# CVEs published 2019-06-11

41 CVEs were published on June 11, 2019: 3 critical, 3 high. 1 is now in CISA KEV. Days are UTC.

- [CVE-2019-0197](https://cve.now/CVE-2019-0197.md): A vulnerability was found in Apache HTTP Server 2.4.34 to 2.4.38. (no CVSS, Apache Software Foundation Apache HTTP Server)
- [CVE-2019-12149](https://cve.now/CVE-2019-12149.md): SQL injection vulnerability in silverstripe/restfulserver module 1.0.x before 1.0.9, 2.0.x before 2.0.4, and 2.1.x before 2.1.2 and silverst (no CVSS, silverstripe/restfulserver · silverstripe/registry)
- [CVE-2019-12795](https://cve.now/CVE-2019-12795.md): daemon/gvfsdaemon.c in gvfsd from GNOME gvfs before 1.38.3, 1.40.x before 1.40.2, and 1.41.x before 1.41.3 opened a private D-Bus server soc (no CVSS)
- [CVE-2019-0196](https://cve.now/CVE-2019-0196.md): A vulnerability was found in Apache HTTP Server 2.4.17 to 2.4.38. (no CVSS, Apache Software Foundation Apache HTTP Server)
- [CVE-2019-12146](https://cve.now/CVE-2019-12146.md): A Directory Traversal issue was discovered in SSHServerAPI.dll in Progress ipswitch WS\_FTP Server 2018 before 8.6.1. (no CVSS)
- [CVE-2019-12145](https://cve.now/CVE-2019-12145.md): A Directory Traversal issue was discovered in SSHServerAPI.dll in Progress ipswitch WS\_FTP Server 2018 before 8.6.1. (no CVSS)
- [CVE-2019-12144](https://cve.now/CVE-2019-12144.md): An issue was discovered in SSHServerAPI.dll in Progress ipswitch WS\_FTP Server 2018 before 8.6.1. (no CVSS)
- [CVE-2019-12143](https://cve.now/CVE-2019-12143.md): A Directory Traversal issue was discovered in SSHServerAPI.dll in Progress ipswitch WS\_FTP Server 2018 before 8.6.1. (no CVSS)
- [CVE-2019-0220](https://cve.now/CVE-2019-0220.md): A vulnerability was found in Apache HTTP Server 2.4.0 to 2.4.38. (no CVSS, Apache Software Foundation Apache HTTP Server)
- [CVE-2013-7471](https://cve.now/CVE-2013-7471.md): An issue was discovered in soap.cgi?service=WANIPConn1 on D-Link DIR-845 before v1.02b03, DIR-600 before v2.17b01, DIR-645 before v1.04b11, (no CVSS)
- [CVE-2016-10760](https://cve.now/CVE-2016-10760.md): On Seowon Intech routers, there is a Command Injection vulnerability in diagnostic.cgi via shell metacharacters in the ping\_ipaddr parameter (no CVSS)
- [CVE-2009-5157](https://cve.now/CVE-2009-5157.md): On Linksys WAG54G2 1.00.10 devices, there is authenticated command injection via shell metacharacters in the setup.cgi c4\_ping\_ipaddr variab (no CVSS)
- [CVE-2009-5156](https://cve.now/CVE-2009-5156.md): An issue was discovered on ASMAX AR-804gu 66.34.1 devices. (no CVSS)
- [CVE-2010-5330](https://cve.now/CVE-2010-5330.md): On certain Ubiquiti devices, Command Injection exists via a GET request to stainfo.cgi (aka Show AP info) because the ifname variable is not (CVSS 9.8, KEV)
- [CVE-2018-20841](https://cve.now/CVE-2018-20841.md): HooToo TripMate Titan HT-TM05 and HT-05 routers with firmware 2.000.022 and 2.000.082 allow remote command execution via shell metacharacter (no CVSS)
- [CVE-2017-18378](https://cve.now/CVE-2017-18378.md): In NETGEAR ReadyNAS Surveillance before 1.4.3-17 x86 and before 1.1.4-7 ARM, $\_GET\['uploaddir'\] is not escaped and is passed to system() thr (CVSS 8.4)
- [CVE-2017-18377](https://cve.now/CVE-2017-18377.md): An issue was discovered on Wireless IP Camera (P2P) WIFICAM cameras. (no CVSS)
- [CVE-2019-12154](https://cve.now/CVE-2019-12154.md): XXE in the XML parser library in RealObjects PDFreactor before 10.1.10722 allows attackers to supply malicious XML content in externally ref (no CVSS)
- [CVE-2019-12153](https://cve.now/CVE-2019-12153.md): Lack of validation in the HTML parser in RealObjects PDFreactor before 10.1.10722 leads to SSRF, allowing attackers to access network or fil (no CVSS)
- [CVE-2019-3413](https://cve.now/CVE-2019-3413.md): All versions up to V20.18.40.R7.B1of ZTE NetNumen DAP product have an XSS vulnerability. (CVSS 5.4, ZTE NetNumen DAP)
- [CVE-2019-3412](https://cve.now/CVE-2019-3412.md): All versions up to BD\_R218V2.4 of ZTE MF920 product are impacted by command execution vulnerability. (CVSS 9.8, ZTE MF920)
- [CVE-2019-3411](https://cve.now/CVE-2019-3411.md): All versions up to BD\_R218V2.4 of ZTE MF920 product are impacted by information leak vulnerability. (CVSS 8.1, ZTE MF920)
