# CVEs published 2019-06-07

76 CVEs were published on June 7, 2019: 1 critical, 2 high. Days are UTC.

- [CVE-2019-9086](https://cve.now/CVE-2019-9086.md): HotelDruid before v2.3.1 has SQL Injection via the /visualizza\_tabelle.php anno parameter. (no CVSS)
- [CVE-2019-9087](https://cve.now/CVE-2019-9087.md): HotelDruid before v2.3.1 has SQL Injection via the /tab\_tariffe.php numtariffa1 parameter. (no CVSS)
- [CVE-2019-9084](https://cve.now/CVE-2019-9084.md): In Hoteldruid before 2.3.1, a division by zero was discovered in $num\_tabelle in tab\_tariffe.php (aka the numtariffa1 parameter) due to the (no CVSS)
- [CVE-2019-12506](https://cve.now/CVE-2019-12506.md): Due to unencrypted and unauthenticated data communication, the wireless presenter Logitech R700 Laser Presentation Remote R-R0010 is prone t (no CVSS)
- [CVE-2019-12504](https://cve.now/CVE-2019-12504.md): Due to unencrypted and unauthenticated data communication, the wireless presenter Inateck WP2002 is prone to keystroke injection attacks. (no CVSS)
- [CVE-2019-12505](https://cve.now/CVE-2019-12505.md): Due to unencrypted and unauthenticated data communication, the wireless presenter Inateck WP1001 v1.3C is prone to keystroke injection attac (no CVSS)
- [CVE-2019-3957](https://cve.now/CVE-2019-3957.md): Dameware Remote Mini Control version 12.1.0.34 and prior contains an unauthenticated remote buffer over-read due to the server not properly (no CVSS, Solarwinds Dameware Remote Mini Controller)
- [CVE-2019-3956](https://cve.now/CVE-2019-3956.md): Dameware Remote Mini Control version 12.1.0.34 and prior contains an unauthenticated remote buffer over-read due to the server not properly (no CVSS, Solarwinds Dameware Remote Mini Controller)
- [CVE-2019-3955](https://cve.now/CVE-2019-3955.md): Dameware Remote Mini Control version 12.1.0.34 and prior contains a unauthenticated remote heap overflow due to the server not properly vali (no CVSS, Solarwinds Dameware Remote Mini Controller)
- [CVE-2018-10703](https://cve.now/CVE-2018-10703.md): An issue was discovered on Moxa AWK-3121 1.14 devices. (no CVSS)
- [CVE-2018-10702](https://cve.now/CVE-2018-10702.md): An issue was discovered on Moxa AWK-3121 1.14 devices. (no CVSS)
- [CVE-2018-10701](https://cve.now/CVE-2018-10701.md): An issue was discovered on Moxa AWK-3121 1.14 devices. (no CVSS)
- [CVE-2018-10700](https://cve.now/CVE-2018-10700.md): An issue was discovered on Moxa AWK-3121 1.19 devices. (no CVSS)
- [CVE-2019-12779](https://cve.now/CVE-2019-12779.md): libqb before 1.0.5 allows local users to overwrite arbitrary files via a symlink attack, because it uses predictable filenames (under /dev/s (no CVSS)
- [CVE-2019-2101](https://cve.now/CVE-2019-2101.md): In uvc\_parse\_standard\_control of uvc\_driver.c, there is a possible out-of-bound read due to improper input validation. (no CVSS, Android)
- [CVE-2019-2099](https://cve.now/CVE-2019-2099.md): In nfa\_rw\_store\_ndef\_rx\_buf of nfa\_rw\_act.cc, there is a possible out-of-bound write due to a missing bounds check. (no CVSS, Android)
- [CVE-2019-2098](https://cve.now/CVE-2019-2098.md): In areNotificationsEnabledForPackage of NotificationManagerService.java, there is a possible permissions bypass due to a missing permissions (no CVSS, Android)
- [CVE-2019-2102](https://cve.now/CVE-2019-2102.md): In the Bluetooth Low Energy (BLE) specification, there is a provided example Long Term Key (LTK). (no CVSS, Android)
- [CVE-2019-2097](https://cve.now/CVE-2019-2097.md): In HAliasAnalyzer.Query of hydrogen-alias-analysis.h, there is possible memory corruption due to type confusion. (no CVSS, Android)
