CVEs published May 13, 2019
80 CVEs were published on May 13, 2019: 3 critical, 7 high.
- Published
- 80
- Critical
- 3
- High
- 7
- Medium
- 6
- Low
- 0
- Unrated
- 64
- Now in CISA KEV
- 0
- Fix available
- 5
Most affected products
- Novatek
- 8
- Anker
- 3
- remarkable
- 2
- Cisco IOS XE Software
- 1
- Cisco Routers
- 1
- IBM Spectrum Scale
- 1
- simditor
- 1
- SUSE Manager · Uyuni
- 1
Critical 3
- CVE-2018-4029An exploitable code execution vulnerability exists in the HTTP request-parsing function of the NT9665X Chipset firmware running on the AnkerNovatek
- CVE-2018-4018An exploitable firmware update vulnerability exists in the NT9665X Chipset firmware, running on Anker Roav A1 Dashcam version RoavA1SWV1.9.Novatek
- CVE-2018-4023An exploitable code execution vulnerability exists in the XML_UploadFile Wi-Fi command of the NT9665X Chipset firmware, running on the AnkerNovatek
High 7
- CVE-2019-1862Cisco IOS XE Software Web UI Command Injection VulnerabilityCisco IOS XE Software
- CVE-2018-4024An exploitable denial-of-service vulnerability exists in the thumbnail display functionality of the NT9665X Chipset firmware, running on theNovatek
- CVE-2018-4025An exploitable denial-of-service vulnerability exists in the XML_GetRawEncJpg Wi-Fi command of the NT9665X Chipset firmware, running on the Novatek
- CVE-2018-4026An exploitable denial-of-service vulnerability exists in the XML_GetScreen Wi-Fi command of the NT9665X Chipset firmware, running on the AnkNovatek
- CVE-2018-4017An exploitable vulnerability exists in the Wi-Fi Access Point feature of the Roav A1 Dashcam running version RoavA1SWV1.9.Anker
- CVE-2018-4016An exploitable code execution vulnerability exists in the URL-parsing functionality of the Roav A1 Dashcam running version RoavA1SWV1.9.Anker
- CVE-2018-4014An exploitable code execution vulnerability exists in Wi-Fi Command 9999 of the Roav A1 Dashcam running version RoavA1SWV1.9.Anker
Medium, low and unrated 70
- CVE-2019-9618The GraceMedia Media Player plugin 1.0 for WordPress allows Local File Inclusion via the "cfg" parameter.
- CVE-2019-8952A Path Traversal vulnerability located in the webserver affects several Bosch hardware and software products.
- CVE-2019-8951An Open Redirect vulnerability located in the webserver affects several Bosch hardware and software products.
- CVE-2018-16138An issue was discovered in the administration page in IPBRICK OS 6.3.
- CVE-2018-16137An issue was discovered in the Web Management Console in IPBRICK OS 6.3.
- CVE-2018-16136An issue was discovered in the administrator interface in IPBRICK OS 6.3.
- CVE-2019-10053An issue was discovered in Suricata 4.1.x before 4.1.4.
- CVE-2019-11600A SQL injection vulnerability in the activities API in OpenProject before 8.3.2 allows a remote attacker to execute arbitrary SQL commands v
- CVE-2018-16139Cross-site scripting (XSS) vulnerability in BIBLIOsoft BIBLIOpac 2008 allows remote attackers to inject arbitrary web script or HTML via the
- CVE-2019-1649Cisco Secure Boot Hardware Tampering VulnerabilityCisco Routers
- CVE-2019-12083The Rust Programming Language Standard Library 1.34.x before 1.34.2 contains a stabilized method which, if overridden, can violate Rust's sa
- CVE-2018-18912An issue was discovered in Easy File Sharing (EFS) Web Server 7.2.
- CVE-2019-7218Citrix ShareFile before 19.23 allows a downgrade from two-factor authentication to one-factor authentication.
- CVE-2019-7217Citrix ShareFile before 19.12 allows User Enumeration.
- CVE-2019-11680KonaKart 8.9.0.0 is vulnerable to Remote Code Execution by uploading a web shell as a product category image.
