# CVEs published 2019-07-10

89 CVEs were published on July 10, 2019: 1 critical, 4 high. Days are UTC.

- [CVE-2019-13489](https://cve.now/CVE-2019-13489.md): Trape through 2019-05-08 has SQL injection via the data\[2\] variable in core/db.py, as demonstrated by the /bs t parameter. (no CVSS)
- [CVE-2019-13488](https://cve.now/CVE-2019-13488.md): A cross-site scripting (XSS) vulnerability in static/js/trape.js in Trape through 2019-05-08 allows remote attackers to inject arbitrary web (no CVSS)
- [CVE-2019-13482](https://cve.now/CVE-2019-13482.md): An issue was discovered on D-Link DIR-818LW devices with firmware 2.06betab01. (no CVSS)
- [CVE-2019-13481](https://cve.now/CVE-2019-13481.md): An issue was discovered on D-Link DIR-818LW devices with firmware 2.06betab01. (no CVSS)
- [CVE-2019-5446](https://cve.now/CVE-2019-5446.md): Command Injection in EdgeMAX EdgeSwitch prior to 1.8.2 allow an Admin user to execute commands as root. (no CVSS, EdgeMAX)
- [CVE-2019-5445](https://cve.now/CVE-2019-5445.md): DoS in EdgeMAX EdgeSwitch prior to 1.8.2 allow an Admin user to Crash the SSH CLI interface by using crafted commands. (no CVSS, EdgeMAX)
- [CVE-2019-5444](https://cve.now/CVE-2019-5444.md): Path traversal vulnerability in version up to v1.1.3 in serve-here.js npm module allows attackers to list any file in arbitrary folder. (no CVSS, serve-here.js npm module · serve-here.js)
- [CVE-2019-12804](https://cve.now/CVE-2019-12804.md): Hunesion i-oneNet Missing Support for Integrity Check vulnerability (CVSS 7.8, Hunesion i-oneNet)
- [CVE-2019-12803](https://cve.now/CVE-2019-12803.md): Hunesion i-oneNet unrestricted file upload vulnerability (CVSS 8.8, Hunesion i-oneNet)
- [CVE-2019-0330](https://cve.now/CVE-2019-0330.md): The OS Command Plugin in the transaction GPA\_ADMIN and the OSCommand Console of SAP Diagnostic Agent (LM-Service), version 7.2, allow an att (no CVSS, SAP SE SAP Diagnostic Agent)
- [CVE-2019-0329](https://cve.now/CVE-2019-0329.md): SAP Information Steward, version 4.2, does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting (XSS) vulnerabi (no CVSS, SAP SE SAP Information Steward)
- [CVE-2019-0328](https://cve.now/CVE-2019-0328.md): ABAP Tests Modules (SAP Basis, versions 7.0, 7.1, 7.3, 7.31, 7.4, 7.5) of SAP NetWeaver Process Integration enables an attacker the executio (no CVSS, SAP SE SAP NetWeaver Process Integration ABAP tests)
- [CVE-2019-0327](https://cve.now/CVE-2019-0327.md): SAP NetWeaver for Java Application Server - Web Container, (engineapi, versions 7.1, 7.2, 7.3, 7.31, 7.4 and 7.5), (servercode, versions 7.2 (no CVSS, SAP SE SAP NetWeaver for Java Application Server - Web Cont…)
- [CVE-2019-0326](https://cve.now/CVE-2019-0326.md): SAP BusinessObjects Business Intelligence Platform (BI Workspace) (Enterprise), versions 4.1, 4.2, 4.3, does not sufficiently encode user-co (no CVSS, SAP SE SAP BusinessObjects Business Intelligence Platform -…)
- [CVE-2019-0325](https://cve.now/CVE-2019-0325.md): SAP ERP HCM (SAP\_HRCES) , version 3, does not perform necessary authorization checks for a report that reads payroll data of employees in a (no CVSS, SAP SE SAP ERP HCM)
- [CVE-2019-0322](https://cve.now/CVE-2019-0322.md): SAP Commerce Cloud (previously known as SAP Hybris Commerce), (HY\_COM, versions 6.3, 6.4, 6.5, 6.6, 6.7, 1808, 1811), allows an attacker to (no CVSS, SAP SE SAP Commerce Cloud (ex SAP Hybris Commerce))
