# CVEs published 2019-05-17

93 CVEs were published on May 17, 2019: 1 critical, 0 high. Days are UTC.

- [CVE-2019-12173](https://cve.now/CVE-2019-12173.md): MacDown 0.7.1 (870) allows remote code execution via a file:\\\\\\ URI, with a .app pathname, in the HREF attribute of an A element. (no CVSS)
- [CVE-2019-12172](https://cve.now/CVE-2019-12172.md): Typora 0.9.9.21.1 (1913) allows arbitrary code execution via a modified file: URL syntax in the HREF attribute of an AREA element, as demons (no CVSS)
- [CVE-2019-12170](https://cve.now/CVE-2019-12170.md): ATutor through 2.2.4 is vulnerable to arbitrary file uploads via the mods/\_core/backups/upload.php (aka backup) component. (no CVSS)
- [CVE-2019-12168](https://cve.now/CVE-2019-12168.md): Four-Faith Wireless Mobile Router F3x24 v1.0 devices allow remote code execution via the Command Shell (aka Administration \> Commands) scree (no CVSS)
- [CVE-2019-12163](https://cve.now/CVE-2019-12163.md): GAT-Ship Web Module through 1.30 allows remote attackers to obtain potentially sensitive information via {} in a ws/gatshipWs.asmx/SqlVersio (no CVSS)
- [CVE-2019-11644](https://cve.now/CVE-2019-11644.md): In the F-Secure installer in F-Secure SAFE for Windows before 17.6, F-Secure Internet Security before 17.6, F-Secure Anti-Virus before 17.6, (no CVSS)
- [CVE-2019-8339](https://cve.now/CVE-2019-8339.md): An issue was discovered in Falco through 0.14.0. (no CVSS)
- [CVE-2019-12161](https://cve.now/CVE-2019-12161.md): WPO WebPageTest 19.04 allows SSRF because ValidateURL in www/runtest.php does not consider octal encoding of IP addresses (such as 0300.0250 (no CVSS)
- [CVE-2019-12160](https://cve.now/CVE-2019-12160.md): GoHTTP through 2017-07-25 has a sendHeader use-after-free. (no CVSS)
- [CVE-2019-12159](https://cve.now/CVE-2019-12159.md): GoHTTP through 2017-07-25 has a stack-based buffer over-read in the scan function (when called from getRequestType) via a long URL. (no CVSS)
- [CVE-2019-12158](https://cve.now/CVE-2019-12158.md): GoHTTP through 2017-07-25 has a GetExtension heap-based buffer overflow via a long extension. (no CVSS)
- [CVE-2018-16156](https://cve.now/CVE-2018-16156.md): In PaperStream IP (TWAIN) 1.42.0.5685 (Service Update 7), the FJTWSVIC service running with SYSTEM privilege processes unauthenticated messa (no CVSS)
- [CVE-2019-12086](https://cve.now/CVE-2019-12086.md): A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.x before 2.9.9. (no CVSS, com.fasterxml.jackson.core:jackson-databind)
- [CVE-2019-11887](https://cve.now/CVE-2019-11887.md): SimplyBook.me through 2019-05-11 does not properly restrict File Upload which could allow remote code execution. (no CVSS)
- [CVE-2019-11057](https://cve.now/CVE-2019-11057.md): SQL injection vulnerability in Vtiger CRM before 7.1.0 hotfix3 allows authenticated users to execute arbitrary SQL commands. (no CVSS)
- [CVE-2019-7353](https://cve.now/CVE-2019-7353.md): An Incorrect Access Control issue was discovered in GitLab Community and Enterprise Edition 11.7.x before 11.7.4. (no CVSS)
- [CVE-2018-17181](https://cve.now/CVE-2018-17181.md): An issue was discovered in OpenEMR before 5.0.1 Patch 7. (no CVSS)
- [CVE-2019-6797](https://cve.now/CVE-2019-6797.md): An information disclosure issue was discovered in GitLab Enterprise Edition before 11.5.8, 11.6.x before 11.6.6, and 11.7.x before 11.7.1. (no CVSS)
