# CVEs published 2019-07-03

97 CVEs were published on July 3, 2019: 0 critical, 4 high. 2 are now in CISA KEV. Days are UTC.

- [CVE-2019-13208](https://cve.now/CVE-2019-13208.md): WavesSysSvc in Waves MAXX Audio allows privilege escalation because the General registry key has Full Control access for the Users group, le (no CVSS)
- [CVE-2015-3907](https://cve.now/CVE-2015-3907.md): CodeIgniter Rest Server (aka codeigniter-restserver) 2.7.1 allows XXE attacks. (no CVSS, chriskacerguis/codeigniter-restserver)
- [CVE-2019-9827](https://cve.now/CVE-2019-9827.md): Hawt Hawtio through 2.5.0 is vulnerable to SSRF, allowing a remote attacker to trigger an HTTP request from an affected server to an arbitra (no CVSS, io.hawt:hawtio-core)
- [CVE-2019-13074](https://cve.now/CVE-2019-13074.md): A vulnerability in the FTP daemon on MikroTik routers through 6.44.3 could allow remote attackers to exhaust all available memory, causing t (no CVSS)
- [CVE-2019-13207](https://cve.now/CVE-2019-13207.md): nsd-checkzone in NLnet Labs NSD 4.2.0 has a Stack-based Buffer Overflow in the dname\_concatenate() function in dname.c. (no CVSS)
- [CVE-2019-12852](https://cve.now/CVE-2019-12852.md): An SSRF attack was possible on a JetBrains YouTrack server. (no CVSS)
- [CVE-2019-12846](https://cve.now/CVE-2019-12846.md): A user without the required permissions could gain access to some JetBrains TeamCity settings. (no CVSS)
- [CVE-2019-12842](https://cve.now/CVE-2019-12842.md): A reflected XSS on a user page was detected on one of the JetBrains TeamCity pages. (no CVSS)
- [CVE-2019-12841](https://cve.now/CVE-2019-12841.md): Incorrect handling of user input in ZIP extraction was detected in JetBrains TeamCity. (no CVSS)
- [CVE-2019-12843](https://cve.now/CVE-2019-12843.md): A possible stored JavaScript injection requiring a deliberate server administrator action was detected. (no CVSS)
- [CVE-2019-12845](https://cve.now/CVE-2019-12845.md): The generated Kotlin DSL settings allowed usage of an unencrypted connection for resolving artifacts. (no CVSS)
- [CVE-2019-12844](https://cve.now/CVE-2019-12844.md): A possible stored JavaScript injection was detected on one of the JetBrains TeamCity pages. (no CVSS)
- [CVE-2017-13719](https://cve.now/CVE-2017-13719.md): The Amcrest IPM-721S Amcrest\_IPC-AWXX\_Eng\_N\_V2.420.AC00.17.R.20170322 allows HTTP requests that permit enabling various functionalities of t (no CVSS)
- [CVE-2017-8228](https://cve.now/CVE-2017-8228.md): Amcrest IPM-721S V2.420.AC00.16.R.20160909 devices mishandle reboots within the past two hours. (no CVSS)
- [CVE-2017-8227](https://cve.now/CVE-2017-8227.md): Amcrest IPM-721S V2.420.AC00.16.R.20160909 devices have a timeout policy to wait for 5 minutes in case 30 incorrect password attempts are de (no CVSS)
- [CVE-2017-8230](https://cve.now/CVE-2017-8230.md): On Amcrest IPM-721S V2.420.AC00.16.R.20160909 devices, the users on the device are divided into 2 groups "admin" and "user". (no CVSS)
- [CVE-2017-8226](https://cve.now/CVE-2017-8226.md): Amcrest IPM-721S V2.420.AC00.16.R.20160909 devices have default credentials that are hardcoded in the firmware and can be extracted by anyon (no CVSS)
