# CVEs published 2019-05-29

48 CVEs were published on May 29, 2019: 3 critical, 3 high. 2 are now in CISA KEV. Days are UTC.

- [CVE-2018-18631](https://cve.now/CVE-2018-18631.md): mailboxd component in Synacor Zimbra Collaboration Suite 8.6, 8.7 before 8.7.11 Patch 7, and 8.8 before 8.8.10 Patch 2 has Persistent XSS. (no CVSS)
- [CVE-2018-14013](https://cve.now/CVE-2018-14013.md): Synacor Zimbra Collaboration Suite Collaboration before 8.8.11 has XSS in the AJAX and html web clients. (no CVSS)
- [CVE-2019-6981](https://cve.now/CVE-2019-6981.md): Zimbra Collaboration Suite 8.7.x through 8.8.11 allows Blind SSRF in the Feed component. (no CVSS)
- [CVE-2018-20160](https://cve.now/CVE-2018-20160.md): ZxChat (aka ZeXtras Chat), as used for zimbra-chat and zimbra-talk in Synacor Zimbra Collaboration Suite 8.7 and 8.8 and in other products, (no CVSS)
- [CVE-2019-6980](https://cve.now/CVE-2019-6980.md): Synacor Zimbra Collaboration Suite 8.7.x through 8.8.11 allows insecure object deserialization in the IMAP component. (no CVSS)
- [CVE-2019-9670](https://cve.now/CVE-2019-9670.md): mailboxd component in Synacor Zimbra Collaboration Suite 8.7.x before 8.7.11p10 has an XML External Entity injection (XXE) vulnerability, as (CVSS 9.8, KEV)
- [CVE-2018-13365](https://cve.now/CVE-2018-13365.md): An Information Exposure vulnerability in Fortinet FortiOS 6.0.1, 5.6.5 and below, allow attackers to learn private IP as well as the hostnam (no CVSS, Fortinet FortiOS)
- [CVE-2019-11896](https://cve.now/CVE-2019-11896.md): Incorrect pviilege assignment in the 3rd party pairing mechanism of the Bosch Smart Home Controller (SHC) (CVSS 5.5, Bosch Smart Home Controller)
- [CVE-2019-11895](https://cve.now/CVE-2019-11895.md): Improper access control in the JSON-RPC interface of the Bosch Smart Home Controller (SHC) (CVSS 5.3, Bosch Smart Home Controller)
- [CVE-2019-11894](https://cve.now/CVE-2019-11894.md): Improper access control in the backup mechanism of the Bosch Smart Home Controller (SHC) (CVSS 5.7, Bosch Smart Home Controller)
- [CVE-2019-11893](https://cve.now/CVE-2019-11893.md): Incorrect privilege assignment in the app permission update API of the Bosch Smart Home Controller (SHC) (CVSS 5.5, Bosch Smart Home Controller)
- [CVE-2019-6322](https://cve.now/CVE-2019-6322.md): HP has identified a security vulnerability with some versions of Workstation BIOS (UEFI Firmware) where the runtime BIOS code could be tampe (no CVSS, HP Z4 G4 Workstation · HP Z4 G4 Core-X Workstation +2)
- [CVE-2019-6321](https://cve.now/CVE-2019-6321.md): HP has identified a security vulnerability with some versions of Workstation BIOS (UEFI Firmware) where the runtime BIOS code could be tampe (no CVSS, HP Z4 G4 Workstation · HP Z4 G4 Core-X Workstation +2)
- [CVE-2019-11892](https://cve.now/CVE-2019-11892.md): Improper access control in the JSON-RPC interface of the Bosch Smart Home Controller (SHC) (CVSS 7.5, Bosch Smart Home Controller)
- [CVE-2019-11891](https://cve.now/CVE-2019-11891.md): Incorrect privilege assignment in the app pairing mechanism of the Bosch Smart Home Controller (SHC) (CVSS 8.0, Bosch Smart Home Controller)