- [CVE-2018-17180](https://cve.now/CVE-2018-17180.md): An issue was discovered in OpenEMR before 5.0.1 Patch 7. (no CVSS)
- [CVE-2018-17179](https://cve.now/CVE-2018-17179.md): An issue was discovered in OpenEMR before 5.0.1 Patch 7. (no CVSS)
- [CVE-2019-6790](https://cve.now/CVE-2019-6790.md): An Incorrect Access Control (issue 2 of 3) issue was discovered in GitLab Community and Enterprise Edition 8.14 and later but before 11.5.8, (no CVSS)
- [CVE-2019-6787](https://cve.now/CVE-2019-6787.md): An Incorrect Access Control issue was discovered in GitLab Community and Enterprise Edition before 11.5.8, 11.6.x before 11.6.6, and 11.7.x (no CVSS)
- [CVE-2019-6781](https://cve.now/CVE-2019-6781.md): An Improper Input Validation issue was discovered in GitLab Community and Enterprise Edition before 11.5.8, 11.6.x before 11.6.6, and 11.7.x (no CVSS)
- [CVE-2018-3701](https://cve.now/CVE-2018-3701.md): Improper directory permissions in the installer for Intel(R) PROSet/Wireless WiFi Software version 20.100 and earlier may allow an authentic (no CVSS, Intel(R) PROSet/Wireless WiFi Software Advisory)
- [CVE-2019-0086](https://cve.now/CVE-2019-0086.md): Insufficient access control vulnerability in Dynamic Application Loader software for Intel(R) CSME before versions 11.8.65, 11.11.65, 11.22. (no CVSS, Intel(R) Converged Security & Management Engine (CSME) Dyna…)
- [CVE-2019-0089](https://cve.now/CVE-2019-0089.md): Improper data sanitization vulnerability in subsystem in Intel(R) SPS before versions SPS\_E5\_04.00.04.381.0, SPS\_E3\_04.01.04.054.0, SPS\_SoC- (no CVSS, Intel(R) Server Platform Services)
- [CVE-2019-0090](https://cve.now/CVE-2019-0090.md): Insufficient access control vulnerability in subsystem for Intel(R) CSME before versions 11.x, 12.0.35 Intel(R) TXE 3.x, 4.x, Intel(R) Serve (no CVSS, Intel(R) Converged Security & Management Engine (CSME), Int…)
- [CVE-2019-0091](https://cve.now/CVE-2019-0091.md): Code injection vulnerability in installer for Intel(R) CSME before versions 11.8.65, 11.11.65, 11.22.65, 12.0.35 and Intel(R) TXE 3.1.65, 4. (no CVSS, Intel(R) Converged Security & Management Engine (CSME), Int…)
- [CVE-2019-0092](https://cve.now/CVE-2019-0092.md): Insufficient input validation vulnerability in subsystem for Intel(R) AMT before versions 11.8.65, 11.11.65, 11.22.65, 12.0.35 may allow an (no CVSS, Intel(R) Active Management Technology)
- [CVE-2019-0093](https://cve.now/CVE-2019-0093.md): Insufficient data sanitization vulnerability in HECI subsystem for Intel(R) CSME before versions 11.8.65, 11.11.65, 11.22.65, 12.0.35 and In (no CVSS, Intel(R) Converged Security & Management Engine (CSME), Int…)
- [CVE-2019-0094](https://cve.now/CVE-2019-0094.md): Insufficient input validation vulnerability in subsystem for Intel(R) AMT before versions 11.8.65, 11.11.65, 11.22.65, 12.0.35 may allow an (no CVSS, Intel(R) Active Management Technology)
- [CVE-2019-0096](https://cve.now/CVE-2019-0096.md): Out of bound write vulnerability in subsystem for Intel(R) AMT before versions 11.8.65, 11.11.65, 11.22.65, 12.0.35 may allow an authenticat (no CVSS, Intel(R) Active Management Technology)
- [CVE-2019-0097](https://cve.now/CVE-2019-0097.md): Insufficient input validation vulnerability in subsystem for Intel(R) AMT before version 12.0.35 may allow a privileged user to potentially (no CVSS, Intel(R) Active Management Technology)
