CVEs published June 24, 2019
30 CVEs were published on June 24, 2019: 0 critical, 1 high.
- Published
- 30
- Critical
- 0
- High
- 1
- Medium
- 0
- Low
- 0
- Unrated
- 29
- Now in CISA KEV
- 0
- Fix available
- 1
Most affected products
- Micro Focus NetIQ Self Service Password Reset.
- 2
- com.fasterxml.jackson.core:jackson-databind
- 1
High 1
Medium, low and unrated 29
- CVE-2019-12958In Xpdf 4.01.01, a heap-based buffer over-read could be triggered in FoFiType1C::convertToType0 in fofi/FoFiType1C.cc when it is trying to a
- CVE-2019-12957In Xpdf 4.01.01, a buffer over-read could be triggered in FoFiType1C::convertToType1 in fofi/FoFiType1C.cc when the index number is larger t
- CVE-2019-12951An issue was discovered in Mongoose before 6.15.
- CVE-2019-10689VVX products using UCS software version 5.9.2 and earlier with Better Together over Ethernet Connector (BToE) application version 3.9.1 and
- CVE-2014-9699The MakerBot Replicator 5G printer runs an Apache HTTP Server with directory indexing enabled.
- CVE-2019-12346In the miniOrange SAML SP Single Sign On plugin before 4.8.73 for WordPress, the SAML Login Endpoint is vulnerable to XSS via a specially cr
- CVE-2019-7231The ABB IDAL FTP server is vulnerable to a buffer overflow when a long string is sent by an authenticated attacker.
- CVE-2019-12880BCN Quark Quarking Password Manager 3.1.84 suffers from a clickjacking vulnerability caused by allowing * within web_accessible_resources.
- CVE-2017-17945The ASUS HiVivo aspplication before 5.6.27 for ASUS Watch has Missing SSL Certificate Validation.
- CVE-2019-9957Stored XSS within Quadbase EspressReport ES (ERES) v7.0 update 7 allows remote attackers to execute malicious JavaScript and inject arbitrar
- CVE-2019-10271An issue was discovered in the Ultimate Member plugin 2.39 for WordPress.
- CVE-2019-9958CSRF within the admin panel in Quadbase EspressReport ES (ERES) v7.0 update 7 allows remote attackers to escalate privileges, or create new
- CVE-2019-9085Hoteldruid before v2.3.1 allows remote authenticated users to cause a denial of service (invoice-creation outage) via the n_file parameter t
- CVE-2019-7229The ABB CP635 HMI uses two different transmission methods to upgrade its firmware and its software components: "Utilization of USB/SD Card t
- CVE-2019-7230The ABB IDAL FTP server mishandles format strings in a username during the authentication process.
- CVE-2019-7232The ABB IDAL HTTP server is vulnerable to a buffer overflow when a long Host header is sent in a web request.
- CVE-2019-12292Citrix AppDNA before 7 1906.1.0.472 has Incorrect Access Control.
- CVE-2019-12323The HC.Server service in Hosting Controller HC10 10.14 allows an Invalid Pointer Write DoS.
- CVE-2019-11648An information leakage exists in Micro Focus NetIQ Self Service Password Reset Software all versions prior to version 4.4.Micro Focus NetIQ Self Service Password Reset.
- CVE-2019-12384FasterXML jackson-databind 2.x before 2.9.9.1 might allow attackers to have a variety of impacts by leveraging failure to block the logback-com.fasterxml.jackson.core:jackson-databind
- CVE-2019-11647A potential XSS exists in Self Service Password Reset, in Micro Focus NetIQ Software all versions prior to version 4.4.Micro Focus NetIQ Self Service Password Reset.
- CVE-2019-12869An issue was discovered in PHOENIX CONTACT PC Worx through 1.86, PC Worx Express through 1.86, and Config+ through 1.86.
- CVE-2019-12870An issue was discovered in PHOENIX CONTACT PC Worx through 1.86, PC Worx Express through 1.86, and Config+ through 1.86.
- CVE-2019-12940LiveZilla Server before 8.0.1.1 is vulnerable to Denial Of Service (memory consumption) in knowledgebase.php via a large integer value of th
- CVE-2019-12939LiveZilla Server before 8.0.1.1 is vulnerable to SQL Injection in server.php via the p_ext_rse parameter.
- CVE-2019-12871An issue was discovered in PHOENIX CONTACT PC Worx through 1.86, PC Worx Express through 1.86, and Config+ through 1.86.
- CVE-2019-12938The Roundcube component of Analogic Poste.io 2.1.6 uses .htaccess to protect the logs/ folder, which is effective with the Apache HTTP Serve
- CVE-2019-12929The QMP guest_exec command in QEMU 4.0.0 and earlier is prone to OS command injection, which allows the attacker to achieve code execution,
- CVE-2019-12928The QMP migrate command in QEMU version 4.0.0 and earlier is vulnerable to OS command injection, which allows the remote attacker to achieve