# CVEs published 2019-07-08

33 CVEs were published on July 8, 2019: 0 critical, 0 high. Days are UTC.

- [CVE-2019-12927](https://cve.now/CVE-2019-12927.md): MailEnable Enterprise Premium 10.23 was vulnerable to stored and reflected cross-site scripting (XSS) attacks. (no CVSS)
- [CVE-2019-12926](https://cve.now/CVE-2019-12926.md): MailEnable Enterprise Premium 10.23 did not use appropriate access control checks in a number of areas. (no CVSS)
- [CVE-2019-12925](https://cve.now/CVE-2019-12925.md): MailEnable Enterprise Premium 10.23 was vulnerable to multiple directory traversal issues, with which authenticated users could add, remove, (no CVSS)
- [CVE-2019-12924](https://cve.now/CVE-2019-12924.md): MailEnable Enterprise Premium 10.23 was vulnerable to XML External Entity Injection (XXE) attacks that could be exploited by an unauthentica (no CVSS)
- [CVE-2019-12923](https://cve.now/CVE-2019-12923.md): In MailEnable Enterprise Premium 10.23, the potential cross-site request forgery (CSRF) protection mechanism was not implemented correctly a (no CVSS)
- [CVE-2019-12930](https://cve.now/CVE-2019-12930.md): A cross-site scripting (XSS) vulnerability in noMenu() and noSubMenu() in core/navigation/MENU.php in WIKINDX prior to version 5.8.1 allows (no CVSS)
- [CVE-2019-9630](https://cve.now/CVE-2019-9630.md): Sonatype Nexus Repository Manager before 3.17.0 has a weak default of giving any unauthenticated user read permissions on the repository fil (no CVSS)
- [CVE-2019-9629](https://cve.now/CVE-2019-9629.md): Sonatype Nexus Repository Manager before 3.17.0 establishes a default administrator user with weak defaults (fixed credentials). (no CVSS)
- [CVE-2019-2119](https://cve.now/CVE-2019-2119.md): In multiple functions of key\_store\_service.cpp, there is a possible Information Disclosure due to improper locking. (no CVSS, Android)
- [CVE-2019-2118](https://cve.now/CVE-2019-2118.md): In various functions of Parcel.cpp, there are uninitialized or partially initialized stack variables. (no CVSS, Android)
- [CVE-2019-2117](https://cve.now/CVE-2019-2117.md): In checkQueryPermission of TelephonyProvider.java, there is a possible disclosure of secure data due to a missing permission check. (no CVSS, Android)
- [CVE-2019-2116](https://cve.now/CVE-2019-2116.md): In save\_attr\_seq of sdp\_discovery.cc, there is a possible out-of-bound read due to a missing bounds check. (no CVSS, Android)
- [CVE-2019-2113](https://cve.now/CVE-2019-2113.md): In setup wizard there is a bypass of some checks when wifi connection is skipped. (no CVSS, Android)
- [CVE-2019-2112](https://cve.now/CVE-2019-2112.md): In several functions of alarm.cc, there is possible memory corruption due to a use after free. (no CVSS, Android)
- [CVE-2019-2111](https://cve.now/CVE-2019-2111.md): In loop of DnsTlsSocket.cpp, there is a possible heap memory corruption due to a use after free. (no CVSS, Android)
- [CVE-2019-2109](https://cve.now/CVE-2019-2109.md): In MakeMPEG4VideoCodecSpecificData of AVIExtractor.cpp, there is a possible out of bounds write due to an incorrect bounds check. (no CVSS, Android)
- [CVE-2019-2107](https://cve.now/CVE-2019-2107.md): In ihevcd\_parse\_pps of ihevcd\_parse\_headers.c, there is a possible out of bounds write due to a missing bounds check. (no CVSS, Android)
- [CVE-2019-2106](https://cve.now/CVE-2019-2106.md): In ihevcd\_sao\_shift\_ctb of ihevcd\_sao.c, there is a possible out of bounds write due to a missing bounds check. (no CVSS, Android)
- [CVE-2019-2105](https://cve.now/CVE-2019-2105.md): In FileInputStream::Read of file\_input\_stream.cc, there is a possible memory corruption due to uninitialized data. (no CVSS, Android)
- [CVE-2019-2104](https://cve.now/CVE-2019-2104.md): In HIDL, safe\_union, and other C++ structs/unions being sent to application processes, there are uninitialized fields. (no CVSS, Android)
- [CVE-2019-10973](https://cve.now/CVE-2019-10973.md): Quest KACE, all versions prior to version 8.0.x, 8.1.x, and 9.0.x, allows unintentional access to the appliance leveraging functions of the (no CVSS, Quest KACE)
- [CVE-2019-13354](https://cve.now/CVE-2019-13354.md): The strong\_password gem 0.0.7 for Ruby, as distributed on RubyGems.org, included a code-execution backdoor inserted by a third party. (no CVSS, strong\_password)
- [CVE-2019-13414](https://cve.now/CVE-2019-13414.md): The Rencontre plugin before 3.1.3 for WordPress allows XSS via inc/rencontre\_widget.php. (no CVSS)
- [CVE-2019-13413](https://cve.now/CVE-2019-13413.md): The Rencontre plugin before 3.1.3 for WordPress allows SQL Injection via inc/rencontre\_widget.php. (no CVSS)
- [CVE-2019-12174](https://cve.now/CVE-2019-12174.md): hide.me before 2.4.4 on macOS suffers from a privilege escalation vulnerability in the connectWithExecutablePath:configFilePath:configFileNa (no CVSS)
- [CVE-2019-12171](https://cve.now/CVE-2019-12171.md): Dropbox.exe (and QtWebEngineProcess.exe in the Web Helper) in the Dropbox desktop application 71.4.108.0 store cleartext credentials in memo (no CVSS)
- [CVE-2018-11563](https://cve.now/CVE-2018-11563.md): An issue was discovered in Open Ticket Request System (OTRS) 6.0.x through 6.0.7. (no CVSS)
- [CVE-2019-13404](https://cve.now/CVE-2019-13404.md): The MSI installer for Python through 2.7.16 on Windows defaults to the C:\\Python27 directory, which makes it easier for local users to deplo (no CVSS)
- [CVE-2019-13402](https://cve.now/CVE-2019-13402.md): /usr/sbin/default.sh and /usr/apache/htdocs/cgi-bin/admin/hardfactorydefault.cgi on Dynacolor FCM-MB40 v1.2.0.0 devices implement an incompl (no CVSS)
- [CVE-2019-13401](https://cve.now/CVE-2019-13401.md): Dynacolor FCM-MB40 v1.2.0.0 devices have CSRF in all scripts under cgi-bin/. (no CVSS)
- [CVE-2019-13400](https://cve.now/CVE-2019-13400.md): Dynacolor FCM-MB40 v1.2.0.0 use /etc/appWeb/appweb.pass to store administrative web-interface credentials in cleartext. (no CVSS)
- [CVE-2019-13399](https://cve.now/CVE-2019-13399.md): Dynacolor FCM-MB40 v1.2.0.0 devices have a hard-coded SSL/TLS key that is used during an administrator's SSL conversation. (no CVSS)
- [CVE-2019-13398](https://cve.now/CVE-2019-13398.md): Dynacolor FCM-MB40 v1.2.0.0 devices allow remote attackers to execute arbitrary commands via a crafted parameter to a CGI script, as demonst (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2019-07-08
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.