CVEs published in April 2019
1,481 vulnerabilities, 188 critical, 17 exploited.
- graphvizThe agroot() function in cgraph\obj.c in libcgraph.a in Graphviz 2.39.20160612.1140 has a NULL...8.8 High
- thinkadminThinkAdmin Administrator cookies still working after password change9.8 Critical
- elggElgg open redirect6.1 Medium
- vstarcam eye4The VStarCam vstc.vscam.client library and vstc.vscam shared object, as used in the Eye4...9.8 Critical
- cisco clamavClam AntiVirus PE File Out-of-Bounds Read Vulnerability7.5 High
- apache http server, fedoraproject fedora +1 moreIn Apache HTTP Server 2.4 releases 2.4.37 and 2.4.38, a bug in mod_ssl when using per-location...7.5 High
- cisco clamavClam AntiVirus RAR Directory Traversal Vulnerability9.8 Critical
- cisco clamavClam AntiVirus PDF Out-of-Bounds Read Vulnerability7.5 High
- graphicsmagick, debian linux, opensuse leap +2 moreIn GraphicsMagick 1.4 snapshot-20190322 Q8, there is a memory leak in the function ReadMPCImage...6.5 Medium
- graphicsmagick, debian linux, opensuse leap +2 moreIn GraphicsMagick 1.4 snapshot-20190322 Q8, there is a heap-based buffer over-read in the...8.1 High
- graphicsmagick, canonical ubuntu linux, debian linux +2 more +4 moreIn GraphicsMagick 1.4 snapshot-20190322 Q8, there is a heap-based buffer overflow in the function...8.8 High
- graphicsmagick, canonical ubuntu linux, debian linux +2 more +4 moreIn GraphicsMagick 1.4 snapshot-20190322 Q8, there is a heap-based buffer over-read in the...8.1 High
- graphicsmagick, debian linux, opensuse leap +2 moreIn GraphicsMagick 1.4 snapshot-20190322 Q8, there is a heap-based buffer over-read in the...9.1 Critical
- graphicsmagick, opensuse leap +1 moreIn GraphicsMagick 1.4 snapshot-20190322 Q8, there is a stack-based buffer overflow in the...9.8 Critical
- uniqkey password managerAn issue was discovered in Uniqkey Password Manager 1.14. When entering new credentials to a site...6.5 Medium
- materializecss materializeMaterialize-css vulnerable to Improper Neutralization of Input During Web Page Generation6.1 Medium
- materializecss materializeMaterialize-css vulnerable to Cross-site Scripting in autocomplete component6.1 Medium
- materializecss materializeMaterialize-css vulnerable to Cross-site Scripting in tooltip component6.1 Medium
- reolink c1 pro firmware, c2 pro firmware, multiple ip cameras +3 more +5 moreOn Reolink RLC-410W, C1 Pro, C2 Pro, RLC-422W, and RLC-511W devices through 1.0.227, an...7.2 High
- uniqkey password managerAn issue was discovered in Uniqkey Password Manager 1.14. Upon entering new credentials to a site...6.5 Medium
- honeywell experion pks, experion process knowledge system +1 moreAn arbitrary memory write vulnerability exists in the dual_onsrv.exe module in Honeywell Experion...9.8 Critical
- honeywell experion pks, experion process knowledge system +1 moreA directory traversal vulnerability exists in the confd.exe module in Honeywell Experion PKS R40x...7.5 High
- honeywell experion pks, experion process knowledge system +1 moreA file inclusion vulnerability exists in the confd.exe module in Honeywell Experion PKS R40x...9.8 Critical
- ibm qradar siem, qradar security information and event manager +1 moreIBM QRadar SIEM 7.3.2 could allow a user to bypass authentication exposing certain functionality...9.4 Critical
- ibm api connectIBM API Connect's Developer Portal 2018.1 and 2018.4.1.3 is impacted by a privilege escalation...8.8 High
- ibm cloud privateThe IBM Cloud Private Key Management Service (IBM Cloud Private 3.1.1 and 3.1.2) could allow a...5.5 Medium
- ibm api connectSome URIs in IBM API Connect 2018.1 and 2018.4.1.3 disclose system specification information like...5.3 Medium
