CVEs published June 30, 2019
24 CVEs were published on June 30, 2019: 0 critical, 3 high.
- Published
- 24
- Critical
- 0
- High
- 3
- Medium
- 4
- Low
- 0
- Unrated
- 17
- Now in CISA KEV
- 0
- Fix available
- 7
Most affected products
- Synology Calendar
- 2
- Synology Photo Station
- 2
- exiv2
- 1
- Synology Note Station
- 1
- Synology Office
- 1
- Synology Photo Moments
- 1
High 3
- CVE-2019-11829OS command injection vulnerability in drivers_syno_import_user.php in Synology Calendar before 2.3.1-0617 allows remote attackers to executeSynology Calendar
- CVE-2019-11821SQL injection vulnerability in synophoto_csPhotoDB.php in Synology Photo Station before 6.8.11-3489 and before 6.3-2977 allows remote attackSynology Photo Station
- CVE-2019-11826Relative path traversal vulnerability in SYNO.PhotoTeam.Upload.Item in Synology Moments before 1.3.0-0691 allows remote authenticated users Synology Photo Moments
Medium, low and unrated 21
- CVE-2019-13113Exiv2 through 0.27.1 allows an attacker to cause a denial of service (crash due to assertion failure) via an invalid data location in a CRW
- CVE-2019-13111A WebPImage::decodeChunks integer overflow in Exiv2 through 0.27.1 allows an attacker to cause a denial of service (large heap allocation fo
- CVE-2019-13109An integer overflow in Exiv2 through 0.27.1 allows an attacker to cause a denial of service (SIGSEGV) via a crafted PNG image file, because
- CVE-2019-13108An integer overflow in Exiv2 through 0.27.1 allows an attacker to cause a denial of service (SIGSEGV) via a crafted PNG image file, because
- CVE-2019-13107Multiple integer overflows exist in MATIO before 1.5.16, related to mat.c, mat4.c, mat5.c, mat73.c, and matvar_struct.c
- CVE-2018-20849Arastta eCommerce 1.6.2 is vulnerable to XSS via the PATH_INFO to the login/ URI.
- CVE-2018-20848Advisto PEEL SHOPPING 9.0.0 has CSRF via en/achat/caddie_ajout.php and en/achat/caddie_affichage.php, as demonstrated by an XSS payload in t
- CVE-2019-13086core/MY_Security.php in CSZ CMS 1.2.2 before 2019-06-20 has member/login/check SQL injection by sending a crafted HTTP User-Agent header and
- CVE-2019-13085XnView Classic 2.48 has a User Mode Write AV starting at xnview+0x000000000030ecfa.
- CVE-2019-13084XnView Classic 2.48 has a User Mode Write AV starting at xnview+0x000000000026b739.
- CVE-2019-13083XnView Classic 2.48 has a User Mode Write AV starting at xnview+0x0000000000384e2a.
- CVE-2019-13082Chamilo LMS 1.11.8 and 2.x allows remote code execution through an lp_upload.php unauthenticated file upload feature.
- CVE-2019-11827Cross-site scripting (XSS) vulnerability in SYNO.NoteStation.Shard in Synology Note Station before 2.5.3-0863 allows remote attackers to injSynology Note Station
- CVE-2019-11828Cross-site scripting (XSS) vulnerability in Chart in Synology Office before 3.1.4-2771 allows remote authenticated users to inject arbitrarySynology Office
- CVE-2019-11822Relative path traversal vulnerability in SYNO.PhotoStation.File in Synology Photo Station before 6.8.11-3489 and before 6.3-2977 allows remoSynology Photo Station
- CVE-2019-11825Cross-site scripting (XSS) vulnerability in Event Editor in Synology Calendar before 2.3.0-0615 allows remote attackers to inject arbitrary Synology Calendar
- CVE-2019-13075Tor Browser through 8.5.3 has an information exposure vulnerability.
- CVE-2019-13072Stored XSS in the Filters page (Name field) in ZoneMinder 1.32.3 allows a malicious user to embed and execute JavaScript code in the browser
- CVE-2019-13110A CiffDirectory::readDirectory integer overflow and out-of-bounds read in Exiv2 through 0.27.1 allows an attacker to cause a denial of servi
- CVE-2019-13112A PngChunk::parseChunkContent uncontrolled memory allocation in Exiv2 through 0.27.1 allows an attacker to cause a denial of service (crash
- CVE-2019-13114http.c in Exiv2 through 0.27.1 allows a malicious http server to cause a denial of service (crash due to a NULL pointer dereference) by retuexiv2