# CVEs published 2019-05-14

49 CVEs were published on May 14, 2019: 3 critical, 1 high. 2 are now in CISA KEV. Days are UTC.

- [CVE-2019-12099](https://cve.now/CVE-2019-12099.md): In PHP-Fusion 9.03.00, edit\_profile.php allows remote authenticated users to execute arbitrary code because includes/dynamics/includes/form\_ (no CVSS)
- [CVE-2019-11328](https://cve.now/CVE-2019-11328.md): An issue was discovered in Singularity 3.1.0 to 3.2.0-rc2, a malicious user with local/network access to the host system (e.g. (no CVSS, github.com/sylabs/singularity)
- [CVE-2019-0301](https://cve.now/CVE-2019-0301.md): Under certain conditions, it is possible to request the modification of role or privilege assignments through SAP Identity Management REST I (no CVSS, SAP SE SAP Identity Management)
- [CVE-2019-0298](https://cve.now/CVE-2019-0298.md): SAP E-Commerce (Business-to-Consumer) application does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting (XS (no CVSS, SAP SE SAP E-Commerce)
- [CVE-2019-0293](https://cve.now/CVE-2019-0293.md): Read of RFC destination does not always perform necessary authorization checks, resulting in escalation of privileges to access information (no CVSS, SAP SE SAP Solution Manager system)
- [CVE-2019-0291](https://cve.now/CVE-2019-0291.md): Under certain conditions Solution Manager, version 7.2, allows an attacker to access information which would otherwise be restricted. (no CVSS, SAP SE SAP Solution Manager)
- [CVE-2019-0289](https://cve.now/CVE-2019-0289.md): Under certain conditions SAP BusinessObjects Business Intelligence platform (Analysis for OLAP), versions 4.2 and 4.3, allows an attacker to (no CVSS, SAP SE SAP BusinessObjects Business Intelligence platform)
- [CVE-2019-0287](https://cve.now/CVE-2019-0287.md): Under certain conditions SAP BusinessObjects Business Intelligence platform (Central Management Server), versions 4.2 and 4.3, allows an att (no CVSS, SAP SE SAP BusinessObjects Business Intelligence platform)
- [CVE-2019-0280](https://cve.now/CVE-2019-0280.md): SAP Treasury and Risk Management (EA-FINSERV 6.0, 6.03, 6.04, 6.05, 6.06, 6.16, 6.17, 6.18 and 8.0; S4CORE 1.01, 1.02 and 1.03), does not pe (no CVSS, SAP SE SAP Treasury and Risk Management · SAP SE SAP Enterp…)
- [CVE-2019-11397](https://cve.now/CVE-2019-11397.md): GetFile.aspx in Rapid4 RapidFlows Enterprise Application Builder 4.5M.23 (when used with .NET Framework 4.5) allows Local File Inclusion via (no CVSS)
- [CVE-2018-14839](https://cve.now/CVE-2018-14839.md): LG N1A1 NAS 3718.510 is affected by: Remote Command Execution. (CVSS 9.8, KEV)
- [CVE-2018-16656](https://cve.now/CVE-2018-16656.md): DoBox\_CstmBox\_Info.model.htm on Kyocera TASKalfa 4002i and 6002i devices allows remote attackers to read the documents of arbitrary users vi (no CVSS)
- [CVE-2019-11206](https://cve.now/CVE-2019-11206.md): TIBCO Spotfire Server Vulnerabilities With Integrity of Comments and Bookmarks (CVSS 4.3, TIBCO Software TIBCO Spotfire Analytics Platform for AWS Ma…)
- [CVE-2019-11205](https://cve.now/CVE-2019-11205.md): TIBCO Spotfire Server Exposes Multiple Reflected Cross-Site Scripting Vulnerabilities (CVSS 8.8, TIBCO Software TIBCO Spotfire Analytics Platform for AWS Ma…)
- [CVE-2019-11204](https://cve.now/CVE-2019-11204.md): TIBCO Spotfire Statistics Services Exposes Sensitive Files (CVSS 9.9, TIBCO Software TIBCO Spotfire Statistics Services)
