# CVEs published 2019-05-09

42 CVEs were published on May 9, 2019: 0 critical, 0 high. Days are UTC.

- [CVE-2018-20837](https://cve.now/CVE-2018-20837.md): include/admin/Menu/Ajax.php in Typesetter 5.1 has index.php/Admin/Menu/Ajax?cmd=AddHidden title XSS. (no CVSS)
- [CVE-2019-11870](https://cve.now/CVE-2019-11870.md): Serendipity before 2.1.5 has XSS via EXIF data that is mishandled in the templates/2k11/admin/media\_choose.tpl Editor Preview feature or the (no CVSS)
- [CVE-2019-11869](https://cve.now/CVE-2019-11869.md): The Yuzo Related Posts plugin 5.12.94 for WordPress has XSS because it mistakenly expects that is\_admin() verifies that the request comes fr (no CVSS)
- [CVE-2019-7652](https://cve.now/CVE-2019-7652.md): TheHive Project UnshortenLink analyzer before 1.1, included in Cortex-Analyzers before 1.15.2, has SSRF. (no CVSS)
- [CVE-2016-1600](https://cve.now/CVE-2016-1600.md): The ServiceNow driver in NetIQ Identity Manager versions prior to 4.6 are susceptible to an information disclosure vulnerability. (no CVSS, NetIQ Identity Manager)
- [CVE-2019-1568](https://cve.now/CVE-2019-1568.md): Cross-site scripting (XSS) vulnerability in Palo Alto Networks Demisto 4.5 build 40249 may allow an unauthenticated attacker to run arbitrar (no CVSS, Palo Alto Networks Demisto)
- [CVE-2017-12757](https://cve.now/CVE-2017-12757.md): Certain Ambit Technologies Pvt. (no CVSS)
- [CVE-2017-12758](https://cve.now/CVE-2017-12758.md): https://www.joomlaextensions.co.in/ Joomla! Component Appointment 1.1 is affected by: SQL Injection. (no CVSS)
- [CVE-2017-12759](https://cve.now/CVE-2017-12759.md): Ynet Interactive - http://demo.ynetinteractive.com/soa/ SOA School Management 3.0 is affected by: SQL Injection. (no CVSS)
- [CVE-2017-12760](https://cve.now/CVE-2017-12760.md): Ynet Interactive - http://demo.ynetinteractive.com/mobiketa/ Mobiketa 4.0 is affected by: SQL Injection. (no CVSS)
- [CVE-2017-12761](https://cve.now/CVE-2017-12761.md): http://codecanyon.net/user/Endober WebFile Explorer 1.0 is affected by: SQL Injection. (no CVSS)
- [CVE-2019-11842](https://cve.now/CVE-2019-11842.md): An issue was discovered in Matrix Sydent before 1.0.3 and Synapse before 0.99.3.1. (no CVSS, matrix-sydent · matrix-synapse)
- [CVE-2017-12839](https://cve.now/CVE-2017-12839.md): A heap-based buffer over-read in the getbits function in src/libmpg123/getbits.h in mpg123 through 1.25.5 allows remote attackers to cause a (no CVSS)
- [CVE-2017-12778](https://cve.now/CVE-2017-12778.md): The UI Lock feature in qBittorrent version 3.3.15 is vulnerable to Authentication Bypass, which allows Attack to gain unauthorized access to (no CVSS)
- [CVE-2017-12790](https://cve.now/CVE-2017-12790.md): Metinfo 5.3.18 is affected by: Cross Site Request Forgery (CSRF). (no CVSS)
- [CVE-2017-12804](https://cve.now/CVE-2017-12804.md): The iwgif\_init\_screen function in imagew-gif.c:510 in ImageWorsener 1.3.2 allows remote attackers to cause a denial of service (hmemory exha (no CVSS)
- [CVE-2017-12805](https://cve.now/CVE-2017-12805.md): In ImageMagick 7.0.6-6, a memory exhaustion vulnerability was found in the function ReadTIFFImage, which allows attackers to cause a denial (no CVSS)
- [CVE-2017-12806](https://cve.now/CVE-2017-12806.md): In ImageMagick 7.0.6-6, a memory exhaustion vulnerability was found in the function format8BIM, which allows attackers to cause a denial of (no CVSS)
- [CVE-2019-4072](https://cve.now/CVE-2019-4072.md): IBM Tivoli Storage Productivity Center (IBM Spectrum Control Standard Edition 5.2.1 through 5.2.17) allows users to remain idle within the a (CVSS 4.7, IBM Spectrum Control Standard Edition)
- [CVE-2019-4071](https://cve.now/CVE-2019-4071.md): IBM Tivoli Storage Productivity Center (IBM Spectrum Control Standard Edition 5.2.1 through 5.2.17) could allow a remote attacker to execute (CVSS 6.8, IBM Spectrum Control Standard Edition)
- [CVE-2019-7181](https://cve.now/CVE-2019-7181.md): Buffer Overflow vulnerability in myQNAPcloud Connect 1.3.3.0925 and earlier could allow remote attackers to crash the program. (no CVSS, myQNAPcloud Connect)
- [CVE-2017-12788](https://cve.now/CVE-2017-12788.md): Multiple cross-site scripting (XSS) vulnerabilities in admin/index.php in Metinfo 5.3.18 allows remote attackers to inject arbitrary web scr (no CVSS)
