CVEs published in April 2019
1,481 vulnerabilities, 188 critical, 17 exploited.
- eclipse vorto, the eclipse foundation eclipse vorto +1 moreEclipse Vorto resolved Maven build artifacts for the Xtext project over HTTP instead of HTTPS8.1 High
- eclipse jetty, the eclipse foundation eclipse jetty, debian linux +24 more +26 moreInstallation information leak in Eclipse Jetty5.3 Medium
- eclipse jetty, the eclipse foundation eclipse jetty, netapp element +23 more +25 moreInformation Exposure vulnerability in Eclipse Jetty5.3 Medium
- eclipse jetty, the eclipse foundation eclipse jetty, apache activemq +5 more +7 moreEclipse Jetty XmlParser allows arbitrary DOCTYPE declarations6.1 Medium
- zyxel atp200 firmware, atp500 firmware, atp800 firmware +18 more +20 moreOn Zyxel ATP200, ATP500, ATP800, USG20-VPN, USG20W-VPN, USG40, USG40W, USG60, USG60W, USG110,...6.1 Medium
- snapwebThe Snapweb interface before version 0.21.2 was exposing controls to install or remove snap...7.1 High
- apparmorAppArmor mount rules grant excessive permissions3.9 Low
- ubuntu unity8Unity8 converged application lifecycle allows background applications to use on-screen keyboard when not top-most1.6 Low
- canonical ubuntu download manager, ubuntu download manager +1 moreUDM doesn't check for confinement before running post-processing commands6.7 Medium
- ubports unity8Using a specially crafted fallback art property, scopes can execute arbitrary QML code in context of unity8-dash4.8 Medium
- ubuntu unity-scope-gdrive, canonical ubuntu linux +1 moreunity-scope-gdrive search feature logs search terms to syslog2.0 Low
- canonical lxdchmod race in doUidshiftIntoContainer7.0 High
- ubuntu content hub, canonical ubuntu linux +1 moreContent-hub DBUS API doesn't prevent confined apps from passing paths to files without access3.9 Low
- ubuntu maas, canonical metal as a service +1 moreProbe-and-enlist for SeaMicro chassis writes password to the log5.5 Medium
- canonical jujuJuju Joyent provider uploads user's private ssh key by default6.4 Medium
- ubuntu maas, canonical metal as a service +1 moreuuid.uuid1() is not suitable as an unguessable identifier/token2.0 Low
- ubuntu maas, canonical metal as a service +1 moreMAAS API vulnerable to CSRF attack9.6 Critical
- ubuntu maas, canonical metal as a service +1 moreget_file_by_name does not check owner8.6 High
- canonical selinuxSELinux initscript misuse of touch5.2 Medium
- openstack novaqcow format could expose host filesystem information2.8 Low
- ekigaEkiga attempts to dlopen /tmp/ekiga_test.so5.7 Medium
- gilacms gila cmsGila CMS 1.10.1 allows fm/save CSRF for executing arbitrary PHP code.8.8 High
- linux kernel, debian linux, netapp active iq unified manager for vmware vsphere +7 more +9 moreA race condition in perf_event_open() allows local attackers to leak sensitive data from setuid...5.6 Medium
- ibm system x, bladecenter hs22 firmware, bladecenter hs23 firmware +35 more +37 moreIn various firmware versions of Lenovo System x, the integrated management module II (IMM2)'s...6.5 Medium
- ibm bladecenter bios, bladecenter hs23 firmware, system x bios +3 more +5 moreA potential vulnerability was found in an SMI handler in various BIOS versions of certain legacy...4.1 Medium
- heketi project heketi, redhat openshift container platform +1 moreIt was found that default configuration of Heketi does not require any authentication potentially...7.3 High
- kubernetes, netapp trident, redhat openshift container platform +2 morekubectl creates world-writeable cached schema files3.3 Low
- kubernetes, netapp trident +1 moreKubernetes did not effectively clear service account credentials3.1 Low
- whatsnswhatsns 4.0 allows index.php?admin_category/remove.html cid[] SQL injection.7.2 High
- whatsnswhatsns 4.0 allows index.php?inform/add.html qid SQL injection.7.2 High
- whatsnswhatsns 4.0 allows index.php?question/ajaxadd.html title SQL injection.9.8 Critical
- scilico i\, librarianI, Librarian 4.10 has XSS via the notes.php notes parameter.6.1 Medium
- zohocorp manageengine applications managerAn issue was discovered in Zoho ManageEngine Applications Manager 11.0 through 14.0. An...9.8 Critical
- cutephp cutenewsAn issue was discovered in CutePHP CuteNews 2.1.2. An attacker can infiltrate the server through...8.8 High
- atutorAn issue was discovered in ATutor through 2.2.4. It allows the user to run commands on the server...8.8 High
- openkmOpenKM 6.3.2 through 6.3.7 allows an attacker to upload a malicious JSP file into the /okm:root...7.2 High
- liferay portalAn issue was discovered in Liferay Portal CE 7.1.2 GA3. An attacker can use Liferay's Groovy...7.2 High
- mercurial, debian linux, redhat enterprise linux +2 moreMercurial Path Traversal/Link Following vulnerability5.1 Medium
- gnome gnome-desktopAn issue was discovered in GNOME gnome-desktop 3.26, 3.28, and 3.30 prior to 3.30.2.2, and 3.32...9.0 Critical
- gnome evince, canonical ubuntu linux, debian linux +6 more +8 moreThe tiff_document_render() and tiff_document_get_thumbnail() functions in the TIFF document...5.5 Medium
- tildeslash monit, canonical ubuntu linux, debian linux +1 more +3 moreBuffer overflow8.1 High
- mmonit monit, canonical ubuntu linux, debian linux +1 more +3 moreCross-site scripting6.1 Medium
- scilico i\, librarianI, Librarian 4.10 has XSS via the export.php export_files parameter.6.1 Medium
- idreamsoft icmsAn XSS issue was discovered in app/search/search.app.php in idreamsoft iCMS 7.0.14 via the public...6.1 Medium
- idreamsoft icmsAn XSS issue was discovered in app/admincp/template/admincp.header.php in idreamsoft iCMS 7.0.14...6.1 Medium
- trendnet tew-632brp firmwareapply.cgi on the TRENDnet TEW-632BRP 1.010B32 router has a buffer overflow via long strings to...9.8 Critical
- trendnet tv-ip110wn firmwaresystem.cgi on TRENDnet TV-IP110WN cameras has a buffer overflow caused by an inadequate source...9.8 Critical
- openplcproject openplc v2 firmware, openplc v3 firmware +1 moreA buffer overflow vulnerability was discovered in the OpenPLC controller, in the OpenPLC_v2 and...9.8 Critical
- intelbras iwr 3000n firmwareA CSRF issue was discovered on Intelbras IWR 3000N 1.5.0 devices, leading to complete control of...8.8 High
- intelbras iwr 3000n firmwareAn issue was discovered on Intelbras IWR 3000N 1.5.0 devices. A malformed login request allows...7.5 High
- Show moreLoading…