CVEs published May 14, 2019
49 CVEs were published on May 14, 2019: 3 critical, 1 high. 2 are now in CISA KEV.
- Published
- 49
- Critical
- 3
- High
- 1
- Medium
- 2
- Low
- 0
- Unrated
- 43
- Now in CISA KEV
- 2
- Fix available
- 9
Most affected products
- Siemens AG SIMATIC HMI Comfort Panels 4" - 22" · Siemens… +5
- 3
- Siemens AG SIMATIC PCS 7 V8.0 and earlier · Siemens AG S… +4
- 3
- Siemens LOGO! 8 BM
- 3
- SAP SE SAP BusinessObjects Business Intelligence platform
- 2
- Siemens AG SINAMICS PERFECT HARMONY GH180 with NXG I contro…
- 2
- TIBCO Software TIBCO Spotfire Analytics Platform for AWS Ma…
- 2
- Facebook WhatsApp for Android · Facebook WhatsApp Busine… +4
- 1
- github.com/sylabs/singularity
- 1
- SAP SE SAP E-Commerce
- 1
- SAP SE SAP Identity Management
- 1
Critical 3
- CVE-2018-14839LG N1A1 NAS 3718.510 is affected by: Remote Command Execution.
- CVE-2019-11204TIBCO Spotfire Statistics Services Exposes Sensitive FilesTIBCO Software TIBCO Spotfire Statistics Services
- CVE-2019-3568A buffer overflow vulnerability in WhatsApp VOIP stack allowed remote code execution via specially crafted series of RTCP packets sent to a Facebook WhatsApp for Android · Facebook WhatsApp Busine… +4
High 1
Medium, low and unrated 45
- CVE-2019-12099In PHP-Fusion 9.03.00, edit_profile.php allows remote authenticated users to execute arbitrary code because includes/dynamics/includes/form_
- CVE-2019-11328An issue was discovered in Singularity 3.1.0 to 3.2.0-rc2, a malicious user with local/network access to the host system (e.g.github.com/sylabs/singularity
- CVE-2019-0301Under certain conditions, it is possible to request the modification of role or privilege assignments through SAP Identity Management REST ISAP SE SAP Identity Management
- CVE-2019-0298SAP E-Commerce (Business-to-Consumer) application does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting (XSSAP SE SAP E-Commerce
- CVE-2019-0293Read of RFC destination does not always perform necessary authorization checks, resulting in escalation of privileges to access information SAP SE SAP Solution Manager system
- CVE-2019-0291Under certain conditions Solution Manager, version 7.2, allows an attacker to access information which would otherwise be restricted.SAP SE SAP Solution Manager
- CVE-2019-0289Under certain conditions SAP BusinessObjects Business Intelligence platform (Analysis for OLAP), versions 4.2 and 4.3, allows an attacker toSAP SE SAP BusinessObjects Business Intelligence platform
- CVE-2019-0287Under certain conditions SAP BusinessObjects Business Intelligence platform (Central Management Server), versions 4.2 and 4.3, allows an attSAP SE SAP BusinessObjects Business Intelligence platform
- CVE-2019-0280SAP Treasury and Risk Management (EA-FINSERV 6.0, 6.03, 6.04, 6.05, 6.06, 6.16, 6.17, 6.18 and 8.0; S4CORE 1.01, 1.02 and 1.03), does not peSAP SE SAP Treasury and Risk Management · SAP SE SAP Enterp…
- CVE-2019-11397GetFile.aspx in Rapid4 RapidFlows Enterprise Application Builder 4.5M.23 (when used with .NET Framework 4.5) allows Local File Inclusion via
- CVE-2018-16656DoBox_CstmBox_Info.model.htm on Kyocera TASKalfa 4002i and 6002i devices allows remote attackers to read the documents of arbitrary users vi
- CVE-2019-11206TIBCO Spotfire Server Vulnerabilities With Integrity of Comments and BookmarksTIBCO Software TIBCO Spotfire Analytics Platform for AWS Ma…
- CVE-2019-10916A vulnerability has been identified in SIMATIC PCS 7 V8.0 and earlier (All versions), SIMATIC PCS 7 V8.1 (All versions < V8.1 with WinCC V7.Siemens AG SIMATIC PCS 7 V8.0 and earlier · Siemens AG S… +4
- CVE-2019-10917A vulnerability has been identified in SIMATIC PCS 7 V8.0 and earlier (All versions), SIMATIC PCS 7 V8.1 (All versions < V8.1 with WinCC V7.Siemens AG SIMATIC PCS 7 V8.0 and earlier · Siemens AG S… +4
- CVE-2019-10918A vulnerability has been identified in SIMATIC PCS 7 V8.0 and earlier (All versions), SIMATIC PCS 7 V8.1 (All versions < V8.1 with WinCC V7.Siemens AG SIMATIC PCS 7 V8.0 and earlier · Siemens AG S… +4
- CVE-2019-10919A vulnerability has been identified in LOGO! 8 BM (incl.Siemens LOGO! 8 BM
