Search
Total
46623 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2019-4051 | 1 Ibm | 1 Api Connect | 2019-04-10 | 5.0 MEDIUM | 5.3 MEDIUM |
| Some URIs in IBM API Connect 2018.1 and 2018.4.1.3 disclose system specification information like the machine id, system uuid, filesystem paths, network interface names along with their mac addresses. An attacker can use this information in targeted attacks. IBM X-Force ID: 156542. | |||||
| CVE-2019-4143 | 1 Ibm | 1 Cloud Private | 2019-04-10 | 2.1 LOW | 5.5 MEDIUM |
| The IBM Cloud Private Key Management Service (IBM Cloud Private 3.1.1 and 3.1.2) could allow a local user to obtain sensitive from the KMS plugin container log. IBM X-Force ID: 158348. | |||||
| CVE-2019-0830 | 1 Microsoft | 3 Sharepoint Enterprise Server, Sharepoint Foundation, Sharepoint Server | 2019-04-10 | 3.5 LOW | 5.4 MEDIUM |
| A cross-site-scripting (XSS) vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected SharePoint server, aka 'Microsoft Office SharePoint XSS Vulnerability'. This CVE ID is unique from CVE-2019-0831. | |||||
| CVE-2019-0831 | 1 Microsoft | 3 Sharepoint Enterprise Server, Sharepoint Foundation, Sharepoint Server | 2019-04-10 | 3.5 LOW | 5.4 MEDIUM |
| A cross-site-scripting (XSS) vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected SharePoint server, aka 'Microsoft Office SharePoint XSS Vulnerability'. This CVE ID is unique from CVE-2019-0830. | |||||
| CVE-2018-13366 | 1 Fortinet | 1 Fortios | 2019-04-10 | 5.0 MEDIUM | 5.3 MEDIUM |
| An information disclosure vulnerability in Fortinet FortiOS 6.0.1, 5.6.7 and below allows attacker to reveals serial number of FortiGate via hostname field defined in connection control setup packets of PPTP protocol. | |||||
| CVE-2019-0695 | 1 Microsoft | 3 Windows 10, Windows Server 2016, Windows Server 2019 | 2019-04-09 | 5.5 MEDIUM | 6.8 MEDIUM |
| A denial of service vulnerability exists when Microsoft Hyper-V on a host server fails to properly validate input from a privileged user on a guest operating system, aka 'Windows Hyper-V Denial of Service Vulnerability'. This CVE ID is unique from CVE-2019-0690, CVE-2019-0701. | |||||
| CVE-2019-10904 | 2 Debian, Roundup-tracker | 2 Debian Linux, Roundup | 2019-04-09 | 4.3 MEDIUM | 6.1 MEDIUM |
| Roundup 1.6 allows XSS via the URI because frontends/roundup.cgi and roundup/cgi/wsgi_handler.py mishandle 404 errors. | |||||
| CVE-2019-0778 | 1 Microsoft | 2 Sharepoint Enterprise Server, Sharepoint Foundation | 2019-04-09 | 3.5 LOW | 5.4 MEDIUM |
| A cross-site-scripting (XSS) vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected SharePoint server, aka 'Microsoft Office SharePoint XSS Vulnerability'. | |||||
| CVE-2019-0777 | 1 Microsoft | 1 Team Foundation Server | 2019-04-09 | 3.5 LOW | 5.4 MEDIUM |
| A Cross-site Scripting (XSS) vulnerability exists when Team Foundation Server does not properly sanitize user provided input, aka 'Team Foundation Server Cross-site Scripting Vulnerability'. | |||||
| CVE-2019-0701 | 1 Microsoft | 3 Windows 10, Windows Server 2016, Windows Server 2019 | 2019-04-09 | 5.5 MEDIUM | 6.8 MEDIUM |
| A denial of service vulnerability exists when Microsoft Hyper-V on a host server fails to properly validate input from a privileged user on a guest operating system, aka 'Windows Hyper-V Denial of Service Vulnerability'. This CVE ID is unique from CVE-2019-0690, CVE-2019-0695. | |||||
| CVE-2019-10634 | 1 Zyxel | 2 Nas326, Nas326 Firmware | 2019-04-09 | 3.5 LOW | 5.4 MEDIUM |
| An XSS vulnerability in the Zyxel NAS 326 version 5.21 and below allows a remote authenticated attacker to inject arbitrary JavaScript or HTML via the user, group, and file-share description fields. | |||||
