# CVEs published 2019-05-16

119 CVEs were published on May 16, 2019: 1 critical, 11 high. 3 are now in CISA KEV. Days are UTC.

- [CVE-2019-10909](https://cve.now/CVE-2019-10909.md): In Symfony before 2.7.51, 2.8.x before 2.8.50, 3.x before 3.4.26, 4.x before 4.1.12, and 4.2.x before 4.2.7, validation messages are not esc (no CVSS, symfony/symfony · symfony/framework-bundle +2)
- [CVE-2019-10910](https://cve.now/CVE-2019-10910.md): In Symfony before 2.7.51, 2.8.x before 2.8.50, 3.x before 3.4.26, 4.x before 4.1.12, and 4.2.x before 4.2.7, when service ids allow user inp (no CVSS, symfony/dependency-injection · symfony/proxy-manager-bri… +1)
- [CVE-2019-10911](https://cve.now/CVE-2019-10911.md): In Symfony before 2.7.51, 2.8.x before 2.8.50, 3.x before 3.4.26, 4.x before 4.1.12, and 4.2.x before 4.2.7, a vulnerability would allow an (no CVSS, symfony/security-http · symfony/security +1)
- [CVE-2019-10912](https://cve.now/CVE-2019-10912.md): In Symfony before 2.8.50, 3.x before 3.4.26, 4.x before 4.1.12, and 4.2.x before 4.2.7, it is possible to cache objects that may contain bad (no CVSS, symfony/cache · symfony/phpunit-bridge +3)
- [CVE-2019-10913](https://cve.now/CVE-2019-10913.md): In Symfony before 2.7.51, 2.8.x before 2.8.50, 3.x before 3.4.26, 4.x before 4.1.12, and 4.2.x before 4.2.7, HTTP Methods provided as verbs (no CVSS, symfony/http-foundation · symfony/symfony)
- [CVE-2019-3839](https://cve.now/CVE-2019-3839.md): It was found that in ghostscript some privileged operators remained accessible from various places after the CVE-2019-6116 fix. (CVSS 7.3, The ghostscript Project ghostscript)
- [CVE-2019-0963](https://cve.now/CVE-2019-0963.md): A cross-site-scripting (XSS) vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web reques (CVSS 5.4, Microsoft SharePoint Foundation)
- [CVE-2019-0971](https://cve.now/CVE-2019-0971.md): An information disclosure vulnerability exists when Azure DevOps Server and Microsoft Team Foundation Server do not properly sanitize a spec (no CVSS, Microsoft Team Foundation Server · Microsoft Azure DevOps S…)
- [CVE-2019-0976](https://cve.now/CVE-2019-0976.md): A tampering vulnerability exists in the NuGet Package Manager for Linux and Mac that could allow an authenticated attacker to modify content (no CVSS, Microsoft Nuget · NuGet.Commands)
- [CVE-2019-0979](https://cve.now/CVE-2019-0979.md): A Cross-site Scripting (XSS) vulnerability exists when Azure DevOps Server and Team Foundation Server do not properly sanitize user provided (no CVSS, Microsoft Team Foundation Server · Microsoft Azure DevOps S…)
- [CVE-2019-0980](https://cve.now/CVE-2019-0980.md): A denial of service vulnerability exists when .NET Framework or .NET Core improperly handle web requests, aka '.Net Framework and .Net Core (no CVSS, Microsoft .NET Framework · Microsoft .NET Core +1)
- [CVE-2019-0981](https://cve.now/CVE-2019-0981.md): A denial of service vulnerability exists when .NET Framework or .NET Core improperly handle web requests, aka '.Net Framework and .Net Core (no CVSS, Microsoft .NET Framework · Microsoft .NET Core +1)
- [CVE-2019-0982](https://cve.now/CVE-2019-0982.md): A denial of service vulnerability exists when ASP.NET Core improperly handles web requests, aka 'ASP.NET Core Denial of Service Vulnerabilit (no CVSS, Microsoft ASP.NET Core · Microsoft.AspNetCore.SignalR.Proto…)
- [CVE-2019-0995](https://cve.now/CVE-2019-0995.md): A security feature bypass vulnerability exists when urlmon.dll improperly handles certain Mark of the Web queries, aka 'Internet Explorer Se (no CVSS, Microsoft Internet Explorer)