- [CVE-2019-10916](https://cve.now/CVE-2019-10916.md): A vulnerability has been identified in SIMATIC PCS 7 V8.0 and earlier (All versions), SIMATIC PCS 7 V8.1 (All versions \< V8.1 with WinCC V7. (no CVSS, Siemens AG SIMATIC PCS 7 V8.0 and earlier · Siemens AG S… +4)
- [CVE-2019-10917](https://cve.now/CVE-2019-10917.md): A vulnerability has been identified in SIMATIC PCS 7 V8.0 and earlier (All versions), SIMATIC PCS 7 V8.1 (All versions \< V8.1 with WinCC V7. (no CVSS, Siemens AG SIMATIC PCS 7 V8.0 and earlier · Siemens AG S… +4)
- [CVE-2019-10918](https://cve.now/CVE-2019-10918.md): A vulnerability has been identified in SIMATIC PCS 7 V8.0 and earlier (All versions), SIMATIC PCS 7 V8.1 (All versions \< V8.1 with WinCC V7. (no CVSS, Siemens AG SIMATIC PCS 7 V8.0 and earlier · Siemens AG S… +4)
- [CVE-2019-10919](https://cve.now/CVE-2019-10919.md): A vulnerability has been identified in LOGO! 8 BM (incl. (no CVSS, Siemens LOGO! 8 BM)
- [CVE-2019-10920](https://cve.now/CVE-2019-10920.md): A vulnerability has been identified in LOGO! 8 BM (incl. (no CVSS, Siemens LOGO! 8 BM)
- [CVE-2019-10921](https://cve.now/CVE-2019-10921.md): A vulnerability has been identified in LOGO! 8 BM (incl. (no CVSS, Siemens LOGO! 8 BM)
- [CVE-2019-10922](https://cve.now/CVE-2019-10922.md): A vulnerability has been identified in SIMATIC PCS 7 V8.0 and earlier (All versions), SIMATIC PCS 7 V8.1 and newer (All versions), SIMATIC W (no CVSS, Siemens AG SIMATIC PCS 7 V8.0 and earlier · Siemens AG S… +2)
- [CVE-2019-10924](https://cve.now/CVE-2019-10924.md): A vulnerability has been identified in LOGO! Soft Comfort (All versions \< V8.3). (no CVSS, Siemens LOGO! Soft Comfort)
- [CVE-2019-6572](https://cve.now/CVE-2019-6572.md): A vulnerability has been identified in SIMATIC HMI Comfort Panels 4" - 22" (All versions \< V15.1 Update 1), SIMATIC HMI Comfort Outdoor Pane (no CVSS, Siemens AG SIMATIC HMI Comfort Panels 4" - 22" · Siemens… +5)
- [CVE-2019-6574](https://cve.now/CVE-2019-6574.md): A vulnerability has been identified in SINAMICS PERFECT HARMONY GH180 with NXG I control, MLFBs: 6SR2...-, 6SR3...-, 6SR4...- (All Versions (no CVSS, Siemens AG SINAMICS PERFECT HARMONY GH180 with NXG I contro…)
- [CVE-2019-6576](https://cve.now/CVE-2019-6576.md): A vulnerability has been identified in SIMATIC HMI Comfort Panels 4" - 22" (All versions \< V15.1 Update 1), SIMATIC HMI Comfort Outdoor Pane (CVSS 6.5, Siemens AG SIMATIC HMI Comfort Panels 4" - 22" · Siemens… +5)
- [CVE-2019-6577](https://cve.now/CVE-2019-6577.md): A vulnerability has been identified in SIMATIC HMI Comfort Panels 4" - 22" (All versions \< V15.1 Update 1), SIMATIC HMI Comfort Outdoor Pane (no CVSS, Siemens AG SIMATIC HMI Comfort Panels 4" - 22" · Siemens… +5)
- [CVE-2019-6578](https://cve.now/CVE-2019-6578.md): A vulnerability has been identified in SINAMICS PERFECT HARMONY GH180 with NXG I control, MLFBs: 6SR2...-, 6SR3...-, 6SR4...- (All Versions (no CVSS, Siemens AG SINAMICS PERFECT HARMONY GH180 with NXG I contro…)
- [CVE-2019-3568](https://cve.now/CVE-2019-3568.md): A buffer overflow vulnerability in WhatsApp VOIP stack allowed remote code execution via specially crafted series of RTCP packets sent to a (CVSS 9.8, KEV, Facebook WhatsApp for Android · Facebook WhatsApp Busine… +4)
- [CVE-2019-8978](https://cve.now/CVE-2019-8978.md): An improper authentication vulnerability can be exploited through a race condition that occurs in Ellucian Banner Web Tailor 8.8.3, 8.8.4, a (no CVSS)
