CVEs published July 10, 2019
89 CVEs were published on July 10, 2019: 1 critical, 4 high.
- Published
- 89
- Critical
- 1
- High
- 4
- Medium
- 0
- Low
- 0
- Unrated
- 84
- Now in CISA KEV
- 0
- Fix available
- 22
Most affected products
- mediawiki/core
- 9
- EdgeMAX
- 2
- Hunesion i-oneNet
- 2
- Cisco Adaptive Security Appliance (ASA) Software
- 1
- GE Aestiva and Aespire
- 1
- Huawei Mate 20 X
- 1
- Huawei Mate 20 X · Huawei Mate +1
- 1
- libpng
- 1
- Micro Focus NetIQ Advanced Authentication Framework
- 1
- paypal/adaptivepayments-sdk-php
- 1
Critical 1
High 4
- CVE-2019-12804Hunesion i-oneNet Missing Support for Integrity Check vulnerabilityHunesion i-oneNet
- CVE-2019-12803Hunesion i-oneNet unrestricted file upload vulnerabilityHunesion i-oneNet
- CVE-2019-1873Cisco ASA and FTD Software Cryptographic TLS and SSL Driver Denial of Service VulnerabilityCisco Adaptive Security Appliance (ASA) Software
- CVE-2019-13071CSRF in the Agent/Center component of CyberPower PowerPanel Business Edition 3.4.0 allows an attacker to submit POST requests to any forms i
Medium, low and unrated 84
- CVE-2019-13489Trape through 2019-05-08 has SQL injection via the data[2] variable in core/db.py, as demonstrated by the /bs t parameter.
- CVE-2019-13488A cross-site scripting (XSS) vulnerability in static/js/trape.js in Trape through 2019-05-08 allows remote attackers to inject arbitrary web
- CVE-2019-13482An issue was discovered on D-Link DIR-818LW devices with firmware 2.06betab01.
- CVE-2019-13481An issue was discovered on D-Link DIR-818LW devices with firmware 2.06betab01.
- CVE-2019-5446Command Injection in EdgeMAX EdgeSwitch prior to 1.8.2 allow an Admin user to execute commands as root.EdgeMAX
- CVE-2019-5445DoS in EdgeMAX EdgeSwitch prior to 1.8.2 allow an Admin user to Crash the SSH CLI interface by using crafted commands.EdgeMAX
- CVE-2019-5444Path traversal vulnerability in version up to v1.1.3 in serve-here.js npm module allows attackers to list any file in arbitrary folder.serve-here.js npm module · serve-here.js
- CVE-2019-0330The OS Command Plugin in the transaction GPA_ADMIN and the OSCommand Console of SAP Diagnostic Agent (LM-Service), version 7.2, allow an attSAP SE SAP Diagnostic Agent
- CVE-2019-0329SAP Information Steward, version 4.2, does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting (XSS) vulnerabiSAP SE SAP Information Steward
- CVE-2019-0328ABAP Tests Modules (SAP Basis, versions 7.0, 7.1, 7.3, 7.31, 7.4, 7.5) of SAP NetWeaver Process Integration enables an attacker the executioSAP SE SAP NetWeaver Process Integration ABAP tests
- CVE-2019-0327SAP NetWeaver for Java Application Server - Web Container, (engineapi, versions 7.1, 7.2, 7.3, 7.31, 7.4 and 7.5), (servercode, versions 7.2SAP SE SAP NetWeaver for Java Application Server - Web Cont…
- CVE-2019-0326SAP BusinessObjects Business Intelligence Platform (BI Workspace) (Enterprise), versions 4.1, 4.2, 4.3, does not sufficiently encode user-coSAP SE SAP BusinessObjects Business Intelligence Platform -…
- CVE-2019-0325SAP ERP HCM (SAP_HRCES) , version 3, does not perform necessary authorization checks for a report that reads payroll data of employees in a SAP SE SAP ERP HCM
- CVE-2019-0322SAP Commerce Cloud (previously known as SAP Hybris Commerce), (HY_COM, versions 6.3, 6.4, 6.5, 6.6, 6.7, 1808, 1811), allows an attacker to SAP SE SAP Commerce Cloud (ex SAP Hybris Commerce)
- CVE-2019-0321ABAP Server and ABAP Platform (SAP Basis), versions, 7.31, 7.4, 7.5, do not sufficiently encode user-controlled inputs, resulting in Cross-SSAP SE ABAP Server and ABAP Platform
- CVE-2019-0319The SAP Gateway, versions 7.5, 7.51, 7.52 and 7.53, allows an attacker to inject content which is displayed in the form of an error message.SAP SE SAP Gateway
- CVE-2019-0318Under certain conditions SAP NetWeaver Application Server for Java (Startup Framework), versions 7.21, 7.22, 7.45, 7.49, and 7.53, allows anSAP SE SAP NetWeaver Application Server for Java
- CVE-2019-0281SAPUI5 and OpenUI5, before versions 1.38.39, 1.44.39, 1.52.25, 1.60.6 and 1.63.0, does not sufficiently encode user-controlled inputs, resulSAP SE OpenUI5 · SAP SE SAPUI5
- CVE-2019-11650A potential Man in the Middle attack (MITM) was found in NetIQ Advanced Authentication Framework versions prior to 6.0.Micro Focus NetIQ Advanced Authentication Framework
- CVE-2019-10966In GE Aestiva and Aespire versions 7100 and 7900, a vulnerability exists where serial devices are connected via an added unsecured terminal GE Aestiva and Aespire
- CVE-2019-5221There is a path traversal vulnerability on Huawei Share.Huawei Mate 20 X
- CVE-2019-5220There is a Factory Reset Protection (FRP) bypass vulnerability on several smartphones.Huawei Mate 20 X · Huawei Mate +1
- CVE-2018-11734In e107 v2.1.7, output without filtering results in XSS.
