# CVEs published 2019-05-10

33 CVEs were published on May 10, 2019: 1 critical, 1 high. Days are UTC.

- [CVE-2019-11884](https://cve.now/CVE-2019-11884.md): The do\_hidp\_sock\_ioctl function in net/bluetooth/hidp/sock.c in the Linux kernel before 5.0.15 allows a local user to obtain potentially sen (no CVSS)
- [CVE-2019-5437](https://cve.now/CVE-2019-5437.md): Information exposure through the directory listing in npm's harp module allows to access files that are supposed to be ignored according to (no CVSS, harp)
- [CVE-2019-5438](https://cve.now/CVE-2019-5438.md): Path traversal using symlink in npm harp module versions \<= 0.29.0. (no CVSS, harp)
- [CVE-2019-3566](https://cve.now/CVE-2019-3566.md): A bug in WhatsApp for Android's messaging logic would potentially allow a malicious individual who has taken over over a WhatsApp user's acc (no CVSS, Facebook WhatsApp for Android · Facebook WhatsApp Business…)
- [CVE-2019-5677](https://cve.now/CVE-2019-5677.md): NVIDIA Windows GPU Display driver software for Windows (all versions) contains a vulnerability in the kernel mode layer (nvlddmkm.sys) handl (no CVSS, NVIDIA GPU Display Driver)
- [CVE-2019-5676](https://cve.now/CVE-2019-5676.md): NVIDIA Windows GPU Display driver software for Windows (all versions) contains a vulnerability in which it incorrectly loads Windows system (no CVSS, NVIDIA GPU Display Driver)
- [CVE-2019-5675](https://cve.now/CVE-2019-5675.md): NVIDIA Windows GPU Display driver software for Windows (all versions) contains a vulnerability in the kernel mode layer (nvlddmkm.sys) handl (no CVSS, NVIDIA GPU Display Driver)
- [CVE-2019-11000](https://cve.now/CVE-2019-11000.md): An issue was discovered in GitLab Enterprise Edition before 11.7.11, 11.8.x before 11.8.7, and 11.9.x before 11.9.7. (no CVSS)
- [CVE-2019-11059](https://cve.now/CVE-2019-11059.md): Das U-Boot 2016.11-rc1 through 2019.04 mishandles the ext4 64-bit extension, resulting in a buffer overflow. (no CVSS)
- [CVE-2019-5496](https://cve.now/CVE-2019-5496.md): Oncommand Insight versions prior to 7.3.5 shipped without certain HTTP Security headers configured which could allow an attacker to obtain s (no CVSS, NetApp OnCommand Insight)
- [CVE-2019-11066](https://cve.now/CVE-2019-11066.md): openid.php in LightOpenID through 1.3.1 allows SSRF via a crafted OpenID 2.0 assertion request using the HTTP GET method. (no CVSS)
- [CVE-2019-5495](https://cve.now/CVE-2019-5495.md): OnCommand Unified Manager for VMware vSphere, Linux and Windows prior to 9.5 shipped without certain HTTP Security headers configured which (no CVSS, NetApp OnCommand Unified Manager for VMware vSphere,Linux a…)
- [CVE-2019-5494](https://cve.now/CVE-2019-5494.md): OnCommand Unified Manager 7-Mode prior to version 5.2.4 shipped without certain HTTP Security headers configured which could allow an attack (no CVSS, NetApp OnCommand Unified Manager 7-Mode)
- [CVE-2019-5018](https://cve.now/CVE-2019-5018.md): An exploitable use after free vulnerability exists in the window function functionality of Sqlite3 3.26.0. (CVSS 8.1, Sqlite3)
- [CVE-2018-7120](https://cve.now/CVE-2018-7120.md): A security vulnerability in the HPE Virtual Connect SE 16Gb Fibre Channel Module for HPE Synergy running firmware 5.00.50, which is part of (no CVSS, HPE Virtual Connect SE 16Gb Fibre Channel Module for HPE Sy…)
- [CVE-2018-7119](https://cve.now/CVE-2018-7119.md): A Local Disclosure of Sensitive Information vulnerability was identified in HPE NonStop Safeguard earlier than version SPR T9750L01^AIC or T (no CVSS, HPE NonStop SAFEGAURD and NonStop H-series STDSEC-STANDARD…)