- [CVE-2017-8229](https://cve.now/CVE-2017-8229.md): Amcrest IPM-721S V2.420.AC00.16.R.20160909 devices allow an unauthenticated attacker to download the administrative credentials. (no CVSS)
- [CVE-2018-14859](https://cve.now/CVE-2018-14859.md): Incorrect access control in the password reset component in Odoo Community 11.0 and earlier and Odoo Enterprise 11.0 and earlier allows auth (no CVSS)
- [CVE-2018-14860](https://cve.now/CVE-2018-14860.md): Improper sanitization of dynamic user expressions in Odoo Community 11.0 and earlier and Odoo Enterprise 11.0 and earlier allows authenticat (no CVSS)
- [CVE-2018-14861](https://cve.now/CVE-2018-14861.md): Improper data access control in Odoo Community 10.0 and 11.0 and Odoo Enterprise 10.0 and 11.0 allows authenticated users to perform a CSV e (no CVSS)
- [CVE-2018-14862](https://cve.now/CVE-2018-14862.md): Incorrect access control in the mail templating system in Odoo Community 11.0 and earlier and Odoo Enterprise 11.0 and earlier allows authen (no CVSS)
- [CVE-2018-14863](https://cve.now/CVE-2018-14863.md): Incorrect access control in the RPC framework in Odoo Community 8.0 through 11.0 and Odoo Enterprise 9.0 through 11.0 allows authenticated u (no CVSS)
- [CVE-2019-5602](https://cve.now/CVE-2019-5602.md): In FreeBSD 12.0-STABLE before r349628, 12.0-RELEASE before 12.0-RELEASE-p7, 11.3-PRERELEASE before r349629, 11.3-RC3 before 11.3-RC3-p1, and (no CVSS, FreeBSD)
- [CVE-2019-10104](https://cve.now/CVE-2019-10104.md): In several JetBrains IntelliJ IDEA Ultimate versions, an Application Server run configuration (for Tomcat, Jetty, Resin, or CloudBees) with (no CVSS)
- [CVE-2019-5601](https://cve.now/CVE-2019-5601.md): In FreeBSD 12.0-STABLE before r347474, 12.0-RELEASE before 12.0-RELEASE-p7, 11.2-STABLE before r347475, and 11.2-RELEASE before 11.2-RELEASE (no CVSS, FreeBSD)
- [CVE-2018-14864](https://cve.now/CVE-2018-14864.md): Incorrect access control in asset bundles in Odoo Community 9.0 through 11.0 and earlier and Odoo Enterprise 9.0 through 11.0 and earlier al (no CVSS)
- [CVE-2019-5600](https://cve.now/CVE-2019-5600.md): In FreeBSD 12.0-STABLE before r349622, 12.0-RELEASE before 12.0-RELEASE-p7, 11.3-PRERELEASE before r349624, 11.3-RC3 before 11.3-RC3-p1, and (no CVSS, FreeBSD)
- [CVE-2019-5051](https://cve.now/CVE-2019-5051.md): An exploitable heap-based buffer overflow vulnerability exists when loading a PCX file in SDL2\_image, version 2.0.4. (CVSS 8.8, Simple DirectMedia)
- [CVE-2019-9873](https://cve.now/CVE-2019-9873.md): In several versions of JetBrains IntelliJ IDEA Ultimate, creating Task Servers configurations leads to saving a cleartext unencrypted record (no CVSS)
- [CVE-2019-5052](https://cve.now/CVE-2019-5052.md): An exploitable integer overflow vulnerability exists when loading a PCX file in SDL2\_image 2.0.4. (CVSS 8.8, Simple DirectMedia)
- [CVE-2018-14865](https://cve.now/CVE-2018-14865.md): Report engine in Odoo Community 9.0 through 11.0 and earlier and Odoo Enterprise 9.0 through 11.0 and earlier does not use secure options wh (no CVSS)
