CVEs published May 16, 2019
119 CVEs were published on May 16, 2019: 1 critical, 11 high. 3 are now in CISA KEV.
- Published
- 119
- Critical
- 1
- High
- 11
- Medium
- 12
- Low
- 0
- Unrated
- 95
- Now in CISA KEV
- 3
- Fix available
- 27
Most affected products
- Microsoft Windows
- 27
- Microsoft Edge · Microsoft ChakraCore +1
- 12
- Cisco Prime Infrastructure
- 8
- Microsoft Internet Explorer
- 5
- Microsoft SharePoint Foundation · Microsoft SharePoint Ente…
- 4
- Microsoft .NET Framework · Microsoft .NET Core +1
- 3
- Microsoft Office
- 3
- Microsoft Team Foundation Server · Microsoft Azure DevOps S…
- 3
- Cisco Firepower Threat Defense Software
- 2
- Cisco IOS XR Software
- 2
Critical 1
High 11
- CVE-2019-3839It was found that in ghostscript some privileged operators remained accessible from various places after the CVE-2019-6116 fix.The ghostscript Project ghostscript
- CVE-2019-0903A remote code execution vulnerability exists in the way that the Windows Graphics Device Interface (GDI) handles objects in the memory, aka Microsoft Windows
- CVE-2019-0863An elevation of privilege vulnerability exists in the way Windows Error Reporting (WER) handles files, aka 'Windows Error Reporting ElevatioMicrosoft Windows
- CVE-2019-1846Cisco IOS XR Software for Cisco ASR 9000 Series Aggregation Services Routers MPLS OAM Denial of Service VulnerabilityCisco IOS XR Software
- CVE-2019-1849Cisco IOS XR Software BGP MPLS-Based EVPN Denial of Service VulnerabilityCisco IOS XR Software
- CVE-2019-1858Cisco FXOS and NX-OS Software Simple Network Management Protocol Denial of Service VulnerabilityCisco Firepower Extensible Operating System
- CVE-2019-1821Cisco Prime Infrastructure and Evolved Programmable Network Manager Remote Code Execution VulnerabilitiesCisco Prime Infrastructure
- CVE-2019-1822Cisco Prime Infrastructure and Evolved Programmable Network Manager Remote Code Execution VulnerabilitiesCisco Prime Infrastructure
- CVE-2019-1823Cisco Prime Infrastructure and Evolved Programmable Network Manager Remote Code Execution VulnerabilitiesCisco Prime Infrastructure
- CVE-2019-1824Cisco Prime Infrastructure and Evolved Programmable Network Manager SQL Injection VulnerabilitiesCisco Prime Infrastructure
- CVE-2019-1825Cisco Prime Infrastructure and Evolved Programmable Network Manager SQL Injection VulnerabilitiesCisco Prime Infrastructure
Medium, low and unrated 107
- CVE-2019-10909In Symfony before 2.7.51, 2.8.x before 2.8.50, 3.x before 3.4.26, 4.x before 4.1.12, and 4.2.x before 4.2.7, validation messages are not escsymfony/symfony · symfony/framework-bundle +2
- CVE-2019-10910In Symfony before 2.7.51, 2.8.x before 2.8.50, 3.x before 3.4.26, 4.x before 4.1.12, and 4.2.x before 4.2.7, when service ids allow user inpsymfony/dependency-injection · symfony/proxy-manager-bri… +1
- CVE-2019-10911In Symfony before 2.7.51, 2.8.x before 2.8.50, 3.x before 3.4.26, 4.x before 4.1.12, and 4.2.x before 4.2.7, a vulnerability would allow an symfony/security-http · symfony/security +1
- CVE-2019-10912In Symfony before 2.8.50, 3.x before 3.4.26, 4.x before 4.1.12, and 4.2.x before 4.2.7, it is possible to cache objects that may contain badsymfony/cache · symfony/phpunit-bridge +3
- CVE-2019-10913In Symfony before 2.7.51, 2.8.x before 2.8.50, 3.x before 3.4.26, 4.x before 4.1.12, and 4.2.x before 4.2.7, HTTP Methods provided as verbs symfony/http-foundation · symfony/symfony
- CVE-2019-0963A cross-site-scripting (XSS) vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web requesMicrosoft SharePoint Foundation
- CVE-2019-0971An information disclosure vulnerability exists when Azure DevOps Server and Microsoft Team Foundation Server do not properly sanitize a specMicrosoft Team Foundation Server · Microsoft Azure DevOps S…
- CVE-2019-0976A tampering vulnerability exists in the NuGet Package Manager for Linux and Mac that could allow an authenticated attacker to modify contentMicrosoft Nuget · NuGet.Commands
- CVE-2019-0979A Cross-site Scripting (XSS) vulnerability exists when Azure DevOps Server and Team Foundation Server do not properly sanitize user providedMicrosoft Team Foundation Server · Microsoft Azure DevOps S…
