 2.1.1 and 3.x before 3.1.1 for TYPO3 does not prevent directory traversaldrupal/core · typo3/phar-stream-wrapper +1
- CVE-2019-11830PharMetaDataInterceptor in the PharStreamWrapper (aka phar-stream-wrapper) package 2.x before 2.1.1 and 3.x before 3.1.1 for TYPO3 mishandletypo3/phar-stream-wrapper
- CVE-2019-11840An issue was discovered in the supplementary Go cryptography library, golang.org/x/crypto, before v0.0.0-20190320223903-b7391e95e576.golang.org/x/crypto