- [CVE-2018-6885](https://cve.now/CVE-2018-6885.md): An issue was discovered in MicroStrategy Web Services (the Microsoft Office plugin) before 10.4 Hotfix 7, and before 10.11. (no CVSS)
- [CVE-2018-8940](https://cve.now/CVE-2018-8940.md): ClientServiceConfigController.cs in Enghouse Cloud Contact Center Platform 7.2.5 has functionality for loading external XML files and parsin (no CVSS)
- [CVE-2019-11419](https://cve.now/CVE-2019-11419.md): vcodec2\_hls\_filter in libvoipCodec\_v7a.so in the WeChat application through 7.0.3 for Android allows attackers to cause a denial of service (no CVSS)
- [CVE-2019-11844](https://cve.now/CVE-2019-11844.md): An HTML Injection vulnerability has been discovered on the RICOH SP 4520DN via the /web/entry/en/address/adrsSetUserWizard.cgi entryNameIn o (no CVSS)
- [CVE-2019-11845](https://cve.now/CVE-2019-11845.md): An HTML Injection vulnerability has been discovered on the RICOH SP 4510DN via the /web/entry/en/address/adrsSetUserWizard.cgi entryNameIn p (no CVSS)
- [CVE-2019-11846](https://cve.now/CVE-2019-11846.md): /servlets/ajax\_file\_upload?fieldName=binary3 in dotCMS 5.1.1 allows XSS and HTML Injection. (no CVSS)
- [CVE-2019-9861](https://cve.now/CVE-2019-9861.md): Due to the use of an insecure RFID technology (MIFARE Classic), ABUS proximity chip keys (RFID tokens) of the ABUS Secvest FUAA50000 wireles (no CVSS)
- [CVE-2019-8923](https://cve.now/CVE-2019-8923.md): XAMPP through 5.6.8 and previous allows SQL injection via the cds-fpdf.php jahr parameter. (no CVSS)
- [CVE-2019-8404](https://cve.now/CVE-2019-8404.md): An issue was discovered in Webiness Inventory 2.3. (no CVSS)
- [CVE-2018-11691](https://cve.now/CVE-2018-11691.md): Emerson DeltaV Smart Switch Command Center application, available in versions 11.3.x and 12.3.1, was unable to change the DeltaV Smart Switc (no CVSS)
- [CVE-2019-8391](https://cve.now/CVE-2019-8391.md): qdPM 9.1 suffers from Cross-site Scripting (XSS) via configuration?type=\[XSS\] parameter. (no CVSS)
- [CVE-2019-8390](https://cve.now/CVE-2019-8390.md): qdPM 9.1 suffers from Cross-site Scripting (XSS) in the search\[keywords\] parameter. (no CVSS)
- [CVE-2019-6516](https://cve.now/CVE-2019-6516.md): An issue was discovered in WSO2 Dashboard Server 2.0.0. (no CVSS)
- [CVE-2019-6515](https://cve.now/CVE-2019-6515.md): An issue was discovered in WSO2 API Manager 2.6.0. (no CVSS)
- [CVE-2019-6514](https://cve.now/CVE-2019-6514.md): An issue was discovered in WSO2 Dashboard Server 2.0.0. (no CVSS)
- [CVE-2019-6512](https://cve.now/CVE-2019-6512.md): An issue was discovered in WSO2 API Manager 2.6.0. (no CVSS)
- [CVE-2018-18800](https://cve.now/CVE-2018-18800.md): The Tubigan "Welcome to our Resort" 1.0 software allows SQL Injection via index.php?p=accomodation&q=\[SQL\], index.php?p=rooms&q=\[SQL\], or ad (no CVSS)
- [CVE-2019-11336](https://cve.now/CVE-2019-11336.md): Sony Bravia Smart TV devices allow remote attackers to retrieve the static Wi-Fi password (used when the TV is acting as an access point) by (no CVSS)
- [CVE-2019-12087](https://cve.now/CVE-2019-12087.md): Samsung S9+, S10, and XCover 4 P(9.0) devices can become temporarily inoperable because of an unprotected intent in the ContainerAgent appli (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2019-05-14
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.