# CVEs published 2019-06-17

70 CVEs were published on June 17, 2019: 1 critical, 2 high. Days are UTC.

- [CVE-2019-12865](https://cve.now/CVE-2019-12865.md): In radare2 through 3.5.1, cmd\_mount in libr/core/cmd\_mount.c has a double free for the ms command. (no CVSS)
- [CVE-2017-10720](https://cve.now/CVE-2017-10720.md): Recently it was discovered as a part of the research on IoT devices in the most recent firmware for Shekar Endoscope that the desktop applic (no CVSS)
- [CVE-2017-10722](https://cve.now/CVE-2017-10722.md): Recently it was discovered as a part of the research on IoT devices in the most recent firmware for Shekar Endoscope that the desktop applic (no CVSS)
- [CVE-2017-10724](https://cve.now/CVE-2017-10724.md): Recently it was discovered as a part of the research on IoT devices in the most recent firmware for Shekar Endoscope that an attacker connec (no CVSS)
- [CVE-2017-10723](https://cve.now/CVE-2017-10723.md): Recently it was discovered as a part of the research on IoT devices in the most recent firmware for Shekar Endoscope that an attacker connec (no CVSS)
- [CVE-2017-10718](https://cve.now/CVE-2017-10718.md): Recently it was discovered as a part of the research on IoT devices in the most recent firmware for Shekar Endoscope that any malicious user (no CVSS)
- [CVE-2017-10719](https://cve.now/CVE-2017-10719.md): Recently it was discovered as a part of the research on IoT devices in the most recent firmware for Shekar Endoscope that the device has def (no CVSS)
- [CVE-2017-10721](https://cve.now/CVE-2017-10721.md): Recently it was discovered as a part of the research on IoT devices in the most recent firmware for Shekar Endoscope that the device has Tel (no CVSS)
- [CVE-2019-5017](https://cve.now/CVE-2019-5017.md): An exploitable information disclosure vulnerability exists in the KCodes NetUSB.ko kernel module that enables the ReadySHARE Printer functio (CVSS 5.8, Talos KCodes)
- [CVE-2019-5016](https://cve.now/CVE-2019-5016.md): An exploitable arbitrary memory read vulnerability exists in the KCodes NetUSB.ko kernel module which enables the ReadySHARE Printer functio (CVSS 10.0, Talos KCodes)
- [CVE-2017-9392](https://cve.now/CVE-2017-9392.md): An issue was discovered on Vera VeraEdge 1.7.19 and Veralite 1.7.481 devices. (no CVSS)
- [CVE-2017-9391](https://cve.now/CVE-2017-9391.md): An issue was discovered on Vera VeraEdge 1.7.19 and Veralite 1.7.481 devices. (no CVSS)
- [CVE-2018-18958](https://cve.now/CVE-2018-18958.md): OPNsense 18.7.x before 18.7.7 has Incorrect Access Control. (no CVSS)
- [CVE-2018-19146](https://cve.now/CVE-2018-19146.md): Concrete5 8.4.3 has XSS because config/concrete.php allows uploads (by administrators) of SVG files that may contain HTML data with a SCRIPT (no CVSS)
- [CVE-2017-9382](https://cve.now/CVE-2017-9382.md): An issue was discovered on Vera VeraEdge 1.7.19 and Veralite 1.7.481 devices. (no CVSS)
- [CVE-2018-19444](https://cve.now/CVE-2018-19444.md): A use after free in the TextBox field Validate action in IReader\_ContentProvider can occur for specially crafted PDF files in Foxit Reader S (no CVSS)
- [CVE-2018-19445](https://cve.now/CVE-2018-19445.md): A command injection can occur for specially crafted PDF files in Foxit Reader SDK (ActiveX) Professional 5.4.0.1031 when the JavaScript API (no CVSS)
