CVEs published June 19, 2019
95 CVEs were published on June 19, 2019: 2 critical, 2 high.
- Published
- 95
- Critical
- 2
- High
- 2
- Medium
- 7
- Low
- 0
- Unrated
- 84
- Now in CISA KEV
- 0
- Fix available
- 3
Most affected products
- Android
- 29
- IBM Maximo Asset Management
- 2
- bzlib · bz2 +1
- 1
- Cloud Foundry UAA Release
- 1
- com.fasterxml.jackson.core:jackson-databind
- 1
- Data Loss Prevention
- 1
- Dell EMC Avamar
- 1
- IBM Campaign
- 1
- IBM Marketing Platform
- 1
- IBM Spectrum Protect Plus
- 1
Critical 2
High 2
Medium, low and unrated 91
- CVE-2019-12904In Libgcrypt 1.8.4, the C implementation of AES is vulnerable to a flush-and-reload side-channel attack because physical addresses are avail
- CVE-2019-12903Pydio Cells before 1.5.0, when supplied with a Name field in an unexpected Unicode format, fails to handle this and includes the database co
- CVE-2019-12902Pydio Cells before 1.5.0 does incomplete cleanup of a user's data upon deletion.
- CVE-2019-12901Pydio Cells before 1.5.0 fails to neutralize '../' elements, allowing an attacker with minimum privilege to Upload files to, and Delete file
- CVE-2019-12899Delta Electronics DeviceNet Builder 2.04 has a User Mode Write AV starting at ntdll!RtlQueueWorkItem+0x00000000000005e3.
- CVE-2019-12898Delta Electronics DeviceNet Builder 2.04 has a User Mode Write AV starting at image00400000+0x000000000017a45e.
- CVE-2019-12897Edraw Max 7.9.3 has a Read Access Violation at the Instruction Pointer after a call from ObjectModule!Paint::Clear+0x0000000000000074.
- CVE-2019-12896Edraw Max 7.9.3 has Heap Corruption starting at ntdll!RtlpNtMakeTemporaryKey+0x0000000000001a77.
- CVE-2019-12895In Alternate Pic View 2.600, the Exception Handler Chain is Corrupted starting at PicViewer!PerfgrapFinalize+0x00000000000b916d.
- CVE-2019-12894Alternate Pic View 2.600 has a Read Access Violation at the Instruction Pointer after a call from PicViewer!PerfgrapFinalize+0x00000000000a9
- CVE-2019-12893Alternate Pic View 2.600 has a User Mode Write AV starting at PicViewer!PerfgrapFinalize+0x00000000000a8868.
- CVE-2017-14395Auth 2.0 Authorization Server of ForgeRock Access Management (OpenAM) 13.5.0-13.5.1 and Access Management (AM) 5.0.0-5.1.1 does not correctl
- CVE-2017-14394OAuth 2.0 Authorization Server of ForgeRock Access Management (OpenAM) 13.5.0-13.5.1 and Access Management (AM) 5.0.0-5.1.1 does not correct
- CVE-2018-9561In llcp_util_parse_connect of llcp_util.cc, there is a possible out-of-bound read due to a missing bounds check.Android
- CVE-2019-2025In binder_thread_read of binder.c, there is a possible use-after-free due to improper locking.Android
- CVE-2019-2024In em28xx_unregister_dvb of em28xx-dvb.c, there is a possible use after free issue.Android
- CVE-2019-2023In ServiceManager::add function in the hardware service manager, there is an insecure permissions check based on the PID of the caller.Android
- CVE-2019-2003In addLinks of Linkify.java, there is a possible phishing vector due to an unusual root cause.Android
- CVE-2019-2022In rw_t3t_act_handle_fmt_rsp and rw_t3t_act_handle_sro_rsp of rw_t3t.cc, there is a possible out-of-bound read due to a missing bounds checkAndroid
- CVE-2019-2021In rw_t3t_act_handle_ndef_detect_rsp of rw_t3t.cc, there is a possible out-of-bound read due to a missing bounds check.Android
- CVE-2019-2020In llcp_dlc_proc_rr_rnr_pdu of llcp_dlc.cc, there is a possible out-of-bound read due to a missing bounds check.Android
- CVE-2019-2019In ce_t4t_data_cback of ce_t4t.cc, there is a possible out-of-bound read due to a missing bounds check.Android
- CVE-2018-9564In llcp_util_parse_link_params of llcp_util.cc, there is a possible out-of-bound read due to a missing bounds check.Android
- CVE-2018-9563In llcp_util_parse_cc of llcp_util.cc, there is a possible out-of-bound read due to a missing bounds check.Android
- CVE-2019-2018In resetPasswordInternal of DevicePolicyManagerService.java, there is a possible bypass of password reset protection due to an unusual root Android
- CVE-2019-2017In rw_t2t_handle_tlv_detect_rsp of rw_t2t_ndef.cc, there is a possible out-of-bound write due to a missing bounds check.Android
- CVE-2019-2016In NFA_SendRawFrame of nfa_dm_api.cc, there is a possible out-of-bound write due to improper input validation.Android