- [CVE-2018-10699](https://cve.now/CVE-2018-10699.md): An issue was discovered on Moxa AWK-3121 1.14 devices. (no CVSS)
- [CVE-2019-2096](https://cve.now/CVE-2019-2096.md): In EffectRelease of EffectBundle.cpp, there is a possible memory corruption due to a double free. (no CVSS, Android)
- [CVE-2019-2095](https://cve.now/CVE-2019-2095.md): In callGenIDChangeListeners and related functions of SkPixelRef.cpp, there is a possible use after free due to a race condition. (no CVSS, Android)
- [CVE-2019-2094](https://cve.now/CVE-2019-2094.md): In parseMPEGCCData of NuPlayerCCDecoder.cpp, there is a possible out of bounds write due to missing bounds checks. (no CVSS, Android)
- [CVE-2019-2093](https://cve.now/CVE-2019-2093.md): In huff\_dec\_1D of nlc\_dec.cpp, there is a possible out of bounds write due to a missing bounds check. (no CVSS, Android)
- [CVE-2018-10698](https://cve.now/CVE-2018-10698.md): An issue was discovered on Moxa AWK-3121 1.14 devices. (no CVSS)
- [CVE-2019-2092](https://cve.now/CVE-2019-2092.md): In isSeparateProfileChallengeAllowed of DevicePolicyManagerService.java, there is a possible permissions bypass due to a missing permission (no CVSS, Android)
- [CVE-2019-2091](https://cve.now/CVE-2019-2091.md): In GetPermittedAccessibilityServicesForUser of DevicePolicyManagerService.java, there is a possible permissions bypass due to a missing perm (no CVSS, Android)
- [CVE-2019-2090](https://cve.now/CVE-2019-2090.md): In isPackageDeviceAdminOnAnyUser of PackageManagerService.java, there is a possible permissions bypass due to a missing permissions check. (no CVSS, Android)
- [CVE-2018-10697](https://cve.now/CVE-2018-10697.md): An issue was discovered on Moxa AWK-3121 1.14 devices. (no CVSS)
- [CVE-2018-10696](https://cve.now/CVE-2018-10696.md): An issue was discovered on Moxa AWK-3121 1.14 devices. (no CVSS)
- [CVE-2018-10695](https://cve.now/CVE-2018-10695.md): An issue was discovered on Moxa AWK-3121 1.14 devices. (no CVSS)
- [CVE-2018-10694](https://cve.now/CVE-2018-10694.md): An issue was discovered on Moxa AWK-3121 1.14 devices. (no CVSS)
- [CVE-2018-10693](https://cve.now/CVE-2018-10693.md): An issue was discovered on Moxa AWK-3121 1.14 devices. (no CVSS)
- [CVE-2018-10692](https://cve.now/CVE-2018-10692.md): An issue was discovered on Moxa AWK-3121 1.14 devices. (no CVSS)
- [CVE-2018-10691](https://cve.now/CVE-2018-10691.md): An issue was discovered on Moxa AWK-3121 1.14 devices. (no CVSS)
- [CVE-2018-10690](https://cve.now/CVE-2018-10690.md): An issue was discovered on Moxa AWK-3121 1.14 devices. (no CVSS)
- [CVE-2019-10160](https://cve.now/CVE-2019-10160.md): A security regression of CVE-2019-9636 was discovered in python since commit d537ab0ff9767ef024f26246899728f0116b1ec3 affecting versions 2.7 (CVSS 9.8, python)
- [CVE-2019-12599](https://cve.now/CVE-2019-12599.md): SuiteCRM 7.10.x before 7.10.17 and 7.11.x before 7.11.5 allows SQL Injection. (no CVSS)
- [CVE-2019-12598](https://cve.now/CVE-2019-12598.md): SuiteCRM 7.8.x before 7.8.30, 7.10.x before 7.10.17, and 7.11.x before 7.11.5 allows SQL Injection (issue 1 of 3). (no CVSS)
- [CVE-2019-12600](https://cve.now/CVE-2019-12600.md): SuiteCRM 7.8.x before 7.8.30, 7.10.x before 7.10.17, and 7.11.x before 7.11.5 allows SQL Injection (issue 2 of 3). (no CVSS)
- [CVE-2019-12601](https://cve.now/CVE-2019-12601.md): SuiteCRM 7.8.x before 7.8.30, 7.10.x before 7.10.17, and 7.11.x before 7.11.5 allows SQL Injection (issue 3 of 3). (no CVSS)
