CVEs published July 8, 2019
33 CVEs were published on July 8, 2019: 0 critical, 0 high.
- Published
- 33
- Critical
- 0
- High
- 0
- Medium
- 0
- Low
- 0
- Unrated
- 33
- Now in CISA KEV
- 0
- Fix available
- 1
Most affected products
- Android
- 12
- Quest KACE
- 1
- strong_password
- 1
Medium, low and unrated 33
- CVE-2019-12927MailEnable Enterprise Premium 10.23 was vulnerable to stored and reflected cross-site scripting (XSS) attacks.
- CVE-2019-12926MailEnable Enterprise Premium 10.23 did not use appropriate access control checks in a number of areas.
- CVE-2019-12925MailEnable Enterprise Premium 10.23 was vulnerable to multiple directory traversal issues, with which authenticated users could add, remove,
- CVE-2019-12924MailEnable Enterprise Premium 10.23 was vulnerable to XML External Entity Injection (XXE) attacks that could be exploited by an unauthentica
- CVE-2019-12923In MailEnable Enterprise Premium 10.23, the potential cross-site request forgery (CSRF) protection mechanism was not implemented correctly a
- CVE-2019-12930A cross-site scripting (XSS) vulnerability in noMenu() and noSubMenu() in core/navigation/MENU.php in WIKINDX prior to version 5.8.1 allows
- CVE-2019-9630Sonatype Nexus Repository Manager before 3.17.0 has a weak default of giving any unauthenticated user read permissions on the repository fil
- CVE-2019-9629Sonatype Nexus Repository Manager before 3.17.0 establishes a default administrator user with weak defaults (fixed credentials).
- CVE-2019-2119In multiple functions of key_store_service.cpp, there is a possible Information Disclosure due to improper locking.Android
- CVE-2019-2118In various functions of Parcel.cpp, there are uninitialized or partially initialized stack variables.Android
- CVE-2019-2117In checkQueryPermission of TelephonyProvider.java, there is a possible disclosure of secure data due to a missing permission check.Android
- CVE-2019-2116In save_attr_seq of sdp_discovery.cc, there is a possible out-of-bound read due to a missing bounds check.Android
- CVE-2019-2113In setup wizard there is a bypass of some checks when wifi connection is skipped.Android
- CVE-2019-2112In several functions of alarm.cc, there is possible memory corruption due to a use after free.Android
- CVE-2019-2111In loop of DnsTlsSocket.cpp, there is a possible heap memory corruption due to a use after free.Android
- CVE-2019-2109In MakeMPEG4VideoCodecSpecificData of AVIExtractor.cpp, there is a possible out of bounds write due to an incorrect bounds check.Android
- CVE-2019-2107In ihevcd_parse_pps of ihevcd_parse_headers.c, there is a possible out of bounds write due to a missing bounds check.Android
- CVE-2019-2106In ihevcd_sao_shift_ctb of ihevcd_sao.c, there is a possible out of bounds write due to a missing bounds check.Android
- CVE-2019-2105In FileInputStream::Read of file_input_stream.cc, there is a possible memory corruption due to uninitialized data.Android
- CVE-2019-2104In HIDL, safe_union, and other C++ structs/unions being sent to application processes, there are uninitialized fields.Android
- CVE-2019-10973Quest KACE, all versions prior to version 8.0.x, 8.1.x, and 9.0.x, allows unintentional access to the appliance leveraging functions of the Quest KACE
- CVE-2019-13354The strong_password gem 0.0.7 for Ruby, as distributed on RubyGems.org, included a code-execution backdoor inserted by a third party.strong_password
- CVE-2019-13414The Rencontre plugin before 3.1.3 for WordPress allows XSS via inc/rencontre_widget.php.
- CVE-2019-13413The Rencontre plugin before 3.1.3 for WordPress allows SQL Injection via inc/rencontre_widget.php.
- CVE-2019-12174hide.me before 2.4.4 on macOS suffers from a privilege escalation vulnerability in the connectWithExecutablePath:configFilePath:configFileNa
- CVE-2019-12171Dropbox.exe (and QtWebEngineProcess.exe in the Web Helper) in the Dropbox desktop application 71.4.108.0 store cleartext credentials in memo
- CVE-2018-11563An issue was discovered in Open Ticket Request System (OTRS) 6.0.x through 6.0.7.
- CVE-2019-13404The MSI installer for Python through 2.7.16 on Windows defaults to the C:\Python27 directory, which makes it easier for local users to deplo
- CVE-2019-13402/usr/sbin/default.sh and /usr/apache/htdocs/cgi-bin/admin/hardfactorydefault.cgi on Dynacolor FCM-MB40 v1.2.0.0 devices implement an incompl
- CVE-2019-13401Dynacolor FCM-MB40 v1.2.0.0 devices have CSRF in all scripts under cgi-bin/.
- CVE-2019-13400Dynacolor FCM-MB40 v1.2.0.0 use /etc/appWeb/appweb.pass to store administrative web-interface credentials in cleartext.
- CVE-2019-13399Dynacolor FCM-MB40 v1.2.0.0 devices have a hard-coded SSL/TLS key that is used during an administrator's SSL conversation.
- CVE-2019-13398Dynacolor FCM-MB40 v1.2.0.0 devices allow remote attackers to execute arbitrary commands via a crafted parameter to a CGI script, as demonst