CVEs published May 17, 2019
93 CVEs were published on May 17, 2019: 1 critical, 0 high.
- Published
- 93
- Critical
- 1
- High
- 0
- Medium
- 1
- Low
- 1
- Unrated
- 90
- Now in CISA KEV
- 0
- Fix available
- 1
Most affected products
- Cybozu Garoon
- 20
- Intel(R) Active Management Technology
- 4
- Intel(R) Converged Security & Management Engine (CSME), Int…
- 4
- Intel(R) Unified Extensible Firmware Interface
- 3
- Intel(R) Driver & Support Assistant
- 2
- Intel(R) Graphics Driver KMD module
- 2
- Intel(R) Graphics Drivers
- 2
- cockpit-ovirt
- 1
- com.fasterxml.jackson.core:jackson-databind
- 1
- CREATE S.D CO. CREATE SD official App for Android
- 1
Critical 1
Medium, low and unrated 92
- CVE-2019-12173MacDown 0.7.1 (870) allows remote code execution via a file:\\\ URI, with a .app pathname, in the HREF attribute of an A element.
- CVE-2019-12172Typora 0.9.9.21.1 (1913) allows arbitrary code execution via a modified file: URL syntax in the HREF attribute of an AREA element, as demons
- CVE-2019-12170ATutor through 2.2.4 is vulnerable to arbitrary file uploads via the mods/_core/backups/upload.php (aka backup) component.
- CVE-2019-12168Four-Faith Wireless Mobile Router F3x24 v1.0 devices allow remote code execution via the Command Shell (aka Administration > Commands) scree
- CVE-2019-12163GAT-Ship Web Module through 1.30 allows remote attackers to obtain potentially sensitive information via {} in a ws/gatshipWs.asmx/SqlVersio
- CVE-2019-11644In the F-Secure installer in F-Secure SAFE for Windows before 17.6, F-Secure Internet Security before 17.6, F-Secure Anti-Virus before 17.6,
- CVE-2019-8339An issue was discovered in Falco through 0.14.0.
- CVE-2019-12161WPO WebPageTest 19.04 allows SSRF because ValidateURL in www/runtest.php does not consider octal encoding of IP addresses (such as 0300.0250
- CVE-2019-12160GoHTTP through 2017-07-25 has a sendHeader use-after-free.
- CVE-2019-12159GoHTTP through 2017-07-25 has a stack-based buffer over-read in the scan function (when called from getRequestType) via a long URL.
- CVE-2019-12158GoHTTP through 2017-07-25 has a GetExtension heap-based buffer overflow via a long extension.
- CVE-2018-16156In PaperStream IP (TWAIN) 1.42.0.5685 (Service Update 7), the FJTWSVIC service running with SYSTEM privilege processes unauthenticated messa
- CVE-2019-12086A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.x before 2.9.9.com.fasterxml.jackson.core:jackson-databind
- CVE-2019-11887SimplyBook.me through 2019-05-11 does not properly restrict File Upload which could allow remote code execution.
- CVE-2019-11057SQL injection vulnerability in Vtiger CRM before 7.1.0 hotfix3 allows authenticated users to execute arbitrary SQL commands.
- CVE-2019-7353An Incorrect Access Control issue was discovered in GitLab Community and Enterprise Edition 11.7.x before 11.7.4.
- CVE-2018-17181An issue was discovered in OpenEMR before 5.0.1 Patch 7.
- CVE-2019-6797An information disclosure issue was discovered in GitLab Enterprise Edition before 11.5.8, 11.6.x before 11.6.6, and 11.7.x before 11.7.1.
- CVE-2018-17180An issue was discovered in OpenEMR before 5.0.1 Patch 7.
- CVE-2018-17179An issue was discovered in OpenEMR before 5.0.1 Patch 7.
