# CVEs published 2019-07-09

37 CVEs were published on July 9, 2019: 1 critical, 0 high. Days are UTC.

- [CVE-2019-13478](https://cve.now/CVE-2019-13478.md): The Yoast SEO plugin before 11.6-RC5 for WordPress does not properly restrict unfiltered HTML in term descriptions. (CVSS 9.9)
- [CVE-2019-13475](https://cve.now/CVE-2019-13475.md): In MobaXterm 11.1, the mobaxterm: URI handler has an argument injection vulnerability that allows remote attackers to execute arbitrary comm (no CVSS)
- [CVE-2019-13472](https://cve.now/CVE-2019-13472.md): PHPWind 9.1.0 has XSS vulnerabilities in the c and m parameters of the index.php file. (no CVSS)
- [CVE-2019-13470](https://cve.now/CVE-2019-13470.md): MatrixSSL before 4.2.1 has an out-of-bounds read during ASN.1 handling. (no CVSS)
- [CVE-2019-9150](https://cve.now/CVE-2019-9150.md): Mailvelope prior to 3.3.0 does not require user interaction to import public keys shown on web page. (no CVSS)
- [CVE-2019-9149](https://cve.now/CVE-2019-9149.md): Mailvelope prior to 3.3.0 allows private key operations without user interaction via its client-API. (no CVSS)
- [CVE-2019-9148](https://cve.now/CVE-2019-9148.md): Mailvelope prior to 3.3.0 accepts or operates with invalid PGP public keys: Mailvelope allows importing keys that contain users without a va (no CVSS)
- [CVE-2019-13380](https://cve.now/CVE-2019-13380.md): KEYNTO Team Password Manager 1.5.0 allows XSS because data saved from websites is mishandled in the online vault. (no CVSS)
- [CVE-2019-11512](https://cve.now/CVE-2019-11512.md): Contao 4.x allows SQL Injection. (no CVSS, contao/contao · contao/core-bundle)
- [CVE-2019-13277](https://cve.now/CVE-2019-13277.md): TRENDnet TEW-827DRU with firmware up to and including 2.04B03 allows an unauthenticated attacker to execute setup wizard functionality, givi (no CVSS)
- [CVE-2019-9147](https://cve.now/CVE-2019-9147.md): Mailvelope prior to 3.1.0 is vulnerable to a clickjacking attack against the settings page. (no CVSS)
- [CVE-2019-13337](https://cve.now/CVE-2019-13337.md): In WESEEK GROWI before 3.5.0, the site-wide basic authentication can be bypassed by adding a URL parameter access\_token (this is the paramet (no CVSS)
- [CVE-2019-13338](https://cve.now/CVE-2019-13338.md): In WESEEK GROWI before 3.5.0, a remote attacker can obtain the password hash of the creator of a page by leveraging wiki access to make API (no CVSS)
- [CVE-2019-13280](https://cve.now/CVE-2019-13280.md): TRENDnet TEW-827DRU with firmware up to and including 2.04B03 contains a stack-based buffer overflow while returning an error message to the (no CVSS)
- [CVE-2019-11991](https://cve.now/CVE-2019-11991.md): HPE has identified a vulnerability in HPE 3PAR Service Processor (SP) version 4.1 through 4.4. (no CVSS, Hewlett Packard Enterprise HPE 3PAR Service Processors)
- [CVE-2019-13464](https://cve.now/CVE-2019-13464.md): An issue was discovered in OWASP ModSecurity Core Rule Set (CRS) 3.0.2. (no CVSS)
- [CVE-2019-13070](https://cve.now/CVE-2019-13070.md): A stored XSS vulnerability in the Agent/Center component of CyberPower PowerPanel Business Edition 3.4.0 allows a privileged attacker to emb (no CVSS)
- [CVE-2019-13146](https://cve.now/CVE-2019-13146.md): The field\_test gem 0.3.0 for Ruby has unvalidated input. (no CVSS, field\_test)
- [CVE-2019-13142](https://cve.now/CVE-2019-13142.md): The RzSurroundVADStreamingService (RzSurroundVADStreamingService.exe) in Razer Surround 1.1.63.0 runs as the SYSTEM user using an executable (no CVSS)