- CVE-2019-0980A denial of service vulnerability exists when .NET Framework or .NET Core improperly handle web requests, aka '.Net Framework and .Net Core Microsoft .NET Framework · Microsoft .NET Core +1
- CVE-2019-0981A denial of service vulnerability exists when .NET Framework or .NET Core improperly handle web requests, aka '.Net Framework and .Net Core Microsoft .NET Framework · Microsoft .NET Core +1
- CVE-2019-0982A denial of service vulnerability exists when ASP.NET Core improperly handles web requests, aka 'ASP.NET Core Denial of Service VulnerabilitMicrosoft ASP.NET Core · Microsoft.AspNetCore.SignalR.Proto…
- CVE-2019-0995A security feature bypass vulnerability exists when urlmon.dll improperly handles certain Mark of the Web queries, aka 'Internet Explorer SeMicrosoft Internet Explorer
- CVE-2019-1000An elevation of privilege vulnerability exists in Microsoft Azure Active Directory Connect build 1.3.20.0, which allows an attacker to execuMicrosoft Azure Active Directory Connect
- CVE-2019-1008A security feature bypass vulnerability exists in Dynamics On Premise, aka 'Microsoft Dynamics On-Premise Security Feature Bypass'.Microsoft Dynamics
- CVE-2019-0957An elevation of privilege vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request tMicrosoft SharePoint Enterprise Server · Microsoft SharePoi…
- CVE-2019-0958An elevation of privilege vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request tMicrosoft SharePoint Foundation · Microsoft SharePoint Serv…
- CVE-2019-0961An information disclosure vulnerability exists when the Windows GDI component improperly discloses the contents of its memory, aka 'Windows Microsoft Windows
- CVE-2019-0933A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka 'CMicrosoft Edge · Microsoft ChakraCore +1
- CVE-2019-0936An elevation of privilege vulnerability exists in Microsoft Windows when Windows fails to properly handle certain symbolic links, aka 'WindoMicrosoft Windows
- CVE-2019-0937A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka 'CMicrosoft Edge · Microsoft ChakraCore +1
- CVE-2019-0938An elevation of privilege vulnerability exists in Microsoft Edge that could allow an attacker to escape from the AppContainer sandbox in theMicrosoft Edge
- CVE-2019-0940A remote code execution vulnerability exists in the way that Microsoft browsers access objects in memory, aka 'Microsoft Browser Memory CorrMicrosoft Internet Explorer · Microsoft Edge
- CVE-2019-0942An elevation of privilege vulnerability exists in the Unified Write Filter (UWF) feature for Windows 10 when it improperly restricts access Microsoft Windows
- CVE-2019-0945A remote code execution vulnerability exists when the Microsoft Office Access Connectivity Engine improperly handles objects in memory, aka Microsoft Office
- CVE-2019-0946A remote code execution vulnerability exists when the Microsoft Office Access Connectivity Engine improperly handles objects in memory, aka Microsoft Office
- CVE-2019-0947A remote code execution vulnerability exists when the Microsoft Office Access Connectivity Engine improperly handles objects in memory, aka Microsoft Office
- CVE-2019-0949A spoofing vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected SMicrosoft SharePoint Foundation · Microsoft SharePoint Ente…
- CVE-2019-0950A spoofing vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected SMicrosoft SharePoint Foundation · Microsoft SharePoint Ente…
- CVE-2019-0951A spoofing vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected SMicrosoft SharePoint Foundation
- CVE-2019-0952A remote code execution vulnerability exists in Microsoft SharePoint Server when it fails to properly identify and filter unsafe ASP.Net webMicrosoft SharePoint Foundation · Microsoft SharePoint Ente…
- CVE-2019-0953A remote code execution vulnerability exists in Microsoft Word software when it fails to properly handle objects in memory, aka 'Microsoft WMicrosoft Office · Microsoft Word
- CVE-2019-0956An information disclosure vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request tMicrosoft SharePoint Foundation · Microsoft SharePoint Ente…
- CVE-2019-0902A remote code execution vulnerability exists when the Windows Jet Database Engine improperly handles objects in memory, aka 'Jet Database EnMicrosoft Windows