- [CVE-2019-1000](https://cve.now/CVE-2019-1000.md): An elevation of privilege vulnerability exists in Microsoft Azure Active Directory Connect build 1.3.20.0, which allows an attacker to execu (no CVSS, Microsoft Azure Active Directory Connect)
- [CVE-2019-1008](https://cve.now/CVE-2019-1008.md): A security feature bypass vulnerability exists in Dynamics On Premise, aka 'Microsoft Dynamics On-Premise Security Feature Bypass'. (no CVSS, Microsoft Dynamics)
- [CVE-2019-0957](https://cve.now/CVE-2019-0957.md): An elevation of privilege vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request t (no CVSS, Microsoft SharePoint Enterprise Server · Microsoft SharePoi…)
- [CVE-2019-0958](https://cve.now/CVE-2019-0958.md): An elevation of privilege vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request t (no CVSS, Microsoft SharePoint Foundation · Microsoft SharePoint Serv…)
- [CVE-2019-0961](https://cve.now/CVE-2019-0961.md): An information disclosure vulnerability exists when the Windows GDI component improperly discloses the contents of its memory, aka 'Windows (no CVSS, Microsoft Windows)
- [CVE-2019-0933](https://cve.now/CVE-2019-0933.md): A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka 'C (no CVSS, Microsoft Edge · Microsoft ChakraCore +1)
- [CVE-2019-0936](https://cve.now/CVE-2019-0936.md): An elevation of privilege vulnerability exists in Microsoft Windows when Windows fails to properly handle certain symbolic links, aka 'Windo (no CVSS, Microsoft Windows)
- [CVE-2019-0937](https://cve.now/CVE-2019-0937.md): A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka 'C (no CVSS, Microsoft Edge · Microsoft ChakraCore +1)
- [CVE-2019-0938](https://cve.now/CVE-2019-0938.md): An elevation of privilege vulnerability exists in Microsoft Edge that could allow an attacker to escape from the AppContainer sandbox in the (no CVSS, Microsoft Edge)
- [CVE-2019-0940](https://cve.now/CVE-2019-0940.md): A remote code execution vulnerability exists in the way that Microsoft browsers access objects in memory, aka 'Microsoft Browser Memory Corr (no CVSS, Microsoft Internet Explorer · Microsoft Edge)
- [CVE-2019-0942](https://cve.now/CVE-2019-0942.md): An elevation of privilege vulnerability exists in the Unified Write Filter (UWF) feature for Windows 10 when it improperly restricts access (no CVSS, Microsoft Windows)
- [CVE-2019-0945](https://cve.now/CVE-2019-0945.md): A remote code execution vulnerability exists when the Microsoft Office Access Connectivity Engine improperly handles objects in memory, aka (no CVSS, Microsoft Office)
- [CVE-2019-0946](https://cve.now/CVE-2019-0946.md): A remote code execution vulnerability exists when the Microsoft Office Access Connectivity Engine improperly handles objects in memory, aka (no CVSS, Microsoft Office)
- [CVE-2019-0947](https://cve.now/CVE-2019-0947.md): A remote code execution vulnerability exists when the Microsoft Office Access Connectivity Engine improperly handles objects in memory, aka (no CVSS, Microsoft Office)
- [CVE-2019-0949](https://cve.now/CVE-2019-0949.md): A spoofing vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected S (no CVSS, Microsoft SharePoint Foundation · Microsoft SharePoint Ente…)
- [CVE-2019-0950](https://cve.now/CVE-2019-0950.md): A spoofing vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected S (no CVSS, Microsoft SharePoint Foundation · Microsoft SharePoint Ente…)
- [CVE-2019-0951](https://cve.now/CVE-2019-0951.md): A spoofing vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected S (no CVSS, Microsoft SharePoint Foundation)