| CVE-2018-4460 | 1 Apple | 4 Iphone Os, Mac Os X, Tvos and 1 more | 2019-04-09 | 4.0 MEDIUM | 6.5 MEDIUM |
| A denial of service issue was addressed by removing the vulnerable code. This issue affected versions prior to iOS 12.1.1, macOS Mojave 10.14.2, tvOS 12.1.1, watchOS 5.1.2. | |||||
| CVE-2019-11016 | 1 Elgg | 1 Elgg | 2019-04-09 | 5.8 MEDIUM | 6.1 MEDIUM |
| Elgg before 1.12.18 and 2.3.x before 2.3.11 has an open redirect. | |||||
| CVE-2019-11002 | 1 Materializecss | 1 Materialize | 2019-04-09 | 4.3 MEDIUM | 6.1 MEDIUM |
| In Materialize through 1.0.0, XSS is possible via the Tooltip feature. | |||||
| CVE-2018-3979 | 2 Canonical, Nvidia | 33 Ubuntu Linux, Geforce Gtx 745, Geforce Gtx 745 Firmware and 30 more | 2019-04-09 | 4.3 MEDIUM | 6.5 MEDIUM |
| A remote denial-of-service vulnerability exists in the way the Nouveau Display Driver (the default Ubuntu Nvidia display driver) handles GPU shader execution. A specially crafted pixel shader can cause remote denial-of-service issues. An attacker can provide a specially crafted website to trigger this vulnerability. This vulnerability can be triggered remotely after the user visits a malformed website. No further user interaction is required. Vulnerable versions include Ubuntu 18.04 LTS (linux 4.15.0-29-generic x86_64), Nouveau Display Driver NV117 (vermagic: 4.15.0-29-generic SMP mod_unload). | |||||
| CVE-2019-11003 | 1 Materializecss | 1 Materialize | 2019-04-09 | 4.3 MEDIUM | 6.1 MEDIUM |
| In Materialize through 1.0.0, XSS is possible via the Autocomplete feature. | |||||
| CVE-2019-9591 | 1 Mitel | 1 Connect Onsite | 2019-04-08 | 4.3 MEDIUM | 6.1 MEDIUM |
| A reflected Cross-site scripting (XSS) vulnerability in ShoreTel Connect ONSITE before 19.49.1500.0 allows remote attackers to inject arbitrary web script or HTML via the brandUrl parameter. | |||||
| CVE-2019-9592 | 1 Mitel | 1 Connect Onsite | 2019-04-08 | 4.3 MEDIUM | 6.1 MEDIUM |
| A reflected Cross-site scripting (XSS) vulnerability in ShoreTel Connect ONSITE 19.45.1602.0 allows remote attackers to inject arbitrary web script or HTML via the url parameter. | |||||
| CVE-2019-9593 | 1 Mitel | 1 Connect Onsite | 2019-04-08 | 4.3 MEDIUM | 6.1 MEDIUM |
| A reflected Cross-site scripting (XSS) vulnerability in ShoreTel Connect ONSITE 18.82.2000.0 allows remote attackers to inject arbitrary web script or HTML via the page parameter. | |||||
| CVE-2019-11004 | 1 Materializecss | 1 Materialize | 2019-04-08 | 4.3 MEDIUM | 6.1 MEDIUM |
| In Materialize through 1.0.0, XSS is possible via the Toast feature. | |||||
| CVE-2018-4395 | 1 Apple | 4 Iphone Os, Mac Os X, Tvos and 1 more | 2019-04-08 | 2.1 LOW | 5.5 MEDIUM |
| This issue was addressed with improved checks. This issue affected versions prior to iOS 12, macOS Mojave 10.14, tvOS 12, watchOS 5. | |||||
| CVE-2018-4380 | 1 Apple | 1 Iphone Os | 2019-04-08 | 2.1 LOW | 5.5 MEDIUM |
| A lock screen issue allowed access to photos and contacts on a locked device. This issue was addressed by restricting options offered on a locked device. This issue affected versions prior to iOS 12.0.1. | |||||
| CVE-2014-3603 | 1 Shibboleth | 2 Identity Provider, Opensaml Java | 2019-04-08 | 4.3 MEDIUM | 5.9 MEDIUM |
| The (1) HttpResource and (2) FileBackedHttpResource implementations in Shibboleth Identity Provider (IdP) before 2.4.1 and OpenSAML Java 2.6.2 do not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate. | |||||
| CVE-2015-5462 | 1 Axiomsl | 1 Axiom | 2019-04-08 | 4.3 MEDIUM | 6.1 MEDIUM |
| AxiomSL's Axiom Google Web Toolkit module 9.5.3 and earlier allows remote attackers to inject HTML into the scoping dashboard features. | |||||
