CVEs published June 3, 2019
91 CVEs were published on June 3, 2019: 6 critical, 28 high. 1 is now in CISA KEV.
- Published
- 91
- Critical
- 6
- High
- 28
- Medium
- 5
- Low
- 12
- Unrated
- 40
- Now in CISA KEV
- 1
- Fix available
- 12
Most affected products
- Foxit Reader
- 18
- Foxit Studio Photo
- 6
- Foxit PhantomPDF
- 4
- [UNKNOWN] rkt
- 3
- Bitdefender SafePay
- 3
- Quest Kace K1000 Appliance
- 3
- Samsung Galaxy S9
- 3
- OAKlouds MailSherlock MSR35 · OAKlouds MailSherlock MSR45
- 2
- Atlassian Bitbucket Data Center
- 1
- Atlassian Crowd
- 1
Critical 6
- CVE-2017-14854A stack buffer overflow exists in one of the Orpak SiteOmat CGI components, allowing for remote code execution.
- CVE-2017-14851A SQL injection vulnerability exists in all Orpak SiteOmat versions prior to 2017-09-25.
- CVE-2017-14728An authentication bypass was found in an unknown area of the SiteOmat source code.
- CVE-2019-6740This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Samsung Galaxy S9 prior to January 2019 Samsung Galaxy S9
- CVE-2019-6742This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Samsung Galaxy S9 prior to 1.4.20.2.Samsung Galaxy S9
- CVE-2019-11580Atlassian Crowd and Crowd Data Center had the pdkinstall development plugin incorrectly enabled in release builds.Atlassian Crowd
High 28
- CVE-2017-14853The Orpak SiteOmat OrCU component is vulnerable to code injection, for all versions prior to 2017-09-25, due to a search query that uses a d
- CVE-2017-14852An insecure communication was found between a user and the Orpak SiteOmat management console for all known versions, due to an invalid SSL c
- CVE-2019-3846A flaw that allowed an attacker to corrupt memory and possibly escalate privileges was found in the mwifiex kernel module while connecting tkernel
- CVE-2019-10145rkt through version 1.30.0 does not isolate processes in containers that are run with `rkt enter`.[UNKNOWN] rkt
- CVE-2019-10144rkt through version 1.30.0 does not isolate processes in containers that are run with `rkt enter`.[UNKNOWN] rkt
- CVE-2019-6743This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Xiaomi Mi6 Browser prior to 10.4.0.Xiaomi Browser
- CVE-2019-6757This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 9.4.16811.Foxit Reader
- CVE-2019-6759This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 9.3.10826.Foxit Reader
- CVE-2019-6760This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 9.4.16811.Foxit Reader
- CVE-2019-6761This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 9.4.0.16811.Foxit Reader
- CVE-2019-6762This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit PhantomPDF 9.4.1.16828.Foxit PhantomPDF
- CVE-2019-6763This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 9.4.1.16828.Foxit Reader
- CVE-2019-6764This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 9.4.1.16828.Foxit Reader
- CVE-2019-6765This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit PhantomPDF 9.4.1.16828.Foxit PhantomPDF
- CVE-2019-6767This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 9.4.1.16828.Foxit Reader
- CVE-2019-6768This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 9.4.1.16828.Foxit Reader
- CVE-2019-6769This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 9.4.1.16828.Foxit Reader
- CVE-2019-6747This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Studio Photo 3.6.6.Foxit Studio Photo
- CVE-2019-6748This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Studio Photo 3.6.6.Foxit Studio Photo
- CVE-2019-6749This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Studio Photo 3.6.6.Foxit Studio Photo
- CVE-2019-6750This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Studio Photo 3.6.6.Foxit Studio Photo
- CVE-2019-6751This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Studio Photo 3.6.6.779.Foxit Studio Photo
- CVE-2019-6754This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 9.3.10826.Foxit Reader
- CVE-2019-6755This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 9.3.10826.Foxit Reader
- CVE-2019-6739This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Malwarebytes Antimalware 3.6.1.2711.Malwarebytes Antimalware
- CVE-2019-6736This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Bitdefender SafePay 23.0.10.34.Bitdefender SafePay
- CVE-2019-6737This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Bitdefender SafePay 23.0.10.34.Bitdefender SafePay
- CVE-2019-6738This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Bitdefender SafePay 23.0.10.34.Bitdefender SafePay
Medium, low and unrated 57
- CVE-2019-12615An issue was discovered in get_vdev_port_node_info in arch/sparc/kernel/mdesc.c in the Linux kernel through 5.1.6.
- CVE-2019-12614An issue was discovered in dlpar_parse_cc_property in arch/powerpc/platforms/pseries/dlpar.c in the Linux kernel through 5.1.6.
