# CVEs published 2019-05-31

36 CVEs were published on May 31, 2019: 1 critical, 1 high. 2 are now in CISA KEV. Days are UTC.

- [CVE-2019-10123](https://cve.now/CVE-2019-10123.md): SQL Injection in Advanced InfoData Systems (AIS) ESEL-Server 67 (which is the backend for the AIS logistics mobile app) allows an anonymous (no CVSS)
- [CVE-2018-20815](https://cve.now/CVE-2018-20815.md): In QEMU 3.1.0, load\_device\_tree in device\_tree.c calls the deprecated load\_image function, which has a buffer overflow risk. (no CVSS)
- [CVE-2019-10069](https://cve.now/CVE-2019-10069.md): In Godot through 3.1, remote code execution is possible due to the deserialization policy not being applied correctly. (no CVSS)
- [CVE-2019-9653](https://cve.now/CVE-2019-9653.md): NUUO Network Video Recorder Firmware 1.7.x through 3.3.x allows unauthenticated attackers to execute arbitrary commands via shell metacharac (no CVSS)
- [CVE-2019-6725](https://cve.now/CVE-2019-6725.md): The rpWLANRedirect.asp ASP page is accessible without authentication on ZyXEL P-660HN-T1 V2 (2.00(AAKK.3)) devices. (no CVSS)
- [CVE-2019-9106](https://cve.now/CVE-2019-9106.md): The WebApp v04.68 in the supervisor on SAET Impianti Speciali TEBE Small 05.01 build 1137 devices allows remote attackers to execute or incl (no CVSS)
- [CVE-2019-9105](https://cve.now/CVE-2019-9105.md): The WebApp v04.68 in the supervisor on SAET Impianti Speciali TEBE Small 05.01 build 1137 devices allows remote attackers to make several ty (no CVSS)
- [CVE-2019-10049](https://cve.now/CVE-2019-10049.md): It is possible for an attacker with regular user access to the web application of Pydio through 8.2.2 to trick an administrator user into op (no CVSS)
- [CVE-2019-10048](https://cve.now/CVE-2019-10048.md): The ImageMagick plugin that is installed by default in Pydio through 8.2.2 does not perform the appropriate validation and sanitization of u (no CVSS)
- [CVE-2019-10047](https://cve.now/CVE-2019-10047.md): A stored XSS vulnerability exists in the web application of Pydio through 8.2.2 that can be exploited by levering the file upload and file p (no CVSS, pydio)
- [CVE-2019-5678](https://cve.now/CVE-2019-5678.md): NVIDIA GeForce Experience versions prior to 3.19 contains a vulnerability in the Web Helper component, in which an attacker with local syste (no CVSS, NVIDIA GeForce Experience)
- [CVE-2019-10046](https://cve.now/CVE-2019-10046.md): An unauthenticated attacker can obtain information about the Pydio 8.2.2 configuration including session timeout, libraries, and license inf (no CVSS)
- [CVE-2019-10045](https://cve.now/CVE-2019-10045.md): The "action" get\_sess\_id in the web application of Pydio through 8.2.2 discloses the session cookie value in the response body, enabling scr (no CVSS)
- [CVE-2019-10038](https://cve.now/CVE-2019-10038.md): Evernote 7.9 on macOS allows attackers to execute arbitrary programs by embedding a reference to a local executable file such as the /Applic (no CVSS)
- [CVE-2019-10981](https://cve.now/CVE-2019-10981.md): In Vijeo Citect 7.30 and 7.40, and CitectSCADA 7.30 and 7.40, a vulnerability has been identified that may allow an authenticated local user (no CVSS, AVEVA Vijeo Citect and CitectSCADA)
- [CVE-2019-9891](https://cve.now/CVE-2019-9891.md): The function getopt\_simple as described in Advanced Bash Scripting Guide (ISBN 978-1435752184) allows privilege escalation and execution of (no CVSS)
- [CVE-2019-9875](https://cve.now/CVE-2019-9875.md): Deserialization of Untrusted Data in the anti CSRF module in Sitecore through 9.1 allows an authenticated attacker to execute arbitrary code (CVSS 8.8, KEV)
- [CVE-2019-9874](https://cve.now/CVE-2019-9874.md): Deserialization of Untrusted Data in the Sitecore.Security.AntiCSRF (aka anti CSRF) module in Sitecore CMS 7.0 to 7.2 and Sitecore XP 7.5 to (CVSS 9.8, KEV)
- [CVE-2019-9871](https://cve.now/CVE-2019-9871.md): Jector Smart TV FM-K75 devices allow remote code execution because there is an adb open port with root permission. (no CVSS)