- [CVE-2017-9383](https://cve.now/CVE-2017-9383.md): An issue was discovered on Vera VeraEdge 1.7.19 and Veralite 1.7.481 devices. (no CVSS)
- [CVE-2018-19446](https://cve.now/CVE-2018-19446.md): A File Write can occur for specially crafted PDF files in Foxit Reader SDK (ActiveX) Professional 5.4.0.1031 when the JavaScript API Doc.cre (no CVSS)
- [CVE-2017-9385](https://cve.now/CVE-2017-9385.md): An issue was discovered on Vera Veralite 1.7.481 devices. (no CVSS)
- [CVE-2018-19447](https://cve.now/CVE-2018-19447.md): A stack-based buffer overflow can occur for specially crafted PDF files in Foxit Reader SDK (ActiveX) 5.4.0.1031 when parsing the URI string (no CVSS)
- [CVE-2018-19448](https://cve.now/CVE-2018-19448.md): In Foxit Reader SDK (ActiveX) Professional 5.4.0.1031, an uninitialized object in IReader\_ContentProvider::GetDocEventHandler occurs when em (no CVSS)
- [CVE-2017-9386](https://cve.now/CVE-2017-9386.md): An issue was discovered on Vera VeraEdge 1.7.19 and Veralite 1.7.481 devices. (no CVSS)
- [CVE-2018-19449](https://cve.now/CVE-2018-19449.md): A File Write can occur for specially crafted PDF files in Foxit Reader SDK (ActiveX) Professional 5.4.0.1031 when the JavaScript API Doc.exp (no CVSS)
- [CVE-2017-9389](https://cve.now/CVE-2017-9389.md): An issue was discovered on Vera VeraEdge 1.7.19 and Veralite 1.7.481 devices. (no CVSS)
- [CVE-2018-19450](https://cve.now/CVE-2018-19450.md): A command injection can occur for specially crafted PDF files in Foxit Reader SDK (ActiveX) 5.4.0.1031 when parsing a launch action. (no CVSS)
- [CVE-2017-9387](https://cve.now/CVE-2017-9387.md): An issue was discovered on Vera VeraEdge 1.7.19 and Veralite 1.7.481 devices. (no CVSS)
- [CVE-2017-9390](https://cve.now/CVE-2017-9390.md): An issue was discovered on Vera VeraEdge 1.7.19 and Veralite 1.7.481 devices. (no CVSS)
- [CVE-2019-7158](https://cve.now/CVE-2019-7158.md): OX App Suite 7.10.0 and earlier has Incorrect Access Control. (no CVSS)
- [CVE-2019-8321](https://cve.now/CVE-2019-8321.md): An issue was discovered in RubyGems 2.6 and later through 3.0.2. (no CVSS, rubygems-update)
- [CVE-2019-8322](https://cve.now/CVE-2019-8322.md): An issue was discovered in RubyGems 2.6 and later through 3.0.2. (no CVSS, rubygems-update)
- [CVE-2019-8323](https://cve.now/CVE-2019-8323.md): An issue was discovered in RubyGems 2.6 and later through 3.0.2. (no CVSS, rubygems-update)
- [CVE-2019-8325](https://cve.now/CVE-2019-8325.md): An issue was discovered in RubyGems 2.6 and later through 3.0.2. (no CVSS, rubygems-update)
- [CVE-2019-8324](https://cve.now/CVE-2019-8324.md): An issue was discovered in RubyGems 2.6 and later through 3.0.2. (no CVSS, rubygems-update)
- [CVE-2019-7315](https://cve.now/CVE-2019-7315.md): Genie Access WIP3BVAF WISH IP 3MP IR Auto Focus Bullet Camera devices through 3.x are vulnerable to directory traversal via the web interfac (no CVSS)
- [CVE-2019-7579](https://cve.now/CVE-2019-7579.md): An issue was discovered on Linksys WRT1900ACS 1.0.3.187766 devices. (no CVSS)