- CVE-2019-6790An Incorrect Access Control (issue 2 of 3) issue was discovered in GitLab Community and Enterprise Edition 8.14 and later but before 11.5.8,
- CVE-2019-6787An Incorrect Access Control issue was discovered in GitLab Community and Enterprise Edition before 11.5.8, 11.6.x before 11.6.6, and 11.7.x
- CVE-2019-6781An Improper Input Validation issue was discovered in GitLab Community and Enterprise Edition before 11.5.8, 11.6.x before 11.6.6, and 11.7.x
- CVE-2018-3701Improper directory permissions in the installer for Intel(R) PROSet/Wireless WiFi Software version 20.100 and earlier may allow an authenticIntel(R) PROSet/Wireless WiFi Software Advisory
- CVE-2019-0086Insufficient access control vulnerability in Dynamic Application Loader software for Intel(R) CSME before versions 11.8.65, 11.11.65, 11.22.Intel(R) Converged Security & Management Engine (CSME) Dyna…
- CVE-2019-0089Improper data sanitization vulnerability in subsystem in Intel(R) SPS before versions SPS_E5_04.00.04.381.0, SPS_E3_04.01.04.054.0, SPS_SoC-Intel(R) Server Platform Services
- CVE-2019-0090Insufficient access control vulnerability in subsystem for Intel(R) CSME before versions 11.x, 12.0.35 Intel(R) TXE 3.x, 4.x, Intel(R) ServeIntel(R) Converged Security & Management Engine (CSME), Int…
- CVE-2019-0091Code injection vulnerability in installer for Intel(R) CSME before versions 11.8.65, 11.11.65, 11.22.65, 12.0.35 and Intel(R) TXE 3.1.65, 4.Intel(R) Converged Security & Management Engine (CSME), Int…
- CVE-2019-0092Insufficient input validation vulnerability in subsystem for Intel(R) AMT before versions 11.8.65, 11.11.65, 11.22.65, 12.0.35 may allow an Intel(R) Active Management Technology
- CVE-2019-0093Insufficient data sanitization vulnerability in HECI subsystem for Intel(R) CSME before versions 11.8.65, 11.11.65, 11.22.65, 12.0.35 and InIntel(R) Converged Security & Management Engine (CSME), Int…
- CVE-2019-0094Insufficient input validation vulnerability in subsystem for Intel(R) AMT before versions 11.8.65, 11.11.65, 11.22.65, 12.0.35 may allow an Intel(R) Active Management Technology
- CVE-2019-0096Out of bound write vulnerability in subsystem for Intel(R) AMT before versions 11.8.65, 11.11.65, 11.22.65, 12.0.35 may allow an authenticatIntel(R) Active Management Technology
- CVE-2019-0097Insufficient input validation vulnerability in subsystem for Intel(R) AMT before version 12.0.35 may allow a privileged user to potentially Intel(R) Active Management Technology
- CVE-2019-0098Logic bug vulnerability in subsystem for Intel(R) CSME before version 12.0.35, Intel(R) TXE before 3.1.65, 4.0.15 may allow an unauthenticatIntel(R) Converged Security & Management Engine (CSME), Int…
- CVE-2019-0099Insufficient access control vulnerability in subsystem in Intel(R) SPS before version SPS_E3_05.00.04.027.0 may allow an unauthenticated useIntel(R) Server Platform Services (SPS), Intel (R) Trusted…
- CVE-2019-0113Insufficient bounds checking in Intel(R) Graphics Drivers before version 10.18.14.5067 (aka 15.36.x.5067) and 10.18.10.5069 (aka 15.33.x.506Intel(R) Graphics Drivers
- CVE-2019-0114A race condition in Intel(R) Graphics Drivers before version 10.18.14.5067 (aka 15.36.x.5067) and 10.18.10.5069 (aka 15.33.x.5069) may allowIntel(R) Graphics Drivers
- CVE-2019-0115Insufficient input validation in KMD module for Intel(R) Graphics Driver before version 10.18.14.5067 (aka 15.36.x.5067) and 10.18.10.5069 (Intel(R) Graphics Driver KMD module
- CVE-2019-0116An out of bound read in KMD module for Intel(R) Graphics Driver before version 10.18.14.5067 (aka 15.36.x.5067) and 10.18.10.5069 (aka 15.33Intel(R) Graphics Driver KMD module
- CVE-2019-0119Buffer overflow vulnerability in system firmware for Intel(R) Xeon(R) Processor D Family, Intel(R) Xeon(R) Scalable Processor, Intel(R) ServIntel(R) Unified Extensible Firmware Interface
- CVE-2019-0120Insufficient key protection vulnerability in silicon reference firmware for Intel(R) Pentium(R) Processor J Series, Intel(R) Pentium(R) ProcIntel(R) Unified Extensible Firmware Interface
- CVE-2019-0126Insufficient access control in silicon reference firmware for Intel(R) Xeon(R) Scalable Processor, Intel(R) Xeon(R) Processor D Family may aIntel(R) Unified Extensible Firmware Interface
