CVEs published June 10, 2019
23 CVEs were published on June 10, 2019: 0 critical, 0 high.
- Published
- 23
- Critical
- 0
- High
- 0
- Medium
- 0
- Low
- 0
- Unrated
- 23
- Now in CISA KEV
- 0
- Fix available
- 2
Most affected products
- github.com/rancher/rancher
- 1
- HG255s
- 1
- ruby-openid
- 1
- twisted
- 1
Medium, low and unrated 23
- CVE-2017-13717Starry Station (aka Starry Router) sets the Access-Control-Allow-Origin header to "*".
- CVE-2017-13718The HTTP API supported by Starry Station (aka Starry Router) allows brute forcing the PIN setup by the user on the device, and this allows a
- CVE-2019-11881A vulnerability exists in Rancher before 2.2.4 in the login component, where the errorMsg parameter can be tampered to display arbitrary congithub.com/rancher/rancher
- CVE-2019-11027Ruby OpenID (aka ruby-openid) through 2.8.0 has a remotely exploitable flaw.ruby-openid
- CVE-2019-12790In radare2 through 3.5.1, there is a heap-based buffer over-read in the r_egg_lang_parsechar function of egg_lang.c.
- CVE-2019-12788An issue was discovered in Photodex ProShow Producer v9.0.3797 (an application that runs with Administrator privileges).
- CVE-2019-12787An issue was discovered on D-Link DIR-818LW devices from 2.05.B03 to 2.06B01 BETA.
- CVE-2019-12786An issue was discovered on D-Link DIR-818LW devices from 2.05.B03 to 2.06B01 BETA.
- CVE-2019-11517WampServer before 3.1.9 has CSRF in add_vhost.php because the synchronizer pattern implemented as remediation of CVE-2018-8817 was incomplet
- CVE-2019-9881The createComment mutation in the WPGraphQL 0.2.3 plugin for WordPress allows unauthenticated users to post comments on any article, even wh
- CVE-2019-9880An issue was discovered in the WPGraphQL 0.2.3 plugin for WordPress.
- CVE-2019-9879The WPGraphQL 0.2.3 plugin for WordPress allows remote attackers to register a new user with admin privileges, whenever new user registratio
- CVE-2019-11877XSS on the PIX-Link Repeater/Router LV-WR09 with firmware v28K.MiniRouter.20180616 allows attackers to steal credentials without being conne
- CVE-2018-20356An invalid read of 8 bytes due to a use-after-free vulnerability in the mg_http_free_proto_data_cgi function call in mongoose.c in Cesanta M
- CVE-2018-20355An invalid write of 8 bytes due to a use-after-free vulnerability in the mg_http_free_proto_data_cgi function call in mongoose.c in Cesanta
- CVE-2018-20354An invalid read of 8 bytes due to a use-after-free vulnerability during a "return" in the mg_http_get_proto_data function in mongoose.c in C
- CVE-2018-20353An invalid read of 8 bytes due to a use-after-free vulnerability during a "NULL test" in the mg_http_get_proto_data function in mongoose.c i
- CVE-2018-20352Use-after-free vulnerability in the mg_cgi_ev_handler function in mongoose.c in Cesanta Mongoose Embedded Web Server Library 6.13 and earlie
- CVE-2019-6241In Bevywise MQTTRoute 1.1 build 1018-002, a connect packet combined with a malformed unsubscribe request packet can be used to cause a Denia
- CVE-2019-12780The Belkin Wemo Enabled Crock-Pot allows command injection in the Wemo UPnP API via the SmartDevURL argument to the SetSmartDevInfo action.
- CVE-2019-5243There is a Clickjacking vulnerability in Huawei HG255s product.HG255s
- CVE-2019-12387In Twisted before 19.2.1, twisted.web did not validate or sanitize URIs or HTTP methods, allowing an attacker to inject invalid characters stwisted
- CVE-2019-10226HTML Injection has been discovered in the v0.19.0 version of the Fat Free CRM product via an authenticated request to the /comments URI.