# CVEs published 2019-06-29

15 CVEs were published on June 29, 2019: 0 critical, 0 high. Days are UTC.

- [CVE-2019-13067](https://cve.now/CVE-2019-13067.md): njs through 0.3.3, used in NGINX, has a buffer over-read in nxt\_utf8\_decode in nxt/nxt\_utf8.c. (no CVSS)
- [CVE-2019-13055](https://cve.now/CVE-2019-13055.md): Certain Logitech Unifying devices allow attackers to dump AES keys and addresses, leading to the capability of live decryption of Radio Freq (no CVSS)
- [CVE-2019-13054](https://cve.now/CVE-2019-13054.md): The Logitech R500 presentation clicker allows attackers to determine the AES key, leading to keystroke injection. (no CVSS)
- [CVE-2019-13053](https://cve.now/CVE-2019-13053.md): Logitech Unifying devices allow keystroke injection, bypassing encryption. (no CVSS)
- [CVE-2016-10761](https://cve.now/CVE-2016-10761.md): Logitech Unifying devices before 2016-02-26 allow keystroke injection, bypassing encryption, aka MouseJack. (no CVSS)
- [CVE-2019-13052](https://cve.now/CVE-2019-13052.md): Logitech Unifying devices allow live decryption if the pairing of a keyboard to a receiver is sniffed. (no CVSS)
- [CVE-2019-13050](https://cve.now/CVE-2019-13050.md): Interaction between the sks-keyserver code through 1.2.0 of the SKS keyserver network, and GnuPG through 2.2.16, makes it risky to have a Gn (no CVSS)
- [CVE-2019-13049](https://cve.now/CVE-2019-13049.md): An integer wrap in kernel/sys/syscall.c in ToaruOS 1.10.10 allows users to map arbitrary kernel pages into userland process space via TOARU\_ (no CVSS)
- [CVE-2019-13048](https://cve.now/CVE-2019-13048.md): kernel/sys/syscall.c in ToaruOS through 1.10.9 allows a denial of service upon a critical error in certain sys\_sbrk allocation patterns (inv (no CVSS)
- [CVE-2019-13047](https://cve.now/CVE-2019-13047.md): kernel/sys/syscall.c in ToaruOS through 1.10.9 has incorrect access control in sys\_sysfunc case 9 for TOARU\_SYS\_FUNC\_SETHEAP, allowing arbit (no CVSS)
- [CVE-2019-13046](https://cve.now/CVE-2019-13046.md): linker/linker.c in ToaruOS through 1.10.9 has insecure LD\_LIBRARY\_PATH handling in setuid applications. (no CVSS)
- [CVE-2019-13045](https://cve.now/CVE-2019-13045.md): Irssi before 1.0.8, 1.1.x before 1.1.3, and 1.2.x before 1.2.1, when SASL is enabled, has a use after free when sending SASL login to the se (no CVSS)
- [CVE-2019-13035](https://cve.now/CVE-2019-13035.md): Artica Pandora FMS 7.0 NG before 735 suffers from local privilege escalation due to improper permissions on C:\\PandoraFMS and its sub-folder (no CVSS)
- [CVE-2019-13038](https://cve.now/CVE-2019-13038.md): mod\_auth\_mellon through 0.14.2 has an Open Redirect via the login?ReturnTo= substring, as demonstrated by omitting the // after http: in the (no CVSS)
- [CVE-2019-13068](https://cve.now/CVE-2019-13068.md): public/app/features/panel/panel\_ctrl.ts in Grafana before 6.2.5 allows HTML Injection in panel drilldown links (via the Title or url field). (no CVSS, github.com/grafana/grafana)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2019-06-29
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.