- [CVE-2019-0321](https://cve.now/CVE-2019-0321.md): ABAP Server and ABAP Platform (SAP Basis), versions, 7.31, 7.4, 7.5, do not sufficiently encode user-controlled inputs, resulting in Cross-S (no CVSS, SAP SE ABAP Server and ABAP Platform)
- [CVE-2019-0319](https://cve.now/CVE-2019-0319.md): The SAP Gateway, versions 7.5, 7.51, 7.52 and 7.53, allows an attacker to inject content which is displayed in the form of an error message. (no CVSS, SAP SE SAP Gateway)
- [CVE-2019-0318](https://cve.now/CVE-2019-0318.md): Under certain conditions SAP NetWeaver Application Server for Java (Startup Framework), versions 7.21, 7.22, 7.45, 7.49, and 7.53, allows an (no CVSS, SAP SE SAP NetWeaver Application Server for Java)
- [CVE-2019-0281](https://cve.now/CVE-2019-0281.md): SAPUI5 and OpenUI5, before versions 1.38.39, 1.44.39, 1.52.25, 1.60.6 and 1.63.0, does not sufficiently encode user-controlled inputs, resul (no CVSS, SAP SE OpenUI5 · SAP SE SAPUI5)
- [CVE-2019-11650](https://cve.now/CVE-2019-11650.md): A potential Man in the Middle attack (MITM) was found in NetIQ Advanced Authentication Framework versions prior to 6.0. (no CVSS, Micro Focus NetIQ Advanced Authentication Framework)
- [CVE-2019-10966](https://cve.now/CVE-2019-10966.md): In GE Aestiva and Aespire versions 7100 and 7900, a vulnerability exists where serial devices are connected via an added unsecured terminal (no CVSS, GE Aestiva and Aespire)
- [CVE-2019-5221](https://cve.now/CVE-2019-5221.md): There is a path traversal vulnerability on Huawei Share. (no CVSS, Huawei Mate 20 X)
- [CVE-2019-5220](https://cve.now/CVE-2019-5220.md): There is a Factory Reset Protection (FRP) bypass vulnerability on several smartphones. (no CVSS, Huawei Mate 20 X · Huawei Mate +1)
- [CVE-2019-1873](https://cve.now/CVE-2019-1873.md): Cisco ASA and FTD Software Cryptographic TLS and SSL Driver Denial of Service Vulnerability (CVSS 8.6, Cisco Adaptive Security Appliance (ASA) Software)
- [CVE-2018-11734](https://cve.now/CVE-2018-11734.md): In e107 v2.1.7, output without filtering results in XSS. (no CVSS)
- [CVE-2018-19578](https://cve.now/CVE-2018-19578.md): GitLab EE, version 11.5 before 11.5.1, is vulnerable to an insecure object reference issue that permits a user with Reporter privileges to v (no CVSS)
- [CVE-2018-19579](https://cve.now/CVE-2018-19579.md): GitLab EE version 11.5 is vulnerable to a persistent XSS vulnerability in the Operations page. (no CVSS)
- [CVE-2018-19584](https://cve.now/CVE-2018-19584.md): GitLab EE, versions 11.x before 11.3.11, 11.4 before 11.4.8, and 11.5 before 11.5.1, is vulnerable to an insecure direct object reference vu (no CVSS)
- [CVE-2018-19581](https://cve.now/CVE-2018-19581.md): GitLab EE, versions 8.3 up to 11.x before 11.3.11, 11.4 before 11.4.8, and 11.5 before 11.5.1, is vulnerable to an insecure object reference (no CVSS)
- [CVE-2018-19582](https://cve.now/CVE-2018-19582.md): GitLab EE, versions 11.4 before 11.4.8 and 11.5 before 11.5.1, is affected by an insecure direct object reference vulnerability that permits (no CVSS)
- [CVE-2018-19583](https://cve.now/CVE-2018-19583.md): GitLab CE/EE, versions 8.0 up to 11.x before 11.3.11, 11.4 before 11.4.8, and 11.5 before 11.5.1, would log access tokens in the Workhorse l (no CVSS)
