CVEs published May 29, 2019
48 CVEs were published on May 29, 2019: 3 critical, 3 high. 2 are now in CISA KEV.
- Published
- 48
- Critical
- 3
- High
- 3
- Medium
- 11
- Low
- 0
- Unrated
- 31
- Now in CISA KEV
- 2
- Fix available
- 7
Most affected products
- Bosch Smart Home Controller
- 6
- HP Z4 G4 Workstation · HP Z4 G4 Core-X Workstation +2
- 2
- IBM Spectrum Control Standard Edition
- 2
- Adobe Experience Manager Forms
- 1
- Fortinet FortiOS
- 1
- Fortinet FortiOS and FortiProxy
- 1
- github.com/traefik/traefik
- 1
- IBM API Connect
- 1
- IBM Cognos Analytics
- 1
- IBM Jazz Reporting Service
- 1
Critical 3
- CVE-2019-9670mailboxd component in Synacor Zimbra Collaboration Suite 8.7.x before 8.7.11p10 has an XML External Entity injection (XXE) vulnerability, as
- CVE-2019-6957Buffer Overflow for Bosch Video Systems, PSIM and Access Control Systems
- CVE-2019-6958Improper Access Control for Bosch Video Systems, PSIM and Access Control Systems
High 3
- CVE-2019-11892Improper access control in the JSON-RPC interface of the Bosch Smart Home Controller (SHC)Bosch Smart Home Controller
- CVE-2019-11891Incorrect privilege assignment in the app pairing mechanism of the Bosch Smart Home Controller (SHC)Bosch Smart Home Controller
- CVE-2019-12439bubblewrap.c in Bubblewrap before 0.3.3 misuses temporary directories in /tmp as a mount point.
Medium, low and unrated 42
- CVE-2018-18631mailboxd component in Synacor Zimbra Collaboration Suite 8.6, 8.7 before 8.7.11 Patch 7, and 8.8 before 8.8.10 Patch 2 has Persistent XSS.
- CVE-2018-14013Synacor Zimbra Collaboration Suite Collaboration before 8.8.11 has XSS in the AJAX and html web clients.
- CVE-2019-6981Zimbra Collaboration Suite 8.7.x through 8.8.11 allows Blind SSRF in the Feed component.
- CVE-2018-20160ZxChat (aka ZeXtras Chat), as used for zimbra-chat and zimbra-talk in Synacor Zimbra Collaboration Suite 8.7 and 8.8 and in other products,
- CVE-2019-6980Synacor Zimbra Collaboration Suite 8.7.x through 8.8.11 allows insecure object deserialization in the IMAP component.
- CVE-2018-13365An Information Exposure vulnerability in Fortinet FortiOS 6.0.1, 5.6.5 and below, allow attackers to learn private IP as well as the hostnamFortinet FortiOS
- CVE-2019-11896Incorrect pviilege assignment in the 3rd party pairing mechanism of the Bosch Smart Home Controller (SHC)Bosch Smart Home Controller
- CVE-2019-11895Improper access control in the JSON-RPC interface of the Bosch Smart Home Controller (SHC)Bosch Smart Home Controller
- CVE-2019-11894Improper access control in the backup mechanism of the Bosch Smart Home Controller (SHC)Bosch Smart Home Controller
- CVE-2019-11893Incorrect privilege assignment in the app permission update API of the Bosch Smart Home Controller (SHC)Bosch Smart Home Controller
- CVE-2019-6322HP has identified a security vulnerability with some versions of Workstation BIOS (UEFI Firmware) where the runtime BIOS code could be tampeHP Z4 G4 Workstation · HP Z4 G4 Core-X Workstation +2
- CVE-2019-6321HP has identified a security vulnerability with some versions of Workstation BIOS (UEFI Firmware) where the runtime BIOS code could be tampeHP Z4 G4 Workstation · HP Z4 G4 Core-X Workstation +2
- CVE-2019-12452types/types.go in Containous Traefik 1.7.x through 1.7.11, when the --api flag is used and the API is publicly reachable and exposed withoutgithub.com/traefik/traefik
- CVE-2019-12347In pfSense 2.4.4-p3, a stored XSS vulnerability occurs when attackers inject a payload into the Name or Description field via an acme_accoun
- CVE-2019-11872The Hustle (aka wordpress-popup) plugin 6.0.7 for WordPress is vulnerable to CSV Injection as it allows for injecting malicious code into a
