# CVEs published 2019-06-26

35 CVEs were published on June 26, 2019: 0 critical, 4 high. Days are UTC.

- [CVE-2019-9039](https://cve.now/CVE-2019-9039.md): In Couchbase Sync Gateway 2.1.2, an attacker with access to the Sync Gateway’s public REST API was able to issue additional N1QL statements (no CVSS, github.com/couchbase/sync\_gateway)
- [CVE-2019-10154](https://cve.now/CVE-2019-10154.md): A flaw was found in Moodle before versions 3.7, 3.6.4. (CVSS 6.5, moodle · moodle/moodle)
- [CVE-2019-10134](https://cve.now/CVE-2019-10134.md): A flaw was found in Moodle before 3.7, 3.6.4, 3.5.6, 3.4.9 and 3.1.18. (CVSS 4.2, moodle · moodle/moodle)
- [CVE-2019-10133](https://cve.now/CVE-2019-10133.md): A flaw was found in Moodle before 3.7, 3.6.4, 3.5.6, 3.4.9 and 3.1.18. (CVSS 3.1, moodle · moodle/moodle)
- [CVE-2019-12984](https://cve.now/CVE-2019-12984.md): A NULL pointer dereference vulnerability in the function nfc\_genl\_deactivate\_target() in net/nfc/netlink.c in the Linux kernel before 5.1.13 (no CVSS)
- [CVE-2019-12982](https://cve.now/CVE-2019-12982.md): Ming (aka libming) 0.4.8 has a heap buffer overflow and underflow in the decompileCAST function in util/decompile.c in libutil.a. (no CVSS)
- [CVE-2019-12981](https://cve.now/CVE-2019-12981.md): Ming (aka libming) 0.4.8 has an "fill overflow" vulnerability in the function SWFShape\_setLeftFillStyle in blocks/shape.c. (no CVSS)
- [CVE-2019-12980](https://cve.now/CVE-2019-12980.md): In Ming (aka libming) 0.4.8, there is an integer overflow (caused by an out-of-range left shift) in the SWFInput\_readSBits function in block (no CVSS)
- [CVE-2019-12979](https://cve.now/CVE-2019-12979.md): ImageMagick 7.0.8-34 has a "use of uninitialized value" vulnerability in the SyncImageSettings function in MagickCore/image.c. (no CVSS)
- [CVE-2019-12978](https://cve.now/CVE-2019-12978.md): ImageMagick 7.0.8-34 has a "use of uninitialized value" vulnerability in the ReadPANGOImage function in coders/pango.c. (no CVSS)
- [CVE-2019-12977](https://cve.now/CVE-2019-12977.md): ImageMagick 7.0.8-34 has a "use of uninitialized value" vulnerability in the WriteJP2Image function in coders/jp2.c. (no CVSS)
- [CVE-2019-12976](https://cve.now/CVE-2019-12976.md): ImageMagick 7.0.8-34 has a memory leak in the ReadPCLImage function in coders/pcl.c. (no CVSS)
- [CVE-2019-12975](https://cve.now/CVE-2019-12975.md): ImageMagick 7.0.8-34 has a memory leak vulnerability in the WriteDPXImage function in coders/dpx.c. (no CVSS)
- [CVE-2019-12974](https://cve.now/CVE-2019-12974.md): A NULL pointer dereference in the function ReadPANGOImage in coders/pango.c and the function ReadVIDImage in coders/vid.c in ImageMagick 7.0 (no CVSS)
- [CVE-2019-12973](https://cve.now/CVE-2019-12973.md): In OpenJPEG 2.3.1, there is excessive iteration in the opj\_t1\_encode\_cblks function of openjp2/t1.c. (no CVSS)
- [CVE-2018-20847](https://cve.now/CVE-2018-20847.md): An improper computation of p\_tx0, p\_tx1, p\_ty0 and p\_ty1 in the function opj\_get\_encoding\_parameters in openjp2/pi.c in OpenJPEG through 2.3 (no CVSS)
- [CVE-2018-20846](https://cve.now/CVE-2018-20846.md): Out-of-bounds accesses in the functions pi\_next\_lrcp, pi\_next\_rlcp, pi\_next\_rpcl, pi\_next\_pcrl, pi\_next\_rpcl, and pi\_next\_cprl in openmj2/pi (no CVSS)
- [CVE-2018-20845](https://cve.now/CVE-2018-20845.md): Division-by-zero vulnerabilities in the functions pi\_next\_pcrl, pi\_next\_cprl, and pi\_next\_rpcl in openmj2/pi.c in OpenJPEG through 2.3.0 all (no CVSS)
