# CVEs published 2019-07-05

59 CVEs were published on July 5, 2019: 0 critical, 0 high. Days are UTC.

- [CVE-2019-10639](https://cve.now/CVE-2019-10639.md): The Linux kernel 4.x (starting from 4.1) and 5.x before 5.0.8 allows Information Exposure (partial kernel address disclosure), leading to a (no CVSS)
- [CVE-2019-10638](https://cve.now/CVE-2019-10638.md): In the Linux kernel before 5.1.7, a device can be tracked by an attacker using the IP ID values the kernel produces for connection-less prot (no CVSS)
- [CVE-2019-13358](https://cve.now/CVE-2019-13358.md): lib/DocumentToText.php in OpenCats before 0.9.4-3 has XXE that allows remote users to read files on the underlying operating system. (no CVSS)
- [CVE-2018-16386](https://cve.now/CVE-2018-16386.md): An issue was discovered in SWIFT Alliance Web Platform 7.1.23. (no CVSS)
- [CVE-2018-14733](https://cve.now/CVE-2018-14733.md): The Odoo Community Association (OCA) dbfilter\_from\_header module makes Odoo 8.x, 9.x, 10.x, and 11.x vulnerable to ReDoS (regular expression (no CVSS)
- [CVE-2018-14529](https://cve.now/CVE-2018-14529.md): Invoxia NVX220 devices allow access to /bin/sh via escape from a restricted CLI, leading to disclosure of password hashes. (no CVSS)
- [CVE-2018-14528](https://cve.now/CVE-2018-14528.md): Invoxia NVX220 devices allow TELNET access as admin with a default password. (no CVSS)
- [CVE-2019-12971](https://cve.now/CVE-2019-12971.md): BKS EBK Ethernet-Buskoppler Pro before 3.01 allows Unrestricted Upload of a File with a Dangerous Type. (no CVSS)
- [CVE-2019-13352](https://cve.now/CVE-2019-13352.md): WolfVision Cynap before 1.30j uses a static, hard-coded cryptographic secret for generating support PINs for the 'forgot password' feature. (no CVSS)
- [CVE-2019-13351](https://cve.now/CVE-2019-13351.md): posix/JackSocket.cpp in libjack in JACK2 1.9.1 through 1.9.12 (as distributed with alsa-plugins 1.1.7 and later) has a "double file descript (no CVSS)
- [CVE-2018-12621](https://cve.now/CVE-2018-12621.md): An issue was discovered in Eventum 3.5.0. (no CVSS)
- [CVE-2019-13345](https://cve.now/CVE-2019-13345.md): The cachemgr.cgi web module of Squid through 4.7 has XSS via the user\_name or auth parameter. (no CVSS)
- [CVE-2018-14027](https://cve.now/CVE-2018-14027.md): Digisol Wireless Wifi Home Router HR-3300 allows XSS via the userid or password parameter to the admin login page. (no CVSS)
- [CVE-2019-13344](https://cve.now/CVE-2019-13344.md): An authentication bypass vulnerability in the CRUDLab WP Like Button plugin through 1.6.0 for WordPress allows unauthenticated attackers to (no CVSS)
- [CVE-2019-13341](https://cve.now/CVE-2019-13341.md): In MiniCMS V1.10, stored XSS was found in mc-admin/conf.php (comment box), which can be used to get a user's cookie. (no CVSS)
- [CVE-2019-13340](https://cve.now/CVE-2019-13340.md): In MiniCMS V1.10, stored XSS was found in mc-admin/post-edit.php via the content box. (no CVSS)
- [CVE-2019-13339](https://cve.now/CVE-2019-13339.md): In MiniCMS V1.10, stored XSS was found in mc-admin/page-edit.php (content box), which can be used to get a user's cookie. (no CVSS)
- [CVE-2019-13314](https://cve.now/CVE-2019-13314.md): virt-bootstrap 1.1.0 allows local users to discover a root password by listing a process, because this password may be present in the --root (no CVSS)
- [CVE-2019-13313](https://cve.now/CVE-2019-13313.md): libosinfo 1.5.0 allows local users to discover credentials by listing a process, because credentials are passed to osinfo-install-script via (no CVSS)
- [CVE-2019-5982](https://cve.now/CVE-2019-5982.md): Improper download file verification vulnerability in VAIO Update 7.3.0.03150 and earlier allows remote attackers to conduct a man-in-the-mid (no CVSS, Sony VAIO Update)
- [CVE-2019-5983](https://cve.now/CVE-2019-5983.md): Cross-site request forgery (CSRF) vulnerability in HTML5 Maps 1.6.5.6 and earlier allows remote attackers to hijack the authentication of ad (no CVSS, Fla-shop.com HTML5 Maps)