- CVE-2019-0911A remote code execution vulnerability exists in the way the scripting engine handles objects in memory in Microsoft browsers, aka 'ScriptingMicrosoft Internet Explorer · Microsoft Edge +2
- CVE-2019-0912A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka 'CMicrosoft Edge · Microsoft ChakraCore +1
- CVE-2019-0913A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka 'CMicrosoft Edge · Microsoft ChakraCore +1
- CVE-2019-0914A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka 'CMicrosoft Edge · Microsoft ChakraCore +1
- CVE-2019-0915A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka 'CMicrosoft Edge · Microsoft ChakraCore +1
- CVE-2019-0916A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka 'CMicrosoft Edge · Microsoft ChakraCore +1
- CVE-2019-0917A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka 'CMicrosoft Edge · Microsoft ChakraCore +1
- CVE-2019-0918A remote code execution vulnerability exists in the way the scripting engine handles objects in memory in Microsoft browsers, aka 'ScriptingMicrosoft Internet Explorer
- CVE-2019-0921An spoofing vulnerability exists when Internet Explorer improperly handles URLs, aka 'Internet Explorer Spoofing Vulnerability'.Microsoft Internet Explorer
- CVE-2019-0922A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka 'CMicrosoft Edge · Microsoft ChakraCore +1
- CVE-2019-0923A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka 'CMicrosoft Edge · Microsoft.ChakraCore
- CVE-2019-0924A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka 'CMicrosoft Edge · Microsoft ChakraCore +1
- CVE-2019-0925A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka 'CMicrosoft Edge · Microsoft ChakraCore +1
- CVE-2019-0926A remote code execution vulnerability exists when Microsoft Edge improperly accesses objects in memory, aka 'Microsoft Edge Memory CorruptioMicrosoft Edge
- CVE-2019-0927A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka 'CMicrosoft Edge · Microsoft ChakraCore +1
- CVE-2019-0929A remote code execution vulnerability exists when Internet Explorer improperly accesses objects in memory, aka 'Internet Explorer Memory CorMicrosoft Internet Explorer
- CVE-2019-0930An information disclosure vulnerability exists when Internet Explorer improperly handles objects in memory, aka 'Internet Explorer InformatiMicrosoft Internet Explorer
- CVE-2019-0931An elevation of privilege vulnerability exists when the Storage Service improperly handles file operations, aka 'Windows Storage Service EleMicrosoft Windows
- CVE-2019-0932An information disclosure vulnerability exists in Skype for Android, aka 'Skype for Android Information Disclosure Vulnerability'.Microsoft Skype
- CVE-2019-0872A Cross-site Scripting (XSS) vulnerability exists when Azure DevOps Server and Team Foundation Server do not properly sanitize user providedMicrosoft Team Foundation Server · Microsoft Azure DevOps S…
- CVE-2019-0881An elevation of privilege vulnerability exists when the Windows Kernel improperly handles key enumeration, aka 'Windows Kernel Elevation of Microsoft Windows
- CVE-2019-0882An information disclosure vulnerability exists when the Windows GDI component improperly discloses the contents of its memory, aka 'Windows Microsoft Windows
- CVE-2019-0884A remote code execution vulnerability exists in the way the scripting engine handles objects in memory in Microsoft browsers, aka 'ScriptingMicrosoft Internet Explorer · Microsoft Edge
- CVE-2019-0885A remote code execution vulnerability exists when Microsoft Windows OLE fails to properly validate user input, aka 'Windows OLE Remote Code Microsoft Windows
- CVE-2019-0886An information disclosure vulnerability exists when Windows Hyper-V on a host operating system fails to properly validate input from an authMicrosoft Windows Server · Microsoft Windows
- CVE-2019-0889A remote code execution vulnerability exists when the Windows Jet Database Engine improperly handles objects in memory, aka 'Jet Database EnMicrosoft Windows
- CVE-2019-0890A remote code execution vulnerability exists when the Windows Jet Database Engine improperly handles objects in memory, aka 'Jet Database EnMicrosoft Windows