- CVE-2019-10920A vulnerability has been identified in LOGO! 8 BM (incl.Siemens LOGO! 8 BM
- CVE-2019-10921A vulnerability has been identified in LOGO! 8 BM (incl.Siemens LOGO! 8 BM
- CVE-2019-10922A vulnerability has been identified in SIMATIC PCS 7 V8.0 and earlier (All versions), SIMATIC PCS 7 V8.1 and newer (All versions), SIMATIC WSiemens AG SIMATIC PCS 7 V8.0 and earlier · Siemens AG S… +2
- CVE-2019-10924A vulnerability has been identified in LOGO! Soft Comfort (All versions < V8.3).Siemens LOGO! Soft Comfort
- CVE-2019-6572A vulnerability has been identified in SIMATIC HMI Comfort Panels 4" - 22" (All versions < V15.1 Update 1), SIMATIC HMI Comfort Outdoor PaneSiemens AG SIMATIC HMI Comfort Panels 4" - 22" · Siemens… +5
- CVE-2019-6574A vulnerability has been identified in SINAMICS PERFECT HARMONY GH180 with NXG I control, MLFBs: 6SR2...-, 6SR3...-, 6SR4...- (All Versions Siemens AG SINAMICS PERFECT HARMONY GH180 with NXG I contro…
- CVE-2019-6576A vulnerability has been identified in SIMATIC HMI Comfort Panels 4" - 22" (All versions < V15.1 Update 1), SIMATIC HMI Comfort Outdoor PaneSiemens AG SIMATIC HMI Comfort Panels 4" - 22" · Siemens… +5
- CVE-2019-6577A vulnerability has been identified in SIMATIC HMI Comfort Panels 4" - 22" (All versions < V15.1 Update 1), SIMATIC HMI Comfort Outdoor PaneSiemens AG SIMATIC HMI Comfort Panels 4" - 22" · Siemens… +5
- CVE-2019-6578A vulnerability has been identified in SINAMICS PERFECT HARMONY GH180 with NXG I control, MLFBs: 6SR2...-, 6SR3...-, 6SR4...- (All Versions Siemens AG SINAMICS PERFECT HARMONY GH180 with NXG I contro…
- CVE-2019-8978An improper authentication vulnerability can be exploited through a race condition that occurs in Ellucian Banner Web Tailor 8.8.3, 8.8.4, a
- CVE-2018-6885An issue was discovered in MicroStrategy Web Services (the Microsoft Office plugin) before 10.4 Hotfix 7, and before 10.11.
- CVE-2018-8940ClientServiceConfigController.cs in Enghouse Cloud Contact Center Platform 7.2.5 has functionality for loading external XML files and parsin
- CVE-2019-11419vcodec2_hls_filter in libvoipCodec_v7a.so in the WeChat application through 7.0.3 for Android allows attackers to cause a denial of service
- CVE-2019-11844An HTML Injection vulnerability has been discovered on the RICOH SP 4520DN via the /web/entry/en/address/adrsSetUserWizard.cgi entryNameIn o
- CVE-2019-11845An HTML Injection vulnerability has been discovered on the RICOH SP 4510DN via the /web/entry/en/address/adrsSetUserWizard.cgi entryNameIn p
- CVE-2019-11846/servlets/ajax_file_upload?fieldName=binary3 in dotCMS 5.1.1 allows XSS and HTML Injection.
- CVE-2019-9861Due to the use of an insecure RFID technology (MIFARE Classic), ABUS proximity chip keys (RFID tokens) of the ABUS Secvest FUAA50000 wireles
- CVE-2019-8923XAMPP through 5.6.8 and previous allows SQL injection via the cds-fpdf.php jahr parameter.
- CVE-2019-8404An issue was discovered in Webiness Inventory 2.3.
- CVE-2018-11691Emerson DeltaV Smart Switch Command Center application, available in versions 11.3.x and 12.3.1, was unable to change the DeltaV Smart Switc
- CVE-2019-8391qdPM 9.1 suffers from Cross-site Scripting (XSS) via configuration?type=[XSS] parameter.
- CVE-2019-8390qdPM 9.1 suffers from Cross-site Scripting (XSS) in the search[keywords] parameter.
- CVE-2019-6516An issue was discovered in WSO2 Dashboard Server 2.0.0.
- CVE-2019-6515An issue was discovered in WSO2 API Manager 2.6.0.
- CVE-2019-6514An issue was discovered in WSO2 Dashboard Server 2.0.0.
- CVE-2019-6512An issue was discovered in WSO2 API Manager 2.6.0.
- CVE-2018-18800The Tubigan "Welcome to our Resort" 1.0 software allows SQL Injection via index.php?p=accomodation&q=[SQL], index.php?p=rooms&q=[SQL], or ad
- CVE-2019-11336Sony Bravia Smart TV devices allow remote attackers to retrieve the static Wi-Fi password (used when the TV is acting as an access point) by
- CVE-2019-12087Samsung S9+, S10, and XCover 4 P(9.0) devices can become temporarily inoperable because of an unprotected intent in the ContainerAgent appli