# CVEs published 2019-07-01

60 CVEs were published on July 1, 2019: 0 critical, 6 high. Days are UTC.

- [CVE-2019-9703](https://cve.now/CVE-2019-9703.md): Symantec Endpoint Encryption, prior to SEE 11.3.0, may be susceptible to a privilege escalation vulnerability, which is a type of issue that (no CVSS, Symantec Endpoint Encryption)
- [CVE-2019-9702](https://cve.now/CVE-2019-9702.md): Symantec Endpoint Encryption, prior to SEE 11.3.0, may be susceptible to a privilege escalation vulnerability, which is a type of issue that (no CVSS, Symantec Endpoint Encryption)
- [CVE-2019-6642](https://cve.now/CVE-2019-6642.md): In BIG-IP 15.0.0, 14.0.0-14.1.0.5, 13.0.0-13.1.1.5, 12.1.0-12.1.4.2, and 11.5.2-11.6.4, BIG-IQ 6.0.0-6.1.0 and 5.1.0-5.4.0, iWorkflow 2.3.0, (no CVSS, F5 BIG-IP, BIG-IQ, iWorkflow, Enterprise Manager)
- [CVE-2019-5497](https://cve.now/CVE-2019-5497.md): NetApp AFF A700s Baseboard Management Controller (BMC) firmware versions 1.22 and higher were shipped with a default account enabled that co (no CVSS, NetApp AFF A700s Baseboard Management Controller)
- [CVE-2019-7271](https://cve.now/CVE-2019-7271.md): Nortek Linear eMerge 50P/5000P devices have Default Credentials. (no CVSS)
- [CVE-2019-7272](https://cve.now/CVE-2019-7272.md): Optergy Proton/Enterprise devices allow Username Disclosure. (no CVSS)
- [CVE-2019-7273](https://cve.now/CVE-2019-7273.md): Optergy Proton/Enterprise devices allow Cross-Site Request Forgery (CSRF). (no CVSS)
- [CVE-2019-10979](https://cve.now/CVE-2019-10979.md): SICK MSC800 all versions prior to Version 4.0, the affected firmware versions contain a hard-coded customer account password. (no CVSS, SICK MSC800)
- [CVE-2019-7274](https://cve.now/CVE-2019-7274.md): Optergy Proton/Enterprise devices allow Authenticated File Upload with Code Execution as root. (no CVSS)
- [CVE-2019-7275](https://cve.now/CVE-2019-7275.md): Optergy Proton/Enterprise devices allow Open Redirect. (no CVSS)
- [CVE-2019-7277](https://cve.now/CVE-2019-7277.md): Optergy Proton/Enterprise devices allow Unauthenticated Internal Network Information Disclosure. (no CVSS)
- [CVE-2019-7278](https://cve.now/CVE-2019-7278.md): Optergy Proton/Enterprise devices have an Unauthenticated SMS Sending Service. (no CVSS)
- [CVE-2019-3962](https://cve.now/CVE-2019-3962.md): Content Injection vulnerability in Tenable Nessus prior to 8.5.0 may allow an authenticated, local attacker to exploit this vulnerability by (no CVSS, Tenable Nessus)
- [CVE-2019-13137](https://cve.now/CVE-2019-13137.md): ImageMagick before 7.0.8-50 has a memory leak vulnerability in the function ReadPSImage in coders/ps.c. (no CVSS)
- [CVE-2019-13136](https://cve.now/CVE-2019-13136.md): ImageMagick before 7.0.8-50 has an integer overflow vulnerability in the function TIFFSeekCustomStream in coders/tiff.c. (no CVSS)
- [CVE-2019-13135](https://cve.now/CVE-2019-13135.md): ImageMagick before 7.0.8-50 has a "use of uninitialized value" vulnerability in the function ReadCUTImage in coders/cut.c. (no CVSS)
- [CVE-2019-13134](https://cve.now/CVE-2019-13134.md): ImageMagick before 7.0.8-50 has a memory leak vulnerability in the function ReadVIFFImage in coders/viff.c. (no CVSS)
- [CVE-2019-13133](https://cve.now/CVE-2019-13133.md): ImageMagick before 7.0.8-50 has a memory leak vulnerability in the function ReadBMPImage in coders/bmp.c. (no CVSS)
- [CVE-2019-7279](https://cve.now/CVE-2019-7279.md): Optergy Proton/Enterprise devices have Hard-coded Credentials. (no CVSS)
- [CVE-2019-7280](https://cve.now/CVE-2019-7280.md): Prima Systems FlexAir, Versions 2.3.38 and prior. (no CVSS)
- [CVE-2019-1578](https://cve.now/CVE-2019-1578.md): Cross-site scripting vulnerability in Palo Alto Networks MineMeld version 0.9.60 and earlier may allow a remote attacker able to convince an (no CVSS, Palo Alto Networks MineMeld)
- [CVE-2019-1577](https://cve.now/CVE-2019-1577.md): Code injection vulnerability in Palo Alto Networks Traps 5.0.5 and earlier may allow an authenticated attacker to inject arbitrary JavaScrip (no CVSS, Palo Alto Networks Traps)
