# CVEs published 2019-06-03

91 CVEs were published on June 3, 2019: 6 critical, 28 high. 1 is now in CISA KEV. Days are UTC.

- [CVE-2019-12615](https://cve.now/CVE-2019-12615.md): An issue was discovered in get\_vdev\_port\_node\_info in arch/sparc/kernel/mdesc.c in the Linux kernel through 5.1.6. (no CVSS)
- [CVE-2019-12614](https://cve.now/CVE-2019-12614.md): An issue was discovered in dlpar\_parse\_cc\_property in arch/powerpc/platforms/pseries/dlpar.c in the Linux kernel through 5.1.6. (no CVSS)
- [CVE-2019-10009](https://cve.now/CVE-2019-10009.md): A Directory Traversal issue was discovered in the Web GUI in Titan FTP Server 2019 Build 3505. (no CVSS)
- [CVE-2019-9824](https://cve.now/CVE-2019-9824.md): tcp\_emu in slirp/tcp\_subr.c (aka slirp/src/tcp\_subr.c) in QEMU 3.0.0 uses uninitialized data in an snprintf call, leading to Information dis (no CVSS)
- [CVE-2019-9838](https://cve.now/CVE-2019-9838.md): VFront 0.99.5 has stored XSS via the admin/sync\_reg\_tab.php azzera parameter, which is mishandled during admin/error\_log.php rendering. (no CVSS)
- [CVE-2019-9839](https://cve.now/CVE-2019-9839.md): VFront 0.99.5 has Reflected XSS via the admin/menu\_registri.php descrizione\_g parameter or the admin/sync\_reg\_tab.php azzera parameter. (no CVSS)
- [CVE-2019-12548](https://cve.now/CVE-2019-12548.md): Bludit before 3.9.0 allows remote code execution for an authenticated user by uploading a php file while changing the logo through /admin/aj (no CVSS)
- [CVE-2019-10883](https://cve.now/CVE-2019-10883.md): Citrix SD-WAN Center 10.2.x before 10.2.1 and NetScaler SD-WAN Center 10.0.x before 10.0.7 allow Command Injection. (no CVSS)
- [CVE-2019-11185](https://cve.now/CVE-2019-11185.md): The WP Live Chat Support Pro plugin through 8.0.26 for WordPress contains an arbitrary file upload vulnerability. (no CVSS)
- [CVE-2019-12097](https://cve.now/CVE-2019-12097.md): Telerik Fiddler v5.0.20182.28034 doesn't verify the hash of EnableLoopback.exe before running it, which could lead to code execution or loca (no CVSS)
- [CVE-2019-11367](https://cve.now/CVE-2019-11367.md): An issue was discovered in AUO Solar Data Recorder before 1.3.0. (no CVSS)
- [CVE-2019-11368](https://cve.now/CVE-2019-11368.md): Stored XSS was discovered in AUO Solar Data Recorder before 1.3.0 via the protect/config.htm addr parameter. (no CVSS)
- [CVE-2019-12169](https://cve.now/CVE-2019-12169.md): ATutor 2.2.4 allows Arbitrary File Upload and Directory Traversal, resulting in remote code execution via a ".." pathname in a ZIP archive t (no CVSS)
- [CVE-2019-11369](https://cve.now/CVE-2019-11369.md): An issue was discovered in Carel pCOWeb prior to B1.2.4. (no CVSS)
- [CVE-2019-11356](https://cve.now/CVE-2019-11356.md): The CalDAV feature in httpd in Cyrus IMAP 2.5.x through 2.5.12 and 3.0.x through 3.0.9 allows remote attackers to execute arbitrary code via (no CVSS)
- [CVE-2019-11370](https://cve.now/CVE-2019-11370.md): Stored XSS was discovered in Carel pCOWeb prior to B1.2.4, as demonstrated by the config/pw\_snmp.html "System contact" field. (no CVSS)
- [CVE-2019-6588](https://cve.now/CVE-2019-6588.md): In Liferay Portal before 7.1 CE GA4, an XSS vulnerability exists in the SimpleCaptcha API when custom code passes unsanitized input into the (no CVSS, com.liferay.portal:release.portal.bom)
- [CVE-2019-11509](https://cve.now/CVE-2019-11509.md): In Pulse Secure Pulse Connect Secure (PCS) before 8.1R15.1, 8.2 before 8.2R12.1, 8.3 before 8.3R7.1, and 9.0 before 9.0R3.4 and Pulse Policy (no CVSS)