- [CVE-2019-13122](https://cve.now/CVE-2019-13122.md): A Cross Site Scripting (XSS) vulnerability exists in the template tag used to render message ids in Patchwork v1.1 through v2.1.x. (no CVSS)
- [CVE-2019-13279](https://cve.now/CVE-2019-13279.md): TRENDnet TEW-827DRU with firmware up to and including 2.04B03 contains multiple stack-based buffer overflows when processing user input for (no CVSS)
- [CVE-2019-13278](https://cve.now/CVE-2019-13278.md): TRENDnet TEW-827DRU with firmware up to and including 2.04B03 contains multiple command injections when processing user input for the setup (no CVSS)
- [CVE-2019-13276](https://cve.now/CVE-2019-13276.md): TRENDnet TEW-827DRU with firmware up to and including 2.04B03 contains a stack-based buffer overflow in the ssi binary. (no CVSS)
- [CVE-2019-12470](https://cve.now/CVE-2019-12470.md): Wikimedia MediaWiki through 1.32.1 has Incorrect Access Control. (no CVSS, mediawiki/core)
- [CVE-2018-19580](https://cve.now/CVE-2018-19580.md): All versions of GitLab prior to 11.5.1, 11.4.8, and 11.3.11 do not send an email to the old email address when an email address change is ma (no CVSS)
- [CVE-2019-12469](https://cve.now/CVE-2019-12469.md): MediaWiki through 1.32.1 has Incorrect Access Control. (no CVSS, mediawiki/core)
- [CVE-2018-19571](https://cve.now/CVE-2018-19571.md): GitLab CE/EE, versions 8.18 up to 11.x before 11.3.11, 11.4 before 11.4.8, and 11.5 before 11.5.1, are vulnerable to an SSRF vulnerability i (no CVSS)
- [CVE-2018-19574](https://cve.now/CVE-2018-19574.md): GitLab CE/EE, versions 7.6 up to 11.x before 11.3.11, 11.4 before 11.4.8, and 11.5 before 11.5.1, are vulnerable to an XSS vulnerability in (no CVSS)
- [CVE-2019-12474](https://cve.now/CVE-2019-12474.md): Wikimedia MediaWiki 1.23.0 through 1.32.1 has an information leak. (no CVSS, mediawiki/core)
- [CVE-2018-19569](https://cve.now/CVE-2018-19569.md): GitLab CE/EE, versions 8.8 up to 11.x before 11.3.11, 11.4 before 11.4.8, and 11.5 before 11.5.1, are vulnerable to an authorization vulnera (no CVSS)
- [CVE-2019-12472](https://cve.now/CVE-2019-12472.md): An Incorrect Access Control vulnerability was found in Wikimedia MediaWiki 1.18.0 through 1.32.1. (no CVSS, mediawiki/core)
- [CVE-2018-19575](https://cve.now/CVE-2018-19575.md): GitLab CE/EE, versions 10.1 up to 11.x before 11.3.11, 11.4 before 11.4.8, and 11.5 before 11.5.1, are vulnerable to an insecure direct obje (no CVSS)
- [CVE-2019-12471](https://cve.now/CVE-2019-12471.md): Wikimedia MediaWiki 1.30.0 through 1.32.1 has XSS. (no CVSS, mediawiki/core)
- [CVE-2019-12473](https://cve.now/CVE-2019-12473.md): Wikimedia MediaWiki 1.27.0 through 1.32.1 might allow DoS. (no CVSS, mediawiki/core)
- [CVE-2018-19576](https://cve.now/CVE-2018-19576.md): GitLab CE/EE, versions 8.6 up to 11.x before 11.3.11, 11.4 before 11.4.8, and 11.5 before 11.5.1, are vulnerable to an access control issue (no CVSS)
- [CVE-2018-10531](https://cve.now/CVE-2018-10531.md): An issue was discovered in the America's Army Proving Grounds platform for the Unreal Engine. (no CVSS)
- [CVE-2018-19572](https://cve.now/CVE-2018-19572.md): GitLab CE 8.17 and later and EE 8.3 and later have a symlink time-of-check-to-time-of-use race condition that would allow unauthorized acces (no CVSS)
- [CVE-2019-12466](https://cve.now/CVE-2019-12466.md): Wikimedia MediaWiki through 1.32.1 allows CSRF. (no CVSS, mediawiki/core)