- [CVE-2019-0098](https://cve.now/CVE-2019-0098.md): Logic bug vulnerability in subsystem for Intel(R) CSME before version 12.0.35, Intel(R) TXE before 3.1.65, 4.0.15 may allow an unauthenticat (no CVSS, Intel(R) Converged Security & Management Engine (CSME), Int…)
- [CVE-2019-0099](https://cve.now/CVE-2019-0099.md): Insufficient access control vulnerability in subsystem in Intel(R) SPS before version SPS\_E3\_05.00.04.027.0 may allow an unauthenticated use (no CVSS, Intel(R) Server Platform Services (SPS), Intel (R) Trusted…)
- [CVE-2019-0113](https://cve.now/CVE-2019-0113.md): Insufficient bounds checking in Intel(R) Graphics Drivers before version 10.18.14.5067 (aka 15.36.x.5067) and 10.18.10.5069 (aka 15.33.x.506 (no CVSS, Intel(R) Graphics Drivers)
- [CVE-2019-0114](https://cve.now/CVE-2019-0114.md): A race condition in Intel(R) Graphics Drivers before version 10.18.14.5067 (aka 15.36.x.5067) and 10.18.10.5069 (aka 15.33.x.5069) may allow (no CVSS, Intel(R) Graphics Drivers)
- [CVE-2019-0115](https://cve.now/CVE-2019-0115.md): Insufficient input validation in KMD module for Intel(R) Graphics Driver before version 10.18.14.5067 (aka 15.36.x.5067) and 10.18.10.5069 ( (no CVSS, Intel(R) Graphics Driver KMD module)
- [CVE-2019-0116](https://cve.now/CVE-2019-0116.md): An out of bound read in KMD module for Intel(R) Graphics Driver before version 10.18.14.5067 (aka 15.36.x.5067) and 10.18.10.5069 (aka 15.33 (no CVSS, Intel(R) Graphics Driver KMD module)
- [CVE-2019-0119](https://cve.now/CVE-2019-0119.md): Buffer overflow vulnerability in system firmware for Intel(R) Xeon(R) Processor D Family, Intel(R) Xeon(R) Scalable Processor, Intel(R) Serv (no CVSS, Intel(R) Unified Extensible Firmware Interface)
- [CVE-2019-0120](https://cve.now/CVE-2019-0120.md): Insufficient key protection vulnerability in silicon reference firmware for Intel(R) Pentium(R) Processor J Series, Intel(R) Pentium(R) Proc (no CVSS, Intel(R) Unified Extensible Firmware Interface)
- [CVE-2019-0126](https://cve.now/CVE-2019-0126.md): Insufficient access control in silicon reference firmware for Intel(R) Xeon(R) Scalable Processor, Intel(R) Xeon(R) Processor D Family may a (no CVSS, Intel(R) Unified Extensible Firmware Interface)
- [CVE-2019-0153](https://cve.now/CVE-2019-0153.md): Buffer overflow in subsystem in Intel(R) CSME 12.0.0 through 12.0.34 may allow an unauthenticated user to potentially enable escalation of p (no CVSS, Intel(R) Converged Security & Management Engine)
- [CVE-2019-0170](https://cve.now/CVE-2019-0170.md): Buffer overflow in subsystem in Intel(R) DAL before version 12.0.35 may allow a privileged user to potentially enable escalation of privileg (no CVSS, Intel(R) Dynamic Application Loader)
- [CVE-2019-0132](https://cve.now/CVE-2019-0132.md): Data Corruption in Intel Unite(R) Client before version 3.3.176.13 may allow an unauthenticated user to potentially cause a denial of servic (no CVSS, Intel Unite(R) Client)
- [CVE-2019-0138](https://cve.now/CVE-2019-0138.md): Improper directory permissions in Intel(R) ACU Wizard version 12.0.0.129 and earlier may allow an authenticated user to potentially enable e (no CVSS, Intel(R) ACU Wizard)
- [CVE-2019-0171](https://cve.now/CVE-2019-0171.md): Improper directory permissions in the installer for Intel(R) Quartus(R) software may allow an authenticated user to potentially enable escal (no CVSS, Intel(R) Quartus)