- [CVE-2019-0952](https://cve.now/CVE-2019-0952.md): A remote code execution vulnerability exists in Microsoft SharePoint Server when it fails to properly identify and filter unsafe ASP.Net web (no CVSS, Microsoft SharePoint Foundation · Microsoft SharePoint Ente…)
- [CVE-2019-0953](https://cve.now/CVE-2019-0953.md): A remote code execution vulnerability exists in Microsoft Word software when it fails to properly handle objects in memory, aka 'Microsoft W (no CVSS, Microsoft Office · Microsoft Word)
- [CVE-2019-0956](https://cve.now/CVE-2019-0956.md): An information disclosure vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request t (no CVSS, Microsoft SharePoint Foundation · Microsoft SharePoint Ente…)
- [CVE-2019-0902](https://cve.now/CVE-2019-0902.md): A remote code execution vulnerability exists when the Windows Jet Database Engine improperly handles objects in memory, aka 'Jet Database En (no CVSS, Microsoft Windows)
- [CVE-2019-0903](https://cve.now/CVE-2019-0903.md): A remote code execution vulnerability exists in the way that the Windows Graphics Device Interface (GDI) handles objects in the memory, aka (CVSS 8.8, KEV, Microsoft Windows)
- [CVE-2019-0911](https://cve.now/CVE-2019-0911.md): A remote code execution vulnerability exists in the way the scripting engine handles objects in memory in Microsoft browsers, aka 'Scripting (no CVSS, Microsoft Internet Explorer · Microsoft Edge +2)
- [CVE-2019-0912](https://cve.now/CVE-2019-0912.md): A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka 'C (no CVSS, Microsoft Edge · Microsoft ChakraCore +1)
- [CVE-2019-0913](https://cve.now/CVE-2019-0913.md): A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka 'C (no CVSS, Microsoft Edge · Microsoft ChakraCore +1)
- [CVE-2019-0914](https://cve.now/CVE-2019-0914.md): A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka 'C (no CVSS, Microsoft Edge · Microsoft ChakraCore +1)
- [CVE-2019-0915](https://cve.now/CVE-2019-0915.md): A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka 'C (no CVSS, Microsoft Edge · Microsoft ChakraCore +1)
- [CVE-2019-0916](https://cve.now/CVE-2019-0916.md): A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka 'C (no CVSS, Microsoft Edge · Microsoft ChakraCore +1)
- [CVE-2019-0917](https://cve.now/CVE-2019-0917.md): A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka 'C (no CVSS, Microsoft Edge · Microsoft ChakraCore +1)
- [CVE-2019-0918](https://cve.now/CVE-2019-0918.md): A remote code execution vulnerability exists in the way the scripting engine handles objects in memory in Microsoft browsers, aka 'Scripting (no CVSS, Microsoft Internet Explorer)
- [CVE-2019-0921](https://cve.now/CVE-2019-0921.md): An spoofing vulnerability exists when Internet Explorer improperly handles URLs, aka 'Internet Explorer Spoofing Vulnerability'. (no CVSS, Microsoft Internet Explorer)
- [CVE-2019-0922](https://cve.now/CVE-2019-0922.md): A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka 'C (no CVSS, Microsoft Edge · Microsoft ChakraCore +1)
- [CVE-2019-0923](https://cve.now/CVE-2019-0923.md): A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka 'C (no CVSS, Microsoft Edge · Microsoft.ChakraCore)
- [CVE-2019-0924](https://cve.now/CVE-2019-0924.md): A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka 'C (no CVSS, Microsoft Edge · Microsoft ChakraCore +1)
- [CVE-2019-0925](https://cve.now/CVE-2019-0925.md): A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka 'C (no CVSS, Microsoft Edge · Microsoft ChakraCore +1)
- [CVE-2019-0926](https://cve.now/CVE-2019-0926.md): A remote code execution vulnerability exists when Microsoft Edge improperly accesses objects in memory, aka 'Microsoft Edge Memory Corruptio (no CVSS, Microsoft Edge)
