# CVEs published 2019-06-06

51 CVEs were published on June 6, 2019: 1 critical, 3 high. Days are UTC.

- [CVE-2019-4257](https://cve.now/CVE-2019-4257.md): IBM InfoSphere Information Server 11.5 and 11.7 is affected by an information disclosure vulnerability. (CVSS 4.3, IBM InfoSphere Information Server)
- [CVE-2019-4219](https://cve.now/CVE-2019-4219.md): IBM Security Information Queue (ISIQ) 1.0.0, 1.0.1, and 1.0.2 generates an error message that includes sensitive information that could be… (CVSS 4.3, IBM Security Information Queue)
- [CVE-2019-4218](https://cve.now/CVE-2019-4218.md): IBM Security Information Queue (ISIQ) 1.0.0, 1.0.1, and 1.0.2 allows web pages to be stored locally which can be read by another user on… (CVSS 4.0, IBM Security Information Queue)
- [CVE-2019-4217](https://cve.now/CVE-2019-4217.md): IBM Security Information Queue (ISIQ) 1.0.0, 1.0.1, and 1.0.2 could allow a remote attacker to hijack the clicking action of the victim. (CVSS 6.1, IBM Security Information Queue)
- [CVE-2019-4162](https://cve.now/CVE-2019-4162.md): IBM Security Information Queue (ISIQ) 1.0.0, 1.0.1, and 1.0.2 is missing the HTTP Strict Transport Security header. (CVSS 5.9, IBM Security Information Queue)
- [CVE-2019-4161](https://cve.now/CVE-2019-4161.md): IBM Security Information Queue (ISIQ) 1.0.0, 1.0.1, and 1.0.2 discloses sensitive information to unauthorized users. (CVSS 4.0, IBM Security Information Queue)
- [CVE-2019-12762](https://cve.now/CVE-2019-12762.md): Xiaomi Mi 5s Plus devices allow attackers to trigger touchscreen anomalies via a radio signal between 198 kHz and 203 kHz, as demonstrated… (no CVSS)
- [CVE-2019-11523](https://cve.now/CVE-2019-11523.md): Anviz Global M3 Outdoor RFID Access Control executes any command received from any source. (no CVSS)
- [CVE-2019-12492](https://cve.now/CVE-2019-12492.md): Gallagher Command Centre before 7.80.939, 7.90.x before 7.90.961, and 8.x before 8.00.1128 allows arbitrary event creation and information… (no CVSS)
- [CVE-2019-3790](https://cve.now/CVE-2019-3790.md): Ops Manager uaa client issues tokens after refresh token expiration (CVSS 6.1, Pivotal Ops Manager)
- [CVE-2019-3723](https://cve.now/CVE-2019-3723.md): Web Parameter Tampering Vulnerability (CVSS 9.1, Dell EMC OpenManage Server Administrator)
- [CVE-2019-3722](https://cve.now/CVE-2019-3722.md): XML External Entity (XXE) Injection Vulnerability (CVSS 7.5, Dell EMC OpenManage Server Administrator)
- [CVE-2019-5525](https://cve.now/CVE-2019-5525.md): VMware Workstation (15.x before 15.1.0) contains a use-after-free vulnerability in the Advanced Linux Sound Architecture (ALSA) backend. (no CVSS, VMware Workstation)
- [CVE-2019-5522](https://cve.now/CVE-2019-5522.md): VMware Tools for Windows update addresses an out of bounds read vulnerability in vm3dmp driver which is installed with vmtools in Windows… (no CVSS, VMware Tools for Windows)
- [CVE-2019-12761](https://cve.now/CVE-2019-12761.md): A code injection issue was discovered in PyXDG before 0.26 via crafted Python code in a Category element of a Menu XML document in a .menu… (no CVSS, pyxdg)
- [CVE-2019-12760](https://cve.now/CVE-2019-12760.md): A deserialization vulnerability exists in the way parso through 0.4.0 handles grammar parsing from the cache. (CVSS 3.3, parso)
