# CVEs published 2019-06-18

49 CVEs were published on June 18, 2019: 0 critical, 3 high. Days are UTC.

- [CVE-2019-3896](https://cve.now/CVE-2019-3896.md): A double-free can happen in idr\_remove\_all() in lib/idr.c in the Linux kernel 2.6 branch. (CVSS 7.0, The Linux Foundation kernel)
- [CVE-2019-11271](https://cve.now/CVE-2019-11271.md): Bosh Deployment logs leak sensitive information (CVSS 6.0, Cloud Foundry BOSH)
- [CVE-2019-11479](https://cve.now/CVE-2019-11479.md): Jonathan Looney discovered that the Linux kernel default MSS is hard-coded to 48 bytes. (CVSS 5.3, Linux kernel)
- [CVE-2019-11478](https://cve.now/CVE-2019-11478.md): SACK can cause extensive memory use via fragmented resend queue (CVSS 5.3, Linux kernel)
- [CVE-2019-11477](https://cve.now/CVE-2019-11477.md): Integer overflow in TCP\_SKB\_CB(skb)-\>tcp\_gso\_segs (CVSS 7.5, Linux kernel)
- [CVE-2019-11040](https://cve.now/CVE-2019-11040.md): Heap buffer overflow in EXIF extension (CVSS 4.8, PHP Group PHP)
- [CVE-2019-11039](https://cve.now/CVE-2019-11039.md): Out-of-bounds read in iconv.c (CVSS 4.2, PHP Group PHP)
- [CVE-2019-11038](https://cve.now/CVE-2019-11038.md): Uninitialized read in gdImageCreateFromXbm (CVSS 3.1, PHP Group PHP)
- [CVE-2019-3954](https://cve.now/CVE-2019-3954.md): Stack-based buffer overflow in Advantech WebAccess/SCADA 8.4.0 allows a remote, unauthenticated attacker to execute arbitrary code by sendin (no CVSS, Advantech WebAccess/SCADA)
- [CVE-2019-10085](https://cve.now/CVE-2019-10085.md): In Apache Allura prior to 1.11.0, a vulnerability exists for stored XSS on the user dropdown selector when creating or editing tickets. (no CVSS, Apache Allura)
- [CVE-2019-3953](https://cve.now/CVE-2019-3953.md): Stack-based buffer overflow in Advantech WebAccess/SCADA 8.4.0 allows a remote, unauthenticated attacker to execute arbitrary code by sendin (no CVSS, Advantech WebAccess/SCADA)
- [CVE-2019-12881](https://cve.now/CVE-2019-12881.md): i915\_gem\_userptr\_get\_pages in drivers/gpu/drm/i915/i915\_gem\_userptr.c in the Linux kernel 4.15.0 on Ubuntu 18.04.2 allows local users to cau (no CVSS)
- [CVE-2019-12133](https://cve.now/CVE-2019-12133.md): Multiple Zoho ManageEngine products suffer from local privilege escalation due to improper permissions for the %SYSTEMDRIVE%\\ManageEngine di (no CVSS)
- [CVE-2017-8337](https://cve.now/CVE-2017-8337.md): An issue was discovered on Securifi Almond, Almond+, and Almond 2015 devices with firmware AL-R096. (no CVSS)
- [CVE-2017-8330](https://cve.now/CVE-2017-8330.md): An issue was discovered on Securifi Almond, Almond+, and Almond 2015 devices with firmware AL-R096. (no CVSS)
- [CVE-2019-12592](https://cve.now/CVE-2019-12592.md): A universal Cross-site scripting (UXSS) vulnerability in the Evernote Web Clipper extension before 7.11.1 for Chrome allows remote attackers (no CVSS)
- [CVE-2017-8332](https://cve.now/CVE-2017-8332.md): An issue was discovered on Securifi Almond, Almond+, and Almond 2015 devices with firmware AL-R096. (no CVSS)
- [CVE-2017-8334](https://cve.now/CVE-2017-8334.md): An issue was discovered on Securifi Almond, Almond+, and Almond 2015 devices with firmware AL-R096. (no CVSS)
- [CVE-2017-8328](https://cve.now/CVE-2017-8328.md): An issue was discovered on Securifi Almond, Almond+, and Almond 2015 devices with firmware AL-R096. (no CVSS)
- [CVE-2017-8331](https://cve.now/CVE-2017-8331.md): An issue was discovered on Securifi Almond, Almond+, and Almond 2015 devices with firmware AL-R096. (no CVSS)
- [CVE-2017-8333](https://cve.now/CVE-2017-8333.md): An issue was discovered on Securifi Almond, Almond+, and Almond 2015 devices with firmware AL-R096. (no CVSS)
- [CVE-2017-8329](https://cve.now/CVE-2017-8329.md): An issue was discovered on Securifi Almond, Almond+, and Almond 2015 devices with firmware AL-R096. (no CVSS)
- [CVE-2017-8335](https://cve.now/CVE-2017-8335.md): An issue was discovered on Securifi Almond, Almond+, and Almond 2015 devices with firmware AL-R096. (no CVSS)
- [CVE-2017-8336](https://cve.now/CVE-2017-8336.md): An issue was discovered on Securifi Almond, Almond+, and Almond 2015 devices with firmware AL-R096. (no CVSS)
- [CVE-2019-12875](https://cve.now/CVE-2019-12875.md): Alpine Linux abuild through 3.4.0 allows an unprivileged member of the abuild group to add an untrusted package via a --keys-dir option that (no CVSS)