- [CVE-2019-0927](https://cve.now/CVE-2019-0927.md): A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka 'C (no CVSS, Microsoft Edge · Microsoft ChakraCore +1)
- [CVE-2019-0929](https://cve.now/CVE-2019-0929.md): A remote code execution vulnerability exists when Internet Explorer improperly accesses objects in memory, aka 'Internet Explorer Memory Cor (no CVSS, Microsoft Internet Explorer)
- [CVE-2019-0930](https://cve.now/CVE-2019-0930.md): An information disclosure vulnerability exists when Internet Explorer improperly handles objects in memory, aka 'Internet Explorer Informati (no CVSS, Microsoft Internet Explorer)
- [CVE-2019-0931](https://cve.now/CVE-2019-0931.md): An elevation of privilege vulnerability exists when the Storage Service improperly handles file operations, aka 'Windows Storage Service Ele (no CVSS, Microsoft Windows)
- [CVE-2019-0932](https://cve.now/CVE-2019-0932.md): An information disclosure vulnerability exists in Skype for Android, aka 'Skype for Android Information Disclosure Vulnerability'. (no CVSS, Microsoft Skype)
- [CVE-2019-0872](https://cve.now/CVE-2019-0872.md): A Cross-site Scripting (XSS) vulnerability exists when Azure DevOps Server and Team Foundation Server do not properly sanitize user provided (no CVSS, Microsoft Team Foundation Server · Microsoft Azure DevOps S…)
- [CVE-2019-0881](https://cve.now/CVE-2019-0881.md): An elevation of privilege vulnerability exists when the Windows Kernel improperly handles key enumeration, aka 'Windows Kernel Elevation of (no CVSS, Microsoft Windows)
- [CVE-2019-0882](https://cve.now/CVE-2019-0882.md): An information disclosure vulnerability exists when the Windows GDI component improperly discloses the contents of its memory, aka 'Windows (no CVSS, Microsoft Windows)
- [CVE-2019-0884](https://cve.now/CVE-2019-0884.md): A remote code execution vulnerability exists in the way the scripting engine handles objects in memory in Microsoft browsers, aka 'Scripting (no CVSS, Microsoft Internet Explorer · Microsoft Edge)
- [CVE-2019-0885](https://cve.now/CVE-2019-0885.md): A remote code execution vulnerability exists when Microsoft Windows OLE fails to properly validate user input, aka 'Windows OLE Remote Code (no CVSS, Microsoft Windows)
- [CVE-2019-0886](https://cve.now/CVE-2019-0886.md): An information disclosure vulnerability exists when Windows Hyper-V on a host operating system fails to properly validate input from an auth (no CVSS, Microsoft Windows Server · Microsoft Windows)
- [CVE-2019-0889](https://cve.now/CVE-2019-0889.md): A remote code execution vulnerability exists when the Windows Jet Database Engine improperly handles objects in memory, aka 'Jet Database En (no CVSS, Microsoft Windows)
- [CVE-2019-0890](https://cve.now/CVE-2019-0890.md): A remote code execution vulnerability exists when the Windows Jet Database Engine improperly handles objects in memory, aka 'Jet Database En (no CVSS, Microsoft Windows)
- [CVE-2019-0891](https://cve.now/CVE-2019-0891.md): A remote code execution vulnerability exists when the Windows Jet Database Engine improperly handles objects in memory, aka 'Jet Database En (no CVSS, Microsoft Windows)
- [CVE-2019-0892](https://cve.now/CVE-2019-0892.md): An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in memory, aka 'Win32k (no CVSS, Microsoft Windows)
- [CVE-2019-0893](https://cve.now/CVE-2019-0893.md): A remote code execution vulnerability exists when the Windows Jet Database Engine improperly handles objects in memory, aka 'Jet Database En (no CVSS, Microsoft Windows)
