CVEs published June 6, 2019
51 CVEs were published on June 6, 2019: 1 critical, 3 high.
- Published
- 51
- Critical
- 1
- High
- 3
- Medium
- 10
- Low
- 2
- Unrated
- 35
- Now in CISA KEV
- 0
- Fix available
- 10
Most affected products
- IBM Security Information Queue
- 5
- IBM InfoSphere Information Server
- 3
- IBM Maximo Asset Management
- 3
- Dell EMC OpenManage Server Administrator
- 2
- github.com/rancher/rancher
- 2
- Huawei Mate10
- 2
- Huawei PCManager
- 2
- chartkick
- 1
- github.com/hashicorp/consul
- 1
- Huawei Honor
- 1
Critical 1
High 3
- CVE-2019-3722XML External Entity (XXE) Injection VulnerabilityDell EMC OpenManage Server Administrator
- CVE-2019-4201IBM Jazz for Service Management 1.1.3, 1.1.3.1, and 1.1.3.2 could allow a remote attacker to conduct phishing attacks, using an open redirecIBM Jazz for Service Management
- CVE-2019-4185IBM InfoSphere Information Server 11.7.1 containers are vulnerable to privilege escalation due to an insecurely configured component.IBM InfoSphere Information Server
Medium, low and unrated 47
- CVE-2019-4257IBM InfoSphere Information Server 11.5 and 11.7 is affected by an information disclosure vulnerability.IBM InfoSphere Information Server
- CVE-2019-4219IBM Security Information Queue (ISIQ) 1.0.0, 1.0.1, and 1.0.2 generates an error message that includes sensitive information that could be uIBM Security Information Queue
- CVE-2019-4218IBM Security Information Queue (ISIQ) 1.0.0, 1.0.1, and 1.0.2 allows web pages to be stored locally which can be read by another user on theIBM Security Information Queue
- CVE-2019-4217IBM Security Information Queue (ISIQ) 1.0.0, 1.0.1, and 1.0.2 could allow a remote attacker to hijack the clicking action of the victim.IBM Security Information Queue
- CVE-2019-4162IBM Security Information Queue (ISIQ) 1.0.0, 1.0.1, and 1.0.2 is missing the HTTP Strict Transport Security header.IBM Security Information Queue
- CVE-2019-4161IBM Security Information Queue (ISIQ) 1.0.0, 1.0.1, and 1.0.2 discloses sensitive information to unauthorized users.IBM Security Information Queue
- CVE-2019-12762Xiaomi Mi 5s Plus devices allow attackers to trigger touchscreen anomalies via a radio signal between 198 kHz and 203 kHz, as demonstrated b
- CVE-2019-11523Anviz Global M3 Outdoor RFID Access Control executes any command received from any source.
- CVE-2019-12492Gallagher Command Centre before 7.80.939, 7.90.x before 7.90.961, and 8.x before 8.00.1128 allows arbitrary event creation and information d
- CVE-2019-3790Ops Manager uaa client issues tokens after refresh token expirationPivotal Ops Manager
- CVE-2019-5525VMware Workstation (15.x before 15.1.0) contains a use-after-free vulnerability in the Advanced Linux Sound Architecture (ALSA) backend.VMware Workstation
- CVE-2019-5522VMware Tools for Windows update addresses an out of bounds read vulnerability in vm3dmp driver which is installed with vmtools in Windows guVMware Tools for Windows
- CVE-2019-12761A code injection issue was discovered in PyXDG before 0.26 via crafted Python code in a Category element of a Menu XML document in a .menu fpyxdg
- CVE-2019-12760A deserialization vulnerability exists in the way parso through 0.4.0 handles grammar parsing from the cache.parso
- CVE-2018-8047vtiger CRM 7.0.1 is affected by one reflected Cross-Site Scripting (XSS) vulnerability affecting version 7.0.1 and probably prior versions.
- CVE-2018-9839An issue was discovered in MantisBT through 1.3.14, and 2.0.0.
- CVE-2019-3578MyBB 1.8.19 has XSS in the resetpassword function.
- CVE-2019-3579MyBB 1.8.19 allows remote attackers to obtain sensitive information because it discloses the username upon receiving a password-reset reques
- CVE-2019-6451On SOYAL AR-727H and AR-829Ev5 devices, all CGI programs allow unauthenticated POST access.