- [CVE-2018-8047](https://cve.now/CVE-2018-8047.md): vtiger CRM 7.0.1 is affected by one reflected Cross-Site Scripting (XSS) vulnerability affecting version 7.0.1 and probably prior versions. (no CVSS)
- [CVE-2018-9839](https://cve.now/CVE-2018-9839.md): An issue was discovered in MantisBT through 1.3.14, and 2.0.0. (no CVSS)
- [CVE-2019-3578](https://cve.now/CVE-2019-3578.md): MyBB 1.8.19 has XSS in the resetpassword function. (no CVSS)
- [CVE-2019-3579](https://cve.now/CVE-2019-3579.md): MyBB 1.8.19 allows remote attackers to obtain sensitive information because it discloses the username upon receiving a password-reset… (no CVSS)
- [CVE-2019-6451](https://cve.now/CVE-2019-6451.md): On SOYAL AR-727H and AR-829Ev5 devices, all CGI programs allow unauthenticated POST access. (no CVSS)
- [CVE-2019-6452](https://cve.now/CVE-2019-6452.md): Kyocera Command Center RX TASKalfa4501i and TASKalfa5052ci allows remote attackers to abuse the Test button in the machine address book to… (no CVSS)
- [CVE-2019-6989](https://cve.now/CVE-2019-6989.md): TP-Link TL-WR940N is vulnerable to a stack-based buffer overflow, caused by improper bounds checking by the ipAddrDispose function. (no CVSS)
- [CVE-2019-9929](https://cve.now/CVE-2019-9929.md): Northern.tech CFEngine Enterprise 3.12.1 has Insecure Permissions. (no CVSS)
- [CVE-2019-12291](https://cve.now/CVE-2019-12291.md): HashiCorp Consul 1.4.0 through 1.5.0 has Incorrect Access Control. (no CVSS, github.com/hashicorp/consul)
- [CVE-2019-12135](https://cve.now/CVE-2019-12135.md): An unspecified vulnerability in the application server in PaperCut MF and NG versions 18.3.8 and earlier and versions 19.0.3 and earlier… (no CVSS)
- [CVE-2019-7215](https://cve.now/CVE-2019-7215.md): Progress Sitefinity 10.1.6536 does not invalidate session cookies upon logouts. (no CVSS)
- [CVE-2019-7220](https://cve.now/CVE-2019-7220.md): X-Cart V5 is vulnerable to XSS via the CategoryFilter2 parameter. (no CVSS)
- [CVE-2019-7311](https://cve.now/CVE-2019-7311.md): An issue was discovered on Linksys WRT1900ACS 1.0.3.187766 devices. (no CVSS)
- [CVE-2019-7552](https://cve.now/CVE-2019-7552.md): An issue was discovered in PHP Scripts Mall Investment MLM Software 2.0.2. (no CVSS)
- [CVE-2019-7554](https://cve.now/CVE-2019-7554.md): An issue was discovered in PHP Scripts Mall API Based Travel Booking 3.4.7. (no CVSS)
- [CVE-2019-12274](https://cve.now/CVE-2019-12274.md): In Rancher 1 and 2 through 2.2.3, unprivileged users (if allowed to deploy nodes) can gain admin access to the Rancher management plane… (no CVSS, github.com/rancher/rancher)
- [CVE-2019-12303](https://cve.now/CVE-2019-12303.md): In Rancher 2 through 2.2.3, Project owners can inject additional fluentd configuration to read files or execute arbitrary commands inside… (no CVSS, github.com/rancher/rancher)
- [CVE-2019-12732](https://cve.now/CVE-2019-12732.md): The Chartkick gem through 3.1.0 for Ruby allows XSS. (no CVSS, chartkick)
- [CVE-2019-8320](https://cve.now/CVE-2019-8320.md): A Directory Traversal issue was discovered in RubyGems 2.7.6 and later through 3.0.2. (no CVSS, rubygems-update)
- [CVE-2019-5219](https://cve.now/CVE-2019-5219.md): There is a double free vulnerability on certain drivers of Huawei Mate10 smartphones versions earlier than ALP-AL00B… (no CVSS, Huawei Mate10)