- CVE-2019-0153Buffer overflow in subsystem in Intel(R) CSME 12.0.0 through 12.0.34 may allow an unauthenticated user to potentially enable escalation of pIntel(R) Converged Security & Management Engine
- CVE-2019-0170Buffer overflow in subsystem in Intel(R) DAL before version 12.0.35 may allow a privileged user to potentially enable escalation of privilegIntel(R) Dynamic Application Loader
- CVE-2019-0132Data Corruption in Intel Unite(R) Client before version 3.3.176.13 may allow an unauthenticated user to potentially cause a denial of servicIntel Unite(R) Client
- CVE-2019-0138Improper directory permissions in Intel(R) ACU Wizard version 12.0.0.129 and earlier may allow an authenticated user to potentially enable eIntel(R) ACU Wizard
- CVE-2019-0171Improper directory permissions in the installer for Intel(R) Quartus(R) software may allow an authenticated user to potentially enable escalIntel(R) Quartus
- CVE-2019-0172A logic issue in Intel Unite(R) Client for Android prior to version 4.0 may allow a remote attacker to potentially enable escalation of privIntel Unite(R) Client for Android
- CVE-2019-11085Insufficient input validation in Kernel Mode Driver in Intel(R) i915 Graphics for Linux before version 5.0 may allow an authenticated user tIntel(R) i915 Graphics for Linux
- CVE-2019-11093Unquoted service path in the installer for the Intel(R) SCS Discovery Utility version 12.0.0.129 and earlier may allow an authenticated userIntel(R) SCS Discovery Utility
- CVE-2019-11094Insufficient input validation in system firmware for Intel (R) NUC Kit may allow an authenticated user to potentially enable escalation of pIntel (R) NUC
- CVE-2019-11095Insufficient access control in Intel(R) Driver & Support Assistant version 19.3.12.3 and before may allow a privileged user to potentially eIntel(R) Driver & Support Assistant
- CVE-2019-11114Insufficient input validation in Intel(R) Driver & Support Assistant version 19.3.12.3 and before may allow a privileged user to potentiallyIntel(R) Driver & Support Assistant
- CVE-2019-5883An Incorrect Access Control issue was discovered in GitLab Community and Enterprise Edition 6.0 and later but before 11.3.11, 11.4.x before
- CVE-2019-10139During HE deployment via cockpit-ovirt, cockpit-ovirt generates an ansible variable file `/var/lib/ovirt-hosted-engine-setup/cockpit/ansiblecockpit-ovirt
- CVE-2019-5946Open redirect vulnerability in Cybozu Garoon 4.2.4 to 4.10.1 allows remote attackers to redirect users to arbitrary web sites and conduct phCybozu Garoon
- CVE-2019-5947Cross-site scripting vulnerability in Cybozu Garoon 4.6.0 to 4.10.1 allows remote authenticated attackers to inject arbitrary web script or Cybozu Garoon
- CVE-2019-5953Buffer overflow in GNU Wget 1.20.1 and earlier allows remote attackers to cause a denial-of-service (DoS) or may execute an arbitrary code vThe GNU Projec GNU Wget
- CVE-2019-5954JR East Japan train operation information push notification App for Android version 1.2.4 and earlier allows remote attackers to bypass acceEast Japan Railway Company JR East Japan train operation in…
- CVE-2019-5955CREATE SD official App for Android version 1.0.2 and earlier allows remote attackers to bypass access restriction to lead a user to access aCREATE S.D CO. CREATE SD official App for Android
- CVE-2019-5957Untrusted search path vulnerability in Installer of Electronic reception and examination of application for radio licenses Online 1.0.9.0 anMinistry of Internal Affairs and Communications Installer o…
- CVE-2019-5958Untrusted search path vulnerability in Electronic reception and examination of application for radio licenses Offline 1.0.9.0 and earlier alMinistry of Internal Affairs and Communications Electronic…
- CVE-2019-5933Cybozu Garoon 4.0.0 to 4.10.0 allows remote authenticated attackers to bypass access restriction to view the Bulletin Board without view priCybozu Garoon
- CVE-2019-5934SQL injection vulnerability in the Cybozu Garoon 4.0.0 to 4.10.0 allows attacker with administrator rights to execute arbitrary SQL commandsCybozu Garoon
