CVEs published June 18, 2019
49 CVEs were published on June 18, 2019: 0 critical, 3 high.
- Published
- 49
- Critical
- 0
- High
- 3
- Medium
- 7
- Low
- 1
- Unrated
- 38
- Now in CISA KEV
- 0
- Fix available
- 5
Most affected products
- Linux kernel
- 3
- PHP Group PHP
- 3
- Advantech WebAccess/SCADA
- 2
- Apache Allura
- 1
- Cloud Foundry BOSH
- 1
- craftcms/cms
- 1
- Exacq Technologies exacqVision Enterprise System Manager
- 1
- IBM Cloud Private
- 1
- The Linux Foundation kernel
- 1
High 3
- CVE-2019-3896A double-free can happen in idr_remove_all() in lib/idr.c in the Linux kernel 2.6 branch.The Linux Foundation kernel
- CVE-2019-11477Integer overflow in TCP_SKB_CB(skb)->tcp_gso_segsLinux kernel
- CVE-2012-6711A heap-based buffer overflow exists in GNU Bash before 4.3 when wide characters, not supported by the current locale set in the LC_CTYPE env
Medium, low and unrated 46
- CVE-2019-11271Bosh Deployment logs leak sensitive informationCloud Foundry BOSH
- CVE-2019-11479Jonathan Looney discovered that the Linux kernel default MSS is hard-coded to 48 bytes.Linux kernel
- CVE-2019-11478SACK can cause extensive memory use via fragmented resend queueLinux kernel
- CVE-2019-11040Heap buffer overflow in EXIF extensionPHP Group PHP
- CVE-2019-11039Out-of-bounds read in iconv.cPHP Group PHP
- CVE-2019-11038Uninitialized read in gdImageCreateFromXbmPHP Group PHP
- CVE-2019-3954Stack-based buffer overflow in Advantech WebAccess/SCADA 8.4.0 allows a remote, unauthenticated attacker to execute arbitrary code by sendinAdvantech WebAccess/SCADA
- CVE-2019-10085In Apache Allura prior to 1.11.0, a vulnerability exists for stored XSS on the user dropdown selector when creating or editing tickets.Apache Allura
- CVE-2019-3953Stack-based buffer overflow in Advantech WebAccess/SCADA 8.4.0 allows a remote, unauthenticated attacker to execute arbitrary code by sendinAdvantech WebAccess/SCADA
- CVE-2019-12881i915_gem_userptr_get_pages in drivers/gpu/drm/i915/i915_gem_userptr.c in the Linux kernel 4.15.0 on Ubuntu 18.04.2 allows local users to cau
- CVE-2019-12133Multiple Zoho ManageEngine products suffer from local privilege escalation due to improper permissions for the %SYSTEMDRIVE%\ManageEngine di
- CVE-2017-8337An issue was discovered on Securifi Almond, Almond+, and Almond 2015 devices with firmware AL-R096.
- CVE-2017-8330An issue was discovered on Securifi Almond, Almond+, and Almond 2015 devices with firmware AL-R096.
- CVE-2019-12592A universal Cross-site scripting (UXSS) vulnerability in the Evernote Web Clipper extension before 7.11.1 for Chrome allows remote attackers
- CVE-2017-8332An issue was discovered on Securifi Almond, Almond+, and Almond 2015 devices with firmware AL-R096.
- CVE-2017-8334An issue was discovered on Securifi Almond, Almond+, and Almond 2015 devices with firmware AL-R096.
- CVE-2017-8328An issue was discovered on Securifi Almond, Almond+, and Almond 2015 devices with firmware AL-R096.
- CVE-2017-8331An issue was discovered on Securifi Almond, Almond+, and Almond 2015 devices with firmware AL-R096.
- CVE-2017-8333An issue was discovered on Securifi Almond, Almond+, and Almond 2015 devices with firmware AL-R096.
- CVE-2017-8329An issue was discovered on Securifi Almond, Almond+, and Almond 2015 devices with firmware AL-R096.
- CVE-2017-8335An issue was discovered on Securifi Almond, Almond+, and Almond 2015 devices with firmware AL-R096.
- CVE-2017-8336An issue was discovered on Securifi Almond, Almond+, and Almond 2015 devices with firmware AL-R096.
- CVE-2019-12875Alpine Linux abuild through 3.4.0 allows an unprivileged member of the abuild group to add an untrusted package via a --keys-dir option that
- CVE-2019-12874An issue was discovered in zlib_decompress_extra in modules/demux/mkv/util.cpp in VideoLAN VLC media player 3.x through 3.0.7.
- CVE-2018-18802The Tubigan "Welcome to our Resort" 1.0 software allows CSRF via admin/mod_users/controller.php?action=edit.
- CVE-2018-18836An issue was discovered in Netdata 1.10.0.
- CVE-2018-18837An issue was discovered in Netdata 1.10.0.
- CVE-2018-18838An issue was discovered in Netdata 1.10.0.
- CVE-2018-18839An issue was discovered in Netdata 1.10.0.
- CVE-2018-18852Cerio DT-300N 1.1.6 through 1.1.12 devices allow OS command injection because of improper input validation of the web-interface PING feature
- CVE-2019-4142IBM Cloud Private 2.1.0, 3.1.0, 3.1.1, and 3.1.2 is vulnerable to cross-site request forgery which could allow an attacker to execute maliciIBM Cloud Private
- CVE-2018-18875In firmware version MS_2.6.9900 of Columbia Weather MicroServer, a stored Cross-site scripting (XSS) vulnerability allows remote authenticat
- CVE-2018-18876In firmware version MS_2.6.9900 of Columbia Weather MicroServer, a readouts_rd.php directory traversal issue makes it possible to read any f
- CVE-2018-18877In firmware version MS_2.6.9900 of Columbia Weather MicroServer, an authenticated web user can access an alternative configuration page conf
- CVE-2018-18878In firmware version MS_2.6.9900 of Columbia Weather MicroServer, the BACnet daemon does not properly validate input, which could allow a rem
- CVE-2018-18879In firmware version MS_2.6.9900 of Columbia Weather MicroServer, an authenticated web user can pipe commands directly to the underlying oper
- CVE-2019-7588exacqVision Enterprise System Manager (ESM) privilege escalationExacq Technologies exacqVision Enterprise System Manager
- CVE-2019-12872dotCMS before 5.1.6 is vulnerable to a SQL injection that can be exploited by an attacker of the role Publisher via view_unpushed_bundles.js
- CVE-2018-18880In firmware version MS_2.6.9900 of Columbia Weather MicroServer, a networkdiags.php reflected Cross-site scripting (XSS) vulnerability allow
- CVE-2018-18886Helpy v2.1.0 has Stored XSS via the Ticket title.
- CVE-2018-18944Artha ~ The Open Thesaurus 1.0.3.0 has a Buffer Overflow.
- CVE-2018-20013In UrBackup 2.2.6, an attacker can send a malformed request to the client over the network, and trigger a fileservplugin/CClientThread.cpp C
- CVE-2019-6965An XSS issue was discovered in i-doit Open 1.12 via the src/tools/php/qr/qr.php url parameter.
- CVE-2019-7159OX App Suite 7.10.1 and earlier allows Information Exposure.
- CVE-2019-10998An issue was discovered on Phoenix Contact AXC F 2152 (No.2404267) before 2019.0 LTS and AXC F 2152 STARTERKIT (No.1046568) before 2019.0 LT
- CVE-2019-12823Craft CMS before 3.1.31 does not properly filter XML feeds and thus allowing XSS.craftcms/cms