CVEs published July 3, 2019
97 CVEs were published on July 3, 2019: 0 critical, 4 high. 2 are now in CISA KEV.
- Published
- 97
- Critical
- 0
- High
- 4
- Medium
- 2
- Low
- 1
- Unrated
- 90
- Now in CISA KEV
- 2
- Fix available
- 9
Most affected products
- F5 BIG-IP
- 14
- DotNetNuke.Core
- 4
- FreeBSD
- 3
- F5 SSL Orchestrator
- 2
- Simple DirectMedia
- 2
- chriskacerguis/codeigniter-restserver
- 1
- F5 BIG-IP PEM
- 1
- intelliants/subrion
- 1
- io.hawt:hawtio-core
- 1
- McAfee ePolicy Orchestrator
- 1
High 4
- CVE-2019-5051An exploitable heap-based buffer overflow vulnerability exists when loading a PCX file in SDL2_image, version 2.0.4.Simple DirectMedia
- CVE-2019-5052An exploitable integer overflow vulnerability exists when loading a PCX file in SDL2_image 2.0.4.Simple DirectMedia
- CVE-2018-18325DNN (aka DotNetNuke) 9.2 through 9.2.2 uses a weak encryption algorithm to protect input parameters.DotNetNuke.Core
- CVE-2018-15811DNN (aka DotNetNuke) 9.2 through 9.2.1 uses a weak encryption algorithm to protect input parameters.DotNetNuke.Core
Medium, low and unrated 93
- CVE-2019-13208WavesSysSvc in Waves MAXX Audio allows privilege escalation because the General registry key has Full Control access for the Users group, le
- CVE-2015-3907CodeIgniter Rest Server (aka codeigniter-restserver) 2.7.1 allows XXE attacks.chriskacerguis/codeigniter-restserver
- CVE-2019-9827Hawt Hawtio through 2.5.0 is vulnerable to SSRF, allowing a remote attacker to trigger an HTTP request from an affected server to an arbitraio.hawt:hawtio-core
- CVE-2019-13074A vulnerability in the FTP daemon on MikroTik routers through 6.44.3 could allow remote attackers to exhaust all available memory, causing t
- CVE-2019-13207nsd-checkzone in NLnet Labs NSD 4.2.0 has a Stack-based Buffer Overflow in the dname_concatenate() function in dname.c.
- CVE-2019-12852An SSRF attack was possible on a JetBrains YouTrack server.
- CVE-2019-12846A user without the required permissions could gain access to some JetBrains TeamCity settings.
- CVE-2019-12842A reflected XSS on a user page was detected on one of the JetBrains TeamCity pages.
- CVE-2019-12841Incorrect handling of user input in ZIP extraction was detected in JetBrains TeamCity.
- CVE-2019-12843A possible stored JavaScript injection requiring a deliberate server administrator action was detected.
- CVE-2019-12845The generated Kotlin DSL settings allowed usage of an unencrypted connection for resolving artifacts.
- CVE-2019-12844A possible stored JavaScript injection was detected on one of the JetBrains TeamCity pages.
- CVE-2017-13719The Amcrest IPM-721S Amcrest_IPC-AWXX_Eng_N_V2.420.AC00.17.R.20170322 allows HTTP requests that permit enabling various functionalities of t
- CVE-2017-8228Amcrest IPM-721S V2.420.AC00.16.R.20160909 devices mishandle reboots within the past two hours.
- CVE-2017-8227Amcrest IPM-721S V2.420.AC00.16.R.20160909 devices have a timeout policy to wait for 5 minutes in case 30 incorrect password attempts are de
- CVE-2017-8230On Amcrest IPM-721S V2.420.AC00.16.R.20160909 devices, the users on the device are divided into 2 groups "admin" and "user".
- CVE-2017-8226Amcrest IPM-721S V2.420.AC00.16.R.20160909 devices have default credentials that are hardcoded in the firmware and can be extracted by anyon
- CVE-2017-8229Amcrest IPM-721S V2.420.AC00.16.R.20160909 devices allow an unauthenticated attacker to download the administrative credentials.