- [CVE-2019-9872](https://cve.now/CVE-2019-9872.md): In several versions of JetBrains IntelliJ IDEA Ultimate, creating run configurations for cloud application servers leads to saving a clearte (no CVSS)
- [CVE-2019-9186](https://cve.now/CVE-2019-9186.md): In several JetBrains IntelliJ IDEA versions, a Spring Boot run configuration with the default setting allowed remote attackers to execute co (no CVSS)
- [CVE-2019-6641](https://cve.now/CVE-2019-6641.md): On BIG-IP 12.1.0-12.1.4.1, undisclosed requests can cause iControl REST processes to crash. (no CVSS, F5 BIG-IP)
- [CVE-2019-12847](https://cve.now/CVE-2019-12847.md): In JetBrains Hub versions earlier than 2018.4.11298, the audit events for SMTPSettings show a cleartext password to the admin user. (no CVSS)
- [CVE-2019-6640](https://cve.now/CVE-2019-6640.md): On BIG-IP 14.1.0-14.1.0.5, 14.0.0-14.0.0.4, 13.0.0-13.1.1.4, 12.1.0-12.1.4, 11.6.1-11.6.3.4, and 11.5.1-11.5.8, SNMP exposes sensitive confi (no CVSS, F5 BIG-IP)
- [CVE-2019-12866](https://cve.now/CVE-2019-12866.md): An Insecure Direct Object Reference, with Authorization Bypass through a User-Controlled Key, was possible in JetBrains YouTrack. (no CVSS)
- [CVE-2019-6639](https://cve.now/CVE-2019-6639.md): On BIG-IP (AFM, PEM) 14.1.0-14.1.0.5, 14.0.0-14.0.0.4, 13.0.0-13.1.1.4, 12.1.0-12.1.4, 11.6.1-11.6.3.4, and 11.5.1-11.5.8, an undisclosed TM (no CVSS, F5 BIG-IP)
- [CVE-2019-12867](https://cve.now/CVE-2019-12867.md): Certain actions could cause privilege escalation for issue attachments in JetBrains YouTrack. (no CVSS)
- [CVE-2019-6638](https://cve.now/CVE-2019-6638.md): On BIG-IP 14.1.0-14.1.0.5 and 14.0.0-14.0.0.4, Malformed http requests made to an undisclosed iControl REST endpoint can lead to infinite lo (no CVSS, F5 BIG-IP)
- [CVE-2019-12850](https://cve.now/CVE-2019-12850.md): A query injection was possible in JetBrains YouTrack. (no CVSS)
- [CVE-2019-6637](https://cve.now/CVE-2019-6637.md): On BIG-IP (ASM) 14.1.0-14.1.0.5, 14.0.0-14.0.0.4, 13.0.0-13.1.1.4, and 12.1.0-12.1.4, Application logic abuse of ASM REST endpoints can lead (no CVSS, F5 BIG-IP)
- [CVE-2019-12851](https://cve.now/CVE-2019-12851.md): A CSRF vulnerability was detected in one of the admin endpoints of JetBrains YouTrack. (no CVSS)
- [CVE-2019-6636](https://cve.now/CVE-2019-6636.md): On BIG-IP (AFM, ASM) 14.1.0-14.1.0.5, 14.0.0-14.0.0.4, 13.0.0-13.1.1.4, 12.1.0-12.1.4, and 11.5.1-11.6.4, a stored cross-site scripting vuln (no CVSS, F5 BIG-IP)
- [CVE-2019-10100](https://cve.now/CVE-2019-10100.md): In JetBrains YouTrack Confluence plugin versions before 1.8.1.3, it was possible to achieve Server Side Template Injection. (no CVSS)
- [CVE-2019-6634](https://cve.now/CVE-2019-6634.md): On BIG-IP 14.1.0-14.1.0.5, 14.0.0-14.0.0.4, 13.0.0-13.1.1.4, and 12.1.0-12.1.4, a high volume of malformed analytics report requests leads t (no CVSS, F5 BIG-IP)
- [CVE-2019-9823](https://cve.now/CVE-2019-9823.md): In several JetBrains IntelliJ IDEA versions, creating remote run configurations of JavaEE application servers leads to saving a cleartext re (no CVSS)
