# CVEs published 2019-07-11

84 CVEs were published on July 11, 2019: 2 critical, 6 high. Days are UTC.

- [CVE-2019-10930](https://cve.now/CVE-2019-10930.md): A vulnerability has been identified in All other SIPROTEC 5 device types with CPU variants CP300 and CP100 and the respective Ethernet… (no CVSS, Siemens AG All other SIPROTEC 5 device types with CPU va… +3)
- [CVE-2019-10931](https://cve.now/CVE-2019-10931.md): A vulnerability has been identified in All other SIPROTEC 5 device types with CPU variants CP300 and CP100 and the respective Ethernet… (no CVSS, Siemens AG All other SIPROTEC 5 device types with CPU va… +4)
- [CVE-2019-10933](https://cve.now/CVE-2019-10933.md): A vulnerability has been identified in Spectrum Power 3 (Corporate User Interface) (All versions \<= v3.11), Spectrum Power 4 (Corporate… (no CVSS, Siemens AG Spectrum Power)
- [CVE-2019-10935](https://cve.now/CVE-2019-10935.md): A vulnerability has been identified in SIMATIC PCS 7 V8.0 and earlier (All versions), SIMATIC PCS 7 V8.1 (All versions \< V8.1 with WinCC… (no CVSS, Siemens AG SIMATIC PCS 7 V8.0 and earlier · Siemens AG S… +4)
- [CVE-2019-10915](https://cve.now/CVE-2019-10915.md): A vulnerability has been identified in TIA Administrator (All versions \< V1.0 SP1 Upd1). (no CVSS, Siemens AG TIA Administrator)
- [CVE-2019-3415](https://cve.now/CVE-2019-3415.md): ZTE MW NR8000V2.4.4.03 and NR8000V2.4.4.04 are impacted by path traversal vulnerability. (no CVSS, ZTE MW)
- [CVE-2018-17196](https://cve.now/CVE-2018-17196.md): In Apache Kafka versions between 0.11.0.0 and 2.1.0, it is possible to manually craft a Produce request which bypasses… (no CVSS, Apache Kafka · org.apache.kafka:kafka)
- [CVE-2018-18095](https://cve.now/CVE-2018-18095.md): Improper authentication in firmware for Intel(R) SSD DC S4500 Series and Intel(R) SSD DC S4600 Series before SCV10150 may allow an… (no CVSS, Intel(R) SSD DC S4500/S4600 Series)
- [CVE-2019-11133](https://cve.now/CVE-2019-11133.md): Improper access control in the Intel(R) Processor Diagnostic Tool before version 4.1.2.24 may allow an authenticated user to potentially… (no CVSS, Intel(R) Processor Diagnostic Tool Advisory)
- [CVE-2019-5528](https://cve.now/CVE-2019-5528.md): VMware ESXi 6.5 suffers from partial denial of service vulnerability in hostd process. (no CVSS, VMware ESXi)
- [CVE-2019-12751](https://cve.now/CVE-2019-12751.md): Symantec Messaging Gateway, prior to 10.7.1, may be susceptible to a privilege escalation vulnerability, which is a type of issue whereby… (no CVSS, Symantec Messaging Gateway)
- [CVE-2019-12574](https://cve.now/CVE-2019-12574.md): A vulnerability in the London Trust Media Private Internet Access (PIA) VPN Client v1.0 for Windows could allow an authenticated, local… (no CVSS)
- [CVE-2019-4263](https://cve.now/CVE-2019-4263.md): IBM Content Navigator 3.0CD is vulnerable to local file inclusion, allowing an attacker to access a configuration file in the ICN server. (CVSS 4.3, IBM Content Navigator)
- [CVE-2019-4193](https://cve.now/CVE-2019-4193.md): IBM Jazz for Service Management 1.1.3 and 1.1.3.2 stores sensitive information in URL parameters. (CVSS 5.9, IBM Jazz for Service Management)
