# CVEs published 2019-06-30

24 CVEs were published on June 30, 2019: 0 critical, 3 high. Days are UTC.

- [CVE-2019-13113](https://cve.now/CVE-2019-13113.md): Exiv2 through 0.27.1 allows an attacker to cause a denial of service (crash due to assertion failure) via an invalid data location in a CRW (no CVSS)
- [CVE-2019-13111](https://cve.now/CVE-2019-13111.md): A WebPImage::decodeChunks integer overflow in Exiv2 through 0.27.1 allows an attacker to cause a denial of service (large heap allocation fo (no CVSS)
- [CVE-2019-13109](https://cve.now/CVE-2019-13109.md): An integer overflow in Exiv2 through 0.27.1 allows an attacker to cause a denial of service (SIGSEGV) via a crafted PNG image file, because (no CVSS)
- [CVE-2019-13108](https://cve.now/CVE-2019-13108.md): An integer overflow in Exiv2 through 0.27.1 allows an attacker to cause a denial of service (SIGSEGV) via a crafted PNG image file, because (no CVSS)
- [CVE-2019-13107](https://cve.now/CVE-2019-13107.md): Multiple integer overflows exist in MATIO before 1.5.16, related to mat.c, mat4.c, mat5.c, mat73.c, and matvar\_struct.c (no CVSS)
- [CVE-2018-20849](https://cve.now/CVE-2018-20849.md): Arastta eCommerce 1.6.2 is vulnerable to XSS via the PATH\_INFO to the login/ URI. (no CVSS)
- [CVE-2018-20848](https://cve.now/CVE-2018-20848.md): Advisto PEEL SHOPPING 9.0.0 has CSRF via en/achat/caddie\_ajout.php and en/achat/caddie\_affichage.php, as demonstrated by an XSS payload in t (no CVSS)
- [CVE-2019-13086](https://cve.now/CVE-2019-13086.md): core/MY\_Security.php in CSZ CMS 1.2.2 before 2019-06-20 has member/login/check SQL injection by sending a crafted HTTP User-Agent header and (no CVSS)
- [CVE-2019-13085](https://cve.now/CVE-2019-13085.md): XnView Classic 2.48 has a User Mode Write AV starting at xnview+0x000000000030ecfa. (no CVSS)
- [CVE-2019-13084](https://cve.now/CVE-2019-13084.md): XnView Classic 2.48 has a User Mode Write AV starting at xnview+0x000000000026b739. (no CVSS)
- [CVE-2019-13083](https://cve.now/CVE-2019-13083.md): XnView Classic 2.48 has a User Mode Write AV starting at xnview+0x0000000000384e2a. (no CVSS)
- [CVE-2019-13082](https://cve.now/CVE-2019-13082.md): Chamilo LMS 1.11.8 and 2.x allows remote code execution through an lp\_upload.php unauthenticated file upload feature. (no CVSS)
- [CVE-2019-11827](https://cve.now/CVE-2019-11827.md): Cross-site scripting (XSS) vulnerability in SYNO.NoteStation.Shard in Synology Note Station before 2.5.3-0863 allows remote attackers to inj (CVSS 6.5, Synology Note Station)
- [CVE-2019-11828](https://cve.now/CVE-2019-11828.md): Cross-site scripting (XSS) vulnerability in Chart in Synology Office before 3.1.4-2771 allows remote authenticated users to inject arbitrary (CVSS 5.5, Synology Office)
- [CVE-2019-11829](https://cve.now/CVE-2019-11829.md): OS command injection vulnerability in drivers\_syno\_import\_user.php in Synology Calendar before 2.3.1-0617 allows remote attackers to execute (CVSS 7.3, Synology Calendar)
- [CVE-2019-11822](https://cve.now/CVE-2019-11822.md): Relative path traversal vulnerability in SYNO.PhotoStation.File in Synology Photo Station before 6.8.11-3489 and before 6.3-2977 allows remo (CVSS 4.3, Synology Photo Station)
- [CVE-2019-11821](https://cve.now/CVE-2019-11821.md): SQL injection vulnerability in synophoto\_csPhotoDB.php in Synology Photo Station before 6.8.11-3489 and before 6.3-2977 allows remote attack (CVSS 7.3, Synology Photo Station)
- [CVE-2019-11825](https://cve.now/CVE-2019-11825.md): Cross-site scripting (XSS) vulnerability in Event Editor in Synology Calendar before 2.3.0-0615 allows remote attackers to inject arbitrary (CVSS 6.5, Synology Calendar)
- [CVE-2019-11826](https://cve.now/CVE-2019-11826.md): Relative path traversal vulnerability in SYNO.PhotoTeam.Upload.Item in Synology Moments before 1.3.0-0691 allows remote authenticated users (CVSS 8.0, Synology Photo Moments)
- [CVE-2019-13075](https://cve.now/CVE-2019-13075.md): Tor Browser through 8.5.3 has an information exposure vulnerability. (no CVSS)
- [CVE-2019-13072](https://cve.now/CVE-2019-13072.md): Stored XSS in the Filters page (Name field) in ZoneMinder 1.32.3 allows a malicious user to embed and execute JavaScript code in the browser (no CVSS)
- [CVE-2019-13110](https://cve.now/CVE-2019-13110.md): A CiffDirectory::readDirectory integer overflow and out-of-bounds read in Exiv2 through 0.27.1 allows an attacker to cause a denial of servi (no CVSS)
- [CVE-2019-13112](https://cve.now/CVE-2019-13112.md): A PngChunk::parseChunkContent uncontrolled memory allocation in Exiv2 through 0.27.1 allows an attacker to cause a denial of service (crash (no CVSS)
- [CVE-2019-13114](https://cve.now/CVE-2019-13114.md): http.c in Exiv2 through 0.27.1 allows a malicious http server to cause a denial of service (crash due to a NULL pointer dereference) by retu (no CVSS, exiv2)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2019-06-30
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.