- CVE-2019-10009A Directory Traversal issue was discovered in the Web GUI in Titan FTP Server 2019 Build 3505.
- CVE-2019-9824tcp_emu in slirp/tcp_subr.c (aka slirp/src/tcp_subr.c) in QEMU 3.0.0 uses uninitialized data in an snprintf call, leading to Information dis
- CVE-2019-9838VFront 0.99.5 has stored XSS via the admin/sync_reg_tab.php azzera parameter, which is mishandled during admin/error_log.php rendering.
- CVE-2019-9839VFront 0.99.5 has Reflected XSS via the admin/menu_registri.php descrizione_g parameter or the admin/sync_reg_tab.php azzera parameter.
- CVE-2019-12548Bludit before 3.9.0 allows remote code execution for an authenticated user by uploading a php file while changing the logo through /admin/aj
- CVE-2019-10883Citrix SD-WAN Center 10.2.x before 10.2.1 and NetScaler SD-WAN Center 10.0.x before 10.0.7 allow Command Injection.
- CVE-2019-11185The WP Live Chat Support Pro plugin through 8.0.26 for WordPress contains an arbitrary file upload vulnerability.
- CVE-2019-12097Telerik Fiddler v5.0.20182.28034 doesn't verify the hash of EnableLoopback.exe before running it, which could lead to code execution or loca
- CVE-2019-11367An issue was discovered in AUO Solar Data Recorder before 1.3.0.
- CVE-2019-11368Stored XSS was discovered in AUO Solar Data Recorder before 1.3.0 via the protect/config.htm addr parameter.
- CVE-2019-12169ATutor 2.2.4 allows Arbitrary File Upload and Directory Traversal, resulting in remote code execution via a ".." pathname in a ZIP archive t
- CVE-2019-11369An issue was discovered in Carel pCOWeb prior to B1.2.4.
- CVE-2019-11356The CalDAV feature in httpd in Cyrus IMAP 2.5.x through 2.5.12 and 3.0.x through 3.0.9 allows remote attackers to execute arbitrary code via
- CVE-2019-11370Stored XSS was discovered in Carel pCOWeb prior to B1.2.4, as demonstrated by the config/pw_snmp.html "System contact" field.
- CVE-2019-6588In Liferay Portal before 7.1 CE GA4, an XSS vulnerability exists in the SimpleCaptcha API when custom code passes unsanitized input into thecom.liferay.portal:release.portal.bom
- CVE-2019-11509In Pulse Secure Pulse Connect Secure (PCS) before 8.1R15.1, 8.2 before 8.2R12.1, 8.3 before 8.3R7.1, and 9.0 before 9.0R3.4 and Pulse Policy
- CVE-2019-12373Improper access control and open directories in Ivanti LANDESK Management Suite (LDMS, aka Endpoint Manager) 10.0.1.168 Service Update 5 may
- CVE-2019-12374A SQL Injection vulnerability exists in Ivanti LANDESK Management Suite (LDMS, aka Endpoint Manager) 10.0.1.168 Service Update 5 due to impr
- CVE-2019-12176Privilege escalation in the "HTC Account Service" and "ViveportDesktopService" in HTC VIVEPORT before 1.0.0.36 allows local attackers to esc
- CVE-2019-12375Open directories in Ivanti LANDESK Management Suite (LDMS, aka Endpoint Manager) 10.0.1.168 Service Update 5 may lead to remote information
- CVE-2019-12376Use of a hard-coded encryption key in Ivanti LANDESK Management Suite (LDMS, aka Endpoint Manager) 10.0.1.168 Service Update 5 may lead to f
- CVE-2019-12177Privilege escalation due to insecure directory permissions affecting ViveportDesktopService in HTC VIVEPORT before 1.0.0.36 allows local att
- CVE-2019-12377A vulnerable upl/async_upload.asp web API endpoint in Ivanti LANDESK Management Suite (LDMS, aka Endpoint Manager) 10.0.1.168 Service Update
- CVE-2019-12310ExaGrid appliances with firmware version v4.8.1.1044.P50 have a /monitor/data/Upgrade/ directory traversal vulnerability, which allows remot
- CVE-2017-14850All known versions of the Orpak SiteOmat web management console is vulnerable to multiple instances of Stored Cross-site Scripting due to im
- CVE-2018-5404The Quest Kace K1000 Appliance is vulnerable to multiple Blind SQL Injections.Quest Kace K1000 Appliance
- CVE-2018-5405The Quest Kace K1000 Appliance is vulnerable to JavaScript injection.Quest Kace K1000 Appliance
- CVE-2018-5406The Quest Kace K1000 Appliance misconfigures the Cross-Origin Resource Sharing (CORS) mechanism.Quest Kace K1000 Appliance
- CVE-2019-3567In some configurations an attacker can inject a new executable path into the extensions.load file for osquery and hard link a parent folder Facebook osquery