- CVE-2019-3702A Remote Code Execution issue in the DNS Query Web UI in Lifesize Icon LS_RM3_3.7.0 (2421) allows remote authenticated attackers to execute
- CVE-2019-9727Unauthenticated password hash disclosure in the User.getUserPWD method in eQ-3 AG Homematic CCU3 3.43.15 and earlier allows remote attackers
- CVE-2019-9726Directory Traversal / Arbitrary File Read in eQ-3 AG Homematic CCU3 3.43.15 and earlier allows remote attackers to read arbitrary files of t
- CVE-2019-10050A buffer over-read issue was discovered in Suricata 4.1.x before 4.1.4.
- CVE-2019-8342A Local Privilege Escalation in libqcocoa.dylib in Foxit Reader 3.1.0.0111 on macOS has been discovered due to an incorrect permission set.
- CVE-2019-7690In MobaTek MobaXterm Personal Edition v11.1 Build 3860, the SSH private key and its password can be retrieved from process memory for the li
- CVE-2019-4259A security vulnerability has been identified in IBM Spectrum Scale 4.1.1, 4.2.0, 4.2.1, 4.2.2, 4.2.3, and 5.0.0 with CES stack enabled that IBM Spectrum Scale
- CVE-2015-9287Directory Traversal was discovered in University of Cambridge mod_ucam_webauth before 2.0.2.
- CVE-2018-4027An exploitable denial-of-service vulnerability exists in the XML_UploadFile Wi-Fi command of the NT9665X Chipset firmware, running on the AnNovatek
- CVE-2018-4028An exploitable firmware update vulnerability exists in the NT9665X Chipset firmware running on the Anker Roav A1 Dashcam, version RoavA1SWV1Novatek
- CVE-2019-11429CentOS-WebPanel.com (aka CWP) CentOS Web Panel 0.9.8.793 (Free/Open Source Version), 0.9.8.753 (Pro) and 0.9.8.807 (Pro) is vulnerable to Re
- CVE-2019-12047Gridea v0.8.0 has an XSS vulnerability through which the Nodejs module can be called to achieve arbitrary code execution, as demonstrated by
- CVE-2019-3684susemanager installer creates world-readable swap filesSUSE Manager · Uyuni
- CVE-2019-7409Multiple cross-site scripting (XSS) vulnerabilities in ProfileDesign CMS v6.0.2.5 allows remote attackers to inject arbitrary web script or
- CVE-2019-7411Multiple stored cross-site scripting (XSS) in the MyThemeShop Launcher plugin 1.0.8 for WordPress allow remote authenticated users to inject
- CVE-2019-7404An issue was discovered on LG GAMP-7100, GAPM-7200, and GAPM-8000 routers.
- CVE-2019-8350The Simple - Better Banking application 2.45.0 through 2.45.3 (fixed in 2.46.0) for Android was affected by an information disclosure vulner
- CVE-2012-6652Directory traversal vulnerability in pageflipbook.php script from index.php in Page Flip Book plugin for WordPress (wppageflip) allows remot
- CVE-2018-19990In the /HNAP1/SetWiFiVerifyAlpha message, the WPSPIN parameter is vulnerable, and the vulnerability affects D-Link DIR-822 B1 202KRb06 devic
- CVE-2018-19989In the /HNAP1/SetQoSSettings message, the uplink parameter is vulnerable, and the vulnerability affects D-Link DIR-822 Rev.B 202KRb06 and DI
- CVE-2018-19988In the /HNAP1/SetClientInfoDemo message, the AudioMute and AudioEnable parameters are vulnerable, and the vulnerabilities affect D-Link DIR-
- CVE-2018-19987D-Link DIR-822 Rev.B 202KRb06, DIR-822 Rev.C 3.10B06, DIR-860L Rev.B 2.03.B03, DIR-868L Rev.B 2.05B02, DIR-880L Rev.A 1.20B01_01_i3se_BETA,
- CVE-2018-19986In the /HNAP1/SetRouterSettings message, the RemotePort parameter is vulnerable, and the vulnerability affects D-Link DIR-818LW Rev.A 2.05.B
- CVE-2018-15128An issue was discovered in Polycom Group Series 6.1.6.1 and earlier, HDX 3.1.12 and earlier, and Pano 1.1.1 and earlier.
- CVE-2018-19048Simditor through 2.3.21 allows DOM XSS via an onload attribute within a malformed SVG element.simditor
- CVE-2019-12043In remarkable 1.7.1, lib/parser_inline.js mishandles URL filtering, which allows attackers to trigger XSS via unprintable characters, as demremarkable
- CVE-2018-18872The Kieran O'Shea Calendar plugin before 1.3.11 for WordPress has Stored XSS via the event_title parameter in a wp-admin/admin.php?page=cale
- CVE-2018-18524Evernote 6.15 on Windows has an incorrectly repaired stored XSS vulnerability.