- [CVE-2019-5984](https://cve.now/CVE-2019-5984.md): Cross-site request forgery (CSRF) vulnerability in Custom CSS Pro 1.0.3 and earlier allows remote attackers to hijack the authentication of (no CVSS, WaspThemes Custom CSS Pro)
- [CVE-2019-5961](https://cve.now/CVE-2019-5961.md): The Android App 'Tootdon for Mastodon' version 3.4.1 and earlier does not verify X.509 certificates from SSL servers, which allows man-in-th (no CVSS, Tsukurito Android App 'Tootdon for Mastodon')
- [CVE-2019-5962](https://cve.now/CVE-2019-5962.md): Cross-site scripting vulnerability in Zoho SalesIQ 1.0.8 and earlier allows remote attackers to inject arbitrary web script or HTML via unsp (no CVSS, Zoho SalesIQ Team Zoho SalesIQ)
- [CVE-2019-5963](https://cve.now/CVE-2019-5963.md): Cross-site request forgery (CSRF) vulnerability in Zoho SalesIQ 1.0.8 and earlier allows remote attackers to hijack the authentication of ad (no CVSS, Zoho SalesIQ Team Zoho SalesIQ)
- [CVE-2019-5964](https://cve.now/CVE-2019-5964.md): iDoors Reader 2.10.17 and earlier allows an attacker on the same network segment to bypass authentication to access the management console a (no CVSS, A.T.WORKS iDoors Reader)
- [CVE-2019-5965](https://cve.now/CVE-2019-5965.md): Open redirect vulnerability in Joruri Mail 2.1.4 and earlier allows remote attackers to redirect users to arbitrary web sites and conduct ph (no CVSS, SiteBridge Joruri Mail)
- [CVE-2019-5966](https://cve.now/CVE-2019-5966.md): Joruri Mail 2.1.4 and earlier does not properly manage sessions, which allows remote attackers to impersonate an arbitrary user and alter/di (no CVSS, SiteBridge Joruri Mail)
- [CVE-2019-5967](https://cve.now/CVE-2019-5967.md): Cross-site scripting vulnerability in Joruri CMS 2017 Release2 and earlier allows remote attackers to inject arbitrary web script or HTML vi (no CVSS, SiteBridge Joruri CMS)
- [CVE-2019-5968](https://cve.now/CVE-2019-5968.md): Cross-site request forgery (CSRF) vulnerability in GROWI v3.4.6 and earlier allows remote attackers to hijack the authentication of administ (no CVSS, WESEEK GROWI)
- [CVE-2019-5969](https://cve.now/CVE-2019-5969.md): Open redirect vulnerability in GROWI v3.4.6 and earlier allows remote attackersto redirect users to arbitrary web sites and conduct phishing (no CVSS, WESEEK GROWI)
- [CVE-2019-5970](https://cve.now/CVE-2019-5970.md): Cross-site scripting vulnerability in Attendance Manager 0.5.6 and earlier allows remote attackers to inject arbitrary web script or HTML vi (no CVSS, SUKIMALAB.COM Attendance Manager)
- [CVE-2019-5971](https://cve.now/CVE-2019-5971.md): Cross-site request forgery (CSRF) vulnerability in Attendance Manager 0.5.6 and earlier allows remote attackers to hijack the authentication (no CVSS, SUKIMALAB.COM Attendance Manager)
- [CVE-2019-5972](https://cve.now/CVE-2019-5972.md): Cross-site scripting vulnerability in Online Lesson Booking 0.8.6 and earlier allows remote attackers to inject arbitrary web script or HTML (no CVSS, SUKIMALAB.COM Online Lesson Booking)
- [CVE-2019-5973](https://cve.now/CVE-2019-5973.md): Cross-site request forgery (CSRF) vulnerability in Online Lesson Booking 0.8.6 and earlier allows remote attackers to hijack the authenticat (no CVSS, SUKIMALAB.COM Online Lesson Booking)
- [CVE-2019-5974](https://cve.now/CVE-2019-5974.md): Cross-site request forgery (CSRF) vulnerability in Contest Gallery versions prior to 10.4.5 allows remote attackers to hijack the authentica (no CVSS, Contest-Gallery Contest Gallery)
- [CVE-2019-5979](https://cve.now/CVE-2019-5979.md): Cross-site request forgery (CSRF) vulnerability in Personalized WooCommerce Cart Page 2.4 and earlier allows remote attackers to hijack the (no CVSS, N-MEDIA Personalized WooCommerce Cart Page)
- [CVE-2019-5980](https://cve.now/CVE-2019-5980.md): Cross-site request forgery (CSRF) vulnerability in Related YouTube Videos versions prior to 1.9.9 allows remote attackers to hijack the auth (no CVSS, Chris Doerr Related YouTube Videos)