| CVE-2018-11971 | 1 Qualcomm | 42 Mdm9206, Mdm9206 Firmware, Mdm9607 and 39 more | 2019-04-07 | 4.9 MEDIUM | 5.5 MEDIUM |
| Interrupt exit code flow may undermine access control policy set forth by secure world can lead to potential secure asset leakage in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, in MDM9206, MDM9607, MDM9650, MDM9655, QCS605, SD 410/12, SD 615/16/SD 415, SD 636, SD 712 / SD 710 / SD 670, SD 845 / SD 850, SD 8CX, SDA660, SDM630, SDM660, SXR1130 | |||||
| CVE-2018-17000 | 3 Canonical, Debian, Libtiff | 3 Ubuntu Linux, Debian Linux, Libtiff | 2019-04-05 | 4.3 MEDIUM | 6.5 MEDIUM |
| A NULL pointer dereference in the function _TIFFmemcmp at tif_unix.c (called from TIFFWriteDirectoryTagTransferfunction) in LibTIFF 4.0.9 allows an attacker to cause a denial-of-service through a crafted tiff file. This vulnerability can be triggered by the executable tiffcp. | |||||
| CVE-2018-19210 | 3 Canonical, Debian, Libtiff | 3 Ubuntu Linux, Debian Linux, Libtiff | 2019-04-05 | 4.3 MEDIUM | 6.5 MEDIUM |
| In LibTIFF 4.0.9, there is a NULL pointer dereference in the TIFFWriteDirectorySec function in tif_dirwrite.c that will lead to a denial of service attack, as demonstrated by tiffset. | |||||
| CVE-2019-10856 | 1 Jupyter | 1 Notebook | 2019-04-05 | 5.8 MEDIUM | 6.1 MEDIUM |
| In Jupyter Notebook before 5.7.8, an open redirect can occur via an empty netloc. This issue exists because of an incomplete fix for CVE-2019-10255. | |||||
| CVE-2018-4429 | 1 Apple | 2 Iphone Os, Watchos | 2019-04-05 | 4.3 MEDIUM | 6.5 MEDIUM |
| A spoofing issue existed in the handling of URLs. This issue was addressed with improved input validation. This issue affected versions prior to iOS 12.1.1, watchOS 5.1.2. | |||||
| CVE-2018-4333 | 1 Apple | 2 Iphone Os, Mac Os X | 2019-04-05 | 4.3 MEDIUM | 5.5 MEDIUM |
| A validation issue was addressed with improved input sanitization. This issue affected versions prior to iOS 12, macOS Mojave 10.14. | |||||
| CVE-2019-6607 | 1 F5 | 1 Big-ip Application Security Manager | 2019-04-05 | 6.0 MEDIUM | 6.8 MEDIUM |
| On BIG-IP ASM 11.5.1-11.5.8, 11.6.1-11.6.3, 12.1.0-12.1.3, 13.0.0-13.1.1.3, and 14.0.0-14.0.0.2, there is a stored cross-site scripting vulnerability in an ASM violation viewed in the Configuration utility. In the worst case, an attacker can store a CSRF which results in code execution as the admin user. | |||||
| CVE-2018-4335 | 1 Apple | 1 Iphone Os | 2019-04-05 | 4.3 MEDIUM | 5.5 MEDIUM |
| A validation issue was addressed with improved input sanitization. This issue affected versions prior to iOS 12. | |||||
| CVE-2018-4445 | 1 Apple | 2 Iphone Os, Safari | 2019-04-05 | 4.0 MEDIUM | 4.3 MEDIUM |
| "Clear History and Website Data" did not clear the history. The issue was addressed with improved data deletion. This issue affected versions prior to iOS 12.1.1, Safari 12.0.2. | |||||
| CVE-2018-4462 | 1 Apple | 1 Mac Os X | 2019-04-05 | 4.3 MEDIUM | 5.5 MEDIUM |
| A validation issue was addressed with improved input sanitization. This issue affected versions prior to macOS Mojave 10.14.2. | |||||
| CVE-2018-4195 | 1 Apple | 1 Safari | 2019-04-05 | 4.3 MEDIUM | 6.5 MEDIUM |
| An inconsistent user interface issue was addressed with improved state management. This issue affected versions prior to Safari 12. | |||||
| CVE-2018-4439 | 2 Apple, Microsoft | 5 Icloud, Iphone Os, Itunes and 2 more | 2019-04-05 | 4.3 MEDIUM | 6.5 MEDIUM |
| A logic issue was addressed with improved validation. This issue affected versions prior to iOS 12.1.1, Safari 12.0.2, iTunes 12.9.2 for Windows, iCloud for Windows 7.9. | |||||
| CVE-2018-4440 | 2 Apple, Microsoft | 5 Icloud, Iphone Os, Itunes and 2 more | 2019-04-05 | 4.3 MEDIUM | 4.3 MEDIUM |