- [CVE-2019-4131](https://cve.now/CVE-2019-4131.md): IBM Application Performance Management (IBM Monitoring 8.1.4) could allow a remote attacker to induce the application to perform… (CVSS 5.3, IBM Monitoring)
- [CVE-2019-4118](https://cve.now/CVE-2019-4118.md): IBM Multicloud Manager 3.1.0, 3.1.1, and 3.1.2 ibm-mcm-chart could allow a local attacker with admin privileges to obtain highly sensitive… (CVSS 4.4, IBM Multicloud Manager)
- [CVE-2018-1968](https://cve.now/CVE-2018-1968.md): IBM Security Identity Manager 7.0.1 discloses sensitive information to unauthorized users. (CVSS 5.3, IBM Security Identity Manager)
- [CVE-2019-12578](https://cve.now/CVE-2019-12578.md): A vulnerability in the London Trust Media Private Internet Access (PIA) VPN Client v82 for Linux could allow an authenticated, local… (no CVSS)
- [CVE-2019-10970](https://cve.now/CVE-2019-10970.md): In Rockwell Automation PanelView 5510 (all versions manufactured before March 13, 2019 that have never been updated to v4.003, v5.002, or… (no CVSS, Rockwell Automation PanelView)
- [CVE-2019-12571](https://cve.now/CVE-2019-12571.md): A vulnerability in the London Trust Media Private Internet Access (PIA) VPN Client v0.9.8 beta (build 02099) for macOS could allow an… (no CVSS)
- [CVE-2019-0053](https://cve.now/CVE-2019-0053.md): Junos OS: Insufficient validation of environment variables in telnet client may lead to stack-based buffer overflow (CVSS 7.8, Juniper Networks Junos OS)
- [CVE-2019-0052](https://cve.now/CVE-2019-0052.md): SRX Series: srxpfe process crash while JSF/UTM module parses specific HTTP packets (CVSS 7.5, Juniper Networks Junos OS)
- [CVE-2019-0049](https://cve.now/CVE-2019-0049.md): Junos OS: RPD process crashes when BGP peer restarts (CVSS 7.5, Juniper Networks Junos OS)
- [CVE-2019-0048](https://cve.now/CVE-2019-0048.md): EX4300 Series: When a firewall filter is applied to a loopback interface, other firewall filters for multicast traffic may fail (CVSS 5.8, Juniper Networks Junos OS)
- [CVE-2019-0046](https://cve.now/CVE-2019-0046.md): Junos OS: EX4300 Series: Denial of Service upon receipt of large number of specific valid packets on management interface. (CVSS 6.5, Juniper Networks Junos OS)
- [CVE-2019-12576](https://cve.now/CVE-2019-12576.md): A vulnerability in the London Trust Media Private Internet Access (PIA) VPN Client v82 for macOS could allow an authenticated, local… (no CVSS)
- [CVE-2019-1010315](https://cve.now/CVE-2019-1010315.md): WavPack 5.1 and earlier is affected by: CWE 369: Divide by Zero. (no CVSS, WavPack)
- [CVE-2019-1010314](https://cve.now/CVE-2019-1010314.md): Gitea 1.7.2, 1.7.3 is affected by: Cross Site Scripting (XSS). (no CVSS, Gitea · code.gitea.io/gitea)
- [CVE-2019-12573](https://cve.now/CVE-2019-12573.md): A vulnerability in the London Trust Media Private Internet Access (PIA) VPN Client v82 for Linux and macOS could allow an authenticated… (no CVSS)
- [CVE-2019-12577](https://cve.now/CVE-2019-12577.md): A vulnerability in the London Trust Media Private Internet Access (PIA) VPN Client v82 for macOS could allow an authenticated, local… (no CVSS)
- [CVE-2019-1010316](https://cve.now/CVE-2019-1010316.md): pyxtrlock 0.3 and earlier is affected by: Incorrect Access Control. (no CVSS, pyxtrlock)