- CVE-2019-5935Cybozu Garoon 4.0.0 to 4.10.1 allows remote authenticated attackers to bypass access restriction to change user information without access pCybozu Garoon
- CVE-2019-5936Directory traversal vulnerability in Cybozu Garoon 4.0.0 to 4.10.1 allows remote authenticated attackers to obtain files without access privCybozu Garoon
- CVE-2019-5937Cross-site scripting vulnerability in Cybozu Garoon 4.0.0 to 4.10.1 allows remote authenticated attackers to inject arbitrary web script or Cybozu Garoon
- CVE-2019-5938Cross-site scripting vulnerability in Cybozu Garoon 4.0.0 to 4.10.1 allows remote attackers to inject arbitrary web script or HTML via the aCybozu Garoon
- CVE-2019-5939Cross-site scripting vulnerability in Cybozu Garoon 4.0.0 to 4.10.1 allows remote attackers to inject arbitrary web script or HTML via the aCybozu Garoon
- CVE-2019-5940Cross-site scripting vulnerability in Cybozu Garoon 4.0.0 to 4.10.1 allows remote attackers to inject arbitrary web script or HTML via the aCybozu Garoon
- CVE-2019-5941Cybozu Garoon 4.0.0 to 4.10.1 allows remote authenticated attackers to bypass access restriction alter the Report without access privileges Cybozu Garoon
- CVE-2019-5942Cybozu Garoon 4.0.0 to 4.10.1 allows remote authenticated attackers to bypass access restriction to obtain files without access privileges vCybozu Garoon
- CVE-2019-5943Cybozu Garoon 4.0.0 to 4.10.1 allows remote authenticated attackers to bypass access restriction to view the information without view privilCybozu Garoon
- CVE-2019-5944Cybozu Garoon 4.0.0 to 4.10.1 allows remote authenticated attackers to bypass access restriction alter the contents of application 'Address'Cybozu Garoon
- CVE-2019-5945Cybozu Garoon 4.2.4 to 4.10.1 allow remote attackers to obtain the users' credential information via the authentication of Cybozu Garoon.Cybozu Garoon
- CVE-2019-5928Cross-site scripting vulnerability in Cybozu Garoon 4.0.0 to 4.6.3 allows remote attackers to inject arbitrary web script or HTML via CustomCybozu Garoon
- CVE-2019-5929Cross-site scripting vulnerability in Cybozu Garoon 4.0.0 to 4.6.3 allows remote attackers to inject arbitrary web script or HTML via the apCybozu Garoon
- CVE-2019-5930Cybozu Garoon 4.0.0 to 4.6.3 allows remote attackers to bypass access restriction to browse unauthorized pages via the application 'ManagemeCybozu Garoon
- CVE-2019-5931Cybozu Garoon 4.0.0 to 4.6.3 allows authenticated attackers to alter the information with privileges invoking the installer via unspecified Cybozu Garoon
- CVE-2019-5932Cross-site scripting vulnerability in Cybozu Garoon 4.6.0 to 4.6.3 allows remote authenticated attackers to inject arbitrary web script or HCybozu Garoon
- CVE-2019-4119IBM Cloud Private Kubernetes API server 2.1.0, 3.1.0, 3.1.1, and 3.1.2 can be used as an HTTP proxy to not only cluster internal but also exIBM Cloud Private
- CVE-2018-20500An insecure permissions issue was discovered in GitLab Community and Enterprise Edition 9.4 and later but before 11.4.13, 11.5.x before 11.5
- CVE-2018-19585GitLab CE/EE versions 8.18 up to 11.x before 11.3.11, 11.4.x before 11.4.8, and 11.5.x before 11.5.1 have CRLF Injection in Project Mirrorin
- CVE-2019-8937HotelDruid 2.3.0 has XSS affecting the nsextt, cambia1, mese_fine, origine, and anno parameters in creaprezzi.php, tabella3.php, personalizz
- CVE-2019-8929An issue was discovered in Zoho ManageEngine Netflow Analyzer Professional 7.0.0.2.
- CVE-2019-8928An issue was discovered in Zoho ManageEngine Netflow Analyzer Professional 7.0.0.2.
- CVE-2019-8927An issue was discovered in Zoho ManageEngine Netflow Analyzer Professional 7.0.0.2.
- CVE-2019-8926An issue was discovered in Zoho ManageEngine Netflow Analyzer Professional 7.0.0.2.
- CVE-2018-7191In the tun subsystem in the Linux kernel before 4.13.14, dev_get_valid_name is not called before register_netdevice.
- CVE-2018-20839systemd 242 changes the VT1 mode upon a logout, which allows attackers to read cleartext passwords in certain circumstances, such as watchin
- CVE-2019-8925An issue was discovered in Zoho ManageEngine Netflow Analyzer Professional 7.0.0.2.
- CVE-2019-8924XAMPP through 5.6.8 allows XSS via the cds-fpdf.php interpret or titel parameter.