- CVE-2018-16623Kirby V2.5.12 is prone to a Persistent XSS attack via the Title of the "Site options" in the admin panel dashboard dropdown.
- CVE-2018-16624panel/pages/home/edit in Kirby v2.5.12 allows XSS via the title of a new page.
- CVE-2018-16625index.php/Admin/Uploaded in Typesetter 5.1 allows XSS via an SVG file with JavaScript in a SCRIPT element.
- CVE-2018-16626index.php/Admin/Classes in Typesetter 5.1 allows XSS via the description of a new class name.
- CVE-2018-16639Typesetter 5.1 allows XSS via the index.php/Admin LABEL parameter during new page creation.
- CVE-2018-18558An issue was discovered in Espressif ESP-IDF 2.x and 3.x before 3.0.6 and 3.1.x before 3.1.1.
- CVE-2018-15530Cross-site scripting (XSS) in the web interface of the Xerox ColorQube 8580 allows remote persistent injection of custom HTML / JavaScript c
- CVE-2018-12304Cross-site scripting in Application Manager in Seagate NAS OS version 4.3.15.1 allows attackers to execute JavaScript via multiple applicati
- CVE-2018-12303Cross-site scripting in filebrowser in Seagate NAS OS version 4.3.15.1 allows attackers to execute JavaScript via directory names.
- CVE-2018-12302Missing HTTPOnly flag on session cookies in the Seagate NAS OS version 4.3.15.1 web application allows attackers to steal session tokens via
- CVE-2018-12301Unvalidated URL in Download Manager in Seagate NAS OS version 4.3.15.1 allows attackers to access the loopback interface via a Download URL
- CVE-2018-12300Arbitrary Redirect in echo-server.html in Seagate NAS OS version 4.3.15.1 allows attackers to disclose information in the Referer header via
- CVE-2018-12299Cross-site scripting in filebrowser in Seagate NAS OS version 4.3.15.1 allows attackers to execute JavaScript via uploaded file names.
- CVE-2018-12298Directory Traversal in filebrowser in Seagate NAS OS 4.3.15.1 allows attackers to read files within the application's container via a URL pa
- CVE-2018-12297Cross-site scripting in API error pages in Seagate NAS OS version 4.3.15.1 allows attackers to execute JavaScript via URL path names.
- CVE-2018-12296Insufficient access control in /api/external/7.0/system.System.get_infos in Seagate NAS OS version 4.3.15.1 allows attackers to obtain infor
- CVE-2018-12295SQL injection in folderViewSpecific.psp in Seagate NAS OS version 4.3.15.1 allows attackers to execute arbitrary SQL commands via the dirId
- CVE-2018-14714System command injection in appGet.cgi on ASUS RT-AC3200 version 3.0.0.4.382.50010 allows attackers to execute system commands via the "load
- CVE-2018-14713Format string vulnerability in appGet.cgi on ASUS RT-AC3200 version 3.0.0.4.382.50010 allows attackers to read arbitrary sections of memory
- CVE-2018-14712Buffer overflow in appGet.cgi on ASUS RT-AC3200 version 3.0.0.4.382.50010 allows attackers to inject system commands via the "hook" URL para
- CVE-2018-14711Missing cross-site request forgery protection in appGet.cgi on ASUS RT-AC3200 version 3.0.0.4.382.50010 allows attackers to cause state-chan
- CVE-2018-14710Cross-site scripting in appGet.cgi on ASUS RT-AC3200 version 3.0.0.4.382.50010 allows attackers to execute JavaScript via the "hook" URL par
- CVE-2018-19037On Virgin Media wireless router 3.0 hub devices, the web interface is vulnerable to denial of service.
- CVE-2019-12041lib/common/html_re.js in remarkable 1.7.1 allows Regular Expression Denial of Service (ReDoS) via a CDATA section.remarkable
- CVE-2019-11888Go through 1.12.5 on Windows mishandles process creation with a nil environment in conjunction with a non-nil token, which allows attackers
- CVE-2018-20838ampforwp_save_steps_data in the AMP for WP plugin before 0.9.97.21 for WordPress allows stored XSS.
- CVE-2019-11886The WaspThemes Visual CSS Style Editor (aka yellow-pencil-visual-theme-customizer) plugin before 7.2.1 for WordPress allows yp_option_update