- [CVE-2019-11410](https://cve.now/CVE-2019-11410.md): app/backup/index.php in the Backup Module in FusionPBX 4.4.3 suffers from a command injection vulnerability due to a lack of input validatio (no CVSS)
- [CVE-2019-11409](https://cve.now/CVE-2019-11409.md): app/operator\_panel/exec.php in the Operator Panel module in FusionPBX 4.4.3 suffers from a command injection vulnerability due to a lack of (no CVSS)
- [CVE-2019-11408](https://cve.now/CVE-2019-11408.md): XSS in app/operator\_panel/index\_inc.php in the Operator Panel module in FusionPBX 4.4.3 allows remote unauthenticated attackers to inject ar (no CVSS)
- [CVE-2019-10997](https://cve.now/CVE-2019-10997.md): An issue was discovered on Phoenix Contact AXC F 2152 (No.2404267) before 2019.0 LTS and AXC F 2152 STARTERKIT (No.1046568) before 2019.0 LT (no CVSS)
- [CVE-2019-11407](https://cve.now/CVE-2019-11407.md): app/operator\_panel/index\_inc.php in the Operator Panel module in FusionPBX 4.4.3 suffers from an information disclosure vulnerability due to (no CVSS)
- [CVE-2019-12801](https://cve.now/CVE-2019-12801.md): out/out.GroupMgr.php in SeedDMS 5.1.11 has Stored XSS by making a new group with a JavaScript payload as the "GROUP" Name. (no CVSS)
- [CVE-2017-9381](https://cve.now/CVE-2017-9381.md): An issue was discovered on Vera VeraEdge 1.7.19 and Veralite 1.7.481 devices. (no CVSS)
- [CVE-2017-9384](https://cve.now/CVE-2017-9384.md): An issue was discovered on Vera VeraEdge 1.7.19 and Veralite 1.7.481 devices. (no CVSS)
- [CVE-2019-12476](https://cve.now/CVE-2019-12476.md): An authentication bypass vulnerability in the password reset functionality in Zoho ManageEngine ADSelfService Plus before 5.0.6 allows an at (no CVSS)
- [CVE-2017-9388](https://cve.now/CVE-2017-9388.md): An issue was discovered on Vera VeraEdge 1.7.19 and Veralite 1.7.481 devices. (no CVSS)
- [CVE-2019-12549](https://cve.now/CVE-2019-12549.md): WAGO 852-303 before FW06, 852-1305 before FW06, and 852-1505 before FW03 devices contain hardcoded private keys for the SSH daemon. (no CVSS)
- [CVE-2019-12550](https://cve.now/CVE-2019-12550.md): WAGO 852-303 before FW06, 852-1305 before FW06, and 852-1505 before FW03 devices contain hardcoded users and passwords that can be used to l (no CVSS)
- [CVE-2019-12789](https://cve.now/CVE-2019-12789.md): An issue was discovered on Actiontec T2200H T2200H-31.128L.08 devices, as distributed by Telus. (no CVSS)
- [CVE-2019-6327](https://cve.now/CVE-2019-6327.md): HP Color LaserJet Pro M280-M281 Multifunction Printer series (before v. (no CVSS, HP Color LaserJet Pro M280-M281 Multifunction Printer serie…)
- [CVE-2019-6326](https://cve.now/CVE-2019-6326.md): HP Color LaserJet Pro M280-M281 Multifunction Printer series (before v. (no CVSS, HP Color LaserJet Pro M280-M281 Multifunction Printer serie…)
- [CVE-2019-6325](https://cve.now/CVE-2019-6325.md): HP Color LaserJet Pro M280-M281 Multifunction Printer series (before v. (no CVSS, HP Color LaserJet Pro M280-M281 Multifunction Printer serie…)
- [CVE-2019-6324](https://cve.now/CVE-2019-6324.md): HP Color LaserJet Pro M280-M281 Multifunction Printer series (before v. (no CVSS, HP Color LaserJet Pro M280-M281 Multifunction Printer serie…)
- [CVE-2019-6323](https://cve.now/CVE-2019-6323.md): HP Color LaserJet Pro M280-M281 Multifunction Printer series (before v. (no CVSS, HP Color LaserJet Pro M280-M281 Multifunction Printer serie…)
