CVEs published June 7, 2019
76 CVEs were published on June 7, 2019: 1 critical, 2 high.
- Published
- 76
- Critical
- 1
- High
- 2
- Medium
- 3
- Low
- 0
- Unrated
- 70
- Now in CISA KEV
- 0
- Fix available
- 3
Most affected products
- Android
- 12
- IBM Intelligent Operations Center
- 5
- aubio
- 3
- Solarwinds Dameware Remote Mini Controller
- 3
- Panasonic FPWIN Pro
- 2
- Sentinel LDK RTE
- 2
- Micro Focus Solutions Business Manager
- 1
- python
- 1
Critical 1
High 2
- CVE-2019-4069IBM Intelligent Operations Center (IOC) 5.1.0 through 5.2.0 does not properly validate file types, allowing an attacker to upload malicious IBM Intelligent Operations Center
- CVE-2019-4066IBM Intelligent Operations Center (IOC) 5.1.0 through 5.2.0 could allow an authenciated user to create arbitrary users which could cause ID IBM Intelligent Operations Center
Medium, low and unrated 73
- CVE-2019-9086HotelDruid before v2.3.1 has SQL Injection via the /visualizza_tabelle.php anno parameter.
- CVE-2019-9087HotelDruid before v2.3.1 has SQL Injection via the /tab_tariffe.php numtariffa1 parameter.
- CVE-2019-9084In Hoteldruid before 2.3.1, a division by zero was discovered in $num_tabelle in tab_tariffe.php (aka the numtariffa1 parameter) due to the
- CVE-2019-12506Due to unencrypted and unauthenticated data communication, the wireless presenter Logitech R700 Laser Presentation Remote R-R0010 is prone t
- CVE-2019-12504Due to unencrypted and unauthenticated data communication, the wireless presenter Inateck WP2002 is prone to keystroke injection attacks.
- CVE-2019-12505Due to unencrypted and unauthenticated data communication, the wireless presenter Inateck WP1001 v1.3C is prone to keystroke injection attac
- CVE-2019-3957Dameware Remote Mini Control version 12.1.0.34 and prior contains an unauthenticated remote buffer over-read due to the server not properly Solarwinds Dameware Remote Mini Controller
- CVE-2019-3956Dameware Remote Mini Control version 12.1.0.34 and prior contains an unauthenticated remote buffer over-read due to the server not properly Solarwinds Dameware Remote Mini Controller
- CVE-2019-3955Dameware Remote Mini Control version 12.1.0.34 and prior contains a unauthenticated remote heap overflow due to the server not properly valiSolarwinds Dameware Remote Mini Controller
- CVE-2018-10703An issue was discovered on Moxa AWK-3121 1.14 devices.
- CVE-2018-10702An issue was discovered on Moxa AWK-3121 1.14 devices.
- CVE-2018-10701An issue was discovered on Moxa AWK-3121 1.14 devices.
- CVE-2018-10700An issue was discovered on Moxa AWK-3121 1.19 devices.
- CVE-2019-12779libqb before 1.0.5 allows local users to overwrite arbitrary files via a symlink attack, because it uses predictable filenames (under /dev/s
- CVE-2019-2101In uvc_parse_standard_control of uvc_driver.c, there is a possible out-of-bound read due to improper input validation.Android
- CVE-2019-2099In nfa_rw_store_ndef_rx_buf of nfa_rw_act.cc, there is a possible out-of-bound write due to a missing bounds check.Android
- CVE-2019-2098In areNotificationsEnabledForPackage of NotificationManagerService.java, there is a possible permissions bypass due to a missing permissionsAndroid
- CVE-2019-2102In the Bluetooth Low Energy (BLE) specification, there is a provided example Long Term Key (LTK).Android
- CVE-2019-2097In HAliasAnalyzer.Query of hydrogen-alias-analysis.h, there is possible memory corruption due to type confusion.Android
- CVE-2018-10699An issue was discovered on Moxa AWK-3121 1.14 devices.