- [CVE-2019-1010317](https://cve.now/CVE-2019-1010317.md): WavPack 5.1.0 and earlier is affected by: CWE-457: Use of Uninitialized Variable. (no CVSS, WavPack)
- [CVE-2019-12579](https://cve.now/CVE-2019-12579.md): A vulnerability in the London Trust Media Private Internet Access (PIA) VPN Client v82 for Linux and macOS could allow an authenticated… (no CVSS)
- [CVE-2019-1010319](https://cve.now/CVE-2019-1010319.md): WavPack 5.1.0 and earlier is affected by: CWE-457: Use of Uninitialized Variable. (no CVSS, WavPack)
- [CVE-2019-12575](https://cve.now/CVE-2019-12575.md): A vulnerability in the London Trust Media Private Internet Access (PIA) VPN Client v82 for Linux could allow an authenticated, local… (no CVSS)
- [CVE-2014-3798](https://cve.now/CVE-2014-3798.md): The Windows Guest Tools in Citrix XenServer 6.2 SP1 and earlier allows remote attackers to cause a denial of service (guest OS crash) via… (no CVSS)
- [CVE-2019-9657](https://cve.now/CVE-2019-9657.md): Alarm.com ADC-V522IR 0100b9 devices have Incorrect Access Control, a different issue than CVE-2018-19588. (no CVSS)
- [CVE-2019-13029](https://cve.now/CVE-2019-13029.md): Multiple stored Cross-site scripting (XSS) issues in the admin panel and survey system in REDCap 8 before 8.10.20 and 9 before 9.1.2 allow… (no CVSS)
- [CVE-2018-19588](https://cve.now/CVE-2018-19588.md): Alarm.com ADC-V522IR 0100b9 devices have Incorrect Access Control. (no CVSS)
- [CVE-2018-17151](https://cve.now/CVE-2018-17151.md): Intersystems Cache 2017.2.2.865.0 has Incorrect Access Control. (no CVSS)
- [CVE-2018-17152](https://cve.now/CVE-2018-17152.md): Intersystems Cache 2017.2.2.865.0 allows XXE. (no CVSS)
- [CVE-2018-17150](https://cve.now/CVE-2018-17150.md): Intersystems Cache 2017.2.2.865.0 allows XSS. (no CVSS)
- [CVE-2019-7003](https://cve.now/CVE-2019-7003.md): ACM SQL Injection (CVSS 9.3, Avaya Control Manager)
- [CVE-2019-12529](https://cve.now/CVE-2019-12529.md): An issue was discovered in Squid 2.x through 2.7.STABLE9, 3.x through 3.5.28, and 4.x through 4.7. (no CVSS)
- [CVE-2019-10194](https://cve.now/CVE-2019-10194.md): Sensitive passwords used in deployment and configuration of oVirt Metrics, all versions. (CVSS 5.9, Red Hat ovirt-engine-metrics)
- [CVE-2019-10192](https://cve.now/CVE-2019-10192.md): A heap-buffer overflow vulnerability was found in the Redis hyperloglog data structure versions 3.x before 3.2.13, 4.x before 4.0.14 and… (CVSS 7.2, Redis Labs redis)
- [CVE-2019-10193](https://cve.now/CVE-2019-10193.md): A stack-buffer overflow vulnerability was found in the Redis hyperloglog data structure versions 3.x before 3.2.13, 4.x before 4.0.14 and… (CVSS 7.2, Redis Labs redis)
- [CVE-2019-3889](https://cve.now/CVE-2019-3889.md): A reflected XSS vulnerability exists in authorization flow of OpenShift Container Platform versions: openshift-online-3… (CVSS 4.6, Red Hat atomic-openshift)
- [CVE-2019-11062](https://cve.now/CVE-2019-11062.md): SUNNET WMPro v5.0 and v5.1 has OS Command Injection (no CVSS, SUNNET WMPro)
- [CVE-2019-9886](https://cve.now/CVE-2019-9886.md): eClass platform allows user to download arbitrary files without authentication (CVSS 9.1, BroadLearning eclass)