- [CVE-2019-0172](https://cve.now/CVE-2019-0172.md): A logic issue in Intel Unite(R) Client for Android prior to version 4.0 may allow a remote attacker to potentially enable escalation of priv (no CVSS, Intel Unite(R) Client for Android)
- [CVE-2019-11085](https://cve.now/CVE-2019-11085.md): Insufficient input validation in Kernel Mode Driver in Intel(R) i915 Graphics for Linux before version 5.0 may allow an authenticated user t (no CVSS, Intel(R) i915 Graphics for Linux)
- [CVE-2019-11093](https://cve.now/CVE-2019-11093.md): Unquoted service path in the installer for the Intel(R) SCS Discovery Utility version 12.0.0.129 and earlier may allow an authenticated user (no CVSS, Intel(R) SCS Discovery Utility)
- [CVE-2019-11094](https://cve.now/CVE-2019-11094.md): Insufficient input validation in system firmware for Intel (R) NUC Kit may allow an authenticated user to potentially enable escalation of p (no CVSS, Intel (R) NUC)
- [CVE-2019-11095](https://cve.now/CVE-2019-11095.md): Insufficient access control in Intel(R) Driver & Support Assistant version 19.3.12.3 and before may allow a privileged user to potentially e (no CVSS, Intel(R) Driver & Support Assistant)
- [CVE-2019-11114](https://cve.now/CVE-2019-11114.md): Insufficient input validation in Intel(R) Driver & Support Assistant version 19.3.12.3 and before may allow a privileged user to potentially (no CVSS, Intel(R) Driver & Support Assistant)
- [CVE-2019-5883](https://cve.now/CVE-2019-5883.md): An Incorrect Access Control issue was discovered in GitLab Community and Enterprise Edition 6.0 and later but before 11.3.11, 11.4.x before (no CVSS)
- [CVE-2019-10139](https://cve.now/CVE-2019-10139.md): During HE deployment via cockpit-ovirt, cockpit-ovirt generates an ansible variable file \`/var/lib/ovirt-hosted-engine-setup/cockpit/ansible (CVSS 5.6, cockpit-ovirt)
- [CVE-2019-5946](https://cve.now/CVE-2019-5946.md): Open redirect vulnerability in Cybozu Garoon 4.2.4 to 4.10.1 allows remote attackers to redirect users to arbitrary web sites and conduct ph (no CVSS, Cybozu Garoon)
- [CVE-2019-5947](https://cve.now/CVE-2019-5947.md): Cross-site scripting vulnerability in Cybozu Garoon 4.6.0 to 4.10.1 allows remote authenticated attackers to inject arbitrary web script or (no CVSS, Cybozu Garoon)
- [CVE-2019-5953](https://cve.now/CVE-2019-5953.md): Buffer overflow in GNU Wget 1.20.1 and earlier allows remote attackers to cause a denial-of-service (DoS) or may execute an arbitrary code v (no CVSS, The GNU Projec GNU Wget)
- [CVE-2019-5954](https://cve.now/CVE-2019-5954.md): JR East Japan train operation information push notification App for Android version 1.2.4 and earlier allows remote attackers to bypass acce (no CVSS, East Japan Railway Company JR East Japan train operation in…)
- [CVE-2019-5955](https://cve.now/CVE-2019-5955.md): CREATE SD official App for Android version 1.0.2 and earlier allows remote attackers to bypass access restriction to lead a user to access a (no CVSS, CREATE S.D CO. CREATE SD official App for Android)
- [CVE-2019-5957](https://cve.now/CVE-2019-5957.md): Untrusted search path vulnerability in Installer of Electronic reception and examination of application for radio licenses Online 1.0.9.0 an (no CVSS, Ministry of Internal Affairs and Communications Installer o…)