- [CVE-2018-19451](https://cve.now/CVE-2018-19451.md): A command injection can occur for specially crafted PDF files in Foxit Reader SDK (ActiveX) Professional 5.4.0.1031 when using the Open File (no CVSS)
- [CVE-2018-19452](https://cve.now/CVE-2018-19452.md): A use after free in the TextBox field Mouse Enter action in IReader\_ContentProvider can occur for specially crafted PDF files in Foxit Reade (no CVSS)
- [CVE-2018-19461](https://cve.now/CVE-2018-19461.md): admin\\db\\DoSql.php in EmpireCMS through 7.5 allows XSS via crafted SQL syntax to admin/admin.php. (no CVSS)
- [CVE-2018-19462](https://cve.now/CVE-2018-19462.md): admin\\db\\DoSql.php in EmpireCMS through 7.5 allows remote attackers to execute arbitrary PHP code via SQL injection that uses a .php filenam (no CVSS)
- [CVE-2018-19465](https://cve.now/CVE-2018-19465.md): Maccms through 8.0 allows XSS via the site\_keywords field to index.php?m=system-config because of tpl/module/system.php and tpl/html/system\_ (no CVSS)
- [CVE-2018-19800](https://cve.now/CVE-2018-19800.md): aubio v0.4.0 to v0.4.8 has a Buffer Overflow in new\_aubio\_tempo. (no CVSS, aubio)
- [CVE-2018-19801](https://cve.now/CVE-2018-19801.md): aubio v0.4.0 to v0.4.8 has a NULL pointer dereference in new\_aubio\_filterbank via invalid n\_filters. (no CVSS, aubio)
- [CVE-2018-19802](https://cve.now/CVE-2018-19802.md): aubio v0.4.0 to v0.4.8 has a new\_aubio\_onset NULL pointer dereference. (no CVSS, aubio)
- [CVE-2018-19860](https://cve.now/CVE-2018-19860.md): Broadcom firmware before summer 2014 on Nexus 5 BCM4335C0 2012-12-11, Raspberry Pi 3 BCM43438A1 2014-06-02, and unspecifed other devices doe (no CVSS)
- [CVE-2019-3477](https://cve.now/CVE-2019-3477.md): Micro Focus Solution Business Manager versions prior to 11.4.2 is susceptible to open redirect. (no CVSS, Micro Focus Solutions Business Manager)
- [CVE-2018-19999](https://cve.now/CVE-2018-19999.md): The local management interface in SolarWinds Serv-U FTP Server 15.1.6.25 has incorrect access controls that permit local users to bypass aut (no CVSS)
- [CVE-2018-20014](https://cve.now/CVE-2018-20014.md): In UrBackup 2.2.6, an attacker can send a malformed request to the client over the network, and trigger a fileservplugin/CClientThread.cpp C (no CVSS)
- [CVE-2018-20091](https://cve.now/CVE-2018-20091.md): An SQL injection vulnerability was found in Cloudera Data Science Workbench (CDSW) 1.4.0 through 1.4.2. (no CVSS)
- [CVE-2018-20135](https://cve.now/CVE-2018-20135.md): Samsung Galaxy Apps before 4.4.01.7 allows modification of the hostname used for load balancing on installations of applications through a m (no CVSS)
- [CVE-2018-20523](https://cve.now/CVE-2018-20523.md): Xiaomi Stock Browser 10.2.4.g on Xiaomi Redmi Note 5 Pro devices and other Redmi Android phones allows content provider injection. (no CVSS)
- [CVE-2018-5264](https://cve.now/CVE-2018-5264.md): Ubiquiti UniFi 52 devices, when Hotspot mode is used, allow remote attackers to bypass intended restrictions on "free time" Wi-Fi usage by s (no CVSS)
- [CVE-2019-12777](https://cve.now/CVE-2019-12777.md): An issue was discovered on the ENTTEC Datagate MK2, Storm 24, Pixelator, and E-Streamer MK2 with firmware 70044\_update\_05032019-482. (no CVSS)
- [CVE-2019-12776](https://cve.now/CVE-2019-12776.md): An issue was discovered on the ENTTEC Datagate MK2, Storm 24, Pixelator, and E-Streamer MK2 with firmware 70044\_update\_05032019-482. (no CVSS)
- [CVE-2019-12775](https://cve.now/CVE-2019-12775.md): An issue was discovered on the ENTTEC Datagate MK2, Storm 24, Pixelator, and E-Streamer MK2 with firmware 70044\_update\_05032019-482. (no CVSS)
