# CVEs published 2019-06-06

51 CVEs were published on June 6, 2019: 1 critical, 3 high. Days are UTC.

- [CVE-2019-4257](https://cve.now/CVE-2019-4257.md): IBM InfoSphere Information Server 11.5 and 11.7 is affected by an information disclosure vulnerability. (CVSS 4.3, IBM InfoSphere Information Server)
- [CVE-2019-4219](https://cve.now/CVE-2019-4219.md): IBM Security Information Queue (ISIQ) 1.0.0, 1.0.1, and 1.0.2 generates an error message that includes sensitive information that could be u (CVSS 4.3, IBM Security Information Queue)
- [CVE-2019-4218](https://cve.now/CVE-2019-4218.md): IBM Security Information Queue (ISIQ) 1.0.0, 1.0.1, and 1.0.2 allows web pages to be stored locally which can be read by another user on the (CVSS 4.0, IBM Security Information Queue)
- [CVE-2019-4217](https://cve.now/CVE-2019-4217.md): IBM Security Information Queue (ISIQ) 1.0.0, 1.0.1, and 1.0.2 could allow a remote attacker to hijack the clicking action of the victim. (CVSS 6.1, IBM Security Information Queue)
- [CVE-2019-4162](https://cve.now/CVE-2019-4162.md): IBM Security Information Queue (ISIQ) 1.0.0, 1.0.1, and 1.0.2 is missing the HTTP Strict Transport Security header. (CVSS 5.9, IBM Security Information Queue)
- [CVE-2019-4161](https://cve.now/CVE-2019-4161.md): IBM Security Information Queue (ISIQ) 1.0.0, 1.0.1, and 1.0.2 discloses sensitive information to unauthorized users. (CVSS 4.0, IBM Security Information Queue)
- [CVE-2019-12762](https://cve.now/CVE-2019-12762.md): Xiaomi Mi 5s Plus devices allow attackers to trigger touchscreen anomalies via a radio signal between 198 kHz and 203 kHz, as demonstrated b (no CVSS)
- [CVE-2019-11523](https://cve.now/CVE-2019-11523.md): Anviz Global M3 Outdoor RFID Access Control executes any command received from any source. (no CVSS)
- [CVE-2019-12492](https://cve.now/CVE-2019-12492.md): Gallagher Command Centre before 7.80.939, 7.90.x before 7.90.961, and 8.x before 8.00.1128 allows arbitrary event creation and information d (no CVSS)
- [CVE-2019-3790](https://cve.now/CVE-2019-3790.md): Ops Manager uaa client issues tokens after refresh token expiration (CVSS 6.1, Pivotal Ops Manager)
- [CVE-2019-3723](https://cve.now/CVE-2019-3723.md): Web Parameter Tampering Vulnerability (CVSS 9.1, Dell EMC OpenManage Server Administrator)
- [CVE-2019-3722](https://cve.now/CVE-2019-3722.md): XML External Entity (XXE) Injection Vulnerability (CVSS 7.5, Dell EMC OpenManage Server Administrator)
- [CVE-2019-5525](https://cve.now/CVE-2019-5525.md): VMware Workstation (15.x before 15.1.0) contains a use-after-free vulnerability in the Advanced Linux Sound Architecture (ALSA) backend. (no CVSS, VMware Workstation)
- [CVE-2019-5522](https://cve.now/CVE-2019-5522.md): VMware Tools for Windows update addresses an out of bounds read vulnerability in vm3dmp driver which is installed with vmtools in Windows gu (no CVSS, VMware Tools for Windows)
- [CVE-2019-12761](https://cve.now/CVE-2019-12761.md): A code injection issue was discovered in PyXDG before 0.26 via crafted Python code in a Category element of a Menu XML document in a .menu f (no CVSS, pyxdg)
- [CVE-2019-12760](https://cve.now/CVE-2019-12760.md): A deserialization vulnerability exists in the way parso through 0.4.0 handles grammar parsing from the cache. (CVSS 3.3, parso)