- [CVE-2019-7281](https://cve.now/CVE-2019-7281.md): Prima Systems FlexAir, Versions 2.3.38 and prior. (no CVSS)
- [CVE-2019-7666](https://cve.now/CVE-2019-7666.md): Prima Systems FlexAir, Versions 2.3.38 and prior. (no CVSS)
- [CVE-2019-7667](https://cve.now/CVE-2019-7667.md): Prima Systems FlexAir, Versions 2.3.38 and prior. (no CVSS)
- [CVE-2019-7668](https://cve.now/CVE-2019-7668.md): Prima Systems FlexAir devices have Default Credentials. (no CVSS)
- [CVE-2019-7669](https://cve.now/CVE-2019-7669.md): Prima Systems FlexAir, Versions 2.3.38 and prior. (no CVSS)
- [CVE-2019-13024](https://cve.now/CVE-2019-13024.md): Centreon 18.x before 18.10.6, 19.x before 19.04.3, and Centreon web before 2.8.29 allows the attacker to execute arbitrary system commands b (no CVSS)
- [CVE-2019-7670](https://cve.now/CVE-2019-7670.md): Prima Systems FlexAir, Versions 2.3.38 and prior. (no CVSS)
- [CVE-2019-12826](https://cve.now/CVE-2019-12826.md): A Cross-Site-Request-Forgery (CSRF) vulnerability in widget\_logic.php in the 2by2host Widget Logic plugin before 5.10.2 for WordPress allows (no CVSS)
- [CVE-2016-5236](https://cve.now/CVE-2016-5236.md): Cross-Site-Scripting (XSS) vulnerabilities in F5 WebSafe Dashboard 3.9.5 and earlier, aka F5 WebSafe Alert Server, allow privileged authenti (no CVSS)
- [CVE-2016-5235](https://cve.now/CVE-2016-5235.md): A Cross Site Scripting (XSS) vulnerability in versions of F5 WebSafe Dashboard 3.9.x and earlier, aka F5 WebSafe Alert Server, allows an una (no CVSS)
- [CVE-2019-13131](https://cve.now/CVE-2019-13131.md): Super Micro SuperDoctor 5, when restrictions are not implemented in agent.cfg, allows remote attackers to execute arbitrary commands via NRP (no CVSS)
- [CVE-2019-4410](https://cve.now/CVE-2019-4410.md): IBM Business Automation Workflow 18.0.0.0, 18.0.0.1, 18.0.0.2, and 19.0.0.1 is vulnerable to cross-site scripting. (CVSS 5.4, IBM Business Automation Workflow)
- [CVE-2019-4386](https://cve.now/CVE-2019-4386.md): IBM DB2 for Linux, UNIX and Windows (includes DB2 Connect Server) 11.1 could allow an authenticated user to execute a function that would ca (CVSS 6.5, IBM DB2 for Linux, UNIX and Windows)
- [CVE-2019-4383](https://cve.now/CVE-2019-4383.md): When using IBM Spectrum Protect Plus 10.1.0, 10.1.2, and 10.1.3 to protect Oracle or MongoDB databases, a redirected restore operation may r (CVSS 7.9, IBM Spectrum Protect Plus)
- [CVE-2019-4357](https://cve.now/CVE-2019-4357.md): When using IBM Spectrum Protect Plus 10.1.0, 10.1.2, and 10.1.3 to protect Oracle, DB2 or MongoDB databases, a redirected restore operation (CVSS 8.2, IBM Spectrum Protect Plus)
- [CVE-2019-4337](https://cve.now/CVE-2019-4337.md): IBM Robotic Process Automation with Automation Anywhere 11 could allow an attacker to obtain sensitive information due to missing authentica (CVSS 5.3, IBM Robotic Process Automation with Automation Anywhere)
- [CVE-2019-4336](https://cve.now/CVE-2019-4336.md): IBM Robotic Process Automation with Automation Anywhere 11 uses an inadequate account lockout setting that could allow a remote attacker to (CVSS 7.5, IBM Robotic Process Automation with Automation Anywhere)
- [CVE-2019-4322](https://cve.now/CVE-2019-4322.md): IBM DB2 for Linux, UNIX and Windows (includes DB2 Connect Server) 9.7, 10.1, 10.5, and 11.1 is vulnerable to a buffer overflow, which could (CVSS 8.4, IBM DB2 for Linux, UNIX and Windows)
- [CVE-2019-4299](https://cve.now/CVE-2019-4299.md): IBM Robotic Process Automation with Automation Anywhere 11 could allow a local user to obtain highly sensitive information from log files wh (CVSS 5.1, IBM Robotic Process Automation with Automation Anywhere)
- [CVE-2019-4298](https://cve.now/CVE-2019-4298.md): IBM Robotic Process Automation with Automation Anywhere 11 uses a high privileged PostgreSQL account for database access which could allow a (CVSS 7.7, IBM Robotic Process Automation with Automation Anywhere)