| A logic issue was addressed with improved state management. This issue affected versions prior to iOS 12.1.1, Safari 12.0.2, iTunes 12.9.2 for Windows, iCloud for Windows 7.9. | |||||
| CVE-2018-4362 | 1 Apple | 2 Iphone Os, Safari | 2019-04-05 | 4.3 MEDIUM | 6.5 MEDIUM |
| An inconsistent user interface issue was addressed with improved state management. This issue affected versions prior to Safari 11.1.2, iOS 12. | |||||
| CVE-2018-4409 | 2 Apple, Microsoft | 6 Icloud, Iphone Os, Itunes and 3 more | 2019-04-05 | 4.3 MEDIUM | 6.5 MEDIUM |
| A resource exhaustion issue was addressed with improved input validation. This issue affected versions prior to iOS 12.1, tvOS 12.1, Safari 12.0.1, iTunes 12.9.1, iCloud for Windows 7.8. | |||||
| CVE-2018-4368 | 1 Apple | 4 Iphone Os, Mac Os X, Tvos and 1 more | 2019-04-05 | 4.0 MEDIUM | 6.5 MEDIUM |
| A denial of service issue was addressed with improved validation. This issue affected versions prior to iOS 12.1, macOS Mojave 10.14.1, tvOS 12.1, watchOS 5.1. | |||||
| CVE-2018-4413 | 1 Apple | 4 Iphone Os, Mac Os X, Tvos and 1 more | 2019-04-05 | 7.1 HIGH | 5.5 MEDIUM |
| A memory initialization issue was addressed with improved memory handling. This issue affected versions prior to iOS 12.1, macOS Mojave 10.14.1, tvOS 12.1, watchOS 5.1. | |||||
| CVE-2018-4403 | 1 Apple | 1 Mac Os X | 2019-04-05 | 4.3 MEDIUM | 5.5 MEDIUM |
| This issue was addressed by removing additional entitlements. This issue affected versions prior to macOS Mojave 10.14.1. | |||||
| CVE-2018-4399 | 1 Apple | 4 Iphone Os, Mac Os X, Tvos and 1 more | 2019-04-05 | 4.3 MEDIUM | 5.5 MEDIUM |
| An access issue existed with privileged API calls. This issue was addressed with additional restrictions. This issue affected versions prior to iOS 12, macOS Mojave 10.14, tvOS 12, watchOS 5. | |||||
| CVE-2018-4389 | 1 Apple | 1 Mac Os X | 2019-04-05 | 4.3 MEDIUM | 6.5 MEDIUM |
| An inconsistent user interface issue was addressed with improved state management. This issue affected versions prior to macOS Mojave 10.14.1. | |||||
| CVE-2018-4431 | 1 Apple | 4 Iphone Os, Mac Os X, Tvos and 1 more | 2019-04-05 | 4.9 MEDIUM | 5.5 MEDIUM |
| A memory initialization issue was addressed with improved memory handling. This issue affected versions prior to iOS 12.1.1, macOS Mojave 10.14.2, tvOS 12.1.1, watchOS 5.1.2. | |||||
| CVE-2018-4388 | 1 Apple | 1 Iphone Os | 2019-04-05 | 2.1 LOW | 4.6 MEDIUM |
| A lock screen issue allowed access to the share function on a locked device. This issue was addressed by restricting options offered on a locked device. This issue affected versions prior to iOS 12.1. | |||||
| CVE-2018-4397 | 1 Apple | 2 Apple Support, Iphone Os | 2019-04-05 | 4.0 MEDIUM | 4.3 MEDIUM |
| Analytics data was sent using HTTP rather than HTTPS. This was addressed by sending analytics data using HTTPS. This issue affected versions prior to Apple Support 2.4 for iOS. | |||||
| CVE-2018-4355 | 1 Apple | 2 Iphone Os, Mac Os X | 2019-04-05 | 4.3 MEDIUM | 5.5 MEDIUM |
| A configuration issue was addressed with additional restrictions. This issue affected versions prior to iOS 12, macOS Mojave 10.14. | |||||
| CVE-2018-4363 | 1 Apple | 3 Iphone Os, Tvos, Watchos | 2019-04-05 | 7.1 HIGH | 5.5 MEDIUM |
| An input validation issue existed in the kernel. This issue was addressed with improved input validation. This issue affected versions prior to iOS 12, tvOS 12, watchOS 5. | |||||
| CVE-2018-4374 | 2 Apple, Microsoft | 6 Icloud, Iphone Os, Itunes and 3 more | 2019-04-05 | 4.3 MEDIUM | 6.1 MEDIUM |
| A logic issue was addressed with improved validation. This issue affected versions prior to iOS 12.1, watchOS 5.1, Safari 12.0.1, iTunes 12.9.1, iCloud for Windows 7.8. | |||||