- CVE-2019-0891A remote code execution vulnerability exists when the Windows Jet Database Engine improperly handles objects in memory, aka 'Jet Database EnMicrosoft Windows
- CVE-2019-0892An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in memory, aka 'Win32k Microsoft Windows
- CVE-2019-0893A remote code execution vulnerability exists when the Windows Jet Database Engine improperly handles objects in memory, aka 'Jet Database EnMicrosoft Windows
- CVE-2019-0894A remote code execution vulnerability exists when the Windows Jet Database Engine improperly handles objects in memory, aka 'Jet Database EnMicrosoft Windows
- CVE-2019-0895A remote code execution vulnerability exists when the Windows Jet Database Engine improperly handles objects in memory, aka 'Jet Database EnMicrosoft Windows
- CVE-2019-0896A remote code execution vulnerability exists when the Windows Jet Database Engine improperly handles objects in memory, aka 'Jet Database EnMicrosoft Windows
- CVE-2019-0897A remote code execution vulnerability exists when the Windows Jet Database Engine improperly handles objects in memory, aka 'Jet Database EnMicrosoft Windows
- CVE-2019-0898A remote code execution vulnerability exists when the Windows Jet Database Engine improperly handles objects in memory, aka 'Jet Database EnMicrosoft Windows
- CVE-2019-0899A remote code execution vulnerability exists when the Windows Jet Database Engine improperly handles objects in memory, aka 'Jet Database EnMicrosoft Windows
- CVE-2019-0900A remote code execution vulnerability exists when the Windows Jet Database Engine improperly handles objects in memory, aka 'Jet Database EnMicrosoft Windows
- CVE-2019-0901A remote code execution vulnerability exists when the Windows Jet Database Engine improperly handles objects in memory, aka 'Jet Database EnMicrosoft Windows
- CVE-2019-0707An elevation of privilege vulnerability exists in the Network Driver Interface Specification (NDIS) when ndis.sys fails to check the length Microsoft Windows Server · Microsoft Windows
- CVE-2019-0725A memory corruption vulnerability exists in the Windows Server DHCP service when processing specially crafted packets, aka 'Windows DHCP SerMicrosoft Windows Server · Microsoft Windows Server,
- CVE-2019-0727An elevation of privilege vulnerability exists when the Diagnostics Hub Standard Collector or the Visual Studio Standard Collector allows fiMicrosoft Visual Studio · Microsoft Windows
- CVE-2019-0733A security feature bypass vulnerability exists in Windows Defender Application Control (WDAC) which could allow an attacker to bypass WDAC eMicrosoft Windows
- CVE-2019-0734An elevation of privilege vulnerability exists in Microsoft Windows when a man-in-the-middle attacker is able to successfully decode and repMicrosoft Windows
- CVE-2019-0758An information disclosure vulnerability exists when the Windows GDI component improperly discloses the contents of its memory, aka 'Windows Microsoft Windows
- CVE-2019-0819An information disclosure vulnerability exists in Microsoft SQL Server Analysis Services when it improperly enforces metadata permissions, aMicrosoft SQL Server 2017 for x64-based Systems
- CVE-2019-0820A denial of service vulnerability exists when .NET Framework and .NET Core improperly process RegEx strings, aka '.NET Framework and .NET CoMicrosoft .NET Framework · Microsoft .NET Core +1
- CVE-2019-0864A denial of service vulnerability exists when .NET Framework improperly handles objects in heap memory, aka '.NET Framework Denial of ServicMicrosoft .NET Framework
- CVE-2018-20007Yeelight Smart AI Speaker 3.3.10_0074 devices have improper access control over the UART interface, allowing physical attackers to obtain a
- CVE-2019-1780Cisco FXOS and NX-OS Software Command Injection VulnerabilityCisco NX-OS Software
- CVE-2018-12556The signature verification routine in install.sh in yarnpkg/website through 2018-06-05 only verifies that the yarn release is signed by any
- CVE-2019-8338The signature verification routine in the Airmail GPG-PGP Plugin, versions 1.0 (9) and earlier, does not verify the status of the signature
- CVE-2019-10112An issue was discovered in GitLab Community and Enterprise Edition before 11.7.8, 11.8.x before 11.8.4, and 11.9.x before 11.9.2.