- [CVE-2018-7084](https://cve.now/CVE-2018-7084.md): A command injection vulnerability is present that permits an unauthenticated user with access to the Aruba Instant web interface to execute (no CVSS, Aruba Instant)
- [CVE-2018-7064](https://cve.now/CVE-2018-7064.md): A reflected cross-site scripting (XSS) vulnerability is present in an unauthenticated Aruba Instant web interface. (no CVSS, Aruba Instant)
- [CVE-2018-7082](https://cve.now/CVE-2018-7082.md): A command injection vulnerability is present in Aruba Instant that permits an authenticated administrative user to execute arbitrary command (no CVSS, Aruba Instant)
- [CVE-2018-7083](https://cve.now/CVE-2018-7083.md): If a process running within Aruba Instant crashes, it may leave behind a "core dump", which contains the memory contents of the process at t (no CVSS, Aruba Instant)
- [CVE-2019-11879](https://cve.now/CVE-2019-11879.md): The WEBrick gem 1.4.2 for Ruby allows directory traversal if the attacker once had local access to create a symlink to a location outside of (no CVSS)
- [CVE-2019-11082](https://cve.now/CVE-2019-11082.md): core/api/datasets/internal/actions/Explode.java in the Dataset API in DKPro Core through 1.10.0 allows Directory Traversal, resulting in the (no CVSS, de.tudarmstadt.ukp.dkpro.core:de.tudarmstadt.ukp.dkpro.core…)
- [CVE-2017-12884](https://cve.now/CVE-2017-12884.md): OX Software GmbH App Suite 7.8.4 and earlier is affected by: Information Exposure. (no CVSS)
- [CVE-2017-12885](https://cve.now/CVE-2017-12885.md): OX Software GmbH App Suite 7.8.4 and earlier is affected by: Cross Site Scripting (XSS). (no CVSS)
- [CVE-2019-4204](https://cve.now/CVE-2019-4204.md): IBM Business Automation Workflow 18.0.0.0, 18.0.0.1, 18.0.0.2, and 19.0.0.1 is vulnerable to cross-site scripting. (CVSS 5.4, IBM Business Automation Workflow)
- [CVE-2018-1990](https://cve.now/CVE-2018-1990.md): IBM Cloud App Management V2018.2.0, V2018.4.0, and V2018.4.1 could allow an attacker to obtain sensitive configuration information using a s (CVSS 5.3, IBM Cloud App Management)
- [CVE-2018-1790](https://cve.now/CVE-2018-1790.md): IBM Financial Transaction Manager for Digital Payments for Multi-Platform 3.0.2 is vulnerable to cross-site request forgery which could allo (CVSS 4.3, IBM Financial Transaction Manager)
- [CVE-2017-12795](https://cve.now/CVE-2017-12795.md): OpenMRS openmrs-module-htmlformentry 3.3.2 is affected by: (Improper Input Validation). (no CVSS)
- [CVE-2019-11878](https://cve.now/CVE-2019-11878.md): An issue was discovered on XiongMai Besder IP20H1 V4.02.R12.00035520.12012.047500.00200 cameras. (no CVSS)
- [CVE-2017-12789](https://cve.now/CVE-2017-12789.md): Metinfo 5.3.18 is affected by: Cross Site Request Forgery (CSRF). (no CVSS)
- [CVE-2015-1006](https://cve.now/CVE-2015-1006.md): A vulnerable file in Opto 22 PAC Project Professional versions prior to R9.4006, PAC Project Basic versions prior to R9.4006, PAC Display Ba (no CVSS, Opto 22 PAC Project Professional · Opto 22 PAC Project B… +4)
- [CVE-2019-1867](https://cve.now/CVE-2019-1867.md): Cisco Elastic Services Controller REST API Authentication Bypass Vulnerability (CVSS 10.0, Cisco Elastic Services Controller)
- [CVE-2019-11871](https://cve.now/CVE-2019-11871.md): The Custom Field Suite plugin before 2.5.15 for WordPress has XSS for editors or admins. (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2019-05-10
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.