CVEs published July 9, 2019
37 CVEs were published on July 9, 2019: 1 critical, 0 high.
- Published
- 37
- Critical
- 1
- High
- 0
- Medium
- 0
- Low
- 0
- Unrated
- 36
- Now in CISA KEV
- 0
- Fix available
- 5
Most affected products
- Arlo Basestation firmware
- 2
- typo3/cms-core · typo3/cms
- 2
- com.fasterxml.jackson.core:jackson-databind
- 1
- contao/contao · contao/core-bundle
- 1
- field_test
- 1
- Hewlett Packard Enterprise HPE 3PAR Service Processors
- 1
Critical 1
Medium, low and unrated 36
- CVE-2019-13475In MobaXterm 11.1, the mobaxterm: URI handler has an argument injection vulnerability that allows remote attackers to execute arbitrary comm
- CVE-2019-13472PHPWind 9.1.0 has XSS vulnerabilities in the c and m parameters of the index.php file.
- CVE-2019-13470MatrixSSL before 4.2.1 has an out-of-bounds read during ASN.1 handling.
- CVE-2019-9150Mailvelope prior to 3.3.0 does not require user interaction to import public keys shown on web page.
- CVE-2019-9149Mailvelope prior to 3.3.0 allows private key operations without user interaction via its client-API.
- CVE-2019-9148Mailvelope prior to 3.3.0 accepts or operates with invalid PGP public keys: Mailvelope allows importing keys that contain users without a va
- CVE-2019-13380KEYNTO Team Password Manager 1.5.0 allows XSS because data saved from websites is mishandled in the online vault.
- CVE-2019-11512Contao 4.x allows SQL Injection.contao/contao · contao/core-bundle
- CVE-2019-13277TRENDnet TEW-827DRU with firmware up to and including 2.04B03 allows an unauthenticated attacker to execute setup wizard functionality, givi
- CVE-2019-9147Mailvelope prior to 3.1.0 is vulnerable to a clickjacking attack against the settings page.
- CVE-2019-13337In WESEEK GROWI before 3.5.0, the site-wide basic authentication can be bypassed by adding a URL parameter access_token (this is the paramet
- CVE-2019-13338In WESEEK GROWI before 3.5.0, a remote attacker can obtain the password hash of the creator of a page by leveraging wiki access to make API
- CVE-2019-13280TRENDnet TEW-827DRU with firmware up to and including 2.04B03 contains a stack-based buffer overflow while returning an error message to the
- CVE-2019-11991HPE has identified a vulnerability in HPE 3PAR Service Processor (SP) version 4.1 through 4.4.Hewlett Packard Enterprise HPE 3PAR Service Processors
- CVE-2019-13464An issue was discovered in OWASP ModSecurity Core Rule Set (CRS) 3.0.2.
- CVE-2019-13070A stored XSS vulnerability in the Agent/Center component of CyberPower PowerPanel Business Edition 3.4.0 allows a privileged attacker to emb
- CVE-2019-13146The field_test gem 0.3.0 for Ruby has unvalidated input.field_test
- CVE-2019-13142The RzSurroundVADStreamingService (RzSurroundVADStreamingService.exe) in Razer Surround 1.1.63.0 runs as the SYSTEM user using an executable
- CVE-2019-13461In PrestaShop before 1.7.6.0 RC2, the id_address_delivery and id_address_invoice parameters are affected by an Insecure Direct Object Refere
- CVE-2019-3950Arlo Basestation firmware 1.12.0.1_27940 and prior contain a hardcoded username and password combination that allows root access to the deviArlo Basestation firmware
- CVE-2019-3949Arlo Basestation firmware 1.12.0.1_27940 and prior firmware contain a networking misconfiguration that allows access to restricted network iArlo Basestation firmware
- CVE-2019-8920iart.php in XAMPP 1.7.0 has XSS, a related issue to CVE-2008-3569.
- CVE-2019-11020Lack of authentication in file-viewing components in DDRT Dashcom Live 2019-05-09 allows anyone to remotely access all claim details by visi
- CVE-2019-13397Unauthenticated Stored XSS in osTicket 1.10.1 allows a remote attacker to gain admin privileges by injecting arbitrary web script or HTML vi
- CVE-2019-13454ImageMagick 7.0.1-0 to 7.0.8-54 Q16 allows Division by Zero in RemoveDuplicateLayers in MagickCore/layer.c.
- CVE-2019-11019Lack of authentication in case-exporting components in DDRT Dashcom Live through 2019-05-08 allows anyone to remotely access all claim detai
- CVE-2018-11307An issue was discovered in FasterXML jackson-databind 2.0.0 through 2.9.5.com.fasterxml.jackson.core:jackson-databind
- CVE-2019-12782An authorization bypass vulnerability in pinboard updates in ThoughtSpot 4.4.1 through 5.1.1 (before 5.1.2) allows a low-privilege user with
- CVE-2019-12748TYPO3 8.3.0 through 8.7.26 and 9.0.0 through 9.5.7 allows XSS.typo3/cms-core · typo3/cms
- CVE-2019-12747TYPO3 8.x through 8.7.26 and 9.x through 9.5.7 allows Deserialization of Untrusted Data.typo3/cms-core · typo3/cms
- CVE-2019-11890Sony Bravia Smart TV devices allow remote attackers to cause a denial of service (device hang or reboot) via a SYN flood attack over a wired
- CVE-2019-11889Sony BRAVIA Smart TV devices allow remote attackers to cause a denial of service (device hang) via a crafted web page over HbbTV.
- CVE-2018-14833Intuit Lacerte 2017 has Incorrect Access Control.
- CVE-2018-15738An issue was discovered in STOPzilla AntiMalware 6.5.2.59.
- CVE-2019-13450In the Zoom Client through 4.4.4 and RingCentral 7.0.136380.0312 on macOS, remote attackers can force a user to join a video call with the v
- CVE-2019-13449In the Zoom Client before 4.4.2 on macOS, remote attackers can cause a denial of service (continual focus grabs) via a sequence of invalid l