- [CVE-2019-6635](https://cve.now/CVE-2019-6635.md): On BIG-IP 14.1.0-14.1.0.5, 14.0.0-14.0.0.4, 13.0.0-13.1.1.4, 12.1.0-12.1.4, 11.6.1-11.6.3.4, and 11.5.1-11.5.8, when the BIG-IP system is li (no CVSS, F5 BIG-IP)
- [CVE-2019-6632](https://cve.now/CVE-2019-6632.md): On BIG-IP 14.1.0-14.1.0.5, 14.0.0-14.0.0.4, 13.0.0-13.1.1.4, and 12.1.0-12.1.4, under certain circumstances, attackers can decrypt configura (no CVSS, F5 BIG-IP)
- [CVE-2019-6633](https://cve.now/CVE-2019-6633.md): On BIG-IP 14.1.0-14.1.0.5, 14.0.0-14.0.0.4, 13.0.0-13.1.1.4, 12.1.0-12.1.4.1, and 11.5.1-11.6.4, when the BIG-IP system is licensed with App (no CVSS, F5 BIG-IP)
- [CVE-2019-6630](https://cve.now/CVE-2019-6630.md): On F5 SSL Orchestrator 14.1.0-14.1.0.5 and 14.0.0-14.0.0.4, undisclosed traffic flow may cause TMM to restart under certain circumstances. (no CVSS, F5 SSL Orchestrator)
- [CVE-2019-6631](https://cve.now/CVE-2019-6631.md): On BIG-IP 11.5.1-11.6.4, iRules performing HTTP header manipulation may cause an interruption to service when processing traffic handled by (no CVSS, F5 BIG-IP)
- [CVE-2019-6629](https://cve.now/CVE-2019-6629.md): On BIG-IP 14.1.0-14.1.0.5, undisclosed SSL traffic to a virtual server configured with a Client SSL profile may cause TMM to fail and restar (no CVSS, F5 BIG-IP)
- [CVE-2019-6627](https://cve.now/CVE-2019-6627.md): On F5 SSL Orchestrator 14.1.0-14.1.0.5, on rare occasions, specific to a certain race condition, TMM may restart when SSL Forward Proxy enfo (no CVSS, F5 SSL Orchestrator)
- [CVE-2019-6628](https://cve.now/CVE-2019-6628.md): On BIG-IP PEM 14.1.0-14.1.0.5 and 14.0.0-14.0.0.4, under certain conditions, the TMM process may terminate and restart while processing BIG- (no CVSS, F5 BIG-IP PEM)
- [CVE-2018-14866](https://cve.now/CVE-2018-14866.md): Incorrect access control in the TransientModel framework in Odoo Community 11.0 and earlier and Odoo Enterprise 11.0 and earlier allows auth (no CVSS)
- [CVE-2019-6625](https://cve.now/CVE-2019-6625.md): On BIG-IP 14.1.0-14.1.0.5, 14.0.0-14.0.0.4, 13.0.0-13.1.1.4, 12.1.0-12.1.4, and 11.5.1-11.6.4, a reflected cross-site scripting (XSS) vulner (no CVSS, F5 BIG-IP)
- [CVE-2019-6626](https://cve.now/CVE-2019-6626.md): On BIG-IP (AFM, Analytics, ASM) 14.1.0-14.1.0.5, 14.0.0-14.0.0.4, 13.0.0-13.1.1.4, 12.1.0-12.1.4, and 11.5.1-11.6.3.4, A reflected cross-sit (no CVSS, F5 BIG-IP)
- [CVE-2019-7165](https://cve.now/CVE-2019-7165.md): A buffer overflow in DOSBox 0.74-2 allows attackers to execute arbitrary code. (no CVSS)
- [CVE-2019-12570](https://cve.now/CVE-2019-12570.md): A SQL injection vulnerability in the Xpert Solution "Server Status by Hostname/IP" plugin 4.6 for WordPress allows an authenticated user to (no CVSS)
- [CVE-2018-12715](https://cve.now/CVE-2018-12715.md): DIGISOL DG-HR3400 devices have XSS via a modified SSID when the apssid value is unchanged. (no CVSS)
- [CVE-2019-5630](https://cve.now/CVE-2019-5630.md): Rapid7 Nexpose/InsightVM Security Console CSRF (CVSS 5.9, Rapid7 Nexpose/InsightVM Security Console)
- [CVE-2018-12250](https://cve.now/CVE-2018-12250.md): An issue was discovered in Elite CMS Pro 2.01. (no CVSS)