- CVE-2018-16221The diagnostics web interface in the Yeahlink Ultra-elegant IP Phone SIP-T41P (firmware 66.83.0.35) does not validate (escape) the path info
- CVE-2018-16218A CSRF (Cross Site Request Forgery) in the web interface of the Yeahlink Ultra-elegant IP Phone SIP-T41P firmware version 66.83.0.35 allows
- CVE-2018-16217The network diagnostic function (ping) in the Yeahlink Ultra-elegant IP Phone SIP-T41P (firmware 66.83.0.35) allows a remote authenticated a
- CVE-2019-7129Adobe Experience Manager Forms versions 6.2, 6.3 and 6.4 have a stored cross-site scripting vulnerability.Adobe Experience Manager Forms
- CVE-2018-19978A buffer overflow vulnerability in the DHCP and PPPOE configuration interface of the Auerswald COMfort 1200 IP phone 3.4.4.1-10589 allows a
- CVE-2018-13383A heap buffer overflow in Fortinet FortiOS 6.0.0 through 6.0.4, 5.6.0 through 5.6.10, 5.4.0 through 5.4.12, 5.2.14 and earlier and FortiProxFortinet FortiOS and FortiProxy
- CVE-2018-19977A command injection (missing input validation, escaping) in the ftp upgrade configuration interface on the Auerswald COMfort 1200 IP phone 3
- CVE-2019-12165MiCollab 7.3 PR2 (7.3.0.204) and earlier, 7.2 (7.2.2.13) and earlier, and 7.1 (7.1.0.57) and earlier and MiCollab AWV 6.3 (6.3.0.103), 6.2 (
- CVE-2019-9865When RPC is enabled in Wind River VxWorks 6.9 prior to 6.9.1, a specially crafted RPC request can trigger an integer overflow leading to an
- CVE-2019-9866An issue was discovered in GitLab Community and Enterprise Edition 11.x before 11.7.7 and 11.8.x before 11.8.3.
- CVE-2019-9858Remote code execution was discovered in Horde Groupware Webmail 5.2.22 and 5.2.17.
- CVE-2019-9732An issue was discovered in GitLab Community and Enterprise Edition 10.x (starting from 10.8) and 11.x before 11.6.10, 11.7.x before 11.7.6,
- CVE-2019-12450file_copy_fallback in gio/gfile.c in GNOME GLib 2.15.0 through 2.61.1 does not properly restrict file permissions while a copy operation is
- CVE-2019-12449An issue was discovered in GNOME gvfs 1.29.4 through 1.41.2.
- CVE-2019-12448An issue was discovered in GNOME gvfs 1.29.4 through 1.41.2.
- CVE-2019-12447An issue was discovered in GNOME gvfs 1.29.4 through 1.41.2.
- CVE-2019-9485An issue was discovered in GitLab Community and Enterprise Edition before 11.6.10, 11.7.x before 11.7.6, and 11.8.x before 11.8.1.
- CVE-2019-9221An issue was discovered in GitLab Community and Enterprise Edition before 11.6.10, 11.7.x before 11.7.6, and 11.8.x before 11.8.1.
- CVE-2019-9218An issue was discovered in GitLab Community and Enterprise Edition before 11.6.10, 11.7.x before 11.7.6, and 11.8.x before 11.8.1.
- CVE-2019-7549An issue was discovered in GitLab Community and Enterprise Edition 10.x and 11.x before 11.5.10, 11.6.x before 11.6.8, and 11.7.x before 11.
- CVE-2019-4264IBM QRadar SIEM 7.2.8 WinCollect could allow an attacker to obtain sensitive information by spoofing a trusted entity using man in the middlIBM QRadar SIEM
- CVE-2019-4256IBM API Connect 5.0.0.0 through 5.0.8.6 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly seIBM API Connect
- CVE-2019-4184IBM Jazz Reporting Service 6.0 through 6.0.6.1 is vulnerable to cross-site scripting.IBM Jazz Reporting Service
- CVE-2019-4139IBM Cognos Analytics 11.0, 11.1.0, and 11.1.1 is vulnerable to cross-site scripting.IBM Cognos Analytics
- CVE-2019-4138IBM Tivoli Storage Productivity Center 5.2.13 through 5.3.0.1 could allow a remote attacker to obtain sensitive information, caused by the fIBM Spectrum Control Standard Edition
- CVE-2019-4137IBM Tivoli Storage Productivity Center 5.2.13 through 5.3.0.1 is vulnerable to cross-site scripting.IBM Spectrum Control Standard Edition
- CVE-2019-12440The Sitecore Rocks plugin before 2.1.149 for Sitecore allows an unauthenticated threat actor to inject malicious commands and code via the S