- [CVE-2019-10321](https://cve.now/CVE-2019-10321.md): A cross-site request forgery vulnerability in Jenkins Artifactory Plugin 3.2.2 and earlier in ArtifactoryBuilder.DescriptorImpl#doTestConnec (no CVSS, Jenkins project Jenkins Artifactory Plugin · org.jenkins-ci…)
- [CVE-2019-10322](https://cve.now/CVE-2019-10322.md): A missing permission check in Jenkins Artifactory Plugin 3.2.2 and earlier in ArtifactoryBuilder.DescriptorImpl#doTestConnection allowed use (no CVSS, Jenkins project Jenkins Artifactory Plugin · org.jenkins-ci…)
- [CVE-2019-10323](https://cve.now/CVE-2019-10323.md): A missing permission check in Jenkins Artifactory Plugin 3.2.3 and earlier in various 'fillCredentialsIdItems' methods allowed users with Ov (no CVSS, Jenkins project Jenkins Artifactory Plugin · org.jenkins-ci…)
- [CVE-2019-10324](https://cve.now/CVE-2019-10324.md): A cross-site request forgery vulnerability in Jenkins Artifactory Plugin 3.2.2 and earlier in ReleaseAction#doSubmit, GradleReleaseApiAction (no CVSS, Jenkins project Jenkins Artifactory Plugin · org.jenkins-ci…)
- [CVE-2019-10325](https://cve.now/CVE-2019-10325.md): A cross-site scripting vulnerability in Jenkins Warnings NG Plugin 5.0.0 and earlier allowed attacker with Job/Configure permission to injec (no CVSS, Jenkins project Jenkins Warnings NG Plugin · io.jenkins.plu…)
- [CVE-2019-10326](https://cve.now/CVE-2019-10326.md): A cross-site request forgery vulnerability in Jenkins Warnings NG Plugin 5.0.0 and earlier allowed attackers to reset warning counts for fut (no CVSS, Jenkins project Jenkins Warnings NG Plugin · io.jenkins.plu…)
- [CVE-2019-10327](https://cve.now/CVE-2019-10327.md): An XML external entities (XXE) vulnerability in Jenkins Pipeline Maven Integration Plugin 1.7.0 and earlier allowed attackers able to contro (no CVSS, Jenkins project Jenkins Pipeline Maven Integration Plugin ·…)
- [CVE-2019-10328](https://cve.now/CVE-2019-10328.md): Jenkins Pipeline Remote Loader Plugin 1.4 and earlier provided a custom whitelist for script security that allowed attackers to invoke arbit (no CVSS, Jenkins project Jenkins Pipeline Remote Loader Plugin · org…)
- [CVE-2019-10329](https://cve.now/CVE-2019-10329.md): Jenkins InfluxDB Plugin 1.21 and earlier stored credentials unencrypted in its global configuration file on the Jenkins master where they ca (no CVSS, Jenkins project Jenkins InfluxDB Plugin · org.jenkins-ci.pl…)
- [CVE-2019-10330](https://cve.now/CVE-2019-10330.md): Jenkins Gitea Plugin 1.1.1 and earlier did not implement trusted revisions, allowing attackers without commit access to the Git repo to chan (no CVSS, Jenkins project Jenkins Gitea Plugin · org.jenkins-ci.plugi…)
- [CVE-2019-12507](https://cve.now/CVE-2019-12507.md): An XSS vulnerability exists in PHPRelativePath (aka Relative Path) through 1.0.2 via the RelativePath.Example1.php path parameter. (no CVSS)
- [CVE-2019-12502](https://cve.now/CVE-2019-12502.md): There is a lack of CSRF countermeasures on MOBOTIX S14 MX-V4.2.1.61 cameras, as demonstrated by adding an admin account via the /admin/acces (no CVSS)
- [CVE-2019-12500](https://cve.now/CVE-2019-12500.md): The Xiaomi M365 scooter 2019-02-12 before 1.5.1 allows spoofing of "suddenly accelerate" commands. (no CVSS)
- [CVE-2019-12499](https://cve.now/CVE-2019-12499.md): Firejail before 0.9.60 allows truncation (resizing to length 0) of the firejail binary on the host by running exploit code inside a firejail (no CVSS)
- [CVE-2019-12496](https://cve.now/CVE-2019-12496.md): An issue was discovered in Hybrid Group Gobot before 1.13.0. (no CVSS, github.com/hybridgroup/gobot)
- [CVE-2019-12495](https://cve.now/CVE-2019-12495.md): An issue was discovered in Tiny C Compiler (aka TinyCC or TCC) 0.9.27. (no CVSS)
- [CVE-2019-12493](https://cve.now/CVE-2019-12493.md): A stack-based buffer over-read exists in PostScriptFunction::transform in Function.cc in Xpdf 4.01.01 because GfxSeparationColorSpace and Gf (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2019-05-31
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.