- [CVE-2019-12373](https://cve.now/CVE-2019-12373.md): Improper access control and open directories in Ivanti LANDESK Management Suite (LDMS, aka Endpoint Manager) 10.0.1.168 Service Update 5 may (no CVSS)
- [CVE-2019-12374](https://cve.now/CVE-2019-12374.md): A SQL Injection vulnerability exists in Ivanti LANDESK Management Suite (LDMS, aka Endpoint Manager) 10.0.1.168 Service Update 5 due to impr (no CVSS)
- [CVE-2019-12176](https://cve.now/CVE-2019-12176.md): Privilege escalation in the "HTC Account Service" and "ViveportDesktopService" in HTC VIVEPORT before 1.0.0.36 allows local attackers to esc (no CVSS)
- [CVE-2019-12375](https://cve.now/CVE-2019-12375.md): Open directories in Ivanti LANDESK Management Suite (LDMS, aka Endpoint Manager) 10.0.1.168 Service Update 5 may lead to remote information (no CVSS)
- [CVE-2019-12376](https://cve.now/CVE-2019-12376.md): Use of a hard-coded encryption key in Ivanti LANDESK Management Suite (LDMS, aka Endpoint Manager) 10.0.1.168 Service Update 5 may lead to f (no CVSS)
- [CVE-2019-12177](https://cve.now/CVE-2019-12177.md): Privilege escalation due to insecure directory permissions affecting ViveportDesktopService in HTC VIVEPORT before 1.0.0.36 allows local att (no CVSS)
- [CVE-2019-12377](https://cve.now/CVE-2019-12377.md): A vulnerable upl/async\_upload.asp web API endpoint in Ivanti LANDESK Management Suite (LDMS, aka Endpoint Manager) 10.0.1.168 Service Update (no CVSS)
- [CVE-2017-14854](https://cve.now/CVE-2017-14854.md): A stack buffer overflow exists in one of the Orpak SiteOmat CGI components, allowing for remote code execution. (CVSS 9.1)
- [CVE-2017-14853](https://cve.now/CVE-2017-14853.md): The Orpak SiteOmat OrCU component is vulnerable to code injection, for all versions prior to 2017-09-25, due to a search query that uses a d (CVSS 8.6)
- [CVE-2019-12310](https://cve.now/CVE-2019-12310.md): ExaGrid appliances with firmware version v4.8.1.1044.P50 have a /monitor/data/Upgrade/ directory traversal vulnerability, which allows remot (no CVSS)
- [CVE-2017-14852](https://cve.now/CVE-2017-14852.md): An insecure communication was found between a user and the Orpak SiteOmat management console for all known versions, due to an invalid SSL c (CVSS 8.6)
- [CVE-2017-14851](https://cve.now/CVE-2017-14851.md): A SQL injection vulnerability exists in all Orpak SiteOmat versions prior to 2017-09-25. (CVSS 9.8)
- [CVE-2017-14850](https://cve.now/CVE-2017-14850.md): All known versions of the Orpak SiteOmat web management console is vulnerable to multiple instances of Stored Cross-site Scripting due to im (CVSS 6.1)
- [CVE-2017-14728](https://cve.now/CVE-2017-14728.md): An authentication bypass was found in an unknown area of the SiteOmat source code. (CVSS 9.8)
- [CVE-2019-3846](https://cve.now/CVE-2019-3846.md): A flaw that allowed an attacker to corrupt memory and possibly escalate privileges was found in the mwifiex kernel module while connecting t (CVSS 8.0, kernel)
- [CVE-2018-5404](https://cve.now/CVE-2018-5404.md): The Quest Kace K1000 Appliance is vulnerable to multiple Blind SQL Injections. (no CVSS, Quest Kace K1000 Appliance)
- [CVE-2018-5405](https://cve.now/CVE-2018-5405.md): The Quest Kace K1000 Appliance is vulnerable to JavaScript injection. (no CVSS, Quest Kace K1000 Appliance)
- [CVE-2018-5406](https://cve.now/CVE-2018-5406.md): The Quest Kace K1000 Appliance misconfigures the Cross-Origin Resource Sharing (CORS) mechanism. (no CVSS, Quest Kace K1000 Appliance)