- [CVE-2019-12525](https://cve.now/CVE-2019-12525.md): An issue was discovered in Squid 3.3.9 through 3.5.28 and 4.x through 4.7. (no CVSS)
- [CVE-2019-11268](https://cve.now/CVE-2019-11268.md): UAA SQL Identity Zone Vulnerability (CVSS 6.5, Cloud Foundry UAA Release)
- [CVE-2019-12527](https://cve.now/CVE-2019-12527.md): An issue was discovered in Squid 4.0.23 through 4.7. (no CVSS)
- [CVE-2019-10651](https://cve.now/CVE-2019-10651.md): An issue was discovered in the Core Server in Ivanti Endpoint Manager (EPM) 2017.3 before SU7 and 2018.x before 2018.3 SU3, with remote… (no CVSS)
- [CVE-2019-13564](https://cve.now/CVE-2019-13564.md): XSS exists in Ping Identity Agentless Integration Kit before 1.5. (no CVSS)
- [CVE-2019-13563](https://cve.now/CVE-2019-13563.md): D-Link DIR-655 C devices before 3.02B05 BETA03 allow CSRF for the entire management console. (no CVSS)
- [CVE-2019-13562](https://cve.now/CVE-2019-13562.md): D-Link DIR-655 C devices before 3.02B05 BETA03 allow XSS, as demonstrated by the /www/ping\_response.cgi ping\_ipaddr parameter, the… (no CVSS)
- [CVE-2019-13561](https://cve.now/CVE-2019-13561.md): D-Link DIR-655 C devices before 3.02B05 BETA03 allow remote attackers to execute arbitrary commands via shell metacharacters in the… (no CVSS)
- [CVE-2019-13560](https://cve.now/CVE-2019-13560.md): D-Link DIR-655 C devices before 3.02B05 BETA03 allow remote attackers to force a blank password via the apply\_sec.cgi setup\_wizard… (no CVSS)
- [CVE-2019-10340](https://cve.now/CVE-2019-10340.md): A cross-site request forgery vulnerability in Jenkins Docker Plugin 1.1.6 and earlier in DockerAPI.DescriptorImpl#doTestConnection allowed… (no CVSS, Jenkins project Jenkins Docker Plugin · io.jenkins.docker:d…)
- [CVE-2019-10341](https://cve.now/CVE-2019-10341.md): A missing permission check in Jenkins Docker Plugin 1.1.6 and earlier in DockerAPI.DescriptorImpl#doTestConnection allowed users with… (no CVSS, Jenkins project Jenkins Docker Plugin · io.jenkins.docker:d…)
- [CVE-2019-10342](https://cve.now/CVE-2019-10342.md): A missing permission check in Jenkins Docker Plugin 1.1.6 and earlier in various 'fillCredentialsIdItems' methods allowed users with… (no CVSS, Jenkins project Jenkins Docker Plugin · io.jenkins.docker:d…)
- [CVE-2019-10346](https://cve.now/CVE-2019-10346.md): A reflected cross site scripting vulnerability in Jenkins Embeddable Build Status Plugin 2.0.1 and earlier allowed attackers inject… (no CVSS, Jenkins project Jenkins Embeddable Build Status Plugin · io…)
- [CVE-2019-10347](https://cve.now/CVE-2019-10347.md): Jenkins Mashup Portlets Plugin stored credentials unencrypted on the Jenkins master where they can be viewed by users with access to the… (no CVSS, Jenkins project Jenkins Mashup Portlets Plugin · javagh.jen…)
- [CVE-2019-10348](https://cve.now/CVE-2019-10348.md): Jenkins Gogs Plugin stored credentials unencrypted in job config.xml files on the Jenkins master where they can be viewed by users with… (no CVSS, Jenkins project Jenkins Gogs Plugin · org.jenkins-ci.plugin…)