- ibm business automation workflow, business process manager +1 moreIBM Business Automation Workflow and IBM Business Process Manager 18.0.0.0, 18.0.0.1, and 18.0.0...4.3 Medium
- ibm business automation workflow, business process manager +1 moreIBM Business Automation Workflow 18.0.0.0 and 18.0.0.1 is vulnerable to cross-site request...4.3 Medium
- ibm business automation workflow, business process manager +1 moreIBM Business Automation Workflow 18.0.0.0, 18.0.0.1, and 18.0.0.2 could reveal sensitive version...4.3 Medium
- ibm business automation workflow, business process manager +1 moreIBM Business Automation Workflow and Business Process Manager 18.0.0.0, 18.0.0.1, and 18.0.0.2...4.3 Medium
- ibm cloud privateIBM Cloud Private 3.1.0 and 3.1.1 is vulnerable to HTTP HOST header injection, caused by improper...5.4 Medium
- ibm business automation workflow, business process manager, business process manager enterprise service bus +1 more +3 moreIBM Business Automation Workflow 18.0.0.0, 18.0.0.1, and 18.0.0.2 could allow an unauthenticated...5.3 Medium
- ibm spectrum protect, spectrum protect for space management, spectrum protect backup-archive client +1 more +3 moreIn a certain atypical IBM Spectrum Protect 7.1 and 8.1 configurations, the node password could be...4.7 Medium
- ibm spectrum protect, spectrum protect backup-archive client +1 moreIBM Tivoli Storage Manager (IBM Spectrum Protect 7.1 and 8.1) could allow a remote attacker to...6.1 Medium
- ibm spectrum protect, spectrum protect backup-archive client, spectrum protect for virtual environments +2 moreIBM Spectrum Protect 7.1 and 8.1 is affected by a password exposure vulnerability caused by...5.1 Medium
- winmagic securedoc disk encryptionWINMAGIC SecureDoc Disk Encryption software before 8.3 has an Unquoted Service Path vulnerability...7.8 High
- osisoft pi visionOSIsoft PI Vision, versions PI Vision 2017, and PI Vision 2017 R2, The application contains a...4.8 Medium
- hanwha techwin srn-4000, hanwhasecurity srn-4000 firmware +1 moreHanwha Techwin SRN-4000, SRN-4000 firmware versions prior to SRN4000_v2.16_170401, A specially...9.8 Critical
- matrixsslpubRsaDecryptSignedElementExt in MatrixSSL 4.0.1 Open, as used in Inside Secure TLS Toolkit, has...9.8 Critical
- samba, debian linux, fedoraproject fedora +3 more +5 moreA flaw was found in the way samba implemented an RPC endpoint emulating the Windows registry...4.2 Medium
- systemd, debian linux, fedoraproject fedora +1 more +3 moreIn systemd before v242-rc4, it was discovered that pam_systemd does not properly sanitize the...4.5 Medium
- palletsprojects jinjaJinja2 sandbox escape vulnerability8.6 High
- k-9 mail project mailK-9 Mail v5.600 can include the original quoted HTML code of a specially crafted, benign looking,...4.3 Medium
- roundcube webmail, fedoraproject fedora, opensuse backports sle +1 more +3 moreIn Roundcube Webmail before 1.3.10, an attacker in possession of S/MIME or PGP encrypted emails...4.3 Medium
- claws-mail mailIn Claws Mail 3.14.1, an attacker in possession of S/MIME or PGP encrypted emails can wrap them...4.3 Medium
- trojita project trojitaIn KDE Trojita 0.7, an attacker in possession of S/MIME or PGP encrypted emails can wrap them as...4.3 Medium
- kde kmail, debian linux +1 moreIn KDE KMail 5.2.3, an attacker in possession of S/MIME or PGP encrypted emails can wrap them as...4.3 Medium
- airsonic project airsonicIn Airsonic 10.2.1, RecoverController.java generates passwords via org.apache.commons.lang...9.8 Critical
- airsonic project airsonicAirsonic 10.2.1 uses Spring's default remember-me mechanism based on MD5, with a fixed key of...9.8 Critical
- Show moreLoading…