- [CVE-2019-12774](https://cve.now/CVE-2019-12774.md): A number of stored XSS vulnerabilities have been identified in the web configuration feature in ENTTEC Datagate Mk2 70044\_update\_05032019-48 (no CVSS)
- [CVE-2018-5265](https://cve.now/CVE-2018-5265.md): Ubiquiti EdgeOS 1.9.1 on EdgeRouter Lite devices allows remote attackers to execute arbitrary code with admin credentials, because /opt/vyat (no CVSS)
- [CVE-2018-5798](https://cve.now/CVE-2018-5798.md): This CVE relates to an unspecified cross site scripting vulnerability in Cloudera Manager. (no CVSS)
- [CVE-2018-6185](https://cve.now/CVE-2018-6185.md): In Cloudera Navigator Key Trustee KMS 5.12 and 5.13, incorrect default ACL values allow remote access to purge and undelete API calls on enc (no CVSS)
- [CVE-2019-12477](https://cve.now/CVE-2019-12477.md): Supra Smart Cloud TV allows remote file inclusion in the openLiveURL function, which allows a local attacker to broadcast fake video without (no CVSS)
- [CVE-2019-4070](https://cve.now/CVE-2019-4070.md): IBM Intelligent Operations Center (IOC) 5.1.0 through 5.2.0 is vulnerable to cross-site scripting. (CVSS 5.4, IBM Intelligent Operations Center)
- [CVE-2019-4069](https://cve.now/CVE-2019-4069.md): IBM Intelligent Operations Center (IOC) 5.1.0 through 5.2.0 does not properly validate file types, allowing an attacker to upload malicious (CVSS 8.0, IBM Intelligent Operations Center)
- [CVE-2019-4068](https://cve.now/CVE-2019-4068.md): IBM Intelligent Operations Center (IOC) 5.1.0 through 5.2.0 is vulnerable to user enumeration, allowing an attacker to brute force into the (CVSS 5.9, IBM Intelligent Operations Center)
- [CVE-2019-4067](https://cve.now/CVE-2019-4067.md): IBM Intelligent Operations Center (IOC) 5.1.0 through 5.2.0 does not require that users should have strong passwords by default, which makes (CVSS 5.9, IBM Intelligent Operations Center)
- [CVE-2019-4066](https://cve.now/CVE-2019-4066.md): IBM Intelligent Operations Center (IOC) 5.1.0 through 5.2.0 could allow an authenciated user to create arbitrary users which could cause ID (CVSS 8.8, IBM Intelligent Operations Center)
- [CVE-2019-8282](https://cve.now/CVE-2019-8282.md): Gemalto Admin Control Center, all versions prior to 7.92, uses cleartext HTTP to communicate with www3.safenet-inc.com to obtain language pa (no CVSS, Sentinel LDK RTE)
- [CVE-2019-8283](https://cve.now/CVE-2019-8283.md): Hasplm cookie in Gemalto Admin Control Center, all versions prior to 7.92, does not have 'HttpOnly' flag. (no CVSS, Sentinel LDK RTE)
- [CVE-2019-6532](https://cve.now/CVE-2019-6532.md): Panasonic FPWIN Pro version 7.3.0.0 and prior allows attacker-created project files to be loaded by an authenticated user triggering incompa (no CVSS, Panasonic FPWIN Pro)
- [CVE-2019-6530](https://cve.now/CVE-2019-6530.md): Panasonic FPWIN Pro version 7.3.0.0 and prior allows attacker-created project files to be loaded by an authenticated user causing heap-based (no CVSS, Panasonic FPWIN Pro)
- [CVE-2019-12771](https://cve.now/CVE-2019-12771.md): Command injection is possible in ThinStation through 6.1.1 via shell metacharacters after the cgi-bin/CdControl.cgi action= substring, or af (no CVSS)
- [CVE-2019-12763](https://cve.now/CVE-2019-12763.md): The Security Camera CZ application through 1.6.8 for Android stores potentially sensitive recorded video in external data storage, which is (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2019-06-07
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.