CVEs published June 11, 2019
41 CVEs were published on June 11, 2019: 3 critical, 3 high. 1 is now in CISA KEV.
- Published
- 41
- Critical
- 3
- High
- 3
- Medium
- 2
- Low
- 0
- Unrated
- 33
- Now in CISA KEV
- 1
- Fix available
- 10
Most affected products
- Jenkins project Jenkins ElectricFlow Plugin · org.jenkins-c…
- 6
- Apache Software Foundation Apache HTTP Server
- 3
- Apache Fineract
- 2
- Jenkins project Jenkins JX Resources Plugin · org.jenkins-c…
- 2
- ZTE MF920
- 2
- ZTE WF820+ LTE Outdoor CPE
- 2
- Jenkins project Jenkins Token Macro Plugin · org.jenkins-ci…
- 1
- silverstripe/restfulserver · silverstripe/registry
- 1
- ZTE NetNumen DAP
- 1
Critical 3
- CVE-2010-5330On certain Ubiquiti devices, Command Injection exists via a GET request to stainfo.cgi (aka Show AP info) because the ifname variable is not
- CVE-2019-3412All versions up to BD_R218V2.4 of ZTE MF920 product are impacted by command execution vulnerability.ZTE MF920
- CVE-2019-3409All versions up to UKBB_WF820+_1.0.0B06 of ZTE WF820+ LTE Outdoor CPE product are impacted by command injection vulnerability.ZTE WF820+ LTE Outdoor CPE
High 3
- CVE-2017-18378In NETGEAR ReadyNAS Surveillance before 1.4.3-17 x86 and before 1.1.4-7 ARM, $_GET['uploaddir'] is not escaped and is passed to system() thr
- CVE-2019-3411All versions up to BD_R218V2.4 of ZTE MF920 product are impacted by information leak vulnerability.ZTE MF920
- CVE-2019-12749dbus before 1.10.28, 1.12.x before 1.12.16, and 1.13.x before 1.13.12, as used in DBusServer in Canonical Upstart in Ubuntu 14.04 (and in so
Medium, low and unrated 35
- CVE-2019-0197A vulnerability was found in Apache HTTP Server 2.4.34 to 2.4.38.Apache Software Foundation Apache HTTP Server
- CVE-2019-12149SQL injection vulnerability in silverstripe/restfulserver module 1.0.x before 1.0.9, 2.0.x before 2.0.4, and 2.1.x before 2.1.2 and silverstsilverstripe/restfulserver · silverstripe/registry
- CVE-2019-12795daemon/gvfsdaemon.c in gvfsd from GNOME gvfs before 1.38.3, 1.40.x before 1.40.2, and 1.41.x before 1.41.3 opened a private D-Bus server soc
- CVE-2019-0196A vulnerability was found in Apache HTTP Server 2.4.17 to 2.4.38.Apache Software Foundation Apache HTTP Server
- CVE-2019-12146A Directory Traversal issue was discovered in SSHServerAPI.dll in Progress ipswitch WS_FTP Server 2018 before 8.6.1.
- CVE-2019-12145A Directory Traversal issue was discovered in SSHServerAPI.dll in Progress ipswitch WS_FTP Server 2018 before 8.6.1.
- CVE-2019-12144An issue was discovered in SSHServerAPI.dll in Progress ipswitch WS_FTP Server 2018 before 8.6.1.
- CVE-2019-12143A Directory Traversal issue was discovered in SSHServerAPI.dll in Progress ipswitch WS_FTP Server 2018 before 8.6.1.
- CVE-2019-0220A vulnerability was found in Apache HTTP Server 2.4.0 to 2.4.38.Apache Software Foundation Apache HTTP Server
- CVE-2013-7471An issue was discovered in soap.cgi?service=WANIPConn1 on D-Link DIR-845 before v1.02b03, DIR-600 before v2.17b01, DIR-645 before v1.04b11,
- CVE-2016-10760On Seowon Intech routers, there is a Command Injection vulnerability in diagnostic.cgi via shell metacharacters in the ping_ipaddr parameter
- CVE-2009-5157On Linksys WAG54G2 1.00.10 devices, there is authenticated command injection via shell metacharacters in the setup.cgi c4_ping_ipaddr variab
- CVE-2009-5156An issue was discovered on ASMAX AR-804gu 66.34.1 devices.
