# CVEs published 2019-07-04

48 CVEs were published on July 4, 2019: 0 critical, 5 high. Days are UTC.

- [CVE-2019-13294](https://cve.now/CVE-2019-13294.md): AROX School-ERP Pro has a command execution vulnerability. (no CVSS)
- [CVE-2019-13292](https://cve.now/CVE-2019-13292.md): A SQL Injection issue was discovered in webERP 4.15. (no CVSS)
- [CVE-2019-13291](https://cve.now/CVE-2019-13291.md): In Xpdf 4.01.01, there is a heap-based buffer over-read in the function DCTStream::readScan() located at Stream.cc. (no CVSS)
- [CVE-2019-13290](https://cve.now/CVE-2019-13290.md): Artifex MuPDF 1.15.0 has a heap-based buffer overflow in fz\_append\_display\_node located at fitz/list-device.c, allowing remote attackers to (no CVSS)
- [CVE-2019-13289](https://cve.now/CVE-2019-13289.md): In Xpdf 4.01.01, there is a use-after-free vulnerability in the function JBIG2Stream::close() located at JBIG2Stream.cc. (no CVSS)
- [CVE-2019-13288](https://cve.now/CVE-2019-13288.md): In Xpdf 4.01.01, the Parser::getObj() function in Parser.cc may cause infinite recursion via a crafted file. (no CVSS)
- [CVE-2019-13287](https://cve.now/CVE-2019-13287.md): In Xpdf 4.01.01, there is an out-of-bounds read vulnerability in the function SplashXPath::strokeAdjust() located at splash/SplashXPath.cc. (no CVSS)
- [CVE-2019-13286](https://cve.now/CVE-2019-13286.md): In Xpdf 4.01.01, there is a heap-based buffer over-read in the function JBIG2Stream::readTextRegionSeg() located at JBIG2Stream.cc. (no CVSS)
- [CVE-2019-1890](https://cve.now/CVE-2019-1890.md): Cisco Nexus 9000 Series Fabric Switches ACI Mode Fabric Infrastructure VLAN Unauthorized Access Vulnerability (CVSS 7.4, Cisco NX-OS System Software in ACI Mode)
- [CVE-2019-1889](https://cve.now/CVE-2019-1889.md): Cisco Application Policy Infrastructure Controller REST API Privilege Escalation Vulnerability (CVSS 7.2, Cisco Application Policy Infrastructure Controller)
- [CVE-2019-1855](https://cve.now/CVE-2019-1855.md): Cisco Jabber for Windows DLL Preloading Vulnerability (CVSS 7.3, Cisco Jabber for Windows)
- [CVE-2019-1884](https://cve.now/CVE-2019-1884.md): Cisco Web Security Appliance Web Proxy Denial of Service Vulnerability (CVSS 7.7, Cisco Web Security Appliance)
- [CVE-2019-1886](https://cve.now/CVE-2019-1886.md): Cisco Web Security Appliance HTTPS Certificate Denial of Service Vulnerability (CVSS 8.6, Cisco Web Security Appliance)
- [CVE-2019-13283](https://cve.now/CVE-2019-13283.md): In Xpdf 4.01.01, a heap-based buffer over-read could be triggered in strncpy from FoFiType1::parse in fofi/FoFiType1.cc because it does not (no CVSS)
- [CVE-2019-13282](https://cve.now/CVE-2019-13282.md): In Xpdf 4.01.01, a heap-based buffer over-read could be triggered in SampledFunction::transform in Function.cc when using a large index for (no CVSS)
- [CVE-2019-13281](https://cve.now/CVE-2019-13281.md): In Xpdf 4.01.01, a heap-based buffer overflow could be triggered in DCTStream::decodeImage() in Stream.cc when writing to frameBuf memory. (no CVSS)
- [CVE-2019-13275](https://cve.now/CVE-2019-13275.md): An issue was discovered in the VeronaLabs wp-statistics plugin before 12.6.7 for WordPress. (no CVSS)
- [CVE-2019-13262](https://cve.now/CVE-2019-13262.md): XnView Classic 2.48 has a User Mode Write AV starting at xnview+0x00000000003283eb. (no CVSS)
- [CVE-2019-13261](https://cve.now/CVE-2019-13261.md): XnView Classic 2.48 has a User Mode Write AV starting at xnview+0x0000000000328384. (no CVSS)
- [CVE-2019-13260](https://cve.now/CVE-2019-13260.md): XnView Classic 2.48 has a User Mode Write AV starting at xnview+0x0000000000327a07. (no CVSS)
- [CVE-2019-13259](https://cve.now/CVE-2019-13259.md): XnView Classic 2.48 has a User Mode Write AV starting at xnview+0x000000000032e566. (no CVSS)
- [CVE-2019-13258](https://cve.now/CVE-2019-13258.md): XnView Classic 2.48 has a User Mode Write AV starting at xnview+0x0000000000328165. (no CVSS)
- [CVE-2019-13257](https://cve.now/CVE-2019-13257.md): XnView Classic 2.48 has a User Mode Write AV starting at xnview+0x00000000003273aa. (no CVSS)
- [CVE-2019-13256](https://cve.now/CVE-2019-13256.md): XnView Classic 2.48 has a User Mode Write AV starting at xnview+0x000000000032e849. (no CVSS)
