CVEs published May 10, 2019
33 CVEs were published on May 10, 2019: 1 critical, 1 high.
- Published
- 33
- Critical
- 1
- High
- 1
- Medium
- 3
- Low
- 0
- Unrated
- 28
- Now in CISA KEV
- 0
- Fix available
- 4
Most affected products
- Aruba Instant
- 4
- NVIDIA GPU Display Driver
- 3
- harp
- 2
- Cisco Elastic Services Controller
- 1
- de.tudarmstadt.ukp.dkpro.core:de.tudarmstadt.ukp.dkpro.core…
- 1
- Facebook WhatsApp for Android · Facebook WhatsApp Business…
- 1
- HPE NonStop SAFEGAURD and NonStop H-series STDSEC-STANDARD…
- 1
- HPE Virtual Connect SE 16Gb Fibre Channel Module for HPE Sy…
- 1
- IBM Business Automation Workflow
- 1
- IBM Cloud App Management
- 1
Critical 1
High 1
Medium, low and unrated 31
- CVE-2019-11884The do_hidp_sock_ioctl function in net/bluetooth/hidp/sock.c in the Linux kernel before 5.0.15 allows a local user to obtain potentially sen
- CVE-2019-5437Information exposure through the directory listing in npm's harp module allows to access files that are supposed to be ignored according to harp
- CVE-2019-5438Path traversal using symlink in npm harp module versions <= 0.29.0.harp
- CVE-2019-3566A bug in WhatsApp for Android's messaging logic would potentially allow a malicious individual who has taken over over a WhatsApp user's accFacebook WhatsApp for Android · Facebook WhatsApp Business…
- CVE-2019-5677NVIDIA Windows GPU Display driver software for Windows (all versions) contains a vulnerability in the kernel mode layer (nvlddmkm.sys) handlNVIDIA GPU Display Driver
- CVE-2019-5676NVIDIA Windows GPU Display driver software for Windows (all versions) contains a vulnerability in which it incorrectly loads Windows system NVIDIA GPU Display Driver
- CVE-2019-5675NVIDIA Windows GPU Display driver software for Windows (all versions) contains a vulnerability in the kernel mode layer (nvlddmkm.sys) handlNVIDIA GPU Display Driver
- CVE-2019-11000An issue was discovered in GitLab Enterprise Edition before 11.7.11, 11.8.x before 11.8.7, and 11.9.x before 11.9.7.
- CVE-2019-11059Das U-Boot 2016.11-rc1 through 2019.04 mishandles the ext4 64-bit extension, resulting in a buffer overflow.
- CVE-2019-5496Oncommand Insight versions prior to 7.3.5 shipped without certain HTTP Security headers configured which could allow an attacker to obtain sNetApp OnCommand Insight
- CVE-2019-11066openid.php in LightOpenID through 1.3.1 allows SSRF via a crafted OpenID 2.0 assertion request using the HTTP GET method.
- CVE-2019-5495OnCommand Unified Manager for VMware vSphere, Linux and Windows prior to 9.5 shipped without certain HTTP Security headers configured which NetApp OnCommand Unified Manager for VMware vSphere,Linux a…
- CVE-2019-5494OnCommand Unified Manager 7-Mode prior to version 5.2.4 shipped without certain HTTP Security headers configured which could allow an attackNetApp OnCommand Unified Manager 7-Mode
- CVE-2018-7120A security vulnerability in the HPE Virtual Connect SE 16Gb Fibre Channel Module for HPE Synergy running firmware 5.00.50, which is part of HPE Virtual Connect SE 16Gb Fibre Channel Module for HPE Sy…
- CVE-2018-7119A Local Disclosure of Sensitive Information vulnerability was identified in HPE NonStop Safeguard earlier than version SPR T9750L01^AIC or THPE NonStop SAFEGAURD and NonStop H-series STDSEC-STANDARD…
- CVE-2018-7084A command injection vulnerability is present that permits an unauthenticated user with access to the Aruba Instant web interface to execute Aruba Instant
- CVE-2018-7064A reflected cross-site scripting (XSS) vulnerability is present in an unauthenticated Aruba Instant web interface.Aruba Instant
- CVE-2018-7082A command injection vulnerability is present in Aruba Instant that permits an authenticated administrative user to execute arbitrary commandAruba Instant
- CVE-2018-7083If a process running within Aruba Instant crashes, it may leave behind a "core dump", which contains the memory contents of the process at tAruba Instant
- CVE-2019-11879The WEBrick gem 1.4.2 for Ruby allows directory traversal if the attacker once had local access to create a symlink to a location outside of
- CVE-2019-11082core/api/datasets/internal/actions/Explode.java in the Dataset API in DKPro Core through 1.10.0 allows Directory Traversal, resulting in thede.tudarmstadt.ukp.dkpro.core:de.tudarmstadt.ukp.dkpro.core…
- CVE-2017-12884OX Software GmbH App Suite 7.8.4 and earlier is affected by: Information Exposure.
- CVE-2017-12885OX Software GmbH App Suite 7.8.4 and earlier is affected by: Cross Site Scripting (XSS).
- CVE-2019-4204IBM Business Automation Workflow 18.0.0.0, 18.0.0.1, 18.0.0.2, and 19.0.0.1 is vulnerable to cross-site scripting.IBM Business Automation Workflow
- CVE-2018-1990IBM Cloud App Management V2018.2.0, V2018.4.0, and V2018.4.1 could allow an attacker to obtain sensitive configuration information using a sIBM Cloud App Management
- CVE-2018-1790IBM Financial Transaction Manager for Digital Payments for Multi-Platform 3.0.2 is vulnerable to cross-site request forgery which could alloIBM Financial Transaction Manager
- CVE-2017-12795OpenMRS openmrs-module-htmlformentry 3.3.2 is affected by: (Improper Input Validation).
- CVE-2019-11878An issue was discovered on XiongMai Besder IP20H1 V4.02.R12.00035520.12012.047500.00200 cameras.
- CVE-2017-12789Metinfo 5.3.18 is affected by: Cross Site Request Forgery (CSRF).
- CVE-2015-1006A vulnerable file in Opto 22 PAC Project Professional versions prior to R9.4006, PAC Project Basic versions prior to R9.4006, PAC Display BaOpto 22 PAC Project Professional · Opto 22 PAC Project B… +4
- CVE-2019-11871The Custom Field Suite plugin before 2.5.15 for WordPress has XSS for editors or admins.