- CVE-2018-14859Incorrect access control in the password reset component in Odoo Community 11.0 and earlier and Odoo Enterprise 11.0 and earlier allows auth
- CVE-2018-14860Improper sanitization of dynamic user expressions in Odoo Community 11.0 and earlier and Odoo Enterprise 11.0 and earlier allows authenticat
- CVE-2018-14861Improper data access control in Odoo Community 10.0 and 11.0 and Odoo Enterprise 10.0 and 11.0 allows authenticated users to perform a CSV e
- CVE-2018-14862Incorrect access control in the mail templating system in Odoo Community 11.0 and earlier and Odoo Enterprise 11.0 and earlier allows authen
- CVE-2018-14863Incorrect access control in the RPC framework in Odoo Community 8.0 through 11.0 and Odoo Enterprise 9.0 through 11.0 allows authenticated u
- CVE-2019-5602In FreeBSD 12.0-STABLE before r349628, 12.0-RELEASE before 12.0-RELEASE-p7, 11.3-PRERELEASE before r349629, 11.3-RC3 before 11.3-RC3-p1, andFreeBSD
- CVE-2019-10104In several JetBrains IntelliJ IDEA Ultimate versions, an Application Server run configuration (for Tomcat, Jetty, Resin, or CloudBees) with
- CVE-2019-5601In FreeBSD 12.0-STABLE before r347474, 12.0-RELEASE before 12.0-RELEASE-p7, 11.2-STABLE before r347475, and 11.2-RELEASE before 11.2-RELEASEFreeBSD
- CVE-2018-14864Incorrect access control in asset bundles in Odoo Community 9.0 through 11.0 and earlier and Odoo Enterprise 9.0 through 11.0 and earlier al
- CVE-2019-5600In FreeBSD 12.0-STABLE before r349622, 12.0-RELEASE before 12.0-RELEASE-p7, 11.3-PRERELEASE before r349624, 11.3-RC3 before 11.3-RC3-p1, andFreeBSD
- CVE-2019-9873In several versions of JetBrains IntelliJ IDEA Ultimate, creating Task Servers configurations leads to saving a cleartext unencrypted record
- CVE-2018-14865Report engine in Odoo Community 9.0 through 11.0 and earlier and Odoo Enterprise 9.0 through 11.0 and earlier does not use secure options wh
- CVE-2019-9872In several versions of JetBrains IntelliJ IDEA Ultimate, creating run configurations for cloud application servers leads to saving a clearte
- CVE-2019-9186In several JetBrains IntelliJ IDEA versions, a Spring Boot run configuration with the default setting allowed remote attackers to execute co
- CVE-2019-6641On BIG-IP 12.1.0-12.1.4.1, undisclosed requests can cause iControl REST processes to crash.F5 BIG-IP
- CVE-2019-12847In JetBrains Hub versions earlier than 2018.4.11298, the audit events for SMTPSettings show a cleartext password to the admin user.
- CVE-2019-6640On BIG-IP 14.1.0-14.1.0.5, 14.0.0-14.0.0.4, 13.0.0-13.1.1.4, 12.1.0-12.1.4, 11.6.1-11.6.3.4, and 11.5.1-11.5.8, SNMP exposes sensitive confiF5 BIG-IP
- CVE-2019-12866An Insecure Direct Object Reference, with Authorization Bypass through a User-Controlled Key, was possible in JetBrains YouTrack.
- CVE-2019-6639On BIG-IP (AFM, PEM) 14.1.0-14.1.0.5, 14.0.0-14.0.0.4, 13.0.0-13.1.1.4, 12.1.0-12.1.4, 11.6.1-11.6.3.4, and 11.5.1-11.5.8, an undisclosed TMF5 BIG-IP
- CVE-2019-12867Certain actions could cause privilege escalation for issue attachments in JetBrains YouTrack.
- CVE-2019-6638On BIG-IP 14.1.0-14.1.0.5 and 14.0.0-14.0.0.4, Malformed http requests made to an undisclosed iControl REST endpoint can lead to infinite loF5 BIG-IP
- CVE-2019-12850A query injection was possible in JetBrains YouTrack.
- CVE-2019-6637On BIG-IP (ASM) 14.1.0-14.1.0.5, 14.0.0-14.0.0.4, 13.0.0-13.1.1.4, and 12.1.0-12.1.4, Application logic abuse of ASM REST endpoints can leadF5 BIG-IP
- CVE-2019-12851A CSRF vulnerability was detected in one of the admin endpoints of JetBrains YouTrack.