- CVE-2019-2096In EffectRelease of EffectBundle.cpp, there is a possible memory corruption due to a double free.Android
- CVE-2019-2095In callGenIDChangeListeners and related functions of SkPixelRef.cpp, there is a possible use after free due to a race condition.Android
- CVE-2019-2094In parseMPEGCCData of NuPlayerCCDecoder.cpp, there is a possible out of bounds write due to missing bounds checks.Android
- CVE-2019-2093In huff_dec_1D of nlc_dec.cpp, there is a possible out of bounds write due to a missing bounds check.Android
- CVE-2018-10698An issue was discovered on Moxa AWK-3121 1.14 devices.
- CVE-2019-2092In isSeparateProfileChallengeAllowed of DevicePolicyManagerService.java, there is a possible permissions bypass due to a missing permission Android
- CVE-2019-2091In GetPermittedAccessibilityServicesForUser of DevicePolicyManagerService.java, there is a possible permissions bypass due to a missing permAndroid
- CVE-2019-2090In isPackageDeviceAdminOnAnyUser of PackageManagerService.java, there is a possible permissions bypass due to a missing permissions check.Android
- CVE-2018-10697An issue was discovered on Moxa AWK-3121 1.14 devices.
- CVE-2018-10696An issue was discovered on Moxa AWK-3121 1.14 devices.
- CVE-2018-10695An issue was discovered on Moxa AWK-3121 1.14 devices.
- CVE-2018-10694An issue was discovered on Moxa AWK-3121 1.14 devices.
- CVE-2018-10693An issue was discovered on Moxa AWK-3121 1.14 devices.
- CVE-2018-10692An issue was discovered on Moxa AWK-3121 1.14 devices.
- CVE-2018-10691An issue was discovered on Moxa AWK-3121 1.14 devices.
- CVE-2018-10690An issue was discovered on Moxa AWK-3121 1.14 devices.
- CVE-2019-12599SuiteCRM 7.10.x before 7.10.17 and 7.11.x before 7.11.5 allows SQL Injection.
- CVE-2019-12598SuiteCRM 7.8.x before 7.8.30, 7.10.x before 7.10.17, and 7.11.x before 7.11.5 allows SQL Injection (issue 1 of 3).
- CVE-2019-12600SuiteCRM 7.8.x before 7.8.30, 7.10.x before 7.10.17, and 7.11.x before 7.11.5 allows SQL Injection (issue 2 of 3).
- CVE-2019-12601SuiteCRM 7.8.x before 7.8.30, 7.10.x before 7.10.17, and 7.11.x before 7.11.5 allows SQL Injection (issue 3 of 3).
- CVE-2018-19451A command injection can occur for specially crafted PDF files in Foxit Reader SDK (ActiveX) Professional 5.4.0.1031 when using the Open File
- CVE-2018-19452A use after free in the TextBox field Mouse Enter action in IReader_ContentProvider can occur for specially crafted PDF files in Foxit Reade
- CVE-2018-19461admin\db\DoSql.php in EmpireCMS through 7.5 allows XSS via crafted SQL syntax to admin/admin.php.
- CVE-2018-19462admin\db\DoSql.php in EmpireCMS through 7.5 allows remote attackers to execute arbitrary PHP code via SQL injection that uses a .php filenam
- CVE-2018-19465Maccms through 8.0 allows XSS via the site_keywords field to index.php?m=system-config because of tpl/module/system.php and tpl/html/system_
- CVE-2018-19800aubio v0.4.0 to v0.4.8 has a Buffer Overflow in new_aubio_tempo.aubio
- CVE-2018-19801aubio v0.4.0 to v0.4.8 has a NULL pointer dereference in new_aubio_filterbank via invalid n_filters.aubio
- CVE-2018-19802aubio v0.4.0 to v0.4.8 has a new_aubio_onset NULL pointer dereference.aubio
- CVE-2018-19860Broadcom firmware before summer 2014 on Nexus 5 BCM4335C0 2012-12-11, Raspberry Pi 3 BCM43438A1 2014-06-02, and unspecifed other devices doe
- CVE-2019-3477Micro Focus Solution Business Manager versions prior to 11.4.2 is susceptible to open redirect.Micro Focus Solutions Business Manager
- CVE-2018-19999The local management interface in SolarWinds Serv-U FTP Server 15.1.6.25 has incorrect access controls that permit local users to bypass aut
- CVE-2018-20014In UrBackup 2.2.6, an attacker can send a malformed request to the client over the network, and trigger a fileservplugin/CClientThread.cpp C
- CVE-2018-20091An SQL injection vulnerability was found in Cloudera Data Science Workbench (CDSW) 1.4.0 through 1.4.2.
