CVEs published in April 2019
1,481 vulnerabilities, 188 critical, 17 exploited.
- linux kernelThe coredump implementation in the Linux kernel before 5.0.10 does not use locking or other...7.0 High
- imagemagickIn ImageMagick 7.0.8-40 Q16, there is a heap-based buffer over-read in the function WritePNMImage...8.1 High
- imagemagickIn ImageMagick 7.0.8-43 Q16, there is a heap-based buffer over-read in the function...8.1 High
- memcached, canonical ubuntu linux +1 moreIn memcached before 1.5.14, a NULL pointer dereference was found in the "lru mode" and "lru...7.5 High
- dhcpcd project dhcpcd, debian linux +1 moredhcp.c in dhcpcd before 7.2.1 contains a 1-byte read overflow with DHO_OPTSOVERLOADED.5.3 Medium
- dhcpcd project dhcpcdauth.c in dhcpcd before 7.2.1 allowed attackers to infer secrets by performing latency attacks.5.9 Medium
- dhcpcd project dhcpcddhcpcd before 7.2.1 contains a buffer overflow in dhcp6_findna in dhcp6.c when reading NA/TA...9.8 Critical
- giteaGitea Allows 1FA Even for 2FA-Enrolled Accounts9.8 Critical
- aikcmsAn issue was discovered in AikCms v2.0. There is a File upload vulnerability, as demonstrated by...8.8 High
- aikcmsAn issue was discovered in AikCms v2.0. There is a SQL Injection vulnerability via $_GET['del'],...7.2 High
- print my blog project my blogServer Side Request Forgery (SSRF) exists in the Print My Blog plugin before 1.6.7 for WordPress...9.8 Critical
- ammonia project ammoniaUncontrolled recursion in ammonia7.5 High
- web-dorado wp form builderThe WebDorado Contact Form Builder plugin before 1.0.69 for WordPress allows CSRF via the wp...8.8 High
- [freedesktop.org] systemd, canonical ubuntu linux, fedoraproject fedora +4 more +6 moreIt was discovered that a systemd service that uses DynamicUser property can create a SUID/SGID...4.5 Medium
- [freedesktop.org] systemd, canonical ubuntu linux, netapp cn1610 firmware +3 more +5 moreIt was discovered that a systemd service that uses DynamicUser property can get new privileges...4.5 Medium
- sonicwall global management system (gms), global management system +1 moreA vulnerability in SonicWall Global Management System (GMS), allow a remote user to gain access...8.1 High
- projectsendCross-site scripting (XSS) vulnerability in ProjectSend before r1070 allows remote attackers to...6.1 Medium
- projectsendProjectSend before r1070 writes user passwords to the server logs.7.5 High
- profiles project profilesXSS exists in the ProFiles 1.5 component for Joomla! via the name or path parameter when creating...4.8 Medium
- sir gnuboardCross-Site Scripting (XSS) vulnerability in adm/sms_admin/num_book_write.php and adm/sms_admin...6.1 Medium
- sir gnuboardCross-Site Scripting (XSS) vulnerability in adm/contentformupdate.php in gnuboard5 before 5.3.1.6...6.1 Medium
- sir gnuboardCross-Site Scripting (XSS) vulnerability in adm/boardgroup_form_update.php and adm...6.1 Medium
- sir gnuboardCross-Site Scripting (XSS) vulnerability in adm/faqmasterformupdate.php in gnuboard5 before 5.3.1...6.1 Medium
- ilnkp2p project ilnkp2pAn authentication flaw in Shenzhen Yunni Technology iLnkP2P allows remote attackers to actively...8.1 High
- ilnkp2p project ilnkp2pThe algorithm used to generate device IDs (UIDs) for devices that utilize Shenzhen Yunni...8.2 High
- dillonkane tidal workload automationAn issue was discovered in Dillon Kane Tidal Workload Automation Agent 3.2.0.5 (formerly known as...7.8 High
- dell emc idrac, dell idrac9 firmware +1 moreWS-MAN Authentication Bypass Vulnerability8.6 High
- dell emc idrac, dell idrac9 firmware +1 moreWeb Interface Authentication Bypass Vulnerability8.6 High
- dell emc idrac, dell idrac6 firmware, idrac7 firmware +2 more +4 moreBuffer Overflow Vulnerability8.1 High
- oracle weblogic server, agile product lifecycle management, communications converged application server +5 more +7 moreVulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent:...7.5 High
- mozilla firefoxIn Firefox Developer Tools it is possible that pasting the result of the 'Copy as cURL' command...9.8 Critical
- mozilla firefoxOn Android systems, Firefox can load a library from APITRACE_LIB, which is writable by all users...7.4 High
- mozilla firefoxThe about:crashcontent and about:crashparent pages can be triggered by web content. These pages...6.5 Medium
- apache plutoCross-site Scripting in Apache Pluto Chatroom demo6.1 Medium
- omniauthOmniAuth Ruby gem Cross-site Request Forgery in request phase8.8 High
- verypdfVeryPDF 4.1 has a Memory Overflow leading to Code Execution because pdfocx!CxImageTIF::operator...7.8 High
- ivanti connect secure, pulsesecure pulse connect secure, pulse policy secure +2 moreXSS exists in the admin web console in Pulse Secure Pulse Connect Secure (PCS) 9.0RX before 9.0R3...8.3 High
- ivanti connect secure, pulsesecure pulse connect secure, pulse policy secure +2 moreIn Pulse Secure Pulse Connect Secure version 9.0RX before 9.0R3.4, 8.3RX before 8.3R7.1, 8.2RX...8.0 High
- ivanti connect secure, pulsesecure pulse connect secure +1 moreIn Pulse Secure Pulse Connect Secure version 9.0RX before 9.0R3.4, 8.3RX before 8.3R7.1, and 8...8.3 High
- ivanti connect secure, pulsesecure pulse connect secure, pulse policy secure +2 moreIn Pulse Secure Pulse Connect Secure version 9.0RX before 9.0R3.4 and 8.3RX before 8.3R7.1 and...8.3 High
- ivanti connect secure, policy secure, pulsesecure pulse policy secure +1 more +3 moreIn Pulse Secure Pulse Connect Secure version 9.0RX before 9.0R3.4, 8.3RX before 8.3R7.1, 8.2RX...8.0 High
- ivanti connect secureIn Pulse Secure Pulse Connect Secure version 9.0RX before 9.0R3.4, 8.3RX before 8.3R7.1, 8.2RX...7.7 High
mirage-xenopamGrant unshare vulnerability in mirage-xen7.7 HighsystemdDebiansystemd - regression updateNo score- w1.fi hostapd, wpa supplicant +1 moreThe EAP-pwd implementation in hostapd (EAP server) before 2.8 and wpa_supplicant (EAP peer)...5.9 Medium
- gitlabGitLab Community and Enterprise Edition 8.9 and later and before 11.5.0-rc12, 11.4.6, and 11.3.10...8.8 High
- cloud foundry cf-deployment, credhub, uaa release (oss) +2 more +4 moreJava Projects using HTTP to fetch dependencies8.7 High
- cloudfoundry uaa release, cloud foundry uaa release (oss), pivotal application service +2 moreUAA redirect-uri allows wildcard in the subdomain8.7 High
- dell emc open manage system administrator, dell emc openmanage server administrator +1 moreImproper Range Header Processing Vulnerability4.3 Medium
- dell emc open manage system administrator, dell emc openmanage server administrator +1 moreDirectory Traversal Vulnerability4.9 Medium
- Show moreLoading…