- CVE-2018-19578GitLab EE, version 11.5 before 11.5.1, is vulnerable to an insecure object reference issue that permits a user with Reporter privileges to v
- CVE-2018-19579GitLab EE version 11.5 is vulnerable to a persistent XSS vulnerability in the Operations page.
- CVE-2018-19584GitLab EE, versions 11.x before 11.3.11, 11.4 before 11.4.8, and 11.5 before 11.5.1, is vulnerable to an insecure direct object reference vu
- CVE-2018-19581GitLab EE, versions 8.3 up to 11.x before 11.3.11, 11.4 before 11.4.8, and 11.5 before 11.5.1, is vulnerable to an insecure object reference
- CVE-2018-19582GitLab EE, versions 11.4 before 11.4.8 and 11.5 before 11.5.1, is affected by an insecure direct object reference vulnerability that permits
- CVE-2018-19583GitLab CE/EE, versions 8.0 up to 11.x before 11.3.11, 11.4 before 11.4.8, and 11.5 before 11.5.1, would log access tokens in the Workhorse l
- CVE-2019-13122A Cross Site Scripting (XSS) vulnerability exists in the template tag used to render message ids in Patchwork v1.1 through v2.1.x.
- CVE-2019-13279TRENDnet TEW-827DRU with firmware up to and including 2.04B03 contains multiple stack-based buffer overflows when processing user input for
- CVE-2019-13278TRENDnet TEW-827DRU with firmware up to and including 2.04B03 contains multiple command injections when processing user input for the setup
- CVE-2019-13276TRENDnet TEW-827DRU with firmware up to and including 2.04B03 contains a stack-based buffer overflow in the ssi binary.
- CVE-2019-12470Wikimedia MediaWiki through 1.32.1 has Incorrect Access Control.mediawiki/core
- CVE-2018-19580All versions of GitLab prior to 11.5.1, 11.4.8, and 11.3.11 do not send an email to the old email address when an email address change is ma
- CVE-2019-12469MediaWiki through 1.32.1 has Incorrect Access Control.mediawiki/core
- CVE-2018-19571GitLab CE/EE, versions 8.18 up to 11.x before 11.3.11, 11.4 before 11.4.8, and 11.5 before 11.5.1, are vulnerable to an SSRF vulnerability i
- CVE-2018-19574GitLab CE/EE, versions 7.6 up to 11.x before 11.3.11, 11.4 before 11.4.8, and 11.5 before 11.5.1, are vulnerable to an XSS vulnerability in
- CVE-2019-12474Wikimedia MediaWiki 1.23.0 through 1.32.1 has an information leak.mediawiki/core
- CVE-2018-19569GitLab CE/EE, versions 8.8 up to 11.x before 11.3.11, 11.4 before 11.4.8, and 11.5 before 11.5.1, are vulnerable to an authorization vulnera
- CVE-2019-12472An Incorrect Access Control vulnerability was found in Wikimedia MediaWiki 1.18.0 through 1.32.1.mediawiki/core
- CVE-2018-19575GitLab CE/EE, versions 10.1 up to 11.x before 11.3.11, 11.4 before 11.4.8, and 11.5 before 11.5.1, are vulnerable to an insecure direct obje
- CVE-2019-12471Wikimedia MediaWiki 1.30.0 through 1.32.1 has XSS.mediawiki/core
- CVE-2019-12473Wikimedia MediaWiki 1.27.0 through 1.32.1 might allow DoS.mediawiki/core
- CVE-2018-19576GitLab CE/EE, versions 8.6 up to 11.x before 11.3.11, 11.4 before 11.4.8, and 11.5 before 11.5.1, are vulnerable to an access control issue
- CVE-2018-10531An issue was discovered in the America's Army Proving Grounds platform for the Unreal Engine.