- CVE-2019-10147rkt through version 1.30.0 does not isolate processes in containers that are run with `rkt enter`.[UNKNOWN] rkt
- CVE-2019-6741This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Samsung Galaxy S9 prior to January 2019 Samsung Galaxy S9
- CVE-2019-6758This vulnerability allows remote attackers to disclose sensitive information on vulnerable installations of Foxit Reader 9.4.16811.Foxit Reader
- CVE-2019-6766This vulnerability allows remote attackers to disclose sensitive information on vulnerable installations of Foxit Reader 9.4.1.16828.Foxit Reader
- CVE-2019-6770This vulnerability allows remote attackers to disclose sensitive information on vulnerable installations of Foxit Reader 9.4.1.16828.Foxit Reader
- CVE-2019-6771This vulnerability allows remote attackers to disclose sensitive information on vulnerable installations of Foxit Reader 2019.010.20098.Foxit Reader
- CVE-2019-6772This vulnerability allows remote attackers to disclose sensitive information on vulnerable installations of Foxit Reader 2019.010.20098.Foxit Reader
- CVE-2019-6773This vulnerability allows remote attackers to disclose sensitive information on vulnerable installations of Foxit Reader 9.4.1.16828.Foxit Reader
- CVE-2019-6746This vulnerability allows remote attackers to disclose sensitive information on vulnerable installations of Foxit Studio Photo 3.6.6.Foxit Studio Photo
- CVE-2019-6752This vulnerability allows remote attackers to disclose sensitive information on vulnerable installations of Foxit PhantomPDF 9.3.10826.Foxit PhantomPDF
- CVE-2019-6753This vulnerability allows remote attackers to disclose sensitive information on vulnerable installations of Foxit Reader 9.3.0.10826.Foxit Reader
- CVE-2019-6756This vulnerability allows remote attackers to disclose sensitive information on vulnerable installations of Foxit PhantomPDF 9.4.0.16811.Foxit PhantomPDF
- CVE-2019-9753An issue was discovered in Open Ticket Request System (OTRS) 7.x before 7.0.5.
- CVE-2019-3895An access-control flaw was found in the Octavia service when the cloud platform was deployed using Red Hat OpenStack Platform Director.Red Hat openstack-tripleo-common · octavia
- CVE-2019-9882Multi modules of MailSherlock MSR35 and MSR45 lead to a CSRF vulnerability. It allows attacker to add malicious email sources into whitelist.OAKlouds MailSherlock MSR35 · OAKlouds MailSherlock MSR45
- CVE-2019-9883Multi modules of MailSherlock MSR35 and MSR45 lead to a CSRF vulnerability. It allows attacker to elevate privilege of specific account.OAKlouds MailSherlock MSR35 · OAKlouds MailSherlock MSR45
- CVE-2019-11646Remote unauthorized command execution and unauthorized disclosure of information in Micro Focus Service Manager, versions 9.30, 9.31, 9.32, Micro Focus Service Manager
- CVE-2019-12593IceWarp Mail Server through 10.4.4 is prone to a local file inclusion vulnerability via webmail/calendar/minimizer/index.php?style=..%5c dir
- CVE-2019-12308An issue was discovered in Django 1.11 before 1.11.21, 2.1 before 2.1.9, and 2.2 before 2.2.2.django
- CVE-2019-3802Additional information exposure with Spring Data JPA example matcherSpring Data JPA · org.springframework.data:spring-data-jpa
- CVE-2019-3397Atlassian Bitbucket Data Center licensed instances starting with version 5.13.0 before 5.13.6 (the fixed version for 5.13.x), from 5.14.0 beAtlassian Bitbucket Data Center
- CVE-2019-12591NETGEAR Insight Cloud with firmware before Insight 5.6 allows remote authenticated users to achieve command injection.
- CVE-2019-12589In Firejail before 0.9.60, seccomp filters are writable inside the jail, leading to a lack of intended seccomp restrictions for a process th
- CVE-2019-12585Apcupsd 0.3.91_5, as used in pfSense through 2.4.4-RELEASE-p3 and other products, has an Arbitrary Command Execution issue in apcupsd_status
- CVE-2019-12584Apcupsd 0.3.91_5, as used in pfSense through 2.4.4-RELEASE-p3 and other products, has an XSS issue in apcupsd_status.php.
- CVE-2019-12569A vulnerability in Viber before 10.7.0 for Desktop (Windows) could allow an attacker to execute arbitrary commands on a targeted system.