# CVEs published 2019-06-24

30 CVEs were published on June 24, 2019: 0 critical, 1 high. Days are UTC.

- [CVE-2019-12958](https://cve.now/CVE-2019-12958.md): In Xpdf 4.01.01, a heap-based buffer over-read could be triggered in FoFiType1C::convertToType0 in fofi/FoFiType1C.cc when it is trying to a (no CVSS)
- [CVE-2019-12957](https://cve.now/CVE-2019-12957.md): In Xpdf 4.01.01, a buffer over-read could be triggered in FoFiType1C::convertToType1 in fofi/FoFiType1C.cc when the index number is larger t (no CVSS)
- [CVE-2019-12951](https://cve.now/CVE-2019-12951.md): An issue was discovered in Mongoose before 6.15. (no CVSS)
- [CVE-2019-10689](https://cve.now/CVE-2019-10689.md): VVX products using UCS software version 5.9.2 and earlier with Better Together over Ethernet Connector (BToE) application version 3.9.1 and (no CVSS)
- [CVE-2014-9699](https://cve.now/CVE-2014-9699.md): The MakerBot Replicator 5G printer runs an Apache HTTP Server with directory indexing enabled. (no CVSS)
- [CVE-2019-12346](https://cve.now/CVE-2019-12346.md): In the miniOrange SAML SP Single Sign On plugin before 4.8.73 for WordPress, the SAML Login Endpoint is vulnerable to XSS via a specially cr (no CVSS)
- [CVE-2019-7231](https://cve.now/CVE-2019-7231.md): The ABB IDAL FTP server is vulnerable to a buffer overflow when a long string is sent by an authenticated attacker. (no CVSS)
- [CVE-2019-12880](https://cve.now/CVE-2019-12880.md): BCN Quark Quarking Password Manager 3.1.84 suffers from a clickjacking vulnerability caused by allowing \* within web\_accessible\_resources. (no CVSS)
- [CVE-2017-17945](https://cve.now/CVE-2017-17945.md): The ASUS HiVivo aspplication before 5.6.27 for ASUS Watch has Missing SSL Certificate Validation. (no CVSS)
- [CVE-2019-9957](https://cve.now/CVE-2019-9957.md): Stored XSS within Quadbase EspressReport ES (ERES) v7.0 update 7 allows remote attackers to execute malicious JavaScript and inject arbitrar (no CVSS)
- [CVE-2019-10271](https://cve.now/CVE-2019-10271.md): An issue was discovered in the Ultimate Member plugin 2.39 for WordPress. (no CVSS)
- [CVE-2019-9958](https://cve.now/CVE-2019-9958.md): CSRF within the admin panel in Quadbase EspressReport ES (ERES) v7.0 update 7 allows remote attackers to escalate privileges, or create new (no CVSS)
- [CVE-2019-9085](https://cve.now/CVE-2019-9085.md): Hoteldruid before v2.3.1 allows remote authenticated users to cause a denial of service (invoice-creation outage) via the n\_file parameter t (no CVSS)
- [CVE-2019-7229](https://cve.now/CVE-2019-7229.md): The ABB CP635 HMI uses two different transmission methods to upgrade its firmware and its software components: "Utilization of USB/SD Card t (no CVSS)
- [CVE-2019-7230](https://cve.now/CVE-2019-7230.md): The ABB IDAL FTP server mishandles format strings in a username during the authentication process. (no CVSS)
- [CVE-2019-7232](https://cve.now/CVE-2019-7232.md): The ABB IDAL HTTP server is vulnerable to a buffer overflow when a long Host header is sent in a web request. (no CVSS)
- [CVE-2018-20843](https://cve.now/CVE-2018-20843.md): In libexpat in Expat before 2.2.7, XML input including XML names that contain a large number of colons could make the XML parser consume a h (CVSS 7.5)
- [CVE-2019-12292](https://cve.now/CVE-2019-12292.md): Citrix AppDNA before 7 1906.1.0.472 has Incorrect Access Control. (no CVSS)
- [CVE-2019-12323](https://cve.now/CVE-2019-12323.md): The HC.Server service in Hosting Controller HC10 10.14 allows an Invalid Pointer Write DoS. (no CVSS)
- [CVE-2019-11648](https://cve.now/CVE-2019-11648.md): An information leakage exists in Micro Focus NetIQ Self Service Password Reset Software all versions prior to version 4.4. (no CVSS, Micro Focus NetIQ Self Service Password Reset.)
- [CVE-2019-12384](https://cve.now/CVE-2019-12384.md): FasterXML jackson-databind 2.x before 2.9.9.1 might allow attackers to have a variety of impacts by leveraging failure to block the logback- (no CVSS, com.fasterxml.jackson.core:jackson-databind)
- [CVE-2019-11647](https://cve.now/CVE-2019-11647.md): A potential XSS exists in Self Service Password Reset, in Micro Focus NetIQ Software all versions prior to version 4.4. (no CVSS, Micro Focus NetIQ Self Service Password Reset.)
- [CVE-2019-12869](https://cve.now/CVE-2019-12869.md): An issue was discovered in PHOENIX CONTACT PC Worx through 1.86, PC Worx Express through 1.86, and Config+ through 1.86. (no CVSS)
- [CVE-2019-12870](https://cve.now/CVE-2019-12870.md): An issue was discovered in PHOENIX CONTACT PC Worx through 1.86, PC Worx Express through 1.86, and Config+ through 1.86. (no CVSS)
- [CVE-2019-12940](https://cve.now/CVE-2019-12940.md): LiveZilla Server before 8.0.1.1 is vulnerable to Denial Of Service (memory consumption) in knowledgebase.php via a large integer value of th (no CVSS)
- [CVE-2019-12939](https://cve.now/CVE-2019-12939.md): LiveZilla Server before 8.0.1.1 is vulnerable to SQL Injection in server.php via the p\_ext\_rse parameter. (no CVSS)
- [CVE-2019-12871](https://cve.now/CVE-2019-12871.md): An issue was discovered in PHOENIX CONTACT PC Worx through 1.86, PC Worx Express through 1.86, and Config+ through 1.86. (no CVSS)
- [CVE-2019-12938](https://cve.now/CVE-2019-12938.md): The Roundcube component of Analogic Poste.io 2.1.6 uses .htaccess to protect the logs/ folder, which is effective with the Apache HTTP Serve (no CVSS)
- [CVE-2019-12929](https://cve.now/CVE-2019-12929.md): The QMP guest\_exec command in QEMU 4.0.0 and earlier is prone to OS command injection, which allows the attacker to achieve code execution, (no CVSS)
- [CVE-2019-12928](https://cve.now/CVE-2019-12928.md): The QMP migrate command in QEMU version 4.0.0 and earlier is vulnerable to OS command injection, which allows the remote attacker to achieve (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2019-06-24
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.