- CVE-2018-20841HooToo TripMate Titan HT-TM05 and HT-05 routers with firmware 2.000.022 and 2.000.082 allow remote command execution via shell metacharacter
- CVE-2017-18377An issue was discovered on Wireless IP Camera (P2P) WIFICAM cameras.
- CVE-2019-12154XXE in the XML parser library in RealObjects PDFreactor before 10.1.10722 allows attackers to supply malicious XML content in externally ref
- CVE-2019-12153Lack of validation in the HTML parser in RealObjects PDFreactor before 10.1.10722 leads to SSRF, allowing attackers to access network or fil
- CVE-2019-3413All versions up to V20.18.40.R7.B1of ZTE NetNumen DAP product have an XSS vulnerability.ZTE NetNumen DAP
- CVE-2019-3410All versions up to UKBB_WF820+_1.0.0B06 of ZTE WF820+ LTE Outdoor CPE product are impacted by Cross-Site Request Forgery vulnerability,whichZTE WF820+ LTE Outdoor CPE
- CVE-2019-12766An issue was discovered in Joomla! before 3.9.7.
- CVE-2019-12765An issue was discovered in Joomla! before 3.9.7.
- CVE-2019-12764An issue was discovered in Joomla! before 3.9.7.
- CVE-2019-11334An authentication bypass in website post requests in the Tzumi Electronics Klic Lock application 1.0.9 for mobile devices allows attackers t
- CVE-2018-11801SQL injection vulnerability in Apache Fineract before 1.3.0 allows attackers to execute arbitrary SQL commands via a query on a m_center datApache Fineract
- CVE-2018-11800SQL injection vulnerability in Apache Fineract before 1.3.0 allows attackers to execute arbitrary SQL commands via a query on the GroupSummaApache Fineract
- CVE-2019-12794An issue was discovered in MISP 2.4.108.
- CVE-2019-10337An XML external entities (XXE) vulnerability in Jenkins Token Macro Plugin 2.7 and earlier allowed attackers able to control a the content oJenkins project Jenkins Token Macro Plugin · org.jenkins-ci…
- CVE-2019-10338A cross-site request forgery vulnerability in Jenkins JX Resources Plugin 1.0.36 and earlier in GlobalPluginConfiguration#doValidateClient aJenkins project Jenkins JX Resources Plugin · org.jenkins-c…
- CVE-2019-10339A missing permission check in Jenkins JX Resources Plugin 1.0.36 and earlier in GlobalPluginConfiguration#doValidateClient allowed users witJenkins project Jenkins JX Resources Plugin · org.jenkins-c…
- CVE-2019-10331A cross-site request forgery vulnerability in Jenkins ElectricFlow Plugin 1.1.5 and earlier in Configuration#doTestConnection allowed attackJenkins project Jenkins ElectricFlow Plugin · org.jenkins-c…
- CVE-2019-10332A missing permission check in Jenkins ElectricFlow Plugin 1.1.5 and earlier in Configuration#doTestConnection allowed users with Overall/ReaJenkins project Jenkins ElectricFlow Plugin · org.jenkins-c…
- CVE-2019-10333Missing permission checks in Jenkins ElectricFlow Plugin 1.1.5 and earlier in various HTTP endpoints allowed users with Overall/Read access Jenkins project Jenkins ElectricFlow Plugin · org.jenkins-c…
- CVE-2019-10334Jenkins ElectricFlow Plugin 1.1.5 and earlier disabled SSL/TLS and hostname verification globally for the Jenkins master JVM when MultipartUJenkins project Jenkins ElectricFlow Plugin · org.jenkins-c…
- CVE-2019-10335A stored cross site scripting vulnerability in Jenkins ElectricFlow Plugin 1.1.5 and earlier allowed attackers able to configure jobs in JenJenkins project Jenkins ElectricFlow Plugin · org.jenkins-c…
- CVE-2019-10336A reflected cross site scripting vulnerability in Jenkins ElectricFlow Plugin 1.1.6 and earlier allowed attackers able to control the outputJenkins project Jenkins ElectricFlow Plugin · org.jenkins-c…