- CVE-2019-10117An Open Redirect issue was discovered in GitLab Community and Enterprise Edition before 11.7.8, 11.8.x before 11.8.4, and 11.9.x before 11.9
- CVE-2019-11033Applaud HCM 4.0.42+ uses HTML tag fields for HTML inputs in a form.
- CVE-2019-10116An Insecure Permissions issue (issue 3 of 3) was discovered in GitLab Community and Enterprise Edition before 11.7.8, 11.8.x before 11.8.4,
- CVE-2018-1975IBM Rational DOORS Web Access 9.5.1 through 9.5.2.9, and 9.6 through 9.6.1.9 is vulnerable to cross-site scripting.IBM Rational DOORS Web Access
- CVE-2019-10115An Insecure Permissions issue (issue 2 of 3) was discovered in GitLab Community and Enterprise Edition before 11.7.8, 11.8.x before 11.8.4,
- CVE-2019-10114An Information Exposure issue (issue 2 of 2) was discovered in GitLab Community and Enterprise Edition before 11.7.8, 11.8.x before 11.8.4,
- CVE-2019-10113An issue was discovered in GitLab Community and Enterprise Edition before 11.7.8, 11.8.x before 11.8.4, and 11.9.x before 11.9.2.
- CVE-2018-17048admin/Lib/Action/FpluginAction.class.php in FDCMS (aka Fangfa Content Manage System) 4.2 allows SQL Injection.
- CVE-2019-12139An XSS issue was discovered in the Admin UI in eZ Platform 2.x.ezsystems/ezplatform-admin-ui
- CVE-2019-12138MacDown 0.7.1 allows directory traversal, for execution of arbitrary programs, via a file:/// or ../ substring in a shared note.
- CVE-2019-12137Typora 0.9.9.24.6 on macOS allows directory traversal, for execution of arbitrary programs, via a file:/// or ../ substring in a shared note
- CVE-2019-12136There is XSS in BoostIO Boostnote 0.11.15 via a label named mermaid, as demonstrated by a crafted SRC attribute of an IFRAME element.
- CVE-2019-1768Cisco NX-OS Software Buffer Overflow and Command Injection VulnerabilityCisco NX-OS Software
- CVE-2019-1833Cisco Firepower Threat Defense Software SSL/TLS Policy Bypass VulnerabilityCisco Firepower Threat Defense Software
- CVE-2019-1851Cisco Identity Services Engine Arbitrary Client Certificate Creation VulnerabilityCisco Identity Services Engine Software
- CVE-2019-1853Cisco AnyConnect Secure Mobility Client for Linux Out-of-Bounds Memory Read VulnerabilityCisco AnyConnect Secure Mobility Client
- CVE-2019-1860Cisco Unified Intelligence Center Remote File Injection VulnerabilityCisco Unified Intelligence Center
- CVE-2019-1832Cisco Firepower Threat Defense Software Detection Engine Policy Bypass VulnerabilityCisco Firepower Threat Defense Software
- CVE-2019-1818Cisco Prime Infrastructure and Evolved Programmable Network Manager Path Traversal VulnerabilityCisco Prime Infrastructure
- CVE-2019-1819Cisco Prime Infrastructure and Evolved Programmable Network Manager Path Traversal VulnerabilityCisco Prime Infrastructure
- CVE-2019-1820Cisco Prime Infrastructure and Evolved Programmable Network Manager Path Traversal VulnerabilityCisco Prime Infrastructure