# CVEs published 2019-05-28

21 CVEs were published on May 28, 2019: 0 critical, 2 high. Days are UTC.

- [CVE-2019-10967](https://cve.now/CVE-2019-10967.md): In Emerson Ovation OCR400 Controller 3.3.1 and earlier, a stack-based buffer overflow vulnerability in the embedded third-party FTP server i (no CVSS, Emerson Ovation OCR400 Controller)
- [CVE-2019-10965](https://cve.now/CVE-2019-10965.md): In Emerson Ovation OCR400 Controller 3.3.1 and earlier, a heap-based buffer overflow vulnerability in the embedded third-party FTP server in (no CVSS, Emerson Ovation OCR400 Controller)
- [CVE-2019-5589](https://cve.now/CVE-2019-5589.md): A untrusted search path vulnerability in Fortinet may allow attacker to execute unauthorized code or commands via network exploitable (CVSS 8.6, Fortinet FortiClientWindows)
- [CVE-2019-0221](https://cve.now/CVE-2019-0221.md): The SSI printenv command in Apache Tomcat 9.0.0.M1 to 9.0.0.17, 8.5.0 to 8.5.39 and 7.0.0 to 7.0.93 echoes user provided data without escapi (no CVSS, Apache Tomcat · org.apache.tomcat.embed:tomcat-embed-core +2)
- [CVE-2018-20008](https://cve.now/CVE-2018-20008.md): iBall Baton iB-WRB302N20122017 devices have improper access control over the UART interface, allowing physical attackers to discover Wi-Fi c (no CVSS)
- [CVE-2019-5436](https://cve.now/CVE-2019-5436.md): A heap buffer overflow in the TFTP receiving code allows for DoS or arbitrary code execution in libcurl versions 7.19.4 through 7.64.1. (CVSS 7.8, curl)
- [CVE-2019-5435](https://cve.now/CVE-2019-5435.md): An integer overflow in curl's URL API results in a buffer overflow in libcurl 7.62.0 to and including 7.64.1. (no CVSS, curl)
- [CVE-2019-5440](https://cve.now/CVE-2019-5440.md): Use of cryptographically weak PRNG in the password recovery token generation of Revive Adserver \< v4.2.1 causes a potential authentication b (no CVSS, Revive Adserver)
- [CVE-2018-13375](https://cve.now/CVE-2018-13375.md): An Improper Neutralization of Script-Related HTML Tags in Fortinet FortiAnalyzer 5.6.0 and below and FortiManager 5.6.0 and below allows an (no CVSS, Fortinet FortiAnalyzer · Fortinet FortiManager)
- [CVE-2019-7393](https://cve.now/CVE-2019-7393.md): A UI redress vulnerability in the administrative user interface of CA Technologies CA Strong Authentication 9.0.x, 8.2.x, 8.1.x, 8.0.x, 7.1. (no CVSS, CA Technologies, A Broadcom Company CA Strong Authenticatio…)
- [CVE-2019-7394](https://cve.now/CVE-2019-7394.md): A privilege escalation vulnerability in the administrative user interface of CA Technologies CA Strong Authentication 9.0.x, 8.2.x, 8.1.x, 8 (no CVSS, CA Technologies, A Broadcom Company CA Strong Authenticatio…)
- [CVE-2019-0188](https://cve.now/CVE-2019-0188.md): Apache Camel prior to 2.24.0 contains an XML external entity injection (XXE) vulnerability (CWE-611) due to using an outdated vulnerable JSO (no CVSS, Apache Camel · org.apache.camel:camel-core +1)
- [CVE-2018-17198](https://cve.now/CVE-2018-17198.md): Server-side Request Forgery (SSRF) and File Enumeration vulnerability in Apache Roller 5.2.1, 5.2.0 and earlier unsupported versions relies (no CVSS, Apache Software Foundation Apache Roller)
- [CVE-2019-12395](https://cve.now/CVE-2019-12395.md): In Webbukkit Dynmap 3.0-beta-3 or below, due to a missing login check in servlet/MapStorageHandler.java, an attacker can see a map image wit (no CVSS)
- [CVE-2019-12383](https://cve.now/CVE-2019-12383.md): Tor Browser before 8.0.1 has an information exposure vulnerability. (no CVSS)
- [CVE-2019-12382](https://cve.now/CVE-2019-12382.md): An issue was discovered in drm\_load\_edid\_firmware in drivers/gpu/drm/drm\_edid\_load.c in the Linux kernel through 5.1.5. (no CVSS)
- [CVE-2019-12381](https://cve.now/CVE-2019-12381.md): An issue was discovered in ip\_ra\_control in net/ipv4/ip\_sockglue.c in the Linux kernel through 5.1.5. (no CVSS)
- [CVE-2019-12380](https://cve.now/CVE-2019-12380.md): \*\*DISPUTED\*\* An issue was discovered in the efi subsystem in the Linux kernel through 5.1.5. (no CVSS)
- [CVE-2019-12379](https://cve.now/CVE-2019-12379.md): An issue was discovered in con\_insert\_unipair in drivers/tty/vt/consolemap.c in the Linux kernel through 5.1.5. (no CVSS)
- [CVE-2019-12378](https://cve.now/CVE-2019-12378.md): An issue was discovered in ip6\_ra\_control in net/ipv6/ipv6\_sockglue.c in the Linux kernel through 5.1.5. (no CVSS)
- [CVE-2019-12372](https://cve.now/CVE-2019-12372.md): Petraware pTransformer ADC before 2.1.7.22827 allows SQL Injection via the User ID parameter to the login form. (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2019-05-28
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.