- [CVE-2019-0894](https://cve.now/CVE-2019-0894.md): A remote code execution vulnerability exists when the Windows Jet Database Engine improperly handles objects in memory, aka 'Jet Database En (no CVSS, Microsoft Windows)
- [CVE-2019-0895](https://cve.now/CVE-2019-0895.md): A remote code execution vulnerability exists when the Windows Jet Database Engine improperly handles objects in memory, aka 'Jet Database En (no CVSS, Microsoft Windows)
- [CVE-2019-0896](https://cve.now/CVE-2019-0896.md): A remote code execution vulnerability exists when the Windows Jet Database Engine improperly handles objects in memory, aka 'Jet Database En (no CVSS, Microsoft Windows)
- [CVE-2019-0897](https://cve.now/CVE-2019-0897.md): A remote code execution vulnerability exists when the Windows Jet Database Engine improperly handles objects in memory, aka 'Jet Database En (no CVSS, Microsoft Windows)
- [CVE-2019-0898](https://cve.now/CVE-2019-0898.md): A remote code execution vulnerability exists when the Windows Jet Database Engine improperly handles objects in memory, aka 'Jet Database En (no CVSS, Microsoft Windows)
- [CVE-2019-0899](https://cve.now/CVE-2019-0899.md): A remote code execution vulnerability exists when the Windows Jet Database Engine improperly handles objects in memory, aka 'Jet Database En (no CVSS, Microsoft Windows)
- [CVE-2019-0900](https://cve.now/CVE-2019-0900.md): A remote code execution vulnerability exists when the Windows Jet Database Engine improperly handles objects in memory, aka 'Jet Database En (no CVSS, Microsoft Windows)
- [CVE-2019-0901](https://cve.now/CVE-2019-0901.md): A remote code execution vulnerability exists when the Windows Jet Database Engine improperly handles objects in memory, aka 'Jet Database En (no CVSS, Microsoft Windows)
- [CVE-2019-0707](https://cve.now/CVE-2019-0707.md): An elevation of privilege vulnerability exists in the Network Driver Interface Specification (NDIS) when ndis.sys fails to check the length (no CVSS, Microsoft Windows Server · Microsoft Windows)
- [CVE-2019-0708](https://cve.now/CVE-2019-0708.md): A remote code execution vulnerability exists in Remote Desktop Services formerly known as Terminal Services when an unauthenticated attacker (CVSS 9.8, KEV, Microsoft Windows)
- [CVE-2019-0725](https://cve.now/CVE-2019-0725.md): A memory corruption vulnerability exists in the Windows Server DHCP service when processing specially crafted packets, aka 'Windows DHCP Ser (no CVSS, Microsoft Windows Server · Microsoft Windows Server,)
- [CVE-2019-0727](https://cve.now/CVE-2019-0727.md): An elevation of privilege vulnerability exists when the Diagnostics Hub Standard Collector or the Visual Studio Standard Collector allows fi (no CVSS, Microsoft Visual Studio · Microsoft Windows)
- [CVE-2019-0733](https://cve.now/CVE-2019-0733.md): A security feature bypass vulnerability exists in Windows Defender Application Control (WDAC) which could allow an attacker to bypass WDAC e (no CVSS, Microsoft Windows)
- [CVE-2019-0734](https://cve.now/CVE-2019-0734.md): An elevation of privilege vulnerability exists in Microsoft Windows when a man-in-the-middle attacker is able to successfully decode and rep (no CVSS, Microsoft Windows)
- [CVE-2019-0758](https://cve.now/CVE-2019-0758.md): An information disclosure vulnerability exists when the Windows GDI component improperly discloses the contents of its memory, aka 'Windows (no CVSS, Microsoft Windows)
- [CVE-2019-0819](https://cve.now/CVE-2019-0819.md): An information disclosure vulnerability exists in Microsoft SQL Server Analysis Services when it improperly enforces metadata permissions, a (no CVSS, Microsoft SQL Server 2017 for x64-based Systems)