- [CVE-2019-5295](https://cve.now/CVE-2019-5295.md): Huawei Honor V10 smartphones versions earlier than Berkeley-AL20 9.0.0.125(C00E125R2P14T8) have an authorization bypass vulnerability. (no CVSS, Huawei Honor)
- [CVE-2019-5305](https://cve.now/CVE-2019-5305.md): The image processing module of some Huawei Mate 10 smartphones versions before ALP-L29 9.0.0.159(C185) has a memory double free… (no CVSS, Huawei Mate)
- [CVE-2019-5216](https://cve.now/CVE-2019-5216.md): There is a race condition vulnerability on Huawei Honor V10 smartphones versions earlier than Berkeley-AL20 9.0.0.156(C00E156R2P14T8)… (no CVSS, Huawei Honor V10, Honor 10, Honor Play)
- [CVE-2019-5242](https://cve.now/CVE-2019-5242.md): There is a code execution vulnerability in Huawei PCManager versions earlier than PCManager 9.0.1.50. (no CVSS, Huawei PCManager)
- [CVE-2019-5241](https://cve.now/CVE-2019-5241.md): There is a privilege escalation vulnerability in Huawei PCManager versions earlier than PCManager 9.0.1.50. (no CVSS, Huawei PCManager)
- [CVE-2019-5214](https://cve.now/CVE-2019-5214.md): There is a use after free vulnerability on certain driver component in Huawei Mate10 smartphones versions earlier than ALP-AL00B… (no CVSS, Huawei Mate10)
- [CVE-2019-11080](https://cve.now/CVE-2019-11080.md): Sitecore Experience Platform (XP) prior to 9.1.1 is vulnerable to remote code execution via deserialization, aka TFS # 293863. (no CVSS)
- [CVE-2019-12134](https://cve.now/CVE-2019-12134.md): CSV Injection (aka Excel Macro Injection or Formula Injection) exists in the export feature in Workday through 32 via a value (provided by… (no CVSS)
- [CVE-2019-4220](https://cve.now/CVE-2019-4220.md): IBM InfoSphere Information Server 11.7.1.0 stores a common hard coded encryption key that could be used to decrypt sensitive information. (CVSS 6.2, IBM InfoSphere Information Server)
- [CVE-2019-4201](https://cve.now/CVE-2019-4201.md): IBM Jazz for Service Management 1.1.3, 1.1.3.1, and 1.1.3.2 could allow a remote attacker to conduct phishing attacks, using an open… (CVSS 7.4, IBM Jazz for Service Management)
- [CVE-2019-4185](https://cve.now/CVE-2019-4185.md): IBM InfoSphere Information Server 11.7.1 containers are vulnerable to privilege escalation due to an insecurely configured component. (CVSS 8.3, IBM InfoSphere Information Server)
- [CVE-2019-4056](https://cve.now/CVE-2019-4056.md): IBM Maximo Asset Management 7.6 Work Centers' application does not validate file type upon upload, allowing attackers to upload malicious… (CVSS 4.3, IBM Maximo Asset Management)
- [CVE-2019-4048](https://cve.now/CVE-2019-4048.md): IBM Maximo Asset Management 7.6 could allow a physical user of the system to obtain sensitive information from a previous user of the same… (CVSS 2.1, IBM Maximo Asset Management)
- [CVE-2018-2028](https://cve.now/CVE-2018-2028.md): IBM Maximo Asset Management 7.6 could allow a an authenticated user to replace a target page with a phishing site which could allow the… (CVSS 6.5, IBM Maximo Asset Management)
- [CVE-2019-7553](https://cve.now/CVE-2019-7553.md): PHP Scripts Mall Chartered Accountant : Auditor Website 2.0.1 has Stored XSS in the Profile Update page via the My Name field. (no CVSS)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/archive/2019-06-06
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.