- [CVE-2019-5958](https://cve.now/CVE-2019-5958.md): Untrusted search path vulnerability in Electronic reception and examination of application for radio licenses Offline 1.0.9.0 and earlier al (no CVSS, Ministry of Internal Affairs and Communications Electronic…)
- [CVE-2019-5933](https://cve.now/CVE-2019-5933.md): Cybozu Garoon 4.0.0 to 4.10.0 allows remote authenticated attackers to bypass access restriction to view the Bulletin Board without view pri (no CVSS, Cybozu Garoon)
- [CVE-2019-5934](https://cve.now/CVE-2019-5934.md): SQL injection vulnerability in the Cybozu Garoon 4.0.0 to 4.10.0 allows attacker with administrator rights to execute arbitrary SQL commands (no CVSS, Cybozu Garoon)
- [CVE-2019-5935](https://cve.now/CVE-2019-5935.md): Cybozu Garoon 4.0.0 to 4.10.1 allows remote authenticated attackers to bypass access restriction to change user information without access p (no CVSS, Cybozu Garoon)
- [CVE-2019-5936](https://cve.now/CVE-2019-5936.md): Directory traversal vulnerability in Cybozu Garoon 4.0.0 to 4.10.1 allows remote authenticated attackers to obtain files without access priv (no CVSS, Cybozu Garoon)
- [CVE-2019-5937](https://cve.now/CVE-2019-5937.md): Cross-site scripting vulnerability in Cybozu Garoon 4.0.0 to 4.10.1 allows remote authenticated attackers to inject arbitrary web script or (no CVSS, Cybozu Garoon)
- [CVE-2019-5938](https://cve.now/CVE-2019-5938.md): Cross-site scripting vulnerability in Cybozu Garoon 4.0.0 to 4.10.1 allows remote attackers to inject arbitrary web script or HTML via the a (no CVSS, Cybozu Garoon)
- [CVE-2019-5939](https://cve.now/CVE-2019-5939.md): Cross-site scripting vulnerability in Cybozu Garoon 4.0.0 to 4.10.1 allows remote attackers to inject arbitrary web script or HTML via the a (no CVSS, Cybozu Garoon)
- [CVE-2019-5940](https://cve.now/CVE-2019-5940.md): Cross-site scripting vulnerability in Cybozu Garoon 4.0.0 to 4.10.1 allows remote attackers to inject arbitrary web script or HTML via the a (no CVSS, Cybozu Garoon)
- [CVE-2019-5941](https://cve.now/CVE-2019-5941.md): Cybozu Garoon 4.0.0 to 4.10.1 allows remote authenticated attackers to bypass access restriction alter the Report without access privileges (no CVSS, Cybozu Garoon)
- [CVE-2019-5942](https://cve.now/CVE-2019-5942.md): Cybozu Garoon 4.0.0 to 4.10.1 allows remote authenticated attackers to bypass access restriction to obtain files without access privileges v (no CVSS, Cybozu Garoon)
- [CVE-2019-5943](https://cve.now/CVE-2019-5943.md): Cybozu Garoon 4.0.0 to 4.10.1 allows remote authenticated attackers to bypass access restriction to view the information without view privil (no CVSS, Cybozu Garoon)
- [CVE-2019-5944](https://cve.now/CVE-2019-5944.md): Cybozu Garoon 4.0.0 to 4.10.1 allows remote authenticated attackers to bypass access restriction alter the contents of application 'Address' (no CVSS, Cybozu Garoon)
- [CVE-2019-5945](https://cve.now/CVE-2019-5945.md): Cybozu Garoon 4.2.4 to 4.10.1 allow remote attackers to obtain the users' credential information via the authentication of Cybozu Garoon. (no CVSS, Cybozu Garoon)
- [CVE-2019-5928](https://cve.now/CVE-2019-5928.md): Cross-site scripting vulnerability in Cybozu Garoon 4.0.0 to 4.6.3 allows remote attackers to inject arbitrary web script or HTML via Custom (no CVSS, Cybozu Garoon)
