Skip to content
OpenAdvisories

Archive

April 2019

Vulnerabilities first published in this month (UTC), newest first.

← March 2019 2019 / April May 2019 →
  1. 150
  2. 239
  3. 3202
  4. 499
  5. 522
  6. 63
  7. 77
  8. 881
  9. 9169
  10. 1054
  11. 1133
  12. 1225
  13. 132
  14. 141
  15. 1522
  16. 164
  17. 1772
  18. 1862
  19. 1929
  20. 2011
  21. 2126
  22. 2252
  23. 23188
  24. 2442
  25. 2569
  26. 2658
  27. 273
  28. 284
  29. 2926
  30. 3077
All Critical High Medium Low Exploited only Public exploit

20 results · Clear filters · Feed

  • High 7.5
    CVE-2019-9621 Exploited Public exploit Scanner template EPSS 81%

    Zimbra Collaboration Suite before 8.6 patch 13, 8.7.x before 8.7.11 patch 10, and 8.8.x before 8.8.10 patch 7 or 8.8.x …

    KEV Jul 7, 2025
  • High 7.4
    CVE-2019-5624 Public exploit

    Rapid7 Metasploit Framework Zip Import Directory Traversal

    Rapid7 Metasploit Framework suffers from an instance of CWE-22, Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in the Zip import function of Metasploit. Exploiting this vulnerability can allow an attacker to execute arbitrary c…

    Rapid7 Metasploit Framework
  • High 7.5
    CVE-2019-2725 Exploited · Ransomware Public exploit Scanner template EPSS 100%

    Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: Web Services). Support…

    Oracle Tape Library ACSLS
    KEV Jan 10, 2022
  • High 8.0
    CVE-2019-11539 Exploited · Ransomware Public exploit EPSS 99%

    In Pulse Secure Pulse Connect Secure version 9.0RX before 9.0R3.4, 8.3RX before 8.3R7.1, 8.2RX before 8.2R12.1, and 8.1…

    KEV Nov 3, 2021
  • High 7.2
    CVE-2019-2616 Exploited Public exploit Scanner template EPSS 92%

    Vulnerability in the BI Publisher (formerly XML Publisher) component of Oracle Fusion Middleware (subcomponent: BI Publ…

    Oracle BI Publisher (formerly XML Publisher)
    KEV Mar 25, 2022
  • High 8.8
    CVE-2019-7304 Public exploit EPSS 61%

    Local privilege escalation via snapd socket

    Canonical snapd before version 2.37.1 incorrectly performed socket owner validation, allowing an attacker to run arbitrary commands as root. This issue affects: Canonical snapd versions prior to 2.37.1.

    Canonical snapd snapd snapd Debian Ubuntu
  • High 7.5
    CVE-2019-5427 Public exploit

    Billion laughs attack in c3p0

    c3p0 version < 0.9.5.4 may be exploited by a billion laughs attack when loading XML configuration due to missing protections against recursive entity expansion when loading configuration.

    c3p0 com.mchange:c3p0 c3p0 Debian Ubuntu Maven
  • High 7.1
    CVE-2019-3719 Public exploit EPSS 16%

    Dell SupportAssist Client versions prior to 3.2.0.90 contain a remote code execution vulnerability. An unauthenticated …

    Dell SupportAssist Client
  • High 8.8
    CVE-2019-3398 Exploited Public exploit Scanner template EPSS 97%

    Confluence Server and Data Center had a path traversal vulnerability in the downloadallattachments resource. A remote a…

    Atlassian Confluence Web / CMS
    KEV Nov 3, 2021
  • High 7.7
    CVE-2017-11427 Public exploit

    Multiple SAML libraries may allow authentication bypass via incorrect XML canonicalization and DOM traversal

    OneLogin PythonSAML 2.3.0 and earlier may incorrectly utilize the results of XML DOM traversal and canonicalization APIs in such a way that an attacker may be able to manipulate the SAML data without invalidating the cryptographic signature, allowing the atta…

    OneLogin PythonSAML python-saml PyPI
  • High 8.1
    CVE-2019-0232 Public exploit Scanner template EPSS 100%

    Apache Tomcat OS Command Injection vulnerability

    When running on Windows with enableCmdLineArguments enabled, the CGI Servlet in Apache Tomcat 9.0.0.M1 to 9.0.17, 8.5.0 to 8.5.39 and 7.0.0 to 7.0.93 is vulnerable to Remote Code Execution due to a bug in the way the JRE passes command line arguments to Windo…

    Apache Tomcat org.apache.tomcat.embed:tomcat-embed-core Maven
  • High 8.1
    CVE-2019-11229 Public exploit EPSS 55%

    Gitea Remote Code Execution

    models/repo_mirror.go in Gitea before 1.7.6 and 1.8.x before 1.8-RC3 mishandles mirror repo URL settings, leading to remote code execution.

    github.com/go-gitea/gitea Go
  • High 7.8
    CVE-2019-0859 Exploited · Ransomware Public exploit

    An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in…

    Microsoft Windows Windows Server Windows
    KEV Nov 3, 2021
  • High 7.8
    CVE-2019-0841 Exploited · Ransomware Public exploit EPSS 41%

    An elevation of privilege vulnerability exists when Windows AppX Deployment Service (AppXSVC) improperly handles hard l…

    Microsoft Windows Windows Server Windows
    KEV Mar 15, 2022
  • High 7.8
    CVE-2019-0803 Exploited · Ransomware Public exploit EPSS 45%

    An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in…

    Microsoft Windows Windows Server Windows
    KEV Nov 3, 2021
  • High 7.5
    CVE-2019-0752 Exploited · Ransomware Public exploit EPSS 82%

    A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Internet…

    Microsoft Internet Explorer 11 Internet Explorer 10
    KEV Feb 15, 2022
  • High 7.8
    CVE-2019-0808 Exploited Public exploit EPSS 53%

    An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in…

    Microsoft Windows Windows Server Windows
    KEV Nov 3, 2021
  • High 7.8
    CVE-2019-0211 Exploited Public exploit EPSS 65%

    In Apache HTTP Server 2.4 releases 2.4.17 to 2.4.38, with MPM event, worker or prefork, code executing in less-privileg…

    Apache Apache HTTP Server apache2 apache2 Debian Ubuntu Alpine
    KEV Nov 3, 2021
  • High 8.8
    CVE-2019-10874 Public exploit

    Bolt Cross Site Request Forgery (CSRF)

    Cross Site Request Forgery (CSRF) in the bolt/upload File Upload feature in Bolt CMS 3.6.6 allows remote attackers to execute arbitrary code by uploading a JavaScript file to include executable extensions in the file/edit/config/config.yml configuration file.

    bolt/bolt Packagist
  • High 8.8
    CVE-2019-10867 Public exploit EPSS 69%

    Pimcore Unserialize Remote Code Execution

    An issue was discovered in Pimcore before 5.7.1. An attacker with classes permission can send a POST request to /admin/class/bulk-commit, which will make it possible to exploit the unserialize function when passing untrusted values in the data parameter to bu…

    pimcore/pimcore Packagist