- [CVE-2019-6957](https://cve.now/CVE-2019-6957.md): Buffer Overflow for Bosch Video Systems, PSIM and Access Control Systems (CVSS 9.8)
- [CVE-2019-6958](https://cve.now/CVE-2019-6958.md): Improper Access Control for Bosch Video Systems, PSIM and Access Control Systems (CVSS 9.8)
- [CVE-2019-12452](https://cve.now/CVE-2019-12452.md): types/types.go in Containous Traefik 1.7.x through 1.7.11, when the --api flag is used and the API is publicly reachable and exposed without (no CVSS, github.com/traefik/traefik)
- [CVE-2019-12347](https://cve.now/CVE-2019-12347.md): In pfSense 2.4.4-p3, a stored XSS vulnerability occurs when attackers inject a payload into the Name or Description field via an acme\_accoun (no CVSS)
- [CVE-2019-11872](https://cve.now/CVE-2019-11872.md): The Hustle (aka wordpress-popup) plugin 6.0.7 for WordPress is vulnerable to CSV Injection as it allows for injecting malicious code into a (no CVSS)
- [CVE-2018-16221](https://cve.now/CVE-2018-16221.md): The diagnostics web interface in the Yeahlink Ultra-elegant IP Phone SIP-T41P (firmware 66.83.0.35) does not validate (escape) the path info (no CVSS)
- [CVE-2018-16218](https://cve.now/CVE-2018-16218.md): A CSRF (Cross Site Request Forgery) in the web interface of the Yeahlink Ultra-elegant IP Phone SIP-T41P firmware version 66.83.0.35 allows (no CVSS)
- [CVE-2018-16217](https://cve.now/CVE-2018-16217.md): The network diagnostic function (ping) in the Yeahlink Ultra-elegant IP Phone SIP-T41P (firmware 66.83.0.35) allows a remote authenticated a (no CVSS)
- [CVE-2019-7129](https://cve.now/CVE-2019-7129.md): Adobe Experience Manager Forms versions 6.2, 6.3 and 6.4 have a stored cross-site scripting vulnerability. (no CVSS, Adobe Experience Manager Forms)
- [CVE-2018-19978](https://cve.now/CVE-2018-19978.md): A buffer overflow vulnerability in the DHCP and PPPOE configuration interface of the Auerswald COMfort 1200 IP phone 3.4.4.1-10589 allows a (no CVSS)
- [CVE-2018-13383](https://cve.now/CVE-2018-13383.md): A heap buffer overflow in Fortinet FortiOS 6.0.0 through 6.0.4, 5.6.0 through 5.6.10, 5.4.0 through 5.4.12, 5.2.14 and earlier and FortiProx (CVSS 4.3, KEV, Fortinet FortiOS and FortiProxy)
- [CVE-2018-19977](https://cve.now/CVE-2018-19977.md): A command injection (missing input validation, escaping) in the ftp upgrade configuration interface on the Auerswald COMfort 1200 IP phone 3 (no CVSS)
- [CVE-2019-12165](https://cve.now/CVE-2019-12165.md): MiCollab 7.3 PR2 (7.3.0.204) and earlier, 7.2 (7.2.2.13) and earlier, and 7.1 (7.1.0.57) and earlier and MiCollab AWV 6.3 (6.3.0.103), 6.2 ( (no CVSS)
- [CVE-2019-9865](https://cve.now/CVE-2019-9865.md): When RPC is enabled in Wind River VxWorks 6.9 prior to 6.9.1, a specially crafted RPC request can trigger an integer overflow leading to an (no CVSS)
- [CVE-2019-9866](https://cve.now/CVE-2019-9866.md): An issue was discovered in GitLab Community and Enterprise Edition 11.x before 11.7.7 and 11.8.x before 11.8.3. (no CVSS)
- [CVE-2019-9858](https://cve.now/CVE-2019-9858.md): Remote code execution was discovered in Horde Groupware Webmail 5.2.22 and 5.2.17. (no CVSS)