- [CVE-2018-18326](https://cve.now/CVE-2018-18326.md): DNN (aka DotNetNuke) 9.2 through 9.2.2 incorrectly converts encryption key source values, resulting in lower than expected entropy. (no CVSS, DotNetNuke.Core)
- [CVE-2018-18325](https://cve.now/CVE-2018-18325.md): DNN (aka DotNetNuke) 9.2 through 9.2.2 uses a weak encryption algorithm to protect input parameters. (CVSS 7.5, KEV, DotNetNuke.Core)
- [CVE-2017-17972](https://cve.now/CVE-2017-17972.md): packages/subjects/pub/subjects.php in Archon 3.21 rev-1 has XSS in the referer parameter in an index.php?subjecttypeid=xxx request, aka Open (no CVSS)
- [CVE-2018-15812](https://cve.now/CVE-2018-15812.md): DNN (aka DotNetNuke) 9.2 through 9.2.1 incorrectly converts encryption key source values, resulting in lower than expected entropy. (no CVSS, DotNetNuke.Core)
- [CVE-2017-18346](https://cve.now/CVE-2017-18346.md): SQL injection vulnerability in /wbg/core/\_includes/authorization.inc.php in CMS Web-Gooroo through 2013-01-19 allows remote attackers to exe (no CVSS)
- [CVE-2018-11686](https://cve.now/CVE-2018-11686.md): The Publish Service in FlexPaper (later renamed FlowPaper) 2.3.6 allows remote code execution via setup.php and change\_config.php. (no CVSS)
- [CVE-2017-6216](https://cve.now/CVE-2017-6216.md): novaksolutions/infusionsoft-php-sdk v2016-10-31 is vulnerable to a reflected XSS in the leadscoring.php resulting code execution (no CVSS, novaksolutions/infusionsoft-php-sdk)
- [CVE-2017-6900](https://cve.now/CVE-2017-6900.md): An issue was discovered in Riello NetMan 204 14-2 and 15-2. (no CVSS)
- [CVE-2018-15811](https://cve.now/CVE-2018-15811.md): DNN (aka DotNetNuke) 9.2 through 9.2.1 uses a weak encryption algorithm to protect input parameters. (CVSS 7.5, KEV, DotNetNuke.Core)
- [CVE-2017-9325](https://cve.now/CVE-2017-9325.md): The provided secure solrconfig.xml sample configuration does not enforce Sentry authorization on /update/json/docs. (no CVSS)
- [CVE-2017-9326](https://cve.now/CVE-2017-9326.md): The keystore password for the Spark History Server may be exposed in unsecured files under the /var/run/cloudera-scm-agent directory managed (no CVSS)
- [CVE-2017-9327](https://cve.now/CVE-2017-9327.md): Secret data of processes managed by CM is not secured by file permissions. (no CVSS)
- [CVE-2018-10986](https://cve.now/CVE-2018-10986.md): OX Guard 2.8.0 has CSRF. (no CVSS)
- [CVE-2019-13186](https://cve.now/CVE-2019-13186.md): In MiniCMS V1.10, stored XSS was found in mc-admin/post-edit.php via the tags box. (no CVSS)
- [CVE-2018-11215](https://cve.now/CVE-2018-11215.md): Remote code execution is possible in Cloudera Data Science Workbench version 1.3.0 and prior releases via unspecified attack vectors. (no CVSS)
- [CVE-2018-11227](https://cve.now/CVE-2018-11227.md): Monstra CMS 3.0.4 and earlier has XSS via index.php. (no CVSS)
- [CVE-2019-10717](https://cve.now/CVE-2019-10717.md): BlogEngine.NET 3.3.7.0 allows /api/filemanager Directory Traversal via the path parameter. (no CVSS)
- [CVE-2018-11317](https://cve.now/CVE-2018-11317.md): Subrion CMS before 4.1.4 has XSS. (no CVSS, intelliants/subrion)