- [CVE-2019-6566](https://cve.now/CVE-2019-6566.md): GE Communicator, all versions prior to 4.0.517, allows a non-administrative user to replace the uninstaller with a malicious version, which (no CVSS, GE Communicator)
- [CVE-2019-6544](https://cve.now/CVE-2019-6544.md): GE Communicator, all versions prior to 4.0.517, has a service running with system privileges that may allow an unprivileged user to perform (no CVSS, GE Communicator)
- [CVE-2019-6548](https://cve.now/CVE-2019-6548.md): GE Communicator, all versions prior to 4.0.517, contains two backdoor accounts with hardcoded credentials, which may allow control over the (no CVSS, GE Communicator)
- [CVE-2019-6546](https://cve.now/CVE-2019-6546.md): GE Communicator, all versions prior to 4.0.517, allows an attacker to place malicious files within the working directory of the program, whi (no CVSS, GE Communicator)
- [CVE-2019-6564](https://cve.now/CVE-2019-6564.md): GE Communicator, all versions prior to 4.0.517, allows a non-administrative user to place malicious files within the installer file director (no CVSS, GE Communicator)
- [CVE-2019-9847](https://cve.now/CVE-2019-9847.md): Executable hyperlink targets executed unconditionally on activation (no CVSS, Document Foundation LibreOffice)
- [CVE-2019-11323](https://cve.now/CVE-2019-11323.md): HAProxy before 1.9.7 mishandles a reload with rotated keys, which triggers use of uninitialized, and very predictable, HMAC keys. (no CVSS)
- [CVE-2019-11353](https://cve.now/CVE-2019-11353.md): The EnGenius EWS660AP router with firmware 2.0.284 allows an attacker to execute arbitrary commands using the built-in ping and traceroute u (no CVSS)
- [CVE-2019-0226](https://cve.now/CVE-2019-0226.md): Apache Karaf Config service provides a install method (via service or MBean) that could be used to travel in any directory and overwrite exi (no CVSS, Apache Karaf · org.apache.karaf.config:org.apache.karaf.con…)
- [CVE-2019-11839](https://cve.now/CVE-2019-11839.md): njs through 0.3.1, used in NGINX, has a heap-based buffer overflow in Array.prototype.push after a resize, related to njs\_array\_prototype\_pu (no CVSS)
- [CVE-2019-11838](https://cve.now/CVE-2019-11838.md): njs through 0.3.1, used in NGINX, has a heap-based buffer overflow in Array.prototype.splice after a resize, related to njs\_array\_prototype\_ (no CVSS)
- [CVE-2019-11837](https://cve.now/CVE-2019-11837.md): njs through 0.3.1, used in NGINX, has a segmentation fault in String.prototype.toBytes for negative arguments, related to nxt\_utf8\_next in n (no CVSS)
- [CVE-2019-11836](https://cve.now/CVE-2019-11836.md): The Rediffmail (aka com.rediff.mail.and) application 2.2.6 for Android has cleartext mail content in file storage, persisting after a logout (no CVSS)
- [CVE-2019-11820](https://cve.now/CVE-2019-11820.md): Information exposure through process environment vulnerability in Synology Calendar before 2.3.3-0620 allows local users to obtain credentia (CVSS 5.5, Synology Calendar)
- [CVE-2019-11835](https://cve.now/CVE-2019-11835.md): cJSON before 1.7.11 allows out-of-bounds access, related to multiline comments. (no CVSS)
- [CVE-2019-11834](https://cve.now/CVE-2019-11834.md): cJSON before 1.7.11 allows out-of-bounds access, related to \\x00 in a string literal. (no CVSS)
- [CVE-2019-11832](https://cve.now/CVE-2019-11832.md): TYPO3 8.x before 8.7.25 and 9.x before 9.5.6 allows remote code execution because it does not properly configure the applications used for i (no CVSS, typo3/cms-core · typo3/cms)
- [CVE-2019-11831](https://cve.now/CVE-2019-11831.md): The PharStreamWrapper (aka phar-stream-wrapper) package 2.x before 2.1.1 and 3.x before 3.1.1 for TYPO3 does not prevent directory traversal (no CVSS, drupal/core · typo3/phar-stream-wrapper +1)
- [CVE-2019-11830](https://cve.now/CVE-2019-11830.md): PharMetaDataInterceptor in the PharStreamWrapper (aka phar-stream-wrapper) package 2.x before 2.1.1 and 3.x before 3.1.1 for TYPO3 mishandle (no CVSS, typo3/phar-stream-wrapper)
- [CVE-2019-11840](https://cve.now/CVE-2019-11840.md): An issue was discovered in the supplementary Go cryptography library, golang.org/x/crypto, before v0.0.0-20190320223903-b7391e95e576. (no CVSS, golang.org/x/crypto)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2019-05-09
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.