# CVEs published 2019-06-04

27 CVEs were published on June 4, 2019: 2 critical, 1 high. 2 are now in CISA KEV. Days are UTC.

- [CVE-2019-5588](https://cve.now/CVE-2019-5588.md): A reflected Cross-Site-Scripting (XSS) vulnerability in Fortinet FortiOS 6.0.0 to 6.0.4 under SSL VPN web portal may allow an attacker to ex (no CVSS, Fortinet FortiOS)
- [CVE-2019-5586](https://cve.now/CVE-2019-5586.md): A reflected Cross-Site-Scripting (XSS) vulnerability in Fortinet FortiOS 5.2.0 to 5.6.10, 6.0.0 to 6.0.4 under SSL VPN web portal may allow (no CVSS, Fortinet FortiOS)
- [CVE-2019-5587](https://cve.now/CVE-2019-5587.md): Lack of root file system integrity checking in Fortinet FortiOS VM application images all versions below 6.0.5 may allow attacker to implant (no CVSS, Fortinet FortiOS)
- [CVE-2019-10636](https://cve.now/CVE-2019-10636.md): Marvell SSD Controller (88SS1074, 88SS1079, 88SS1080, 88SS1093, 88SS1092, 88SS1095, 88SS9174, 88SS9175, 88SS9187, 88SS9188, 88SS9189, 88SS91 (no CVSS)
- [CVE-2018-13384](https://cve.now/CVE-2018-13384.md): A Host Header Redirection vulnerability in Fortinet FortiOS all versions below 6.0.5 under SSL VPN web portal allows a remote attacker to po (no CVSS, Fortinet FortiOS)
- [CVE-2018-13382](https://cve.now/CVE-2018-13382.md): An Improper Authorization vulnerability in Fortinet FortiOS 6.0.0 to 6.0.4, 5.6.0 to 5.6.8 and 5.4.1 to 5.4.10 and FortiProxy 2.0.0, 1.2.0 t (CVSS 9.1, KEV, Fortinet FortiOS, FortiProxy)
- [CVE-2019-12210](https://cve.now/CVE-2019-12210.md): In Yubico pam-u2f 1.0.7, when configured with debug and a custom debug log file is set using debug\_file, that file descriptor is not closed (no CVSS)
- [CVE-2019-12209](https://cve.now/CVE-2019-12209.md): Yubico pam-u2f 1.0.7 attempts parsing of the configured authfile (default $HOME/.config/Yubico/u2f\_keys) as root (unless openasuser was enab (no CVSS)
- [CVE-2018-13381](https://cve.now/CVE-2018-13381.md): A buffer overflow vulnerability in Fortinet FortiOS 6.0.0 through 6.0.4, 5.6.0 through 5.6.7, 5.4 and earlier versions and FortiProxy 2.0.0, (CVSS 5.3, Fortinet FortiOS and FortiProxy)
- [CVE-2018-13379](https://cve.now/CVE-2018-13379.md): An Improper Limitation of a Pathname to a Restricted Directory ("Path Traversal") in Fortinet FortiOS 6.0.0 to 6.0.4, 5.6.3 to 5.6.7 and 5.4 (CVSS 9.1, KEV, Fortinet FortiOS, FortiProxy)
- [CVE-2018-13380](https://cve.now/CVE-2018-13380.md): A Cross-site Scripting (XSS) vulnerability in Fortinet FortiOS 6.0.0 to 6.0.4, 5.6.0 to 5.6.7, 5.4.0 to 5.4.12, 5.2 and below and Fortinet F (CVSS 4.7, Fortinet FortiOS and FortiProxy)
- [CVE-2019-5307](https://cve.now/CVE-2019-5307.md): Some Huawei 4G LTE devices, P30 versions before ELE-AL00 9.1.0.162(C01E160R1P12/C01E160R2P1) and P30 Pro versions before VOG-AL00 9.1.0.162( (no CVSS, Huawei P30,P30 Pro)
- [CVE-2019-5284](https://cve.now/CVE-2019-5284.md): There is a DoS vulnerability in RTSP module of Leland-AL00A Huawei smart phones versions earlier than Leland-AL00A 9.1.0.111(C00E111R2P10T8) (no CVSS, Huawei Leland-AL00A)