- CVE-2019-6636On BIG-IP (AFM, ASM) 14.1.0-14.1.0.5, 14.0.0-14.0.0.4, 13.0.0-13.1.1.4, 12.1.0-12.1.4, and 11.5.1-11.6.4, a stored cross-site scripting vulnF5 BIG-IP
- CVE-2019-10100In JetBrains YouTrack Confluence plugin versions before 1.8.1.3, it was possible to achieve Server Side Template Injection.
- CVE-2019-6634On BIG-IP 14.1.0-14.1.0.5, 14.0.0-14.0.0.4, 13.0.0-13.1.1.4, and 12.1.0-12.1.4, a high volume of malformed analytics report requests leads tF5 BIG-IP
- CVE-2019-9823In several JetBrains IntelliJ IDEA versions, creating remote run configurations of JavaEE application servers leads to saving a cleartext re
- CVE-2019-6635On BIG-IP 14.1.0-14.1.0.5, 14.0.0-14.0.0.4, 13.0.0-13.1.1.4, 12.1.0-12.1.4, 11.6.1-11.6.3.4, and 11.5.1-11.5.8, when the BIG-IP system is liF5 BIG-IP
- CVE-2019-6632On BIG-IP 14.1.0-14.1.0.5, 14.0.0-14.0.0.4, 13.0.0-13.1.1.4, and 12.1.0-12.1.4, under certain circumstances, attackers can decrypt configuraF5 BIG-IP
- CVE-2019-6633On BIG-IP 14.1.0-14.1.0.5, 14.0.0-14.0.0.4, 13.0.0-13.1.1.4, 12.1.0-12.1.4.1, and 11.5.1-11.6.4, when the BIG-IP system is licensed with AppF5 BIG-IP
- CVE-2019-6630On F5 SSL Orchestrator 14.1.0-14.1.0.5 and 14.0.0-14.0.0.4, undisclosed traffic flow may cause TMM to restart under certain circumstances.F5 SSL Orchestrator
- CVE-2019-6631On BIG-IP 11.5.1-11.6.4, iRules performing HTTP header manipulation may cause an interruption to service when processing traffic handled by F5 BIG-IP
- CVE-2019-6629On BIG-IP 14.1.0-14.1.0.5, undisclosed SSL traffic to a virtual server configured with a Client SSL profile may cause TMM to fail and restarF5 BIG-IP
- CVE-2019-6627On F5 SSL Orchestrator 14.1.0-14.1.0.5, on rare occasions, specific to a certain race condition, TMM may restart when SSL Forward Proxy enfoF5 SSL Orchestrator
- CVE-2019-6628On BIG-IP PEM 14.1.0-14.1.0.5 and 14.0.0-14.0.0.4, under certain conditions, the TMM process may terminate and restart while processing BIG-F5 BIG-IP PEM
- CVE-2018-14866Incorrect access control in the TransientModel framework in Odoo Community 11.0 and earlier and Odoo Enterprise 11.0 and earlier allows auth
- CVE-2019-6625On BIG-IP 14.1.0-14.1.0.5, 14.0.0-14.0.0.4, 13.0.0-13.1.1.4, 12.1.0-12.1.4, and 11.5.1-11.6.4, a reflected cross-site scripting (XSS) vulnerF5 BIG-IP
- CVE-2019-6626On BIG-IP (AFM, Analytics, ASM) 14.1.0-14.1.0.5, 14.0.0-14.0.0.4, 13.0.0-13.1.1.4, 12.1.0-12.1.4, and 11.5.1-11.6.3.4, A reflected cross-sitF5 BIG-IP
- CVE-2019-7165A buffer overflow in DOSBox 0.74-2 allows attackers to execute arbitrary code.
- CVE-2019-12570A SQL injection vulnerability in the Xpert Solution "Server Status by Hostname/IP" plugin 4.6 for WordPress allows an authenticated user to
- CVE-2018-12715DIGISOL DG-HR3400 devices have XSS via a modified SSID when the apssid value is unchanged.
- CVE-2019-5630Rapid7 Nexpose/InsightVM Security Console CSRFRapid7 Nexpose/InsightVM Security Console
- CVE-2018-12250An issue was discovered in Elite CMS Pro 2.01.