- [CVE-2019-5981](https://cve.now/CVE-2019-5981.md): Improper authorization vulnerability in VAIO Update 7.3.0.03150 and earlier allows an attackers to execute arbitrary executable file with ad (no CVSS, Sony VAIO Update)
- [CVE-2019-5960](https://cve.now/CVE-2019-5960.md): Cross-site request forgery (CSRF) vulnerability in WP Open Graph 1.6.1 and earlier allows remote attackers to hijack the authentication of a (no CVSS, Custom4Web WP Open Graph)
- [CVE-2019-13144](https://cve.now/CVE-2019-13144.md): myTinyTodo 1.3.3 through 1.4.3 allows CSV Injection. (no CVSS)
- [CVE-2019-13312](https://cve.now/CVE-2019-13312.md): block\_cmp() in libavcodec/zmbvenc.c in FFmpeg 4.1.3 has a heap-based buffer over-read. (no CVSS)
- [CVE-2019-13311](https://cve.now/CVE-2019-13311.md): ImageMagick 7.0.8-50 Q16 has memory leaks at AcquireMagickMemory because of a wand/mogrify.c error. (no CVSS)
- [CVE-2019-13310](https://cve.now/CVE-2019-13310.md): ImageMagick 7.0.8-50 Q16 has memory leaks at AcquireMagickMemory because of an error in MagickWand/mogrify.c. (no CVSS)
- [CVE-2019-13309](https://cve.now/CVE-2019-13309.md): ImageMagick 7.0.8-50 Q16 has memory leaks at AcquireMagickMemory because of mishandling the NoSuchImage error in CLIListOperatorImages in Ma (no CVSS)
- [CVE-2019-13308](https://cve.now/CVE-2019-13308.md): ImageMagick 7.0.8-50 Q16 has a heap-based buffer overflow in MagickCore/fourier.c in ComplexImage. (no CVSS)
- [CVE-2019-13307](https://cve.now/CVE-2019-13307.md): ImageMagick 7.0.8-50 Q16 has a heap-based buffer overflow at MagickCore/statistic.c in EvaluateImages because of mishandling rows. (no CVSS)
- [CVE-2019-13306](https://cve.now/CVE-2019-13306.md): ImageMagick 7.0.8-50 Q16 has a stack-based buffer overflow at coders/pnm.c in WritePNMImage because of off-by-one errors. (no CVSS)
- [CVE-2019-13305](https://cve.now/CVE-2019-13305.md): ImageMagick 7.0.8-50 Q16 has a stack-based buffer overflow at coders/pnm.c in WritePNMImage because of a misplaced strncpy and an off-by-one (no CVSS)
- [CVE-2019-13304](https://cve.now/CVE-2019-13304.md): ImageMagick 7.0.8-50 Q16 has a stack-based buffer overflow at coders/pnm.c in WritePNMImage because of a misplaced assignment. (no CVSS)
- [CVE-2019-13303](https://cve.now/CVE-2019-13303.md): ImageMagick 7.0.8-50 Q16 has a heap-based buffer over-read in MagickCore/composite.c in CompositeImage. (no CVSS)
- [CVE-2019-13302](https://cve.now/CVE-2019-13302.md): ImageMagick 7.0.8-50 Q16 has a heap-based buffer over-read in MagickCore/fourier.c in ComplexImages. (no CVSS)
- [CVE-2019-13301](https://cve.now/CVE-2019-13301.md): ImageMagick 7.0.8-50 Q16 has memory leaks in AcquireMagickMemory because of an AnnotateImage error. (no CVSS)
- [CVE-2019-13300](https://cve.now/CVE-2019-13300.md): ImageMagick 7.0.8-50 Q16 has a heap-based buffer overflow at MagickCore/statistic.c in EvaluateImages because of mishandling columns. (no CVSS)
- [CVE-2019-13299](https://cve.now/CVE-2019-13299.md): ImageMagick 7.0.8-50 Q16 has a heap-based buffer over-read at MagickCore/pixel-accessor.h in GetPixelChannel. (no CVSS)
- [CVE-2019-13298](https://cve.now/CVE-2019-13298.md): ImageMagick 7.0.8-50 Q16 has a heap-based buffer overflow at MagickCore/pixel-accessor.h in SetPixelViaPixelInfo because of a MagickCore/enh (no CVSS)
- [CVE-2019-13297](https://cve.now/CVE-2019-13297.md): ImageMagick 7.0.8-50 Q16 has a heap-based buffer over-read at MagickCore/threshold.c in AdaptiveThresholdImage because a height of zero is m (no CVSS)
- [CVE-2019-13296](https://cve.now/CVE-2019-13296.md): ImageMagick 7.0.8-50 Q16 has direct memory leaks in AcquireMagickMemory because of an error in CLIListOperatorImages in MagickWand/operation (no CVSS)
- [CVE-2019-13295](https://cve.now/CVE-2019-13295.md): ImageMagick 7.0.8-50 Q16 has a heap-based buffer over-read at MagickCore/threshold.c in AdaptiveThresholdImage because a width of zero is mi (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2019-07-05
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.