- [CVE-2019-10164](https://cve.now/CVE-2019-10164.md): PostgreSQL versions 10.x before 10.9 and versions 11.x before 11.4 are vulnerable to a stack-based buffer overflow. (CVSS 7.5, PostgreSQL)
- [CVE-2019-11583](https://cve.now/CVE-2019-11583.md): The issue searching component in Jira before version 8.1.0 allows remote attackers to deny access to Jira service via denial of service vuln (no CVSS, Atlassian Jira)
- [CVE-2019-3569](https://cve.now/CVE-2019-3569.md): HHVM, when used with FastCGI, would bind by default to all available interfaces. (no CVSS, Facebook HHVM)
- [CVE-2019-4241](https://cve.now/CVE-2019-4241.md): IBM PureApplication System 2.2.3.0 through 2.2.5.3 could allow an authenticated user with local access to bypass authentication and obtain a (CVSS 8.4, IBM PureApplication System)
- [CVE-2019-4235](https://cve.now/CVE-2019-4235.md): IBM PureApplication System 2.2.3.0 through 2.2.5.3 does not require that users should have strong passwords by default, which makes it easie (CVSS 5.9, IBM PureApplication System)
- [CVE-2019-4234](https://cve.now/CVE-2019-4234.md): IBM PureApplication System 2.2.3.0 through 2.2.5.3 weakness in the implementation of locking feature in pattern editor. (CVSS 4.3, IBM PureApplication System)
- [CVE-2019-4225](https://cve.now/CVE-2019-4225.md): IBM PureApplication System 2.2.3.0 through 2.2.5.3 stores potentially sensitive information in log files that could be read by a local user. (CVSS 4.4, IBM PureApplication System)
- [CVE-2019-4224](https://cve.now/CVE-2019-4224.md): IBM PureApplication System 2.2.3.0 through 2.2.5.3 is vulnerable to SQL injection. (CVSS 6.3, IBM PureApplication System)
- [CVE-2019-6169](https://cve.now/CVE-2019-6169.md): A vulnerability reported in Lenovo Service Bridge before version 4.1.0.1 could allow unencrypted downloads over FTP. (CVSS 6.5, Lenovo Service Bridge)
- [CVE-2019-6168](https://cve.now/CVE-2019-6168.md): A vulnerability reported in Lenovo Service Bridge before version 4.1.0.1 could allow remote code execution. (CVSS 8.8, Lenovo Service Bridge)
- [CVE-2019-6167](https://cve.now/CVE-2019-6167.md): A vulnerability reported in Lenovo Service Bridge before version 4.1.0.1 could allow remote code execution. (CVSS 8.8, Lenovo Service Bridge)
- [CVE-2019-6166](https://cve.now/CVE-2019-6166.md): A vulnerability reported in Lenovo Service Bridge before version 4.1.0.1 could allow cross-site request forgery. (CVSS 5.4, Lenovo Service Bridge)
- [CVE-2019-6163](https://cve.now/CVE-2019-6163.md): A denial of service vulnerability was reported in Lenovo System Update before version 5.07.0084 that could allow service log files to be wri (CVSS 5.5, Lenovo System Update)
- [CVE-2019-11272](https://cve.now/CVE-2019-11272.md): PlaintextPasswordEncoder authenticates encoded passwords that are null (no CVSS, Spring Security · org.springframework.security:spring-se… +1)
- [CVE-2019-12972](https://cve.now/CVE-2019-12972.md): An issue was discovered in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.32. (no CVSS)
- [CVE-2019-12968](https://cve.now/CVE-2019-12968.md): A vulnerability was found in the Sonic Robo Blast 2 (SRB2) plugin (EP\_Versions 9 to 11 inclusive) distributed with Doomseeker 1.1 and 1.2. (no CVSS)
- [CVE-2019-12966](https://cve.now/CVE-2019-12966.md): FeHelper through 2019-06-19 allows arbitrary code execution during a JSON format operation, as demonstrated by the {"a":(function(){confirm( (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2019-06-26
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.