# CVEs published 2019-06-28

29 CVEs were published on June 28, 2019: 0 critical, 1 high. Days are UTC.

- [CVE-2019-13032](https://cve.now/CVE-2019-13032.md): An issue was discovered in FlightCrew v0.9.2 and earlier. (no CVSS)
- [CVE-2019-13031](https://cve.now/CVE-2019-13031.md): LemonLDAP::NG before 1.9.20 has an XML External Entity (XXE) issue when submitting a notification to the notification server. (no CVSS)
- [CVE-2019-13028](https://cve.now/CVE-2019-13028.md): An incorrect implementation of a local web server in eID client (Windows version before 3.1.2, Linux version before 3.0.3) allows remote att (no CVSS)
- [CVE-2019-10964](https://cve.now/CVE-2019-10964.md): Medtronic MiniMed 508 and Paradigm Series Insulin Pumps Improper Access Control (CVSS 7.1, Medtronic MiniMed 508 pump · Medtronic MiniMed Paradigm… +9)
- [CVE-2019-10993](https://cve.now/CVE-2019-10993.md): In WebAccess/SCADA Versions 8.3.5 and prior, multiple untrusted pointer dereference vulnerabilities may allow a remote attacker to execute a (no CVSS, WebAccess/SCADA)
- [CVE-2019-10987](https://cve.now/CVE-2019-10987.md): In WebAccess/SCADA Versions 8.3.5 and prior, multiple out-of-bounds write vulnerabilities are caused by a lack of proper validation of the l (no CVSS, WebAccess/SCADA)
- [CVE-2019-10983](https://cve.now/CVE-2019-10983.md): In WebAccess/SCADA Versions 8.3.5 and prior, an out-of-bounds read vulnerability is caused by a lack of proper validation of user-supplied d (no CVSS, WebAccess/SCADA)
- [CVE-2019-10989](https://cve.now/CVE-2019-10989.md): In WebAccess/SCADA Versions 8.3.5 and prior, multiple heap-based buffer overflow vulnerabilities are caused by a lack of proper validation o (no CVSS, WebAccess/SCADA)
- [CVE-2019-10991](https://cve.now/CVE-2019-10991.md): In WebAccess/SCADA, Versions 8.3.5 and prior, multiple stack-based buffer overflow vulnerabilities are caused by a lack of proper validation (no CVSS, WebAccess/SCADA)
- [CVE-2019-10985](https://cve.now/CVE-2019-10985.md): In WebAccess/SCADA, Versions 8.3.5 and prior, a path traversal vulnerability is caused by a lack of proper validation of a user-supplied pat (no CVSS, WebAccess/SCADA)
- [CVE-2019-10175](https://cve.now/CVE-2019-10175.md): A flaw was found in the containerized-data-importer in virt-cdi-cloner, version 1.4, where the host-assisted cloning feature does not determ (CVSS 6.5, KubeVirt containerized-data-importer)
- [CVE-2018-17170](https://cve.now/CVE-2018-17170.md): Grouptime Teamwire Desktop Client 1.5.1 prior to 1.9.0 on Windows allows code injection via a template, leading to remote code execution. (no CVSS)
- [CVE-2018-17560](https://cve.now/CVE-2018-17560.md): The admin interface of the Grouptime Teamwire Client 1.5.1 prior to 1.9.0 on-premises messenger server allows stored XSS. (no CVSS)
- [CVE-2018-14867](https://cve.now/CVE-2018-14867.md): Incorrect access control in the portal messaging system in Odoo Community 9.0 and 10.0 and Odoo Enterprise 9.0 and 10.0 allows remote attack (no CVSS)
- [CVE-2018-14868](https://cve.now/CVE-2018-14868.md): Incorrect access control in the Password Encryption module in Odoo Community 9.0 and Odoo Enterprise 9.0 allows authenticated users to chang (no CVSS)
- [CVE-2018-14885](https://cve.now/CVE-2018-14885.md): Incorrect access control in the database manager component in Odoo Community 10.0 and 11.0 and Odoo Enterprise 10.0 and 11.0 allows a remote (no CVSS)
- [CVE-2018-14886](https://cve.now/CVE-2018-14886.md): The module-description renderer in Odoo Community 11.0 and earlier and Odoo Enterprise 11.0 and earlier does not disable RST's local file in (no CVSS)
- [CVE-2018-14887](https://cve.now/CVE-2018-14887.md): Improper Host header sanitization in the dbfilter routing component in Odoo Community 11.0 and earlier and Odoo Enterprise 11.0 and earlier (no CVSS)
- [CVE-2019-12932](https://cve.now/CVE-2019-12932.md): A stored XSS vulnerability was found in SeedDMS 5.1.11 due to poorly escaping the search result in the autocomplete search form placed in th (no CVSS)
- [CVE-2018-14916](https://cve.now/CVE-2018-14916.md): LOYTEC LGATE-902 6.3.2 devices allow Arbitrary file deletion. (no CVSS)
- [CVE-2018-14918](https://cve.now/CVE-2018-14918.md): LOYTEC LGATE-902 6.3.2 devices allow Directory Traversal. (no CVSS)
- [CVE-2018-14919](https://cve.now/CVE-2018-14919.md): LOYTEC LGATE-902 6.3.2 devices allow XSS. (no CVSS)
- [CVE-2019-4269](https://cve.now/CVE-2019-4269.md): IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 Admin Console could allow a remote attacker to obtain sensitive information when a s (CVSS 5.3, IBM WebSphere Application Server)
- [CVE-2018-15519](https://cve.now/CVE-2018-15519.md): Various Lexmark devices have a Buffer Overflow (issue 1 of 2). (no CVSS)
- [CVE-2018-15520](https://cve.now/CVE-2018-15520.md): Various Lexmark devices have a Buffer Overflow (issue 2 of 2). (no CVSS)
- [CVE-2018-15555](https://cve.now/CVE-2018-15555.md): On Telus Actiontec WEB6000Q v1.1.02.22 devices, an attacker can login with root level access with the user "root" and password "admin" by us (no CVSS)
- [CVE-2019-13012](https://cve.now/CVE-2019-13012.md): The keyfile settings backend in GNOME GLib (aka glib2.0) before 2.60.0 creates directories using g\_file\_make\_directory\_with\_parents (kfsb-\>d (no CVSS)
- [CVE-2019-12997](https://cve.now/CVE-2019-12997.md): In Loopchain through 2.2.1.3, an attacker can escalate privileges from a low-privilege shell by changing the environment (aka injection in t (no CVSS)
- [CVE-2019-12995](https://cve.now/CVE-2019-12995.md): Istio before 1.2.2 mishandles certain access tokens, leading to "Epoch 0 terminated with an error" in Envoy. (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2019-06-28
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.