- CVE-2018-20135Samsung Galaxy Apps before 4.4.01.7 allows modification of the hostname used for load balancing on installations of applications through a m
- CVE-2018-20523Xiaomi Stock Browser 10.2.4.g on Xiaomi Redmi Note 5 Pro devices and other Redmi Android phones allows content provider injection.
- CVE-2018-5264Ubiquiti UniFi 52 devices, when Hotspot mode is used, allow remote attackers to bypass intended restrictions on "free time" Wi-Fi usage by s
- CVE-2019-12777An issue was discovered on the ENTTEC Datagate MK2, Storm 24, Pixelator, and E-Streamer MK2 with firmware 70044_update_05032019-482.
- CVE-2019-12776An issue was discovered on the ENTTEC Datagate MK2, Storm 24, Pixelator, and E-Streamer MK2 with firmware 70044_update_05032019-482.
- CVE-2019-12775An issue was discovered on the ENTTEC Datagate MK2, Storm 24, Pixelator, and E-Streamer MK2 with firmware 70044_update_05032019-482.
- CVE-2019-12774A number of stored XSS vulnerabilities have been identified in the web configuration feature in ENTTEC Datagate Mk2 70044_update_05032019-48
- CVE-2018-5265Ubiquiti EdgeOS 1.9.1 on EdgeRouter Lite devices allows remote attackers to execute arbitrary code with admin credentials, because /opt/vyat
- CVE-2018-5798This CVE relates to an unspecified cross site scripting vulnerability in Cloudera Manager.
- CVE-2018-6185In Cloudera Navigator Key Trustee KMS 5.12 and 5.13, incorrect default ACL values allow remote access to purge and undelete API calls on enc
- CVE-2019-12477Supra Smart Cloud TV allows remote file inclusion in the openLiveURL function, which allows a local attacker to broadcast fake video without
- CVE-2019-4070IBM Intelligent Operations Center (IOC) 5.1.0 through 5.2.0 is vulnerable to cross-site scripting.IBM Intelligent Operations Center
- CVE-2019-4068IBM Intelligent Operations Center (IOC) 5.1.0 through 5.2.0 is vulnerable to user enumeration, allowing an attacker to brute force into the IBM Intelligent Operations Center
- CVE-2019-4067IBM Intelligent Operations Center (IOC) 5.1.0 through 5.2.0 does not require that users should have strong passwords by default, which makesIBM Intelligent Operations Center
- CVE-2019-8282Gemalto Admin Control Center, all versions prior to 7.92, uses cleartext HTTP to communicate with www3.safenet-inc.com to obtain language paSentinel LDK RTE
- CVE-2019-8283Hasplm cookie in Gemalto Admin Control Center, all versions prior to 7.92, does not have 'HttpOnly' flag.Sentinel LDK RTE
- CVE-2019-6532Panasonic FPWIN Pro version 7.3.0.0 and prior allows attacker-created project files to be loaded by an authenticated user triggering incompaPanasonic FPWIN Pro
- CVE-2019-6530Panasonic FPWIN Pro version 7.3.0.0 and prior allows attacker-created project files to be loaded by an authenticated user causing heap-basedPanasonic FPWIN Pro
- CVE-2019-12771Command injection is possible in ThinStation through 6.1.1 via shell metacharacters after the cgi-bin/CdControl.cgi action= substring, or af
- CVE-2019-12763The Security Camera CZ application through 1.6.8 for Android stores potentially sensitive recorded video in external data storage, which is