# CVEs published 2019-05-21

14 CVEs were published on May 21, 2019: 0 critical, 0 high. Days are UTC.

- [CVE-2019-10066](https://cve.now/CVE-2019-10066.md): An issue was discovered in Open Ticket Request System (OTRS) 7.x through 7.0.6, Community Edition 6.0.x through 6.0.17, and OTRSAppointmentC (no CVSS)
- [CVE-2019-9892](https://cve.now/CVE-2019-9892.md): An issue was discovered in Open Ticket Request System (OTRS) 5.x through 5.0.34, 6.x through 6.0.17, and 7.x through 7.0.6. (no CVSS)
- [CVE-2019-10067](https://cve.now/CVE-2019-10067.md): An issue was discovered in Open Ticket Request System (OTRS) 7.x through 7.0.6 and Community Edition 5.0.x through 5.0.35 and 6.0.x through (no CVSS)
- [CVE-2019-6513](https://cve.now/CVE-2019-6513.md): An issue was discovered in WSO2 API Manager 2.6.0. (no CVSS)
- [CVE-2019-12270](https://cve.now/CVE-2019-12270.md): OpenText Brava! Enterprise and Brava! Server 7.5 through 16.4 configure excessive permissions by default on Windows. (no CVSS)
- [CVE-2019-12269](https://cve.now/CVE-2019-12269.md): Enigmail before 2.0.11 allows PGP signature spoofing: for an inline PGP message, an attacker can cause the product to display a "correctly s (no CVSS)
- [CVE-2019-12189](https://cve.now/CVE-2019-12189.md): An issue was discovered in Zoho ManageEngine ServiceDesk Plus 9.3. (no CVSS)
- [CVE-2019-12190](https://cve.now/CVE-2019-12190.md): XSS was discovered in CentOS-WebPanel.com (aka CWP) CentOS Web Panel through 0.9.8.747 via the testacc/fileManager2.php fm\_current\_dir or fi (no CVSS)
- [CVE-2019-12252](https://cve.now/CVE-2019-12252.md): In Zoho ManageEngine ServiceDesk Plus through 10.5, users with the lowest privileges (guest) can view an arbitrary post by appending its num (no CVSS)
- [CVE-2019-12253](https://cve.now/CVE-2019-12253.md): my little forum before 2.4.20 allows CSRF to delete posts, as demonstrated by mode=posting&delete\_posting. (no CVSS)
- [CVE-2019-12251](https://cve.now/CVE-2019-12251.md): sadmin/ceditpost.php in UCMS 1.4.7 allows SQL Injection via the index.php?do=sadmin\_ceditpost cvalue parameter. (no CVSS)
- [CVE-2019-12250](https://cve.now/CVE-2019-12250.md): IdentityServer IdentityServer4 through 2.4 has stored XSS via the httpContext to the host/Extensions/RequestLoggerMiddleware.cs LogForErrorC (no CVSS)
- [CVE-2019-10319](https://cve.now/CVE-2019-10319.md): A missing permission check in Jenkins PAM Authentication Plugin 1.5 and earlier, except 1.4.1 in PamSecurityRealm.DescriptorImpl#doTest allo (no CVSS, Jenkins project Jenkins PAM Authentication Plugin)
- [CVE-2019-10320](https://cve.now/CVE-2019-10320.md): Jenkins Credentials Plugin 2.1.18 and earlier allowed users with permission to create or update credentials to confirm the existence of file (no CVSS, Jenkins project Jenkins Credentials Plugin · org.jenkins-ci…)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2019-05-21
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.