- [CVE-2019-4297](https://cve.now/CVE-2019-4297.md): IBM Robotic Process Automation with Automation Anywhere 11 could allow a remote authenticated attacker to conduct an LDAP injection. (CVSS 6.4, IBM Robotic Process Automation with Automation Anywhere)
- [CVE-2019-4296](https://cve.now/CVE-2019-4296.md): IBM Robotic Process Automation with Automation Anywhere 11 information disclosure could allow a local user to obtain e-mail contents from th (CVSS 4.0, IBM Robotic Process Automation with Automation Anywhere)
- [CVE-2019-4295](https://cve.now/CVE-2019-4295.md): IBM Robotic Process Automation with Automation Anywhere 11 could allow an attacker with specialized access to obtain highly sensitive from t (CVSS 4.9, IBM Robotic Process Automation with Automation Anywhere)
- [CVE-2019-4237](https://cve.now/CVE-2019-4237.md): A Cross-Frame Scripting vulnerability in IBM InfoSphere Information Server 11.3, 11.5, and 11.7 can allow an attacker to load the vulnerable (CVSS 5.4, IBM InfoSphere Information Server)
- [CVE-2019-4154](https://cve.now/CVE-2019-4154.md): IBM DB2 for Linux, UNIX and Windows (includes DB2 Connect Server) 9.7, 10.1, 10.5, and 11.1 is vulnerable to a buffer overflow, which could (CVSS 8.4, IBM DB2 for Linux, UNIX and Windows)
- [CVE-2019-4102](https://cve.now/CVE-2019-4102.md): IBM DB2 for Linux, UNIX and Windows (includes DB2 Connect Server) 9.7, 10.1, 10.5, and 11.0 uses weaker than expected cryptographic algorith (CVSS 5.9, IBM DB2 for Linux, UNIX and Windows)
- [CVE-2019-4101](https://cve.now/CVE-2019-4101.md): IBM DB2 for Linux, UNIX and Windows (includes DB2 Connect Server) 10.1, 10.5, and 11.1 is vulnerable to a denial of service. (CVSS 6.2, IBM DB2 for Linux, UNIX and Windows)
- [CVE-2019-4057](https://cve.now/CVE-2019-4057.md): IBM DB2 for Linux, UNIX and Windows (includes DB2 Connect Server) 9.7, 10.1, 10.5, and 11.1 could allow malicious user with access to the DB (CVSS 6.7, IBM DB2 for Linux, UNIX and Windows)
- [CVE-2019-13129](https://cve.now/CVE-2019-13129.md): On the Motorola router CX2L MWR04L 1.01, there is a stack consumption (infinite recursion) issue in scopd via TCP port 8010 and UDP port 808 (no CVSS)
- [CVE-2019-13128](https://cve.now/CVE-2019-13128.md): An issue was discovered on D-Link DIR-823G devices with firmware 1.02B03. (no CVSS)
- [CVE-2019-13127](https://cve.now/CVE-2019-13127.md): An issue was discovered in mxGraph through 4.0.0, related to the "draw.io Diagrams" plugin before 8.3.14 for Confluence and other products. (no CVSS, mxgraph)
- [CVE-2019-12781](https://cve.now/CVE-2019-12781.md): An issue was discovered in Django 1.11 before 1.11.22, 2.1 before 2.1.10, and 2.2 before 2.2.3. (no CVSS, django)
- [CVE-2019-13125](https://cve.now/CVE-2019-13125.md): HaboMalHunter through 2.0.0.3 in Tencent Habo allows attackers to evade dynamic malware analysis via PIE compilation. (no CVSS)
- [CVE-2019-12970](https://cve.now/CVE-2019-12970.md): XSS was discovered in SquirrelMail through 1.4.22 and 1.5.x through 1.5.2. (no CVSS)
- [CVE-2019-13118](https://cve.now/CVE-2019-13118.md): In numbers.c in libxslt 1.1.33, a type holding grouping characters of an xsl:number instruction was too narrow and an invalid character/leng (CVSS 5.3, nokogiri)
- [CVE-2019-13117](https://cve.now/CVE-2019-13117.md): In numbers.c in libxslt 1.1.33, an xsl:number with certain format strings could lead to a uninitialized read in xsltNumberFormatInsertNumber (CVSS 5.3, nokogiri)
- [CVE-2019-13147](https://cve.now/CVE-2019-13147.md): In Audio File Library (aka audiofile) 0.3.6, there exists one NULL pointer dereference bug in ulaw2linear\_buf in G711.cpp in libmodules.a th (no CVSS)
- [CVE-2019-7276](https://cve.now/CVE-2019-7276.md): Optergy Proton/Enterprise devices allow Remote Root Code Execution via a Backdoor Console. (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2019-07-01
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.