- [CVE-2019-13461](https://cve.now/CVE-2019-13461.md): In PrestaShop before 1.7.6.0 RC2, the id\_address\_delivery and id\_address\_invoice parameters are affected by an Insecure Direct Object Refere (no CVSS)
- [CVE-2019-3950](https://cve.now/CVE-2019-3950.md): Arlo Basestation firmware 1.12.0.1\_27940 and prior contain a hardcoded username and password combination that allows root access to the devi (no CVSS, Arlo Basestation firmware)
- [CVE-2019-3949](https://cve.now/CVE-2019-3949.md): Arlo Basestation firmware 1.12.0.1\_27940 and prior firmware contain a networking misconfiguration that allows access to restricted network i (no CVSS, Arlo Basestation firmware)
- [CVE-2019-8920](https://cve.now/CVE-2019-8920.md): iart.php in XAMPP 1.7.0 has XSS, a related issue to CVE-2008-3569. (no CVSS)
- [CVE-2019-11020](https://cve.now/CVE-2019-11020.md): Lack of authentication in file-viewing components in DDRT Dashcom Live 2019-05-09 allows anyone to remotely access all claim details by visi (no CVSS)
- [CVE-2019-13397](https://cve.now/CVE-2019-13397.md): Unauthenticated Stored XSS in osTicket 1.10.1 allows a remote attacker to gain admin privileges by injecting arbitrary web script or HTML vi (no CVSS)
- [CVE-2019-13454](https://cve.now/CVE-2019-13454.md): ImageMagick 7.0.1-0 to 7.0.8-54 Q16 allows Division by Zero in RemoveDuplicateLayers in MagickCore/layer.c. (no CVSS)
- [CVE-2019-11019](https://cve.now/CVE-2019-11019.md): Lack of authentication in case-exporting components in DDRT Dashcom Live through 2019-05-08 allows anyone to remotely access all claim detai (no CVSS)
- [CVE-2018-11307](https://cve.now/CVE-2018-11307.md): An issue was discovered in FasterXML jackson-databind 2.0.0 through 2.9.5. (no CVSS, com.fasterxml.jackson.core:jackson-databind)
- [CVE-2019-12782](https://cve.now/CVE-2019-12782.md): An authorization bypass vulnerability in pinboard updates in ThoughtSpot 4.4.1 through 5.1.1 (before 5.1.2) allows a low-privilege user with (no CVSS)
- [CVE-2019-12748](https://cve.now/CVE-2019-12748.md): TYPO3 8.3.0 through 8.7.26 and 9.0.0 through 9.5.7 allows XSS. (no CVSS, typo3/cms-core · typo3/cms)
- [CVE-2019-12747](https://cve.now/CVE-2019-12747.md): TYPO3 8.x through 8.7.26 and 9.x through 9.5.7 allows Deserialization of Untrusted Data. (no CVSS, typo3/cms-core · typo3/cms)
- [CVE-2019-11890](https://cve.now/CVE-2019-11890.md): Sony Bravia Smart TV devices allow remote attackers to cause a denial of service (device hang or reboot) via a SYN flood attack over a wired (no CVSS)
- [CVE-2019-11889](https://cve.now/CVE-2019-11889.md): Sony BRAVIA Smart TV devices allow remote attackers to cause a denial of service (device hang) via a crafted web page over HbbTV. (no CVSS)
- [CVE-2018-14833](https://cve.now/CVE-2018-14833.md): Intuit Lacerte 2017 has Incorrect Access Control. (no CVSS)
- [CVE-2018-15738](https://cve.now/CVE-2018-15738.md): An issue was discovered in STOPzilla AntiMalware 6.5.2.59. (no CVSS)
- [CVE-2019-13450](https://cve.now/CVE-2019-13450.md): In the Zoom Client through 4.4.4 and RingCentral 7.0.136380.0312 on macOS, remote attackers can force a user to join a video call with the v (no CVSS)
- [CVE-2019-13449](https://cve.now/CVE-2019-13449.md): In the Zoom Client before 4.4.2 on macOS, remote attackers can cause a denial of service (continual focus grabs) via a sequence of invalid l (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2019-07-09
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.