# CVEs published 2019-05-20 30 CVEs were published on May 20, 2019: 0 critical, 0 high. Days are UTC. - [CVE-2019-11816](https://cve.now/CVE-2019-11816.md): Incorrect access control in the WebUI in OPNsense before version 19.1.8, and pfsense before 2.4.4-p3 allows remote authenticated users to es (no CVSS) - [CVE-2019-10078](https://cve.now/CVE-2019-10078.md): A carefully crafted plugin link invocation could trigger an XSS vulnerability on Apache JSPWiki 2.9.0 to 2.11.0.M3, which could lead to sess (no CVSS, Apache Software Foundation Apache JSPWiki · org.apache.j… +1) - [CVE-2019-10077](https://cve.now/CVE-2019-10077.md): A carefully crafted InterWiki link could trigger an XSS vulnerability on Apache JSPWiki 2.9.0 to 2.11.0.M3, which could lead to session hija (no CVSS, Apache Software Foundation Apache JSPWiki · org.apache.j… +1) - [CVE-2019-10076](https://cve.now/CVE-2019-10076.md): A carefully crafted malicious attachment could trigger an XSS vulnerability on Apache JSPWiki 2.9.0 to 2.11.0.M3, which could lead to sessio (no CVSS, Apache Software Foundation Apache JSPWiki · org.apache.j… +1) - [CVE-2019-12241](https://cve.now/CVE-2019-12241.md): The Carts Guru plugin 1.4.5 for WordPress allows Insecure Deserialization via a cartsguru-source cookie to classes/wc-cartsguru-event-handle (no CVSS) - [CVE-2019-12240](https://cve.now/CVE-2019-12240.md): The Virim plugin 0.4 for WordPress allows Insecure Deserialization via s\_values, t\_values, or c\_values in graph.php. (no CVSS) - [CVE-2019-12239](https://cve.now/CVE-2019-12239.md): The WP Booking System plugin 1.5.1 for WordPress has no CSRF protection, which allows attackers to reach certain SQL injection issues that r (no CVSS) - [CVE-2019-8352](https://cve.now/CVE-2019-8352.md): By default, BMC PATROL Agent through 11.3.01 uses a static encryption key for encrypting/decrypting user credentials sent over the network t (no CVSS) - [CVE-2019-4293](https://cve.now/CVE-2019-4293.md): IBM Storwize V7000 Unified (2073) 1.6 configuration may allow an attacker to reveal the server version in default installation, which could (CVSS 5.3, IBM Storwize V7000 Unified) - [CVE-2019-4058](https://cve.now/CVE-2019-4058.md): IBM BigFix Platform 9.2 and 9.5 could allow a low-privilege user to manipulate the UI into exposing interface elements and information norma (CVSS 6.5, IBM BigFix Platform) - [CVE-2019-4011](https://cve.now/CVE-2019-4011.md): IBM BigFix Platform 9.2 and 9.5 is vulnerable to cross-site scripting. (CVSS 5.4, IBM BigFix Platform) - [CVE-2018-2005](https://cve.now/CVE-2018-2005.md): IBM BigFix Platform 9.2 and 9.5 stores potentially sensitive information in process memory that could be read by a local attacker with eleva (CVSS 3.3, IBM BigFix Platform) - [CVE-2019-12222](https://cve.now/CVE-2019-12222.md): An issue was discovered in libSDL2.a in Simple DirectMedia Layer (SDL) 2.0.9. (no CVSS) - [CVE-2019-12221](https://cve.now/CVE-2019-12221.md): An issue was discovered in libSDL2.a in Simple DirectMedia Layer (SDL) 2.0.9 when used in conjunction with libSDL2\_image.a in SDL2\_image 2.0 (no CVSS) - [CVE-2019-12220](https://cve.now/CVE-2019-12220.md): An issue was discovered in libSDL2.a in Simple DirectMedia Layer (SDL) 2.0.9 when used in conjunction with libSDL2\_image.a in SDL2\_image 2.0 (no CVSS) - [CVE-2019-12219](https://cve.now/CVE-2019-12219.md): An issue was discovered in libSDL2.a in Simple DirectMedia Layer (SDL) 2.0.9 when used in conjunction with libSDL2\_image.a in SDL2\_image 2.0 (no CVSS) - [CVE-2019-12218](https://cve.now/CVE-2019-12218.md): An issue was discovered in libSDL2.a in Simple DirectMedia Layer (SDL) 2.0.9 when used in conjunction with libSDL2\_image.a in SDL2\_image 2.0 (no CVSS) - [CVE-2019-12217](https://cve.now/CVE-2019-12217.md): An issue was discovered in libSDL2.a in Simple DirectMedia Layer (SDL) 2.0.9 when used in conjunction with libSDL2\_image.a in SDL2\_image 2.0 (no CVSS) - [CVE-2019-12216](https://cve.now/CVE-2019-12216.md): An issue was discovered in libSDL2.a in Simple DirectMedia Layer (SDL) 2.0.9 when used in conjunction with libSDL2\_image.a in SDL2\_image 2.0 (no CVSS) - [CVE-2019-12215](https://cve.now/CVE-2019-12215.md): A full path disclosure vulnerability was discovered in Matomo v3.9.1 where a user can trigger a particular error to discover the full path o (no CVSS) - [CVE-2019-12214](https://cve.now/CVE-2019-12214.md): In FreeImage 3.18.0, an out-of-bounds access occurs because of mishandling of the OpenJPEG j2k\_read\_ppm\_v3 function in j2k.c. (no CVSS) - [CVE-2019-12213](https://cve.now/CVE-2019-12213.md): When FreeImage 3.18.0 reads a special TIFF file, the TIFFReadDirectory function in PluginTIFF.cpp always returns 1, leading to stack exhaust (no CVSS) - [CVE-2019-12212](https://cve.now/CVE-2019-12212.md): When FreeImage 3.18.0 reads a special JXR file, the StreamCalcIFDSize function of JXRMeta.c repeatedly calls itself due to improper processi (no CVSS) - [CVE-2019-12211](https://cve.now/CVE-2019-12211.md): When FreeImage 3.18.0 reads a tiff file, it will be handed to the Load function of the PluginTIFF.cpp file, but a memcpy occurs in which the (no CVSS) - [CVE-2018-12270](https://cve.now/CVE-2018-12270.md): In Valve Steam 1528829181 BETA, it is possible to perform a homograph / homoglyph attack to create fake URLs in the client, which may trick (no CVSS) - [CVE-2019-12208](https://cve.now/CVE-2019-12208.md): njs through 0.3.1, used in NGINX, has a heap-based buffer overflow in njs\_function\_native\_call in njs/njs\_function.c. (no CVSS) - [CVE-2019-12207](https://cve.now/CVE-2019-12207.md): njs through 0.3.1, used in NGINX, has a heap-based buffer over-read in nxt\_utf8\_decode in nxt/nxt\_utf8.c. (no CVSS) - [CVE-2019-12206](https://cve.now/CVE-2019-12206.md): njs through 0.3.1, used in NGINX, has a heap-based buffer overflow in nxt\_utf8\_encode in nxt\_utf8.c. (no CVSS) - [CVE-2019-11809](https://cve.now/CVE-2019-11809.md): An issue was discovered in Joomla! before 3.9.6. (no CVSS) - [CVE-2019-12198](https://cve.now/CVE-2019-12198.md): In GoHttp through 2017-07-25, there is a stack-based buffer over-read via a long User-Agent header. (no CVSS) --- Source: cve.now, built and run by Sazabi (AI-native observability and security) Page: https://cve.now/daily/2019-05-20 Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.