- [CVE-2019-0820](https://cve.now/CVE-2019-0820.md): A denial of service vulnerability exists when .NET Framework and .NET Core improperly process RegEx strings, aka '.NET Framework and .NET Co (no CVSS, Microsoft .NET Framework · Microsoft .NET Core +1)
- [CVE-2019-0863](https://cve.now/CVE-2019-0863.md): An elevation of privilege vulnerability exists in the way Windows Error Reporting (WER) handles files, aka 'Windows Error Reporting Elevatio (CVSS 7.8, KEV, Microsoft Windows)
- [CVE-2019-0864](https://cve.now/CVE-2019-0864.md): A denial of service vulnerability exists when .NET Framework improperly handles objects in heap memory, aka '.NET Framework Denial of Servic (no CVSS, Microsoft .NET Framework)
- [CVE-2018-20007](https://cve.now/CVE-2018-20007.md): Yeelight Smart AI Speaker 3.3.10\_0074 devices have improper access control over the UART interface, allowing physical attackers to obtain a (no CVSS)
- [CVE-2019-1780](https://cve.now/CVE-2019-1780.md): Cisco FXOS and NX-OS Software Command Injection Vulnerability (CVSS 4.2, Cisco NX-OS Software)
- [CVE-2018-12556](https://cve.now/CVE-2018-12556.md): The signature verification routine in install.sh in yarnpkg/website through 2018-06-05 only verifies that the yarn release is signed by any (no CVSS)
- [CVE-2019-8338](https://cve.now/CVE-2019-8338.md): The signature verification routine in the Airmail GPG-PGP Plugin, versions 1.0 (9) and earlier, does not verify the status of the signature (no CVSS)
- [CVE-2019-10112](https://cve.now/CVE-2019-10112.md): An issue was discovered in GitLab Community and Enterprise Edition before 11.7.8, 11.8.x before 11.8.4, and 11.9.x before 11.9.2. (no CVSS)
- [CVE-2019-10117](https://cve.now/CVE-2019-10117.md): An Open Redirect issue was discovered in GitLab Community and Enterprise Edition before 11.7.8, 11.8.x before 11.8.4, and 11.9.x before 11.9 (no CVSS)
- [CVE-2019-11033](https://cve.now/CVE-2019-11033.md): Applaud HCM 4.0.42+ uses HTML tag fields for HTML inputs in a form. (no CVSS)
- [CVE-2019-10116](https://cve.now/CVE-2019-10116.md): An Insecure Permissions issue (issue 3 of 3) was discovered in GitLab Community and Enterprise Edition before 11.7.8, 11.8.x before 11.8.4, (no CVSS)
- [CVE-2018-1975](https://cve.now/CVE-2018-1975.md): IBM Rational DOORS Web Access 9.5.1 through 9.5.2.9, and 9.6 through 9.6.1.9 is vulnerable to cross-site scripting. (CVSS 5.4, IBM Rational DOORS Web Access)
- [CVE-2019-10115](https://cve.now/CVE-2019-10115.md): An Insecure Permissions issue (issue 2 of 3) was discovered in GitLab Community and Enterprise Edition before 11.7.8, 11.8.x before 11.8.4, (no CVSS)
- [CVE-2019-10114](https://cve.now/CVE-2019-10114.md): An Information Exposure issue (issue 2 of 2) was discovered in GitLab Community and Enterprise Edition before 11.7.8, 11.8.x before 11.8.4, (no CVSS)
- [CVE-2019-10113](https://cve.now/CVE-2019-10113.md): An issue was discovered in GitLab Community and Enterprise Edition before 11.7.8, 11.8.x before 11.8.4, and 11.9.x before 11.9.2. (no CVSS)
- [CVE-2018-17048](https://cve.now/CVE-2018-17048.md): admin/Lib/Action/FpluginAction.class.php in FDCMS (aka Fangfa Content Manage System) 4.2 allows SQL Injection. (no CVSS)
- [CVE-2019-12139](https://cve.now/CVE-2019-12139.md): An XSS issue was discovered in the Admin UI in eZ Platform 2.x. (no CVSS, ezsystems/ezplatform-admin-ui)
- [CVE-2019-12138](https://cve.now/CVE-2019-12138.md): MacDown 0.7.1 allows directory traversal, for execution of arbitrary programs, via a file:/// or ../ substring in a shared note. (no CVSS)