- [CVE-2019-9732](https://cve.now/CVE-2019-9732.md): An issue was discovered in GitLab Community and Enterprise Edition 10.x (starting from 10.8) and 11.x before 11.6.10, 11.7.x before 11.7.6, (no CVSS)
- [CVE-2019-12450](https://cve.now/CVE-2019-12450.md): file\_copy\_fallback in gio/gfile.c in GNOME GLib 2.15.0 through 2.61.1 does not properly restrict file permissions while a copy operation is (no CVSS)
- [CVE-2019-12449](https://cve.now/CVE-2019-12449.md): An issue was discovered in GNOME gvfs 1.29.4 through 1.41.2. (no CVSS)
- [CVE-2019-12448](https://cve.now/CVE-2019-12448.md): An issue was discovered in GNOME gvfs 1.29.4 through 1.41.2. (no CVSS)
- [CVE-2019-12447](https://cve.now/CVE-2019-12447.md): An issue was discovered in GNOME gvfs 1.29.4 through 1.41.2. (no CVSS)
- [CVE-2019-9485](https://cve.now/CVE-2019-9485.md): An issue was discovered in GitLab Community and Enterprise Edition before 11.6.10, 11.7.x before 11.7.6, and 11.8.x before 11.8.1. (no CVSS)
- [CVE-2019-9221](https://cve.now/CVE-2019-9221.md): An issue was discovered in GitLab Community and Enterprise Edition before 11.6.10, 11.7.x before 11.7.6, and 11.8.x before 11.8.1. (no CVSS)
- [CVE-2019-9218](https://cve.now/CVE-2019-9218.md): An issue was discovered in GitLab Community and Enterprise Edition before 11.6.10, 11.7.x before 11.7.6, and 11.8.x before 11.8.1. (no CVSS)
- [CVE-2019-7549](https://cve.now/CVE-2019-7549.md): An issue was discovered in GitLab Community and Enterprise Edition 10.x and 11.x before 11.5.10, 11.6.x before 11.6.8, and 11.7.x before 11. (no CVSS)
- [CVE-2019-4264](https://cve.now/CVE-2019-4264.md): IBM QRadar SIEM 7.2.8 WinCollect could allow an attacker to obtain sensitive information by spoofing a trusted entity using man in the middl (CVSS 5.9, IBM QRadar SIEM)
- [CVE-2019-4256](https://cve.now/CVE-2019-4256.md): IBM API Connect 5.0.0.0 through 5.0.8.6 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly se (CVSS 5.9, IBM API Connect)
- [CVE-2019-4184](https://cve.now/CVE-2019-4184.md): IBM Jazz Reporting Service 6.0 through 6.0.6.1 is vulnerable to cross-site scripting. (CVSS 5.4, IBM Jazz Reporting Service)
- [CVE-2019-4139](https://cve.now/CVE-2019-4139.md): IBM Cognos Analytics 11.0, 11.1.0, and 11.1.1 is vulnerable to cross-site scripting. (CVSS 5.4, IBM Cognos Analytics)
- [CVE-2019-4138](https://cve.now/CVE-2019-4138.md): IBM Tivoli Storage Productivity Center 5.2.13 through 5.3.0.1 could allow a remote attacker to obtain sensitive information, caused by the f (CVSS 5.9, IBM Spectrum Control Standard Edition)
- [CVE-2019-4137](https://cve.now/CVE-2019-4137.md): IBM Tivoli Storage Productivity Center 5.2.13 through 5.3.0.1 is vulnerable to cross-site scripting. (CVSS 6.1, IBM Spectrum Control Standard Edition)
- [CVE-2019-12440](https://cve.now/CVE-2019-12440.md): The Sitecore Rocks plugin before 2.1.149 for Sitecore allows an unauthenticated threat actor to inject malicious commands and code via the S (no CVSS)
- [CVE-2019-12439](https://cve.now/CVE-2019-12439.md): bubblewrap.c in Bubblewrap before 0.3.3 misuses temporary directories in /tmp as a mount point. (CVSS 7.4)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2019-05-29
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.