- [CVE-2019-12874](https://cve.now/CVE-2019-12874.md): An issue was discovered in zlib\_decompress\_extra in modules/demux/mkv/util.cpp in VideoLAN VLC media player 3.x through 3.0.7. (no CVSS)
- [CVE-2012-6711](https://cve.now/CVE-2012-6711.md): A heap-based buffer overflow exists in GNU Bash before 4.3 when wide characters, not supported by the current locale set in the LC\_CTYPE env (CVSS 7.0)
- [CVE-2018-18802](https://cve.now/CVE-2018-18802.md): The Tubigan "Welcome to our Resort" 1.0 software allows CSRF via admin/mod\_users/controller.php?action=edit. (no CVSS)
- [CVE-2018-18836](https://cve.now/CVE-2018-18836.md): An issue was discovered in Netdata 1.10.0. (no CVSS)
- [CVE-2018-18837](https://cve.now/CVE-2018-18837.md): An issue was discovered in Netdata 1.10.0. (no CVSS)
- [CVE-2018-18838](https://cve.now/CVE-2018-18838.md): An issue was discovered in Netdata 1.10.0. (no CVSS)
- [CVE-2018-18839](https://cve.now/CVE-2018-18839.md): An issue was discovered in Netdata 1.10.0. (no CVSS)
- [CVE-2018-18852](https://cve.now/CVE-2018-18852.md): Cerio DT-300N 1.1.6 through 1.1.12 devices allow OS command injection because of improper input validation of the web-interface PING feature (no CVSS)
- [CVE-2019-4142](https://cve.now/CVE-2019-4142.md): IBM Cloud Private 2.1.0, 3.1.0, 3.1.1, and 3.1.2 is vulnerable to cross-site request forgery which could allow an attacker to execute malici (CVSS 4.3, IBM Cloud Private)
- [CVE-2018-18875](https://cve.now/CVE-2018-18875.md): In firmware version MS\_2.6.9900 of Columbia Weather MicroServer, a stored Cross-site scripting (XSS) vulnerability allows remote authenticat (no CVSS)
- [CVE-2018-18876](https://cve.now/CVE-2018-18876.md): In firmware version MS\_2.6.9900 of Columbia Weather MicroServer, a readouts\_rd.php directory traversal issue makes it possible to read any f (no CVSS)
- [CVE-2018-18877](https://cve.now/CVE-2018-18877.md): In firmware version MS\_2.6.9900 of Columbia Weather MicroServer, an authenticated web user can access an alternative configuration page conf (no CVSS)
- [CVE-2018-18878](https://cve.now/CVE-2018-18878.md): In firmware version MS\_2.6.9900 of Columbia Weather MicroServer, the BACnet daemon does not properly validate input, which could allow a rem (no CVSS)
- [CVE-2018-18879](https://cve.now/CVE-2018-18879.md): In firmware version MS\_2.6.9900 of Columbia Weather MicroServer, an authenticated web user can pipe commands directly to the underlying oper (no CVSS)
- [CVE-2019-7588](https://cve.now/CVE-2019-7588.md): exacqVision Enterprise System Manager (ESM) privilege escalation (CVSS 6.7, Exacq Technologies exacqVision Enterprise System Manager)
- [CVE-2019-12872](https://cve.now/CVE-2019-12872.md): dotCMS before 5.1.6 is vulnerable to a SQL injection that can be exploited by an attacker of the role Publisher via view\_unpushed\_bundles.js (no CVSS)
- [CVE-2018-18880](https://cve.now/CVE-2018-18880.md): In firmware version MS\_2.6.9900 of Columbia Weather MicroServer, a networkdiags.php reflected Cross-site scripting (XSS) vulnerability allow (no CVSS)
- [CVE-2018-18886](https://cve.now/CVE-2018-18886.md): Helpy v2.1.0 has Stored XSS via the Ticket title. (no CVSS)
- [CVE-2018-18944](https://cve.now/CVE-2018-18944.md): Artha ~ The Open Thesaurus 1.0.3.0 has a Buffer Overflow. (no CVSS)
- [CVE-2018-20013](https://cve.now/CVE-2018-20013.md): In UrBackup 2.2.6, an attacker can send a malformed request to the client over the network, and trigger a fileservplugin/CClientThread.cpp C (no CVSS)
- [CVE-2019-6965](https://cve.now/CVE-2019-6965.md): An XSS issue was discovered in i-doit Open 1.12 via the src/tools/php/qr/qr.php url parameter. (no CVSS)
- [CVE-2019-7159](https://cve.now/CVE-2019-7159.md): OX App Suite 7.10.1 and earlier allows Information Exposure. (no CVSS)
- [CVE-2019-10998](https://cve.now/CVE-2019-10998.md): An issue was discovered on Phoenix Contact AXC F 2152 (No.2404267) before 2019.0 LTS and AXC F 2152 STARTERKIT (No.1046568) before 2019.0 LT (no CVSS)
- [CVE-2019-12823](https://cve.now/CVE-2019-12823.md): Craft CMS before 3.1.31 does not properly filter XML feeds and thus allowing XSS. (no CVSS, craftcms/cms)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2019-06-18
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.