- [CVE-2018-8047](https://cve.now/CVE-2018-8047.md): vtiger CRM 7.0.1 is affected by one reflected Cross-Site Scripting (XSS) vulnerability affecting version 7.0.1 and probably prior versions. (no CVSS)
- [CVE-2018-9839](https://cve.now/CVE-2018-9839.md): An issue was discovered in MantisBT through 1.3.14, and 2.0.0. (no CVSS)
- [CVE-2019-3578](https://cve.now/CVE-2019-3578.md): MyBB 1.8.19 has XSS in the resetpassword function. (no CVSS)
- [CVE-2019-3579](https://cve.now/CVE-2019-3579.md): MyBB 1.8.19 allows remote attackers to obtain sensitive information because it discloses the username upon receiving a password-reset reques (no CVSS)
- [CVE-2019-6451](https://cve.now/CVE-2019-6451.md): On SOYAL AR-727H and AR-829Ev5 devices, all CGI programs allow unauthenticated POST access. (no CVSS)
- [CVE-2019-6452](https://cve.now/CVE-2019-6452.md): Kyocera Command Center RX TASKalfa4501i and TASKalfa5052ci allows remote attackers to abuse the Test button in the machine address book to o (no CVSS)
- [CVE-2019-6989](https://cve.now/CVE-2019-6989.md): TP-Link TL-WR940N is vulnerable to a stack-based buffer overflow, caused by improper bounds checking by the ipAddrDispose function. (no CVSS)
- [CVE-2019-9929](https://cve.now/CVE-2019-9929.md): Northern.tech CFEngine Enterprise 3.12.1 has Insecure Permissions. (no CVSS)
- [CVE-2019-12291](https://cve.now/CVE-2019-12291.md): HashiCorp Consul 1.4.0 through 1.5.0 has Incorrect Access Control. (no CVSS, github.com/hashicorp/consul)
- [CVE-2019-12135](https://cve.now/CVE-2019-12135.md): An unspecified vulnerability in the application server in PaperCut MF and NG versions 18.3.8 and earlier and versions 19.0.3 and earlier all (no CVSS)
- [CVE-2019-7215](https://cve.now/CVE-2019-7215.md): Progress Sitefinity 10.1.6536 does not invalidate session cookies upon logouts. (no CVSS)
- [CVE-2019-7220](https://cve.now/CVE-2019-7220.md): X-Cart V5 is vulnerable to XSS via the CategoryFilter2 parameter. (no CVSS)
- [CVE-2019-7311](https://cve.now/CVE-2019-7311.md): An issue was discovered on Linksys WRT1900ACS 1.0.3.187766 devices. (no CVSS)
- [CVE-2019-7552](https://cve.now/CVE-2019-7552.md): An issue was discovered in PHP Scripts Mall Investment MLM Software 2.0.2. (no CVSS)
- [CVE-2019-7554](https://cve.now/CVE-2019-7554.md): An issue was discovered in PHP Scripts Mall API Based Travel Booking 3.4.7. (no CVSS)
- [CVE-2019-12274](https://cve.now/CVE-2019-12274.md): In Rancher 1 and 2 through 2.2.3, unprivileged users (if allowed to deploy nodes) can gain admin access to the Rancher management plane beca (no CVSS, github.com/rancher/rancher)
- [CVE-2019-12303](https://cve.now/CVE-2019-12303.md): In Rancher 2 through 2.2.3, Project owners can inject additional fluentd configuration to read files or execute arbitrary commands inside th (no CVSS, github.com/rancher/rancher)
- [CVE-2019-12732](https://cve.now/CVE-2019-12732.md): The Chartkick gem through 3.1.0 for Ruby allows XSS. (no CVSS, chartkick)
- [CVE-2019-8320](https://cve.now/CVE-2019-8320.md): A Directory Traversal issue was discovered in RubyGems 2.7.6 and later through 3.0.2. (no CVSS, rubygems-update)
- [CVE-2019-5219](https://cve.now/CVE-2019-5219.md): There is a double free vulnerability on certain drivers of Huawei Mate10 smartphones versions earlier than ALP-AL00B 9.0.0.181(C00E87R2P20T8 (no CVSS, Huawei Mate10)
