CVEs published May 31, 2019
36 CVEs were published on May 31, 2019: 1 critical, 1 high. 2 are now in CISA KEV.
- Published
- 36
- Critical
- 1
- High
- 1
- Medium
- 0
- Low
- 0
- Unrated
- 34
- Now in CISA KEV
- 2
- Fix available
- 8
Most affected products
- Jenkins project Jenkins Artifactory Plugin · org.jenkins-ci…
- 4
- Jenkins project Jenkins Warnings NG Plugin · io.jenkins.plu…
- 2
- AVEVA Vijeo Citect and CitectSCADA
- 1
- github.com/hybridgroup/gobot
- 1
- Jenkins project Jenkins Gitea Plugin · org.jenkins-ci.plugi…
- 1
- Jenkins project Jenkins InfluxDB Plugin · org.jenkins-ci.pl…
- 1
- Jenkins project Jenkins Pipeline Maven Integration Plugin ·…
- 1
- Jenkins project Jenkins Pipeline Remote Loader Plugin · org…
- 1
- NVIDIA GeForce Experience
- 1
- pydio
- 1
Critical 1
High 1
Medium, low and unrated 34
- CVE-2019-10123SQL Injection in Advanced InfoData Systems (AIS) ESEL-Server 67 (which is the backend for the AIS logistics mobile app) allows an anonymous
- CVE-2018-20815In QEMU 3.1.0, load_device_tree in device_tree.c calls the deprecated load_image function, which has a buffer overflow risk.
- CVE-2019-10069In Godot through 3.1, remote code execution is possible due to the deserialization policy not being applied correctly.
- CVE-2019-9653NUUO Network Video Recorder Firmware 1.7.x through 3.3.x allows unauthenticated attackers to execute arbitrary commands via shell metacharac
- CVE-2019-6725The rpWLANRedirect.asp ASP page is accessible without authentication on ZyXEL P-660HN-T1 V2 (2.00(AAKK.3)) devices.
- CVE-2019-9106The WebApp v04.68 in the supervisor on SAET Impianti Speciali TEBE Small 05.01 build 1137 devices allows remote attackers to execute or incl
- CVE-2019-9105The WebApp v04.68 in the supervisor on SAET Impianti Speciali TEBE Small 05.01 build 1137 devices allows remote attackers to make several ty
- CVE-2019-10049It is possible for an attacker with regular user access to the web application of Pydio through 8.2.2 to trick an administrator user into op
- CVE-2019-10048The ImageMagick plugin that is installed by default in Pydio through 8.2.2 does not perform the appropriate validation and sanitization of u
- CVE-2019-10047A stored XSS vulnerability exists in the web application of Pydio through 8.2.2 that can be exploited by levering the file upload and file ppydio
- CVE-2019-5678NVIDIA GeForce Experience versions prior to 3.19 contains a vulnerability in the Web Helper component, in which an attacker with local systeNVIDIA GeForce Experience
- CVE-2019-10046An unauthenticated attacker can obtain information about the Pydio 8.2.2 configuration including session timeout, libraries, and license inf
- CVE-2019-10045The "action" get_sess_id in the web application of Pydio through 8.2.2 discloses the session cookie value in the response body, enabling scr
- CVE-2019-10038Evernote 7.9 on macOS allows attackers to execute arbitrary programs by embedding a reference to a local executable file such as the /Applic
- CVE-2019-10981In Vijeo Citect 7.30 and 7.40, and CitectSCADA 7.30 and 7.40, a vulnerability has been identified that may allow an authenticated local userAVEVA Vijeo Citect and CitectSCADA
- CVE-2019-9891The function getopt_simple as described in Advanced Bash Scripting Guide (ISBN 978-1435752184) allows privilege escalation and execution of
- CVE-2019-9871Jector Smart TV FM-K75 devices allow remote code execution because there is an adb open port with root permission.
- CVE-2019-10321A cross-site request forgery vulnerability in Jenkins Artifactory Plugin 3.2.2 and earlier in ArtifactoryBuilder.DescriptorImpl#doTestConnecJenkins project Jenkins Artifactory Plugin · org.jenkins-ci…
- CVE-2019-10322A missing permission check in Jenkins Artifactory Plugin 3.2.2 and earlier in ArtifactoryBuilder.DescriptorImpl#doTestConnection allowed useJenkins project Jenkins Artifactory Plugin · org.jenkins-ci…
- CVE-2019-10323A missing permission check in Jenkins Artifactory Plugin 3.2.3 and earlier in various 'fillCredentialsIdItems' methods allowed users with OvJenkins project Jenkins Artifactory Plugin · org.jenkins-ci…
- CVE-2019-10324A cross-site request forgery vulnerability in Jenkins Artifactory Plugin 3.2.2 and earlier in ReleaseAction#doSubmit, GradleReleaseApiActionJenkins project Jenkins Artifactory Plugin · org.jenkins-ci…
- CVE-2019-10325A cross-site scripting vulnerability in Jenkins Warnings NG Plugin 5.0.0 and earlier allowed attacker with Job/Configure permission to injecJenkins project Jenkins Warnings NG Plugin · io.jenkins.plu…
- CVE-2019-10326A cross-site request forgery vulnerability in Jenkins Warnings NG Plugin 5.0.0 and earlier allowed attackers to reset warning counts for futJenkins project Jenkins Warnings NG Plugin · io.jenkins.plu…
- CVE-2019-10327An XML external entities (XXE) vulnerability in Jenkins Pipeline Maven Integration Plugin 1.7.0 and earlier allowed attackers able to controJenkins project Jenkins Pipeline Maven Integration Plugin ·…
- CVE-2019-10328Jenkins Pipeline Remote Loader Plugin 1.4 and earlier provided a custom whitelist for script security that allowed attackers to invoke arbitJenkins project Jenkins Pipeline Remote Loader Plugin · org…
- CVE-2019-10329Jenkins InfluxDB Plugin 1.21 and earlier stored credentials unencrypted in its global configuration file on the Jenkins master where they caJenkins project Jenkins InfluxDB Plugin · org.jenkins-ci.pl…
- CVE-2019-10330Jenkins Gitea Plugin 1.1.1 and earlier did not implement trusted revisions, allowing attackers without commit access to the Git repo to chanJenkins project Jenkins Gitea Plugin · org.jenkins-ci.plugi…
- CVE-2019-12507An XSS vulnerability exists in PHPRelativePath (aka Relative Path) through 1.0.2 via the RelativePath.Example1.php path parameter.
- CVE-2019-12502There is a lack of CSRF countermeasures on MOBOTIX S14 MX-V4.2.1.61 cameras, as demonstrated by adding an admin account via the /admin/acces
- CVE-2019-12500The Xiaomi M365 scooter 2019-02-12 before 1.5.1 allows spoofing of "suddenly accelerate" commands.
- CVE-2019-12499Firejail before 0.9.60 allows truncation (resizing to length 0) of the firejail binary on the host by running exploit code inside a firejail
- CVE-2019-12496An issue was discovered in Hybrid Group Gobot before 1.13.0.github.com/hybridgroup/gobot
- CVE-2019-12495An issue was discovered in Tiny C Compiler (aka TinyCC or TCC) 0.9.27.
- CVE-2019-12493A stack-based buffer over-read exists in PostScriptFunction::transform in Function.cc in Xpdf 4.01.01 because GfxSeparationColorSpace and Gf