- [CVE-2019-10349](https://cve.now/CVE-2019-10349.md): A stored cross site scripting vulnerability in Jenkins Dependency Graph Viewer Plugin 0.13 and earlier allowed attackers able to configure… (no CVSS, Jenkins project Jenkins Dependency Graph Viewer Plugin · or…)
- [CVE-2019-10350](https://cve.now/CVE-2019-10350.md): Jenkins Port Allocator Plugin stores credentials unencrypted in job config.xml files on the Jenkins master where they can be viewed by… (no CVSS, Jenkins project Jenkins Port Allocator Plugin · org.jenkins…)
- [CVE-2019-10351](https://cve.now/CVE-2019-10351.md): Jenkins Caliper CI Plugin stores credentials unencrypted in job config.xml files on the Jenkins master where they can be viewed by users… (no CVSS, Jenkins project Jenkins Caliper CI Plugin · com.brianfromor…)
- [CVE-2018-11744](https://cve.now/CVE-2018-11744.md): Cloudera Manager through 5.15 has Incorrect Access Control. (no CVSS)
- [CVE-2019-13507](https://cve.now/CVE-2019-13507.md): hidea.com AZ Admin 1.0 has news\_det.php?cod= SQL Injection. (no CVSS)
- [CVE-2019-12363](https://cve.now/CVE-2019-12363.md): An CSRF issue was discovered in the JN-Jones MyBB-2FA plugin through 2014-11-05 for MyBB. (no CVSS)
- [CVE-2019-12537](https://cve.now/CVE-2019-12537.md): An issue was discovered in Zoho ManageEngine AssetExplorer. (no CVSS)
- [CVE-2019-12539](https://cve.now/CVE-2019-12539.md): An issue was discovered in the Purchase component of Zoho ManageEngine ServiceDesk Plus. (no CVSS)
- [CVE-2019-12540](https://cve.now/CVE-2019-12540.md): An issue was discovered in Zoho ManageEngine ServiceDesk Plus 10.5. (no CVSS)
- [CVE-2019-12595](https://cve.now/CVE-2019-12595.md): An issue was discovered in Zoho ManageEngine AssetExplorer. (no CVSS)
- [CVE-2019-12596](https://cve.now/CVE-2019-12596.md): An issue was discovered in Zoho ManageEngine AssetExplorer. (no CVSS)
- [CVE-2019-12597](https://cve.now/CVE-2019-12597.md): An issue was discovered in Zoho ManageEngine AssetExplorer. (no CVSS)
- [CVE-2019-13506](https://cve.now/CVE-2019-13506.md): @nuxt/devalue before 1.2.3, as used in Nuxt.js before 2.6.2, mishandles object keys, leading to XSS. (no CVSS, @nuxt/devalue)
- [CVE-2019-12838](https://cve.now/CVE-2019-12838.md): SchedMD Slurm 17.11.x, 18.08.0 through 18.08.7, and 19.05.0 allows SQL Injection. (no CVSS)
- [CVE-2019-1010003](https://cve.now/CVE-2019-1010003.md): Leanote prior to version 2.6 is affected by: Cross Site Scripting (XSS). (no CVSS, Leanote)
- [CVE-2019-13505](https://cve.now/CVE-2019-13505.md): The Appointment Hour Booking plugin 1.1.44 for WordPress allows XSS via the E-mail field, as demonstrated by email\_1. (no CVSS)
- [CVE-2019-13503](https://cve.now/CVE-2019-13503.md): mq\_parse\_http in mongoose.c in Mongoose 6.15 has a heap-based buffer over-read. (no CVSS)
- [CVE-2019-10135](https://cve.now/CVE-2019-10135.md): A flaw was found in the yaml.load() function in the osbs-client versions since 0.46 before 0.56.1. (CVSS 7.2, Red Hat osbs-client)
- [CVE-2019-13504](https://cve.now/CVE-2019-13504.md): There is an out-of-bounds read in Exiv2::MrwImage::readMetadata in mrwimage.cpp in Exiv2 through 0.27.2. (no CVSS)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/archive/2019-07-11
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.