# CVEs published 2019-06-25 26 CVEs were published on June 25, 2019: 0 critical, 2 high. Days are UTC. - [CVE-2019-12280](https://cve.now/CVE-2019-12280.md): PC-Doctor Toolbox before 7.3 has an Uncontrolled Search Path Element. (no CVSS) - [CVE-2019-3961](https://cve.now/CVE-2019-3961.md): Nessus versions 8.4.0 and earlier were found to contain a reflected XSS vulnerability due to improper validation of user-supplied input. (no CVSS, Tenable Nessus) - [CVE-2019-9836](https://cve.now/CVE-2019-9836.md): Secure Encrypted Virtualization (SEV) on Advanced Micro Devices (AMD) Platform Security Processor (PSP; aka AMD Secure Processor or AMD-SP) (no CVSS) - [CVE-2019-6329](https://cve.now/CVE-2019-6329.md): HP Support Assistant 8.7.50 and earlier allows a user to gain system privilege and allows unauthorized modification of directories or files. (no CVSS, HP Support Assistant) - [CVE-2019-6328](https://cve.now/CVE-2019-6328.md): HP Support Assistant 8.7.50 and earlier allows a user to gain system privilege and allows unauthorized modification of directories or files. (no CVSS, HP Support Assistant) - [CVE-2019-4382](https://cve.now/CVE-2019-4382.md): IBM API Connect 5.0.0.0 through 5.0.8.6 could allow an unauthorized user to obtain sensitive information about the system users using specia (CVSS 5.3, IBM API Connect) - [CVE-2019-4377](https://cve.now/CVE-2019-4377.md): IBM Sterling B2B Integrator 6.0.0.0 and 6.0.0.1 reveals sensitive information from a stack trace that could be used in further attacks again (CVSS 4.3, IBM Sterling B2B Integrator) - [CVE-2019-4158](https://cve.now/CVE-2019-4158.md): IBM Security Access Manager 9.0.1 through 9.0.6 does not prove that a user's identity is correct which can lead to the exposure of resources (CVSS 5.4, IBM Security Access Manager) - [CVE-2019-4157](https://cve.now/CVE-2019-4157.md): IBM Security Access Manager 9.0.1 through 9.0.6 is vulnerable to cross-site scripting. (CVSS 6.1, IBM Security Access Manager) - [CVE-2019-4156](https://cve.now/CVE-2019-4156.md): IBM Security Access Manager 9.0.1 through 9.0.6 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt h (CVSS 5.9, IBM Security Access Manager) - [CVE-2019-4153](https://cve.now/CVE-2019-4153.md): IBM Security Access Manager 9.0.1 through 9.0.6 could allow a remote attacker to conduct phishing attacks, using an open redirect attack. (CVSS 6.8, IBM Security Access Manager) - [CVE-2019-4152](https://cve.now/CVE-2019-4152.md): IBM Security Access Manager 9.0.1 through 9.0.6 does not invalidate session tokens in a timely manner. (CVSS 5.1, IBM Security Access Manager) - [CVE-2019-4151](https://cve.now/CVE-2019-4151.md): IBM Security Access Manager 9.0.1 through 9.0.6 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt h (CVSS 5.9, IBM Security Access Manager) - [CVE-2019-4150](https://cve.now/CVE-2019-4150.md): IBM Security Access Manager 9.0.1 through 9.0.6 does not validate, or incorrectly validates, a certificate which could allow an attacker to (CVSS 3.7, IBM Security Access Manager) - [CVE-2019-4145](https://cve.now/CVE-2019-4145.md): IBM Security Access Manager 9.0.1 through 9.0.6 could reveal highly sensitive in specialized conditions to a local user which could be used (CVSS 7.7, IBM Security Access Manager) - [CVE-2019-4135](https://cve.now/CVE-2019-4135.md): IBM Security Access Manager 9.0.1 through 9.0.6 is affected by a security vulnerability that could allow authenticated users to impersonate (CVSS 7.5, IBM Security Access Manager) - [CVE-2018-2013](https://cve.now/CVE-2018-2013.md): IBM API Connect 2018.1 through 2018.4.1.5 could disclose sensitive information to an unauthorized user that could aid in further attacks aga (CVSS 5.3, IBM API Connect) - [CVE-2018-2011](https://cve.now/CVE-2018-2011.md): IBM API Connect 2018.1 through 2018.4.1.5 could allow an attacker to obtain sensitive information from a specially crafted HTTP request that (CVSS 5.3, IBM API Connect) - [CVE-2018-1858](https://cve.now/CVE-2018-1858.md): IBM API Connect 5.0.0.0 through 5.0.8.6 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and u (CVSS 4.3, IBM API Connect) - [CVE-2019-12964](https://cve.now/CVE-2019-12964.md): LiveZilla Server before 8.0.1.1 is vulnerable to XSS in the ticket.php Subject. (no CVSS) - [CVE-2019-12963](https://cve.now/CVE-2019-12963.md): LiveZilla Server before 8.0.1.1 is vulnerable to XSS in the chat.php Create Ticket Action. (no CVSS) - [CVE-2019-12962](https://cve.now/CVE-2019-12962.md): LiveZilla Server before 8.0.1.1 is vulnerable to XSS in mobile/index.php via the Accept-Language HTTP header. (no CVSS) - [CVE-2019-12961](https://cve.now/CVE-2019-12961.md): LiveZilla Server before 8.0.1.1 is vulnerable to CSV Injection in the Export Function. (no CVSS) - [CVE-2019-12960](https://cve.now/CVE-2019-12960.md): LiveZilla Server before 8.0.1.1 is vulnerable to SQL Injection in functions.internal.build.inc.php via the parameter p\_dt\_s\_d. (no CVSS) - [CVE-2019-12817](https://cve.now/CVE-2019-12817.md): arch/powerpc/mm/mmu\_context\_book3s64.c in the Linux kernel before 5.1.15 for powerpc has a bug where unrelated processes may be able to read (no CVSS) - [CVE-2019-12949](https://cve.now/CVE-2019-12949.md): In pfSense 2.4.4-p2 and 2.4.4-p3, if it is possible to trick an authenticated administrator into clicking on a button on a phishing page, an (no CVSS) --- Source: cve.now, built and run by Sazabi (AI-native observability and security) Page: https://cve.now/daily/2019-06-25 Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.