- [CVE-2019-3567](https://cve.now/CVE-2019-3567.md): In some configurations an attacker can inject a new executable path into the extensions.load file for osquery and hard link a parent folder (no CVSS, Facebook osquery)
- [CVE-2019-10147](https://cve.now/CVE-2019-10147.md): rkt through version 1.30.0 does not isolate processes in containers that are run with \`rkt enter\`. (CVSS 4.7, \[UNKNOWN\] rkt)
- [CVE-2019-10145](https://cve.now/CVE-2019-10145.md): rkt through version 1.30.0 does not isolate processes in containers that are run with \`rkt enter\`. (CVSS 7.0, \[UNKNOWN\] rkt)
- [CVE-2019-10144](https://cve.now/CVE-2019-10144.md): rkt through version 1.30.0 does not isolate processes in containers that are run with \`rkt enter\`. (CVSS 7.0, \[UNKNOWN\] rkt)
- [CVE-2019-6743](https://cve.now/CVE-2019-6743.md): This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Xiaomi Mi6 Browser prior to 10.4.0. (CVSS 7.8, Xiaomi Browser)
- [CVE-2019-6740](https://cve.now/CVE-2019-6740.md): This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Samsung Galaxy S9 prior to January 2019 (CVSS 9.6, Samsung Galaxy S9)
- [CVE-2019-6741](https://cve.now/CVE-2019-6741.md): This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Samsung Galaxy S9 prior to January 2019 (CVSS 6.5, Samsung Galaxy S9)
- [CVE-2019-6742](https://cve.now/CVE-2019-6742.md): This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Samsung Galaxy S9 prior to 1.4.20.2. (CVSS 10.0, Samsung Galaxy S9)
- [CVE-2019-6757](https://cve.now/CVE-2019-6757.md): This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 9.4.16811. (CVSS 7.8, Foxit Reader)
- [CVE-2019-6758](https://cve.now/CVE-2019-6758.md): This vulnerability allows remote attackers to disclose sensitive information on vulnerable installations of Foxit Reader 9.4.16811. (CVSS 3.3, Foxit Reader)
- [CVE-2019-6759](https://cve.now/CVE-2019-6759.md): This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 9.3.10826. (CVSS 7.8, Foxit Reader)
- [CVE-2019-6760](https://cve.now/CVE-2019-6760.md): This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 9.4.16811. (CVSS 7.8, Foxit Reader)
- [CVE-2019-6761](https://cve.now/CVE-2019-6761.md): This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 9.4.0.16811. (CVSS 7.8, Foxit Reader)
- [CVE-2019-6762](https://cve.now/CVE-2019-6762.md): This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit PhantomPDF 9.4.1.16828. (CVSS 7.8, Foxit PhantomPDF)
- [CVE-2019-6763](https://cve.now/CVE-2019-6763.md): This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 9.4.1.16828. (CVSS 7.8, Foxit Reader)
- [CVE-2019-6764](https://cve.now/CVE-2019-6764.md): This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 9.4.1.16828. (CVSS 7.8, Foxit Reader)
- [CVE-2019-6765](https://cve.now/CVE-2019-6765.md): This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit PhantomPDF 9.4.1.16828. (CVSS 7.8, Foxit PhantomPDF)
- [CVE-2019-6766](https://cve.now/CVE-2019-6766.md): This vulnerability allows remote attackers to disclose sensitive information on vulnerable installations of Foxit Reader 9.4.1.16828. (CVSS 3.3, Foxit Reader)
- [CVE-2019-6767](https://cve.now/CVE-2019-6767.md): This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 9.4.1.16828. (CVSS 7.0, Foxit Reader)
- [CVE-2019-6768](https://cve.now/CVE-2019-6768.md): This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 9.4.1.16828. (CVSS 7.0, Foxit Reader)