- [CVE-2019-12181](https://cve.now/CVE-2019-12181.md): A privilege escalation vulnerability exists in SolarWinds Serv-U before 15.1.7 for Linux. (no CVSS)
- [CVE-2019-4177](https://cve.now/CVE-2019-4177.md): IBM Cognos Controller 10.2.0, 10.2.1, 10.3.0, 10.3.1, and 10.4.0 allows web pages to be stored locally which can be read by another user on (CVSS 4.0, IBM Cognos Controller)
- [CVE-2019-4176](https://cve.now/CVE-2019-4176.md): IBM Cognos Controller 10.2.0, 10.2.1, 10.3.0, 10.3.1, and 10.4.0 could allow a remote attacker to bypass security restrictions, caused by an (CVSS 5.3, IBM Cognos Controller)
- [CVE-2019-4174](https://cve.now/CVE-2019-4174.md): IBM Cognos Controller 10.2.0, 10.2.1, 10.3.0, 10.3.1, and 10.4.0 allows web pages to be stored locally which can be read by another user on (CVSS 4.0, IBM Cognos Controller)
- [CVE-2019-4173](https://cve.now/CVE-2019-4173.md): IBM Cognos Controller 10.2.0, 10.2.1, 10.3.0, 10.3.1, and 10.4.0 could allow a remote attacker to obtain sensitive information, caused by a (CVSS 6.5, IBM Cognos Controller)
- [CVE-2019-4136](https://cve.now/CVE-2019-4136.md): IBM Cognos Controller 10.2.0, 10.2.1, 10.3.0, 10.3.1, and 10.4.0 is vulnerable to cross-site scripting. (CVSS 5.4, IBM Cognos Controller)
- [CVE-2019-4103](https://cve.now/CVE-2019-4103.md): IBM Tivoli Netcool/Impact 7.1.0 allows for remote execution of command by low privileged User. (CVSS 8.0, IBM Tivoli Netcool/Impact)
- [CVE-2018-1845](https://cve.now/CVE-2018-1845.md): IBM InfoSphere Information Server 11.3, 11.5, and 11.7 is vulnerable to a XML External Entity Injection (XXE) attack when processing XML dat (CVSS 7.1, IBM InfoSphere Information Server)
- [CVE-2018-10239](https://cve.now/CVE-2018-10239.md): A privilege escalation vulnerability in the "support access" feature on Infoblox NIOS 6.8 through 8.4.1 could allow a locally authenticated (no CVSS)
- [CVE-2018-20468](https://cve.now/CVE-2018-20468.md): An issue was discovered in Tyto Sahi Pro through 7.x.x and 8.0.0. (no CVSS)
- [CVE-2018-20469](https://cve.now/CVE-2018-20469.md): An issue was discovered in Tyto Sahi Pro through 7.x.x and 8.0.0. (no CVSS)
- [CVE-2018-20470](https://cve.now/CVE-2018-20470.md): An issue was discovered in Tyto Sahi Pro through 7.x.x and 8.0.0. (no CVSS)
- [CVE-2018-20472](https://cve.now/CVE-2018-20472.md): An issue was discovered in Tyto Sahi Pro through 7.x.x and 8.0.0. (no CVSS)
- [CVE-2019-12248](https://cve.now/CVE-2019-12248.md): An issue was discovered in Open Ticket Request System (OTRS) 7.0.x through 7.0.7, Community Edition 6.0.x through 6.0.19, and Community Edit (no CVSS)
- [CVE-2019-12497](https://cve.now/CVE-2019-12497.md): An issue was discovered in Open Ticket Request System (OTRS) 7.0.x through 7.0.8, Community Edition 6.0.x through 6.0.19, and Community Edit (no CVSS)
- [CVE-2019-12868](https://cve.now/CVE-2019-12868.md): app/Model/Server.php in MISP 2.4.109 allows remote command execution by a super administrator because the PHP file\_exists function is used w (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2019-06-17
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.