- CVE-2019-2015In rw_t3t_act_handle_check_rsp of rw_t3t.cc, there is a possible out-of-bound write due to a missing bounds check.Android
- CVE-2019-2014In rw_t3t_handle_get_sc_poll_rsp of rw_t3t.cc, there is a possible out-of-bound write due to a missing bounds check.Android
- CVE-2019-2013In rw_t3t_act_handle_sro_rsp of rw_t3t.cc, there is a possible out-of-bound write due to a missing bounds check.Android
- CVE-2019-2012In rw_t3t_act_handle_fmt_rsp of rw_t3t.cc, there is a possible out-of-bound write due to a missing bounds check.Android
- CVE-2019-2011In readNullableNativeHandleNoDup of Parcel.cpp, there is a possible out of bounds write due to a missing bounds check.Android
- CVE-2019-2010In phNxpNciHal_process_ext_rsp of phNxpNciHal_ext.cc, there is a possible out-of-bound write due to a missing bounds check.Android
- CVE-2019-2009In l2c_lcc_proc_pdu of l2c_fcr.cc, there is a possible out of bounds write due to a missing bounds check.Android
- CVE-2019-2008In createEffect of AudioFlinger.cpp, there is a possible memory corruption due to a race condition.Android
- CVE-2019-2007In getReadIndex and getWriteIndex of FifoControllerBase.cpp, there is a possible out-of-bounds write due to an integer overflow.Android
- CVE-2019-2006In serviceDied of HalDeathHandlerHidl.cpp, there is a possible memory corruption due to a use after free.Android
- CVE-2019-1990In ihevcd_fmt_conv_420sp_to_420p of ihevcd_fmt_conv.c, there is a possible out of bounds write due to a missing bounds check.Android
- CVE-2019-1989In ih264d_fmt_conv_420sp_to_420p of ih264d_format_conv.c, there is a possible out of bounds write due to a missing bounds check.Android
- CVE-2019-2005In onPermissionGrantResult of GrantPermissionsActivity.java, there is a possible incorrectly granted permission due to a missing permission Android
- CVE-2019-2004In publishKeyEvent, publishMotionEvent and sendUnchainedFinishedSignal of InputTransport.cpp, there are uninitialized data leading to local Android
- CVE-2019-1985In findAvailSpellCheckerLocked of TextServicesManagerService.java, there is a possible way to bypass the warning dialog when selecting an unAndroid
- CVE-2018-16593The Photo Sharing Plus component on Sony Bravia TV through 8.587 devices allows Shell Metacharacter Injection.
- CVE-2018-16594The Photo Sharing Plus component on Sony Bravia TV through 8.587 devices allows Directory Traversal.
- CVE-2018-16595The Photo Sharing Plus component on Sony Bravia TV through 8.587 devices has a Buffer Overflow.
- CVE-2019-12890RedwoodHQ 2.5.5 does not require any authentication for database operations, which allows remote attackers to create admin users via a con.a
- CVE-2018-16613An issue was discovered in the update function in the wpForo Forum plugin before 1.5.2 for WordPress.
- CVE-2018-16618VTech Storio Max before 56.D3JM6 allows remote command execution via shell metacharacters in an Android activity name.
- CVE-2018-17079An issue was discovered in ZRLOG 2.0.1.
- CVE-2018-17146A cross-site scripting vulnerability exists in Nagios XI before 5.5.4 via the 'name' parameter within the Account Information page.
- CVE-2018-17148An Insufficient Access Control vulnerability (leading to credential disclosure) in coreconfigsnapshot.php (aka configuration snapshot page)
- CVE-2018-17374SQL Injection exists in the Auction Factory 4.5.5 component for Joomla! via the filter_order_Dir or filter_order parameter.
- CVE-2018-17381SQL Injection exists in the Dutch Auction Factory 2.0.2 component for Joomla! via the filter_order_Dir or filter_order parameter.
- CVE-2018-17386SQL Injection exists in the Micro Deal Factory 2.4.0 component for Joomla! via the id parameter, or the PATH_INFO to mydeals/ or listdeals/.
- CVE-2018-17387CSRF exists in Nimble Messaging Bulk SMS Marketing Application 1.0 for adding an admin account.
- CVE-2019-9763An issue was discovered in Openfind Mail2000 6.0 and 7.0 Webmail.
- CVE-2018-17388SQL Injection exists in Twilio WEB To Fax Machine System 1.0 via the email or password parameter to login_check.php, or the id parameter to
- CVE-2018-17389CSRF exists in server.php in Live Call Support Application 1.5 for adding an admin account.