- [CVE-2019-12137](https://cve.now/CVE-2019-12137.md): Typora 0.9.9.24.6 on macOS allows directory traversal, for execution of arbitrary programs, via a file:/// or ../ substring in a shared note (no CVSS)
- [CVE-2019-12136](https://cve.now/CVE-2019-12136.md): There is XSS in BoostIO Boostnote 0.11.15 via a label named mermaid, as demonstrated by a crafted SRC attribute of an IFRAME element. (no CVSS)
- [CVE-2019-1768](https://cve.now/CVE-2019-1768.md): Cisco NX-OS Software Buffer Overflow and Command Injection Vulnerability (CVSS 6.7, Cisco NX-OS Software)
- [CVE-2019-1833](https://cve.now/CVE-2019-1833.md): Cisco Firepower Threat Defense Software SSL/TLS Policy Bypass Vulnerability (CVSS 5.8, Cisco Firepower Threat Defense Software)
- [CVE-2019-1846](https://cve.now/CVE-2019-1846.md): Cisco IOS XR Software for Cisco ASR 9000 Series Aggregation Services Routers MPLS OAM Denial of Service Vulnerability (CVSS 7.4, Cisco IOS XR Software)
- [CVE-2019-1849](https://cve.now/CVE-2019-1849.md): Cisco IOS XR Software BGP MPLS-Based EVPN Denial of Service Vulnerability (CVSS 7.4, Cisco IOS XR Software)
- [CVE-2019-1851](https://cve.now/CVE-2019-1851.md): Cisco Identity Services Engine Arbitrary Client Certificate Creation Vulnerability (CVSS 6.8, Cisco Identity Services Engine Software)
- [CVE-2019-1853](https://cve.now/CVE-2019-1853.md): Cisco AnyConnect Secure Mobility Client for Linux Out-of-Bounds Memory Read Vulnerability (CVSS 4.8, Cisco AnyConnect Secure Mobility Client)
- [CVE-2019-1858](https://cve.now/CVE-2019-1858.md): Cisco FXOS and NX-OS Software Simple Network Management Protocol Denial of Service Vulnerability (CVSS 8.6, Cisco Firepower Extensible Operating System)
- [CVE-2019-1860](https://cve.now/CVE-2019-1860.md): Cisco Unified Intelligence Center Remote File Injection Vulnerability (CVSS 5.9, Cisco Unified Intelligence Center)
- [CVE-2019-1832](https://cve.now/CVE-2019-1832.md): Cisco Firepower Threat Defense Software Detection Engine Policy Bypass Vulnerability (CVSS 5.8, Cisco Firepower Threat Defense Software)
- [CVE-2019-1818](https://cve.now/CVE-2019-1818.md): Cisco Prime Infrastructure and Evolved Programmable Network Manager Path Traversal Vulnerability (CVSS 6.5, Cisco Prime Infrastructure)
- [CVE-2019-1819](https://cve.now/CVE-2019-1819.md): Cisco Prime Infrastructure and Evolved Programmable Network Manager Path Traversal Vulnerability (CVSS 6.5, Cisco Prime Infrastructure)
- [CVE-2019-1820](https://cve.now/CVE-2019-1820.md): Cisco Prime Infrastructure and Evolved Programmable Network Manager Path Traversal Vulnerability (CVSS 6.5, Cisco Prime Infrastructure)
- [CVE-2019-1821](https://cve.now/CVE-2019-1821.md): Cisco Prime Infrastructure and Evolved Programmable Network Manager Remote Code Execution Vulnerabilities (CVSS 8.8, Cisco Prime Infrastructure)
- [CVE-2019-1822](https://cve.now/CVE-2019-1822.md): Cisco Prime Infrastructure and Evolved Programmable Network Manager Remote Code Execution Vulnerabilities (CVSS 8.8, Cisco Prime Infrastructure)
- [CVE-2019-1823](https://cve.now/CVE-2019-1823.md): Cisco Prime Infrastructure and Evolved Programmable Network Manager Remote Code Execution Vulnerabilities (CVSS 8.8, Cisco Prime Infrastructure)
- [CVE-2019-1824](https://cve.now/CVE-2019-1824.md): Cisco Prime Infrastructure and Evolved Programmable Network Manager SQL Injection Vulnerabilities (CVSS 8.1, Cisco Prime Infrastructure)
- [CVE-2019-1825](https://cve.now/CVE-2019-1825.md): Cisco Prime Infrastructure and Evolved Programmable Network Manager SQL Injection Vulnerabilities (CVSS 8.1, Cisco Prime Infrastructure)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2019-05-16
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.