- [CVE-2019-3410](https://cve.now/CVE-2019-3410.md): All versions up to UKBB\_WF820+\_1.0.0B06 of ZTE WF820+ LTE Outdoor CPE product are impacted by Cross-Site Request Forgery vulnerability,which (CVSS 4.6, ZTE WF820+ LTE Outdoor CPE)
- [CVE-2019-3409](https://cve.now/CVE-2019-3409.md): All versions up to UKBB\_WF820+\_1.0.0B06 of ZTE WF820+ LTE Outdoor CPE product are impacted by command injection vulnerability. (CVSS 9.0, ZTE WF820+ LTE Outdoor CPE)
- [CVE-2019-12766](https://cve.now/CVE-2019-12766.md): An issue was discovered in Joomla! before 3.9.7. (no CVSS)
- [CVE-2019-12765](https://cve.now/CVE-2019-12765.md): An issue was discovered in Joomla! before 3.9.7. (no CVSS)
- [CVE-2019-12764](https://cve.now/CVE-2019-12764.md): An issue was discovered in Joomla! before 3.9.7. (no CVSS)
- [CVE-2019-11334](https://cve.now/CVE-2019-11334.md): An authentication bypass in website post requests in the Tzumi Electronics Klic Lock application 1.0.9 for mobile devices allows attackers t (no CVSS)
- [CVE-2018-11801](https://cve.now/CVE-2018-11801.md): SQL injection vulnerability in Apache Fineract before 1.3.0 allows attackers to execute arbitrary SQL commands via a query on a m\_center dat (no CVSS, Apache Fineract)
- [CVE-2018-11800](https://cve.now/CVE-2018-11800.md): SQL injection vulnerability in Apache Fineract before 1.3.0 allows attackers to execute arbitrary SQL commands via a query on the GroupSumma (no CVSS, Apache Fineract)
- [CVE-2019-12794](https://cve.now/CVE-2019-12794.md): An issue was discovered in MISP 2.4.108. (no CVSS)
- [CVE-2019-12749](https://cve.now/CVE-2019-12749.md): dbus before 1.10.28, 1.12.x before 1.12.16, and 1.13.x before 1.13.12, as used in DBusServer in Canonical Upstart in Ubuntu 14.04 (and in so (CVSS 7.1)
- [CVE-2019-10337](https://cve.now/CVE-2019-10337.md): An XML external entities (XXE) vulnerability in Jenkins Token Macro Plugin 2.7 and earlier allowed attackers able to control a the content o (no CVSS, Jenkins project Jenkins Token Macro Plugin · org.jenkins-ci…)
- [CVE-2019-10338](https://cve.now/CVE-2019-10338.md): A cross-site request forgery vulnerability in Jenkins JX Resources Plugin 1.0.36 and earlier in GlobalPluginConfiguration#doValidateClient a (no CVSS, Jenkins project Jenkins JX Resources Plugin · org.jenkins-c…)
- [CVE-2019-10339](https://cve.now/CVE-2019-10339.md): A missing permission check in Jenkins JX Resources Plugin 1.0.36 and earlier in GlobalPluginConfiguration#doValidateClient allowed users wit (no CVSS, Jenkins project Jenkins JX Resources Plugin · org.jenkins-c…)
- [CVE-2019-10331](https://cve.now/CVE-2019-10331.md): A cross-site request forgery vulnerability in Jenkins ElectricFlow Plugin 1.1.5 and earlier in Configuration#doTestConnection allowed attack (no CVSS, Jenkins project Jenkins ElectricFlow Plugin · org.jenkins-c…)
- [CVE-2019-10332](https://cve.now/CVE-2019-10332.md): A missing permission check in Jenkins ElectricFlow Plugin 1.1.5 and earlier in Configuration#doTestConnection allowed users with Overall/Rea (no CVSS, Jenkins project Jenkins ElectricFlow Plugin · org.jenkins-c…)
- [CVE-2019-10333](https://cve.now/CVE-2019-10333.md): Missing permission checks in Jenkins ElectricFlow Plugin 1.1.5 and earlier in various HTTP endpoints allowed users with Overall/Read access (no CVSS, Jenkins project Jenkins ElectricFlow Plugin · org.jenkins-c…)
- [CVE-2019-10334](https://cve.now/CVE-2019-10334.md): Jenkins ElectricFlow Plugin 1.1.5 and earlier disabled SSL/TLS and hostname verification globally for the Jenkins master JVM when MultipartU (no CVSS, Jenkins project Jenkins ElectricFlow Plugin · org.jenkins-c…)
- [CVE-2019-10335](https://cve.now/CVE-2019-10335.md): A stored cross site scripting vulnerability in Jenkins ElectricFlow Plugin 1.1.5 and earlier allowed attackers able to configure jobs in Jen (no CVSS, Jenkins project Jenkins ElectricFlow Plugin · org.jenkins-c…)
- [CVE-2019-10336](https://cve.now/CVE-2019-10336.md): A reflected cross site scripting vulnerability in Jenkins ElectricFlow Plugin 1.1.6 and earlier allowed attackers able to control the output (no CVSS, Jenkins project Jenkins ElectricFlow Plugin · org.jenkins-c…)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2019-06-11
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.