- [CVE-2019-5285](https://cve.now/CVE-2019-5285.md): Some Huawei S series switches have a DoS vulnerability. (no CVSS, Huawei S12700, S12700, S12700, S12700, S12700, S12700, S127…)
- [CVE-2019-5215](https://cve.now/CVE-2019-5215.md): There is a man-in-the-middle (MITM) vulnerability on Huawei P30 smartphones versions before ELE-AL00 9.1.0.162(C01E160R1P12/C01E160R2P1), an (no CVSS, Huawei P30,P30 Pro)
- [CVE-2019-5283](https://cve.now/CVE-2019-5283.md): There is Factory Reset Protection (FRP) bypass security vulnerability in P20 Huawei smart phones versions earlier than Emily-AL00A 9.0.0.167 (no CVSS, Huawei P20)
- [CVE-2019-5217](https://cve.now/CVE-2019-5217.md): There is an information disclosure vulnerability on Mate 9 Pro Huawei smartphones versions earlier than LON-AL00B9.0.1.150 (C00E61R1P8T8). (no CVSS, Huawei Mate 9 Pro)
- [CVE-2019-5300](https://cve.now/CVE-2019-5300.md): There is a digital signature verification bypass vulnerability in AR1200, AR1200-S, AR150, AR160, AR200, AR2200, AR2200-S, AR3200, SRG1300, (no CVSS, Huawei AR1200, AR1200-S, AR150, AR160, AR200, AR2200, AR220…)
- [CVE-2019-5298](https://cve.now/CVE-2019-5298.md): There is an improper authentication vulnerability in some Huawei AP products before version V200R009C00SPC800. (no CVSS, Huawei AP4050DN-E)
- [CVE-2019-5297](https://cve.now/CVE-2019-5297.md): Emily-L29C Huawei phones versions earlier than 9.0.0.159 (C185E2R1P12T8) have a Factory Reset Protection (FRP) bypass security vulnerability (no CVSS, Huawei Emily-L29C)
- [CVE-2019-5306](https://cve.now/CVE-2019-5306.md): There is a Factory Reset Protection (FRP) bypass security vulnerability in P20 Huawei smart phones versions before Emily-AL00A 9.0.0.167(C00 (no CVSS, Huawei P20)
- [CVE-2019-5296](https://cve.now/CVE-2019-5296.md): Mate20 Huawei smartphones versions earlier than HMA-AL00C00B175 have an out-of-bounds read vulnerability. (no CVSS, Huawei Mate20)
- [CVE-2019-5244](https://cve.now/CVE-2019-5244.md): Mate 9 Pro Huawei smartphones earlier than LON-L29C 8.0.0.361(C636) versions have an information leak vulnerability due to the lack of input (no CVSS, Huawei Mate 9 Pro)
- [CVE-2019-5281](https://cve.now/CVE-2019-5281.md): There is an information leak vulnerability in some Huawei phones, versions earlier than Jackman-L21 8.2.0.155(C185R1P2). (no CVSS, Huawei Y9)
- [CVE-2019-12730](https://cve.now/CVE-2019-12730.md): aa\_read\_header in libavformat/aadec.c in FFmpeg before 3.2.14 and 4.x before 4.1.4 does not check for sscanf failure and consequently allows (no CVSS)
- [CVE-2019-12728](https://cve.now/CVE-2019-12728.md): Grails before 3.3.10 used cleartext HTTP to resolve the SDKMan notification service. (CVSS 8.1, org.grails:grails-core)
- [CVE-2019-12727](https://cve.now/CVE-2019-12727.md): On Ubiquiti airCam 3.1.4 devices, a Denial of Service vulnerability exists in the RTSP Service provided by the ubnt-streamer binary. (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2019-06-04
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.