- [CVE-2019-13255](https://cve.now/CVE-2019-13255.md): XnView Classic 2.48 has a User Mode Write AV starting at xnview+0x0000000000327464. (no CVSS)
- [CVE-2019-13254](https://cve.now/CVE-2019-13254.md): XnView Classic 2.48 has a User Mode Write AV starting at xnview+0x000000000032e808. (no CVSS)
- [CVE-2019-13253](https://cve.now/CVE-2019-13253.md): XnView Classic 2.48 has a User Mode Write AV starting at xnview+0x0000000000385474. (no CVSS)
- [CVE-2019-13252](https://cve.now/CVE-2019-13252.md): ACDSee Free 1.1.21 has a User Mode Write AV starting at IDE\_ACDStd!IEP\_SetColorProfile+0x00000000001172b0. (no CVSS)
- [CVE-2019-13251](https://cve.now/CVE-2019-13251.md): ACDSee Free 1.1.21 has a User Mode Write AV starting at IDE\_ACDStd!IEP\_SetColorProfile+0x00000000000c47ff. (no CVSS)
- [CVE-2019-13250](https://cve.now/CVE-2019-13250.md): ACDSee Free 1.1.21 has a User Mode Write AV starting at IDE\_ACDStd!IEP\_SetColorProfile+0x00000000000b9c2f. (no CVSS)
- [CVE-2019-13249](https://cve.now/CVE-2019-13249.md): ACDSee Free 1.1.21 has a User Mode Write AV starting at IDE\_ACDStd!IEP\_SetColorProfile+0x00000000000b9e7a. (no CVSS)
- [CVE-2019-13248](https://cve.now/CVE-2019-13248.md): ACDSee Free 1.1.21 has a User Mode Write AV starting at IDE\_ACDStd!JPEGTransW+0x0000000000002450. (no CVSS)
- [CVE-2019-13247](https://cve.now/CVE-2019-13247.md): ACDSee Free 1.1.21 has a User Mode Write AV starting at IDE\_ACDStd!JPEGTransW+0x00000000000024ed. (no CVSS)
- [CVE-2019-13246](https://cve.now/CVE-2019-13246.md): FastStone Image Viewer 7.0 has a User Mode Write AV starting at image00400000+0x00000000001a9601. (no CVSS)
- [CVE-2019-13245](https://cve.now/CVE-2019-13245.md): FastStone Image Viewer 7.0 has a User Mode Write AV starting at image00400000+0x00000000001a95b1. (no CVSS)
- [CVE-2019-13244](https://cve.now/CVE-2019-13244.md): FastStone Image Viewer 7.0 has a User Mode Write AV starting at image00400000+0x0000000000002d7d. (no CVSS)
- [CVE-2019-13243](https://cve.now/CVE-2019-13243.md): IrfanView 4.52 has a User Mode Write AV starting at image00400000+0x00000000000249c6. (no CVSS)
- [CVE-2019-13242](https://cve.now/CVE-2019-13242.md): IrfanView 4.52 has a User Mode Write AV starting at image00400000+0x0000000000013a98. (no CVSS)
- [CVE-2019-13241](https://cve.now/CVE-2019-13241.md): FlightCrew v0.9.2 and older are vulnerable to a directory traversal, allowing attackers to write arbitrary files via a ../ (dot dot slash) i (no CVSS)
- [CVE-2019-13239](https://cve.now/CVE-2019-13239.md): inc/user.class.php in GLPI before 9.4.3 allows XSS via a user picture. (no CVSS)
- [CVE-2019-13238](https://cve.now/CVE-2019-13238.md): An issue was discovered in Bento4 1.5.1.0. (no CVSS)
- [CVE-2018-20850](https://cve.now/CVE-2018-20850.md): Stormshield Network Security 2.0.0 through 2.13.0 and 3.0.0 through 3.7.1 has self-XSS in the command line interface of the SNS web server. (no CVSS)
- [CVE-2019-13233](https://cve.now/CVE-2019-13233.md): In arch/x86/lib/insn-eval.c in the Linux kernel before 5.1.9, there is a use-after-free for access to an LDT entry because of a race conditi (no CVSS)
- [CVE-2019-13232](https://cve.now/CVE-2019-13232.md): Info-ZIP UnZip 6.0 mishandles the overlapping of files inside a ZIP container, leading to denial of service (resource consumption), aka a "b (no CVSS)
- [CVE-2019-13229](https://cve.now/CVE-2019-13229.md): deepin-clone before 1.1.3 uses a fixed path /tmp/partclone.log in the Helper::getPartitionSizeInfo() function to write a log file as root, a (no CVSS)
- [CVE-2019-13228](https://cve.now/CVE-2019-13228.md): deepin-clone before 1.1.3 uses a fixed path /tmp/repo.iso in the BootDoctor::fix() function to download an ISO file, and follows symlinks th (no CVSS)
- [CVE-2019-13227](https://cve.now/CVE-2019-13227.md): In GUI mode, deepin-clone before 1.1.3 creates a log file at the fixed path /tmp/.deepin-clone.log as root, and follows symlinks there. (no CVSS)
- [CVE-2019-13226](https://cve.now/CVE-2019-13226.md): deepin-clone before 1.1.3 uses a predictable path /tmp/.deepin-clone/mount/\<block-dev-basename\> in the Helper::temporaryMountDevice() functi (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2019-07-04
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.