- CVE-2019-11233EXCELLENT INFOTEK BiYan v1.57 ~ v2.8 allows an attacker to leak user information without being authenticated, by sending a LOGIN_ID element
- CVE-2019-11232EXCELLENT INFOTEK BiYan v1.57 ~ v2.8 allows an attacker to leak user information (Password) without being authenticated, by sending an EMP_N
- CVE-2018-17393SQL Injection exists in HealthNode Hospital Management System 1.0 via the id parameter to dashboard/Patient/info.php or dashboard/Patient/pa
- CVE-2018-17398SQL Injection exists in the AMGallery 1.2.3 component for Joomla! via the filter_category_id parameter.
- CVE-2018-17399SQL Injection exists in the Jimtawl 2.2.7 component for Joomla! via the id parameter.
- CVE-2018-17423An issue was discovered in e107 v2.1.9.
- CVE-2018-17840SQL injection exists in Scriptzee Education Website 1.0 via the college_list.html subject, city, or country parameter.
- CVE-2018-15506In BubbleUPnP 0.9 update 30, the XML parsing engine for SSDP/UPnP functionality is vulnerable to an XML External Entity Processing (XXE) att
- CVE-2018-17841SQL injection exists in Scriptzee Flippa Marketplace Clone 1.0 via the site-search sortBy or sortDir parameter.
- CVE-2019-11649KM03461174 Micro Focus Fortify Software Security Center Server, CVE-2019-11649Micro Focus Fortify Software Security Center Server
- CVE-2018-17842SQL injection exists in Scriptzee Hotel Booking Engine 1.0 via the hotels h_room_type parameter.
- CVE-2018-18406An issue was discovered in Tufin SecureTrack 18.1 with TufinOS 2.16 build 1179(Final).
- CVE-2018-18425The doAirdrop function of a smart contract implementation for Primeo (PEO), an Ethereum token, does not check the numerical relationship bet
- CVE-2019-6114An issue was discovered in Corel PaintShop Pro 2019 21.0.0.119.
- CVE-2019-9701DLP 15.5 MP1 and all prior versions may be susceptible to a cross-site scripting (XSS) vulnerability, a type of issue that can enable attackData Loss Prevention
- CVE-2018-18471/api/2.0/rest/aggregator/xml in Axentra firmware, used by NETGEAR Stora, Seagate GoFlex Home, and MEDION LifeCloud, has an XXE vulnerability
- CVE-2018-18472Western Digital WD My Book Live and WD My Book Live Duo (all versions) have a root Remote Command Execution bug via shell metacharacters in
- CVE-2019-12491OnApp before 5.0.0-88, 5.5.0-93, and 6.0.0-196 allows an attacker to run arbitrary commands with root privileges on servers managed by OnApp
- CVE-2018-18757Open Faculty Evaluation System 5.6 for PHP 5.6 allows submit_feedback.php SQL Injection, a different vulnerability than CVE-2018-18758.
- CVE-2018-18863NGA ResourceLink 20.0.2.1 allows local file inclusion.
- CVE-2018-18758Open Faculty Evaluation System 7 for PHP 7 allows submit_feedback.php SQL Injection, a different vulnerability than CVE-2018-18757.
- CVE-2018-19878An issue was discovered on Teltonika RTU950 R_31.04.89 devices.
- CVE-2019-6972An issue was discovered on TP-Link TL-WR1043ND V2 devices.
- CVE-2019-6971An issue was discovered on TP-Link TL-WR1043ND V2 devices.
- CVE-2019-10257Zucchetti HR Portal through 2019-03-15 allows Directory Traversal.
- CVE-2019-4385IBM Spectrum Protect Plus 10.1.2 may display the vSnap CIFS password in the IBM Spectrum Protect Plus Joblog.IBM Spectrum Protect Plus
- CVE-2019-4384IBM Campaign 9.1.2 and 10.1 could allow a remote attacker to traverse directories on the system.IBM Campaign
- CVE-2019-4364IBM Maximo Asset Management 7.6 is vulnerable to CSV injection, which could allow a remote authenticated attacker to execute arbirary commanIBM Maximo Asset Management
- CVE-2019-4303IBM Maximo Asset Management 7.6 is vulnerable to cross-site scripting.IBM Maximo Asset Management
- CVE-2017-1107IBM Marketing Platform 9.1.0, 9.1.2, 10.0, and 10.1 exposes sensitive information in the headers that could be used by an authenticated attaIBM Marketing Platform
- CVE-2019-12814A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.x through 2.9.9.com.fasterxml.jackson.core:jackson-databind
- CVE-2019-12436Samba 4.10.x before 4.10.5 has a NULL pointer dereference, leading to an AD DC LDAP server Denial of Service.
- CVE-2019-12435Samba 4.9.x before 4.9.9 and 4.10.x before 4.10.5 has a NULL pointer dereference, leading to Denial of Service.