- [CVE-2019-5929](https://cve.now/CVE-2019-5929.md): Cross-site scripting vulnerability in Cybozu Garoon 4.0.0 to 4.6.3 allows remote attackers to inject arbitrary web script or HTML via the ap (no CVSS, Cybozu Garoon)
- [CVE-2019-5930](https://cve.now/CVE-2019-5930.md): Cybozu Garoon 4.0.0 to 4.6.3 allows remote attackers to bypass access restriction to browse unauthorized pages via the application 'Manageme (no CVSS, Cybozu Garoon)
- [CVE-2019-5931](https://cve.now/CVE-2019-5931.md): Cybozu Garoon 4.0.0 to 4.6.3 allows authenticated attackers to alter the information with privileges invoking the installer via unspecified (no CVSS, Cybozu Garoon)
- [CVE-2019-5932](https://cve.now/CVE-2019-5932.md): Cross-site scripting vulnerability in Cybozu Garoon 4.6.0 to 4.6.3 allows remote authenticated attackers to inject arbitrary web script or H (no CVSS, Cybozu Garoon)
- [CVE-2019-4279](https://cve.now/CVE-2019-4279.md): IBM WebSphere Application Server 8.5 and 9.0 could allow a remote attacker to execute arbitrary code on the system with a specially-crafted (CVSS 9.0, IBM WebSphere Application Server)
- [CVE-2019-4119](https://cve.now/CVE-2019-4119.md): IBM Cloud Private Kubernetes API server 2.1.0, 3.1.0, 3.1.1, and 3.1.2 can be used as an HTTP proxy to not only cluster internal but also ex (CVSS 3.1, IBM Cloud Private)
- [CVE-2018-20500](https://cve.now/CVE-2018-20500.md): An insecure permissions issue was discovered in GitLab Community and Enterprise Edition 9.4 and later but before 11.4.13, 11.5.x before 11.5 (no CVSS)
- [CVE-2018-19585](https://cve.now/CVE-2018-19585.md): GitLab CE/EE versions 8.18 up to 11.x before 11.3.11, 11.4.x before 11.4.8, and 11.5.x before 11.5.1 have CRLF Injection in Project Mirrorin (no CVSS)
- [CVE-2019-8937](https://cve.now/CVE-2019-8937.md): HotelDruid 2.3.0 has XSS affecting the nsextt, cambia1, mese\_fine, origine, and anno parameters in creaprezzi.php, tabella3.php, personalizz (no CVSS)
- [CVE-2019-8929](https://cve.now/CVE-2019-8929.md): An issue was discovered in Zoho ManageEngine Netflow Analyzer Professional 7.0.0.2. (no CVSS)
- [CVE-2019-8928](https://cve.now/CVE-2019-8928.md): An issue was discovered in Zoho ManageEngine Netflow Analyzer Professional 7.0.0.2. (no CVSS)
- [CVE-2019-8927](https://cve.now/CVE-2019-8927.md): An issue was discovered in Zoho ManageEngine Netflow Analyzer Professional 7.0.0.2. (no CVSS)
- [CVE-2019-8926](https://cve.now/CVE-2019-8926.md): An issue was discovered in Zoho ManageEngine Netflow Analyzer Professional 7.0.0.2. (no CVSS)
- [CVE-2018-7191](https://cve.now/CVE-2018-7191.md): In the tun subsystem in the Linux kernel before 4.13.14, dev\_get\_valid\_name is not called before register\_netdevice. (no CVSS)
- [CVE-2018-20839](https://cve.now/CVE-2018-20839.md): systemd 242 changes the VT1 mode upon a logout, which allows attackers to read cleartext passwords in certain circumstances, such as watchin (no CVSS)
- [CVE-2019-8925](https://cve.now/CVE-2019-8925.md): An issue was discovered in Zoho ManageEngine Netflow Analyzer Professional 7.0.0.2. (no CVSS)
- [CVE-2019-8924](https://cve.now/CVE-2019-8924.md): XAMPP through 5.6.8 allows XSS via the cds-fpdf.php interpret or titel parameter. (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2019-05-17
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.