- CVE-2019-6452Kyocera Command Center RX TASKalfa4501i and TASKalfa5052ci allows remote attackers to abuse the Test button in the machine address book to o
- CVE-2019-6989TP-Link TL-WR940N is vulnerable to a stack-based buffer overflow, caused by improper bounds checking by the ipAddrDispose function.
- CVE-2019-9929Northern.tech CFEngine Enterprise 3.12.1 has Insecure Permissions.
- CVE-2019-12291HashiCorp Consul 1.4.0 through 1.5.0 has Incorrect Access Control.github.com/hashicorp/consul
- CVE-2019-12135An unspecified vulnerability in the application server in PaperCut MF and NG versions 18.3.8 and earlier and versions 19.0.3 and earlier all
- CVE-2019-7215Progress Sitefinity 10.1.6536 does not invalidate session cookies upon logouts.
- CVE-2019-7220X-Cart V5 is vulnerable to XSS via the CategoryFilter2 parameter.
- CVE-2019-7311An issue was discovered on Linksys WRT1900ACS 1.0.3.187766 devices.
- CVE-2019-7552An issue was discovered in PHP Scripts Mall Investment MLM Software 2.0.2.
- CVE-2019-7554An issue was discovered in PHP Scripts Mall API Based Travel Booking 3.4.7.
- CVE-2019-12274In Rancher 1 and 2 through 2.2.3, unprivileged users (if allowed to deploy nodes) can gain admin access to the Rancher management plane becagithub.com/rancher/rancher
- CVE-2019-12303In Rancher 2 through 2.2.3, Project owners can inject additional fluentd configuration to read files or execute arbitrary commands inside thgithub.com/rancher/rancher
- CVE-2019-12732The Chartkick gem through 3.1.0 for Ruby allows XSS.chartkick
- CVE-2019-8320A Directory Traversal issue was discovered in RubyGems 2.7.6 and later through 3.0.2.rubygems-update
- CVE-2019-5219There is a double free vulnerability on certain drivers of Huawei Mate10 smartphones versions earlier than ALP-AL00B 9.0.0.181(C00E87R2P20T8Huawei Mate10
- CVE-2019-5295Huawei Honor V10 smartphones versions earlier than Berkeley-AL20 9.0.0.125(C00E125R2P14T8) have an authorization bypass vulnerability.Huawei Honor
- CVE-2019-5305The image processing module of some Huawei Mate 10 smartphones versions before ALP-L29 9.0.0.159(C185) has a memory double free vulnerabilitHuawei Mate
- CVE-2019-5216There is a race condition vulnerability on Huawei Honor V10 smartphones versions earlier than Berkeley-AL20 9.0.0.156(C00E156R2P14T8), HonorHuawei Honor V10, Honor 10, Honor Play
- CVE-2019-5242There is a code execution vulnerability in Huawei PCManager versions earlier than PCManager 9.0.1.50.Huawei PCManager
- CVE-2019-5241There is a privilege escalation vulnerability in Huawei PCManager versions earlier than PCManager 9.0.1.50.Huawei PCManager
- CVE-2019-5214There is a use after free vulnerability on certain driver component in Huawei Mate10 smartphones versions earlier than ALP-AL00B 9.0.0.167(CHuawei Mate10
- CVE-2019-11080Sitecore Experience Platform (XP) prior to 9.1.1 is vulnerable to remote code execution via deserialization, aka TFS # 293863.
- CVE-2019-12134CSV Injection (aka Excel Macro Injection or Formula Injection) exists in the export feature in Workday through 32 via a value (provided by a
- CVE-2019-4220IBM InfoSphere Information Server 11.7.1.0 stores a common hard coded encryption key that could be used to decrypt sensitive information.IBM InfoSphere Information Server
- CVE-2019-4056IBM Maximo Asset Management 7.6 Work Centers' application does not validate file type upon upload, allowing attackers to upload malicious fiIBM Maximo Asset Management
- CVE-2019-4048IBM Maximo Asset Management 7.6 could allow a physical user of the system to obtain sensitive information from a previous user of the same mIBM Maximo Asset Management
- CVE-2018-2028IBM Maximo Asset Management 7.6 could allow a an authenticated user to replace a target page with a phishing site which could allow the attaIBM Maximo Asset Management
- CVE-2019-7553PHP Scripts Mall Chartered Accountant : Auditor Website 2.0.1 has Stored XSS in the Profile Update page via the My Name field.