- [CVE-2019-5295](https://cve.now/CVE-2019-5295.md): Huawei Honor V10 smartphones versions earlier than Berkeley-AL20 9.0.0.125(C00E125R2P14T8) have an authorization bypass vulnerability. (no CVSS, Huawei Honor)
- [CVE-2019-5305](https://cve.now/CVE-2019-5305.md): The image processing module of some Huawei Mate 10 smartphones versions before ALP-L29 9.0.0.159(C185) has a memory double free vulnerabilit (no CVSS, Huawei Mate)
- [CVE-2019-5216](https://cve.now/CVE-2019-5216.md): There is a race condition vulnerability on Huawei Honor V10 smartphones versions earlier than Berkeley-AL20 9.0.0.156(C00E156R2P14T8), Honor (no CVSS, Huawei Honor V10, Honor 10, Honor Play)
- [CVE-2019-5242](https://cve.now/CVE-2019-5242.md): There is a code execution vulnerability in Huawei PCManager versions earlier than PCManager 9.0.1.50. (no CVSS, Huawei PCManager)
- [CVE-2019-5241](https://cve.now/CVE-2019-5241.md): There is a privilege escalation vulnerability in Huawei PCManager versions earlier than PCManager 9.0.1.50. (no CVSS, Huawei PCManager)
- [CVE-2019-5214](https://cve.now/CVE-2019-5214.md): There is a use after free vulnerability on certain driver component in Huawei Mate10 smartphones versions earlier than ALP-AL00B 9.0.0.167(C (no CVSS, Huawei Mate10)
- [CVE-2019-11080](https://cve.now/CVE-2019-11080.md): Sitecore Experience Platform (XP) prior to 9.1.1 is vulnerable to remote code execution via deserialization, aka TFS # 293863. (no CVSS)
- [CVE-2019-12134](https://cve.now/CVE-2019-12134.md): CSV Injection (aka Excel Macro Injection or Formula Injection) exists in the export feature in Workday through 32 via a value (provided by a (no CVSS)
- [CVE-2019-4220](https://cve.now/CVE-2019-4220.md): IBM InfoSphere Information Server 11.7.1.0 stores a common hard coded encryption key that could be used to decrypt sensitive information. (CVSS 6.2, IBM InfoSphere Information Server)
- [CVE-2019-4201](https://cve.now/CVE-2019-4201.md): IBM Jazz for Service Management 1.1.3, 1.1.3.1, and 1.1.3.2 could allow a remote attacker to conduct phishing attacks, using an open redirec (CVSS 7.4, IBM Jazz for Service Management)
- [CVE-2019-4185](https://cve.now/CVE-2019-4185.md): IBM InfoSphere Information Server 11.7.1 containers are vulnerable to privilege escalation due to an insecurely configured component. (CVSS 8.3, IBM InfoSphere Information Server)
- [CVE-2019-4056](https://cve.now/CVE-2019-4056.md): IBM Maximo Asset Management 7.6 Work Centers' application does not validate file type upon upload, allowing attackers to upload malicious fi (CVSS 4.3, IBM Maximo Asset Management)
- [CVE-2019-4048](https://cve.now/CVE-2019-4048.md): IBM Maximo Asset Management 7.6 could allow a physical user of the system to obtain sensitive information from a previous user of the same m (CVSS 2.1, IBM Maximo Asset Management)
- [CVE-2018-2028](https://cve.now/CVE-2018-2028.md): IBM Maximo Asset Management 7.6 could allow a an authenticated user to replace a target page with a phishing site which could allow the atta (CVSS 6.5, IBM Maximo Asset Management)
- [CVE-2019-7553](https://cve.now/CVE-2019-7553.md): PHP Scripts Mall Chartered Accountant : Auditor Website 2.0.1 has Stored XSS in the Profile Update page via the My Name field. (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2019-06-06
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.