- [CVE-2019-6769](https://cve.now/CVE-2019-6769.md): This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 9.4.1.16828. (CVSS 7.8, Foxit Reader)
- [CVE-2019-6770](https://cve.now/CVE-2019-6770.md): This vulnerability allows remote attackers to disclose sensitive information on vulnerable installations of Foxit Reader 9.4.1.16828. (CVSS 3.3, Foxit Reader)
- [CVE-2019-6771](https://cve.now/CVE-2019-6771.md): This vulnerability allows remote attackers to disclose sensitive information on vulnerable installations of Foxit Reader 2019.010.20098. (CVSS 3.3, Foxit Reader)
- [CVE-2019-6772](https://cve.now/CVE-2019-6772.md): This vulnerability allows remote attackers to disclose sensitive information on vulnerable installations of Foxit Reader 2019.010.20098. (CVSS 3.3, Foxit Reader)
- [CVE-2019-6773](https://cve.now/CVE-2019-6773.md): This vulnerability allows remote attackers to disclose sensitive information on vulnerable installations of Foxit Reader 9.4.1.16828. (CVSS 3.3, Foxit Reader)
- [CVE-2019-6746](https://cve.now/CVE-2019-6746.md): This vulnerability allows remote attackers to disclose sensitive information on vulnerable installations of Foxit Studio Photo 3.6.6. (CVSS 3.3, Foxit Studio Photo)
- [CVE-2019-6747](https://cve.now/CVE-2019-6747.md): This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Studio Photo 3.6.6. (CVSS 7.8, Foxit Studio Photo)
- [CVE-2019-6748](https://cve.now/CVE-2019-6748.md): This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Studio Photo 3.6.6. (CVSS 7.8, Foxit Studio Photo)
- [CVE-2019-6749](https://cve.now/CVE-2019-6749.md): This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Studio Photo 3.6.6. (CVSS 7.8, Foxit Studio Photo)
- [CVE-2019-6750](https://cve.now/CVE-2019-6750.md): This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Studio Photo 3.6.6. (CVSS 7.8, Foxit Studio Photo)
- [CVE-2019-6751](https://cve.now/CVE-2019-6751.md): This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Studio Photo 3.6.6.779. (CVSS 7.8, Foxit Studio Photo)
- [CVE-2019-6752](https://cve.now/CVE-2019-6752.md): This vulnerability allows remote attackers to disclose sensitive information on vulnerable installations of Foxit PhantomPDF 9.3.10826. (CVSS 3.3, Foxit PhantomPDF)
- [CVE-2019-6753](https://cve.now/CVE-2019-6753.md): This vulnerability allows remote attackers to disclose sensitive information on vulnerable installations of Foxit Reader 9.3.0.10826. (CVSS 3.3, Foxit Reader)
- [CVE-2019-6754](https://cve.now/CVE-2019-6754.md): This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 9.3.10826. (CVSS 7.3, Foxit Reader)
- [CVE-2019-6755](https://cve.now/CVE-2019-6755.md): This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 9.3.10826. (CVSS 7.8, Foxit Reader)
- [CVE-2019-6756](https://cve.now/CVE-2019-6756.md): This vulnerability allows remote attackers to disclose sensitive information on vulnerable installations of Foxit PhantomPDF 9.4.0.16811. (CVSS 3.3, Foxit PhantomPDF)
- [CVE-2019-6739](https://cve.now/CVE-2019-6739.md): This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Malwarebytes Antimalware 3.6.1.2711. (CVSS 8.8, Malwarebytes Antimalware)
- [CVE-2019-6736](https://cve.now/CVE-2019-6736.md): This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Bitdefender SafePay 23.0.10.34. (CVSS 8.8, Bitdefender SafePay)
- [CVE-2019-6737](https://cve.now/CVE-2019-6737.md): This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Bitdefender SafePay 23.0.10.34. (CVSS 8.8, Bitdefender SafePay)
