# CVEs published 2019-06-10

23 CVEs were published on June 10, 2019: 0 critical, 0 high. Days are UTC.

- [CVE-2017-13717](https://cve.now/CVE-2017-13717.md): Starry Station (aka Starry Router) sets the Access-Control-Allow-Origin header to "\*". (no CVSS)
- [CVE-2017-13718](https://cve.now/CVE-2017-13718.md): The HTTP API supported by Starry Station (aka Starry Router) allows brute forcing the PIN setup by the user on the device, and this allows a (no CVSS)
- [CVE-2019-11881](https://cve.now/CVE-2019-11881.md): A vulnerability exists in Rancher before 2.2.4 in the login component, where the errorMsg parameter can be tampered to display arbitrary con (no CVSS, github.com/rancher/rancher)
- [CVE-2019-11027](https://cve.now/CVE-2019-11027.md): Ruby OpenID (aka ruby-openid) through 2.8.0 has a remotely exploitable flaw. (no CVSS, ruby-openid)
- [CVE-2019-12790](https://cve.now/CVE-2019-12790.md): In radare2 through 3.5.1, there is a heap-based buffer over-read in the r\_egg\_lang\_parsechar function of egg\_lang.c. (no CVSS)
- [CVE-2019-12788](https://cve.now/CVE-2019-12788.md): An issue was discovered in Photodex ProShow Producer v9.0.3797 (an application that runs with Administrator privileges). (no CVSS)
- [CVE-2019-12787](https://cve.now/CVE-2019-12787.md): An issue was discovered on D-Link DIR-818LW devices from 2.05.B03 to 2.06B01 BETA. (no CVSS)
- [CVE-2019-12786](https://cve.now/CVE-2019-12786.md): An issue was discovered on D-Link DIR-818LW devices from 2.05.B03 to 2.06B01 BETA. (no CVSS)
- [CVE-2019-11517](https://cve.now/CVE-2019-11517.md): WampServer before 3.1.9 has CSRF in add\_vhost.php because the synchronizer pattern implemented as remediation of CVE-2018-8817 was incomplet (no CVSS)
- [CVE-2019-9881](https://cve.now/CVE-2019-9881.md): The createComment mutation in the WPGraphQL 0.2.3 plugin for WordPress allows unauthenticated users to post comments on any article, even wh (no CVSS)
- [CVE-2019-9880](https://cve.now/CVE-2019-9880.md): An issue was discovered in the WPGraphQL 0.2.3 plugin for WordPress. (no CVSS)
- [CVE-2019-9879](https://cve.now/CVE-2019-9879.md): The WPGraphQL 0.2.3 plugin for WordPress allows remote attackers to register a new user with admin privileges, whenever new user registratio (no CVSS)
- [CVE-2019-11877](https://cve.now/CVE-2019-11877.md): XSS on the PIX-Link Repeater/Router LV-WR09 with firmware v28K.MiniRouter.20180616 allows attackers to steal credentials without being conne (no CVSS)
- [CVE-2018-20356](https://cve.now/CVE-2018-20356.md): An invalid read of 8 bytes due to a use-after-free vulnerability in the mg\_http\_free\_proto\_data\_cgi function call in mongoose.c in Cesanta M (no CVSS)
- [CVE-2018-20355](https://cve.now/CVE-2018-20355.md): An invalid write of 8 bytes due to a use-after-free vulnerability in the mg\_http\_free\_proto\_data\_cgi function call in mongoose.c in Cesanta (no CVSS)
- [CVE-2018-20354](https://cve.now/CVE-2018-20354.md): An invalid read of 8 bytes due to a use-after-free vulnerability during a "return" in the mg\_http\_get\_proto\_data function in mongoose.c in C (no CVSS)
- [CVE-2018-20353](https://cve.now/CVE-2018-20353.md): An invalid read of 8 bytes due to a use-after-free vulnerability during a "NULL test" in the mg\_http\_get\_proto\_data function in mongoose.c i (no CVSS)
- [CVE-2018-20352](https://cve.now/CVE-2018-20352.md): Use-after-free vulnerability in the mg\_cgi\_ev\_handler function in mongoose.c in Cesanta Mongoose Embedded Web Server Library 6.13 and earlie (no CVSS)
- [CVE-2019-6241](https://cve.now/CVE-2019-6241.md): In Bevywise MQTTRoute 1.1 build 1018-002, a connect packet combined with a malformed unsubscribe request packet can be used to cause a Denia (no CVSS)
- [CVE-2019-12780](https://cve.now/CVE-2019-12780.md): The Belkin Wemo Enabled Crock-Pot allows command injection in the Wemo UPnP API via the SmartDevURL argument to the SetSmartDevInfo action. (no CVSS)
- [CVE-2019-5243](https://cve.now/CVE-2019-5243.md): There is a Clickjacking vulnerability in Huawei HG255s product. (no CVSS, HG255s)
- [CVE-2019-12387](https://cve.now/CVE-2019-12387.md): In Twisted before 19.2.1, twisted.web did not validate or sanitize URIs or HTTP methods, allowing an attacker to inject invalid characters s (no CVSS, twisted)
- [CVE-2019-10226](https://cve.now/CVE-2019-10226.md): HTML Injection has been discovered in the v0.19.0 version of the Fat Free CRM product via an authenticated request to the /comments URI. (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2019-06-10
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.