- CVE-2018-18326DNN (aka DotNetNuke) 9.2 through 9.2.2 incorrectly converts encryption key source values, resulting in lower than expected entropy.DotNetNuke.Core
- CVE-2017-17972packages/subjects/pub/subjects.php in Archon 3.21 rev-1 has XSS in the referer parameter in an index.php?subjecttypeid=xxx request, aka Open
- CVE-2018-15812DNN (aka DotNetNuke) 9.2 through 9.2.1 incorrectly converts encryption key source values, resulting in lower than expected entropy.DotNetNuke.Core
- CVE-2017-18346SQL injection vulnerability in /wbg/core/_includes/authorization.inc.php in CMS Web-Gooroo through 2013-01-19 allows remote attackers to exe
- CVE-2018-11686The Publish Service in FlexPaper (later renamed FlowPaper) 2.3.6 allows remote code execution via setup.php and change_config.php.
- CVE-2017-6216novaksolutions/infusionsoft-php-sdk v2016-10-31 is vulnerable to a reflected XSS in the leadscoring.php resulting code executionnovaksolutions/infusionsoft-php-sdk
- CVE-2017-6900An issue was discovered in Riello NetMan 204 14-2 and 15-2.
- CVE-2017-9325The provided secure solrconfig.xml sample configuration does not enforce Sentry authorization on /update/json/docs.
- CVE-2017-9326The keystore password for the Spark History Server may be exposed in unsecured files under the /var/run/cloudera-scm-agent directory managed
- CVE-2017-9327Secret data of processes managed by CM is not secured by file permissions.
- CVE-2018-10986OX Guard 2.8.0 has CSRF.
- CVE-2019-13186In MiniCMS V1.10, stored XSS was found in mc-admin/post-edit.php via the tags box.
- CVE-2018-11215Remote code execution is possible in Cloudera Data Science Workbench version 1.3.0 and prior releases via unspecified attack vectors.
- CVE-2018-11227Monstra CMS 3.0.4 and earlier has XSS via index.php.
- CVE-2019-10717BlogEngine.NET 3.3.7.0 allows /api/filemanager Directory Traversal via the path parameter.
- CVE-2018-11317Subrion CMS before 4.1.4 has XSS.intelliants/subrion
- CVE-2018-11420There is Memory corruption in the web interface of Moxa OnCell G3100-HSPA Series version 1.5 Build 17042015 and prio,r a different vulnerabi
- CVE-2018-11421Moxa OnCell G3100-HSPA Series version 1.6 Build 17100315 and prior use a proprietary monitoring protocol that does not provide confidentiali
- CVE-2018-11422Moxa OnCell G3100-HSPA Series version 1.6 Build 17100315 and prior use a proprietary configuration protocol that does not provide confidenti
- CVE-2019-10721BlogEngine.NET 3.3.7.0 allows a Client Side URL Redirect via the ReturnUrl parameter, related to BlogEngine/BlogEngine.Core/Services/Securit
- CVE-2018-11423There is Memory corruption in the web interface Moxa OnCell G3100-HSPA Series version 1.6 Build 17100315 and prior, different vulnerability
- CVE-2018-11424There is Memory corruption in the web interface of Moxa OnCell G3470A-LTE Series version 1.6 Build 18021314 and prior, a different vulnerabi
- CVE-2018-11425Memory corruption issue was discovered in Moxa OnCell G3470A-LTE Series version 1.6 Build 18021314 and prior, a different vulnerability than
- CVE-2018-11426A weak Cookie parameter is used in the web application of Moxa OnCell G3100-HSPA Series version 1.4 Build 16062919 and prior.
- CVE-2018-11427CSRF tokens are not used in the web application of Moxa OnCell G3100-HSPA Series version 1.4 Build 16062919 and prior, which makes it possib
- CVE-2019-13164qemu-bridge-helper.c in QEMU 3.1 and 4.0.0 does not ensure that a network interface name (obtained from bridge.conf or a --br=bridge option)
- CVE-2019-3619Information Disclosure vulnerability in the Agent Handler in McAfee ePolicy Orchestrator (ePO) 5.9.x and 5.10.0 prior to 5.10.0 update 4 allMcAfee ePolicy Orchestrator
- CVE-2019-10183Virt-install(1) utility used to provision new virtual machines has introduced an option '--unattended' to create VMs without user interactioRed Hat virt-install
- CVE-2019-10101JetBrains Kotlin versions before 1.3.30 were resolving artifacts using an http connection during the build process, potentially allowing an
- CVE-2019-10102JetBrains Ktor framework (created using the Kotlin IDE template) versions before 1.1.0 were resolving artifacts using an http connection dur
- CVE-2019-10103JetBrains IntelliJ IDEA projects created using the Kotlin (JS Client/JVM Server) IDE Template were resolving Gradle artifacts using an http