- [CVE-2019-6738](https://cve.now/CVE-2019-6738.md): This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Bitdefender SafePay 23.0.10.34. (CVSS 8.8, Bitdefender SafePay)
- [CVE-2019-9753](https://cve.now/CVE-2019-9753.md): An issue was discovered in Open Ticket Request System (OTRS) 7.x before 7.0.5. (CVSS 3.5)
- [CVE-2019-3895](https://cve.now/CVE-2019-3895.md): An access-control flaw was found in the Octavia service when the cloud platform was deployed using Red Hat OpenStack Platform Director. (CVSS 5.5, Red Hat openstack-tripleo-common · octavia)
- [CVE-2019-9882](https://cve.now/CVE-2019-9882.md): Multi modules of MailSherlock MSR35 and MSR45 lead to a CSRF vulnerability. It allows attacker to add malicious email sources into whitelist. (no CVSS, OAKlouds MailSherlock MSR35 · OAKlouds MailSherlock MSR45)
- [CVE-2019-9883](https://cve.now/CVE-2019-9883.md): Multi modules of MailSherlock MSR35 and MSR45 lead to a CSRF vulnerability. It allows attacker to elevate privilege of specific account. (no CVSS, OAKlouds MailSherlock MSR35 · OAKlouds MailSherlock MSR45)
- [CVE-2019-11646](https://cve.now/CVE-2019-11646.md): Remote unauthorized command execution and unauthorized disclosure of information in Micro Focus Service Manager, versions 9.30, 9.31, 9.32, (no CVSS, Micro Focus Service Manager)
- [CVE-2019-12593](https://cve.now/CVE-2019-12593.md): IceWarp Mail Server through 10.4.4 is prone to a local file inclusion vulnerability via webmail/calendar/minimizer/index.php?style=..%5c dir (no CVSS)
- [CVE-2019-12308](https://cve.now/CVE-2019-12308.md): An issue was discovered in Django 1.11 before 1.11.21, 2.1 before 2.1.9, and 2.2 before 2.2.2. (no CVSS, django)
- [CVE-2019-3802](https://cve.now/CVE-2019-3802.md): Additional information exposure with Spring Data JPA example matcher (CVSS 3.5, Spring Data JPA · org.springframework.data:spring-data-jpa)
- [CVE-2019-3397](https://cve.now/CVE-2019-3397.md): Atlassian Bitbucket Data Center licensed instances starting with version 5.13.0 before 5.13.6 (the fixed version for 5.13.x), from 5.14.0 be (no CVSS, Atlassian Bitbucket Data Center)
- [CVE-2019-11580](https://cve.now/CVE-2019-11580.md): Atlassian Crowd and Crowd Data Center had the pdkinstall development plugin incorrectly enabled in release builds. (CVSS 9.8, KEV, Atlassian Crowd)
- [CVE-2019-12591](https://cve.now/CVE-2019-12591.md): NETGEAR Insight Cloud with firmware before Insight 5.6 allows remote authenticated users to achieve command injection. (CVSS 6.8)
- [CVE-2019-12589](https://cve.now/CVE-2019-12589.md): In Firejail before 0.9.60, seccomp filters are writable inside the jail, leading to a lack of intended seccomp restrictions for a process th (no CVSS)
- [CVE-2019-12585](https://cve.now/CVE-2019-12585.md): Apcupsd 0.3.91\_5, as used in pfSense through 2.4.4-RELEASE-p3 and other products, has an Arbitrary Command Execution issue in apcupsd\_status (no CVSS)
- [CVE-2019-12584](https://cve.now/CVE-2019-12584.md): Apcupsd 0.3.91\_5, as used in pfSense through 2.4.4-RELEASE-p3 and other products, has an XSS issue in apcupsd\_status.php. (no CVSS)
- [CVE-2019-12569](https://cve.now/CVE-2019-12569.md): A vulnerability in Viber before 10.7.0 for Desktop (Windows) could allow an attacker to execute arbitrary commands on a targeted system. (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2019-06-03
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.