# CVEs published 2019-06-21 25 CVEs were published on June 21, 2019: 0 critical, 1 high. Days are UTC. - [CVE-2019-10028](https://cve.now/CVE-2019-10028.md): Denial of Service (DOS) in Dial Reference Source Code Used before June 18th, 2019. (no CVSS, Dial Reference Source Code Repo) - [CVE-2019-10718](https://cve.now/CVE-2019-10718.md): BlogEngine.NET 3.3.7.0 and earlier allows XML External Entity Blind Injection, related to pingback.axd and BlogEngine.Core/Web/HttpHandlers/ (no CVSS) - [CVE-2019-11392](https://cve.now/CVE-2019-11392.md): BlogEngine.NET 3.3.7 and earlier allows XXE via an apml file to syndication.axd. (no CVSS) - [CVE-2019-10720](https://cve.now/CVE-2019-10720.md): BlogEngine.NET 3.3.7.0 and earlier allows Directory Traversal and Remote Code Execution via the theme cookie to the File Manager. (no CVSS) - [CVE-2019-10719](https://cve.now/CVE-2019-10719.md): BlogEngine.NET 3.3.7.0 and earlier allows Directory Traversal and Remote Code Execution because file creation is mishandled, related to /api (no CVSS) - [CVE-2019-10072](https://cve.now/CVE-2019-10072.md): The fix for CVE-2019-0199 was incomplete and did not address HTTP/2 connection window exhaustion on write in Apache Tomcat versions 9.0.0.M1 (no CVSS, Apache Tomcat · org.apache.tomcat.embed:tomcat-embed-core) - [CVE-2019-11011](https://cve.now/CVE-2019-11011.md): Akamai CloudTest before 58.30 allows remote code execution. (no CVSS) - [CVE-2019-12572](https://cve.now/CVE-2019-12572.md): A vulnerability in the London Trust Media Private Internet Access (PIA) VPN Client 1.0.2 (build 02363) for Windows could allow an authentica (no CVSS) - [CVE-2019-10270](https://cve.now/CVE-2019-10270.md): An arbitrary password reset issue was discovered in the Ultimate Member plugin 2.39 for WordPress. (no CVSS) - [CVE-2017-15694](https://cve.now/CVE-2017-15694.md): When an Apache Geode server versions 1.0.0 to 1.8.0 is operating in secure mode, a user with write permissions for specific data regions can (no CVSS, Apache Geode · org.apache.geode:geode-core) - [CVE-2019-12836](https://cve.now/CVE-2019-12836.md): The Bobronix JEditor editor before 3.0.6 for Jira allows an attacker to add a URL/Link (to an existing issue) that can cause forgery of a re (no CVSS) - [CVE-2018-15665](https://cve.now/CVE-2018-15665.md): An issue was discovered in Cloudera Data Science Workbench (CDSW) 1.2.x through 1.4.0. (no CVSS) - [CVE-2018-15729](https://cve.now/CVE-2018-15729.md): An issue was discovered in STOPzilla AntiMalware 6.5.2.59. (no CVSS) - [CVE-2018-15730](https://cve.now/CVE-2018-15730.md): An issue was discovered in STOPzilla AntiMalware 6.5.2.59. (no CVSS) - [CVE-2018-15731](https://cve.now/CVE-2018-15731.md): An issue was discovered in STOPzilla AntiMalware 6.5.2.59. (no CVSS) - [CVE-2018-15732](https://cve.now/CVE-2018-15732.md): An issue was discovered in STOPzilla AntiMalware 6.5.2.59. (no CVSS) - [CVE-2018-15733](https://cve.now/CVE-2018-15733.md): An issue was discovered in STOPzilla AntiMalware 6.5.2.59. (no CVSS) - [CVE-2018-15734](https://cve.now/CVE-2018-15734.md): An issue was discovered in STOPzilla AntiMalware 6.5.2.59. (no CVSS) - [CVE-2018-15735](https://cve.now/CVE-2018-15735.md): An issue was discovered in STOPzilla AntiMalware 6.5.2.59. (no CVSS) - [CVE-2018-15736](https://cve.now/CVE-2018-15736.md): An issue was discovered in STOPzilla AntiMalware 6.5.2.59. (no CVSS) - [CVE-2018-15737](https://cve.now/CVE-2018-15737.md): An issue was discovered in STOPzilla AntiMalware 6.5.2.59. (no CVSS) - [CVE-2016-7404](https://cve.now/CVE-2016-7404.md): OpenStack Magnum passes OpenStack credentials into the Heat templates creating its instances. (no CVSS, openstack-magnum) - [CVE-2018-15747](https://cve.now/CVE-2018-15747.md): The default configuration of glot-www through 2018-05-19 allows remote attackers to execute arbitrary code because glot-code-runner supports (no CVSS, github.com/prasmussen/glot-code-runner) - [CVE-2018-15868](https://cve.now/CVE-2018-15868.md): SQL injection vulnerability in ChronoScan version 1.5.4.3 and earlier allows an unauthenticated attacker to execute arbitrary SQL commands v (no CVSS) - [CVE-2019-1904](https://cve.now/CVE-2019-1904.md): Cisco IOS XE Software Web UI Cross-Site Request Forgery Vulnerability (CVSS 8.8, Cisco IOS XE Software) --- Source: cve.now, built and run by Sazabi (AI-native observability and security) Page: https://cve.now/daily/2019-06-21 Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.