- [CVE-2018-11420](https://cve.now/CVE-2018-11420.md): There is Memory corruption in the web interface of Moxa OnCell G3100-HSPA Series version 1.5 Build 17042015 and prio,r a different vulnerabi (no CVSS)
- [CVE-2018-11421](https://cve.now/CVE-2018-11421.md): Moxa OnCell G3100-HSPA Series version 1.6 Build 17100315 and prior use a proprietary monitoring protocol that does not provide confidentiali (no CVSS)
- [CVE-2018-11422](https://cve.now/CVE-2018-11422.md): Moxa OnCell G3100-HSPA Series version 1.6 Build 17100315 and prior use a proprietary configuration protocol that does not provide confidenti (no CVSS)
- [CVE-2019-10721](https://cve.now/CVE-2019-10721.md): BlogEngine.NET 3.3.7.0 allows a Client Side URL Redirect via the ReturnUrl parameter, related to BlogEngine/BlogEngine.Core/Services/Securit (no CVSS)
- [CVE-2018-11423](https://cve.now/CVE-2018-11423.md): There is Memory corruption in the web interface Moxa OnCell G3100-HSPA Series version 1.6 Build 17100315 and prior, different vulnerability (no CVSS)
- [CVE-2018-11424](https://cve.now/CVE-2018-11424.md): There is Memory corruption in the web interface of Moxa OnCell G3470A-LTE Series version 1.6 Build 18021314 and prior, a different vulnerabi (no CVSS)
- [CVE-2018-11425](https://cve.now/CVE-2018-11425.md): Memory corruption issue was discovered in Moxa OnCell G3470A-LTE Series version 1.6 Build 18021314 and prior, a different vulnerability than (no CVSS)
- [CVE-2018-11426](https://cve.now/CVE-2018-11426.md): A weak Cookie parameter is used in the web application of Moxa OnCell G3100-HSPA Series version 1.4 Build 16062919 and prior. (no CVSS)
- [CVE-2018-11427](https://cve.now/CVE-2018-11427.md): CSRF tokens are not used in the web application of Moxa OnCell G3100-HSPA Series version 1.4 Build 16062919 and prior, which makes it possib (no CVSS)
- [CVE-2019-13164](https://cve.now/CVE-2019-13164.md): qemu-bridge-helper.c in QEMU 3.1 and 4.0.0 does not ensure that a network interface name (obtained from bridge.conf or a --br=bridge option) (no CVSS)
- [CVE-2019-3619](https://cve.now/CVE-2019-3619.md): Information Disclosure vulnerability in the Agent Handler in McAfee ePolicy Orchestrator (ePO) 5.9.x and 5.10.0 prior to 5.10.0 update 4 all (CVSS 6.8, McAfee ePolicy Orchestrator)
- [CVE-2019-10183](https://cve.now/CVE-2019-10183.md): Virt-install(1) utility used to provision new virtual machines has introduced an option '--unattended' to create VMs without user interactio (CVSS 3.2, Red Hat virt-install)
- [CVE-2019-10101](https://cve.now/CVE-2019-10101.md): JetBrains Kotlin versions before 1.3.30 were resolving artifacts using an http connection during the build process, potentially allowing an (no CVSS)
- [CVE-2019-10102](https://cve.now/CVE-2019-10102.md): JetBrains Ktor framework (created using the Kotlin IDE template) versions before 1.1.0 were resolving artifacts using an http connection dur (no CVSS)
- [CVE-2019-10103](https://cve.now/CVE-2019-10103.md): JetBrains IntelliJ IDEA projects created using the Kotlin (JS Client/JVM Server) IDE Template were resolving Gradle artifacts using an http (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2019-07-03
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.