- CVE-2018-19572GitLab CE 8.17 and later and EE 8.3 and later have a symlink time-of-check-to-time-of-use race condition that would allow unauthorized acces
- CVE-2019-12466Wikimedia MediaWiki through 1.32.1 allows CSRF.mediawiki/core
- CVE-2018-19570GitLab CE/EE, versions 11.3 before 11.3.11, 11.4 before 11.4.8, and 11.5 before 11.5.1, are vulnerable to an XSS vulnerability in Markdown f
- CVE-2018-19573GitLab CE/EE, versions 10.3 up to 11.x before 11.3.11, 11.4 before 11.4.8, and 11.5 before 11.5.1, are vulnerable to an XSS vulnerability in
- CVE-2018-19577Gitlab CE/EE, versions 8.6 up to 11.x before 11.3.11, 11.4 before 11.4.8, and 11.5 before 11.5.1, are vulnerable to an incorrect access cont
- CVE-2019-12468An Incorrect Access Control vulnerability was found in Wikimedia MediaWiki 1.27.0 through 1.32.1.mediawiki/core
- CVE-2018-19496An issue was discovered in GitLab Community and Enterprise Edition 10.x and 11.x before 11.3.11, 11.4.x before 11.4.8, and 11.5.x before 11.
- CVE-2018-19495An issue was discovered in GitLab Community and Enterprise Edition before 11.3.11, 11.4.x before 11.4.8, and 11.5.x before 11.5.1.
- CVE-2018-19494An issue was discovered in GitLab Community and Enterprise Edition 11.x before 11.3.11, 11.4.x before 11.4.8, and 11.5.x before 11.5.1.
- CVE-2019-12467MediaWiki through 1.32.1 has Incorrect Access Control (issue 1 of 3).mediawiki/core
- CVE-2018-19493An issue was discovered in GitLab Community and Enterprise Edition 11.x before 11.3.11, 11.4.x before 11.4.8, and 11.5.x before 11.5.1.
- CVE-2017-7189main/streams/xp_socket.c in PHP 7.x before 2017-03-07 misparses fsockopen calls, such as by interpreting fsockopen('127.0.0.1:80', 443) as i
- CVE-2018-14831An arbitrary file read vulnerability in DamiCMS v6.0.0 allows remote authenticated administrators to read any files in the server via a craf
- CVE-2017-6217paypal/adaptivepayments-sdk-php v3.9.2 is vulnerable to a reflected XSS in the SetPaymentOptions.php resulting code executionpaypal/adaptivepayments-sdk-php
- CVE-2019-10653An issue was discovered in Hsycms V1.1.
- CVE-2018-17147Nagios XI before 5.5.4 has XSS in the auto login admin management page.
- CVE-2019-12724An issue was discovered in the Teclib News plugin through 1.5.2 for GLPI.
- CVE-2019-13224A use-after-free in onig_new_deluxe() in regext.c in Oniguruma 6.9.2 allows attackers to potentially cause information disclosure, denial of
- CVE-2019-13225A NULL Pointer Dereference in match_at() in regexec.c in Oniguruma 6.9.2 allows attackers to potentially cause denial of service by providin
- CVE-2019-13240An issue was discovered in GLPI before 9.4.1.
- CVE-2019-13396FlightPath 4.x and 5.0-x allows directory traversal and Local File Inclusion through the form_include parameter in an index.php?q=system-han
- CVE-2018-20851Helpy before 2.2.0 allows agents to edit admins.
- CVE-2018-14496Vivotek FD8136 devices allow remote memory corruption and remote code execution because of a stack-based buffer overflow, related to sprintf
- CVE-2018-14495Vivotek FD8136 devices allow Remote Command Injection, aka "another command injection vulnerability in our target device," a different issue
- CVE-2018-14494Vivotek FD8136 devices allow Remote Command Injection, related to BusyBox and wget.
- CVE-2019-12723An issue was discovered in the Teclib Fields plugin through 1.9.2 for GLPI.
- CVE-2019-10122eQ-3 HomeMatic CCU2 devices before 2.41.9 and CCU3 devices before 3.43.16 have buffer overflows in the ReGa ise GmbH HTTP-Server 2.0 compone
- CVE-2019-10121eQ-3 HomeMatic CCU2 devices before 2.41.8 and CCU3 devices before 3.43.15 use session IDs for authentication but lack authorization checks.
- CVE-2019-10119eQ-3 HomeMatic CCU2 devices before 2.41.8 and CCU3 devices before 3.43.16 use session IDs for authentication but lack authorization checks.
- CVE-2019-10120On eQ-3 HomeMatic CCU2 devices before 2.41.8 and CCU3 devices before 3.43.16, automatic login configuration (aka setAutoLogin) can be achiev
- CVE-2018-12628An issue was discovered in Eventum 3.5.0.
- CVE-2018-12627An issue was discovered in Eventum 3.5.0.
- CVE-2018-12626An issue was discovered in Eventum 3.5.0.
- CVE-2018-12625An issue was discovered in Eventum 3.5.0.
- CVE-2018-12623An issue was discovered in Eventum 3.5.0.
- CVE-2018-12622An issue was discovered in Eventum 3.5.0.
- CVE-2018-14550An issue has been found in third-party PNM decoding associated with libpng 1.6.35.libpng
- CVE-2019-13132In ZeroMQ libzmq before 4.0.9, 4.1.x before 4.1.7, and 4.2.x before 4.3.2, a remote, unauthenticated client connecting to a libzmq applicati