- [CVE-2018-19570](https://cve.now/CVE-2018-19570.md): GitLab CE/EE, versions 11.3 before 11.3.11, 11.4 before 11.4.8, and 11.5 before 11.5.1, are vulnerable to an XSS vulnerability in Markdown f (no CVSS)
- [CVE-2018-19573](https://cve.now/CVE-2018-19573.md): GitLab CE/EE, versions 10.3 up to 11.x before 11.3.11, 11.4 before 11.4.8, and 11.5 before 11.5.1, are vulnerable to an XSS vulnerability in (no CVSS)
- [CVE-2018-19577](https://cve.now/CVE-2018-19577.md): Gitlab CE/EE, versions 8.6 up to 11.x before 11.3.11, 11.4 before 11.4.8, and 11.5 before 11.5.1, are vulnerable to an incorrect access cont (no CVSS)
- [CVE-2019-12468](https://cve.now/CVE-2019-12468.md): An Incorrect Access Control vulnerability was found in Wikimedia MediaWiki 1.27.0 through 1.32.1. (no CVSS, mediawiki/core)
- [CVE-2018-19496](https://cve.now/CVE-2018-19496.md): An issue was discovered in GitLab Community and Enterprise Edition 10.x and 11.x before 11.3.11, 11.4.x before 11.4.8, and 11.5.x before 11. (no CVSS)
- [CVE-2018-19495](https://cve.now/CVE-2018-19495.md): An issue was discovered in GitLab Community and Enterprise Edition before 11.3.11, 11.4.x before 11.4.8, and 11.5.x before 11.5.1. (no CVSS)
- [CVE-2018-19494](https://cve.now/CVE-2018-19494.md): An issue was discovered in GitLab Community and Enterprise Edition 11.x before 11.3.11, 11.4.x before 11.4.8, and 11.5.x before 11.5.1. (no CVSS)
- [CVE-2019-12467](https://cve.now/CVE-2019-12467.md): MediaWiki through 1.32.1 has Incorrect Access Control (issue 1 of 3). (no CVSS, mediawiki/core)
- [CVE-2018-19493](https://cve.now/CVE-2018-19493.md): An issue was discovered in GitLab Community and Enterprise Edition 11.x before 11.3.11, 11.4.x before 11.4.8, and 11.5.x before 11.5.1. (no CVSS)
- [CVE-2017-7189](https://cve.now/CVE-2017-7189.md): main/streams/xp\_socket.c in PHP 7.x before 2017-03-07 misparses fsockopen calls, such as by interpreting fsockopen('127.0.0.1:80', 443) as i (no CVSS)
- [CVE-2018-14831](https://cve.now/CVE-2018-14831.md): An arbitrary file read vulnerability in DamiCMS v6.0.0 allows remote authenticated administrators to read any files in the server via a craf (no CVSS)
- [CVE-2017-6217](https://cve.now/CVE-2017-6217.md): paypal/adaptivepayments-sdk-php v3.9.2 is vulnerable to a reflected XSS in the SetPaymentOptions.php resulting code execution (no CVSS, paypal/adaptivepayments-sdk-php)
- [CVE-2017-12652](https://cve.now/CVE-2017-12652.md): libpng before 1.6.32 does not properly check the length of chunks against the user limit. (CVSS 9.8)
- [CVE-2019-10653](https://cve.now/CVE-2019-10653.md): An issue was discovered in Hsycms V1.1. (no CVSS)
- [CVE-2018-17147](https://cve.now/CVE-2018-17147.md): Nagios XI before 5.5.4 has XSS in the auto login admin management page. (no CVSS)
- [CVE-2019-12724](https://cve.now/CVE-2019-12724.md): An issue was discovered in the Teclib News plugin through 1.5.2 for GLPI. (no CVSS)
- [CVE-2019-13224](https://cve.now/CVE-2019-13224.md): A use-after-free in onig\_new\_deluxe() in regext.c in Oniguruma 6.9.2 allows attackers to potentially cause information disclosure, denial of (no CVSS)
- [CVE-2019-13225](https://cve.now/CVE-2019-13225.md): A NULL Pointer Dereference in match\_at() in regexec.c in Oniguruma 6.9.2 allows attackers to potentially cause denial of service by providin (no CVSS)
- [CVE-2019-13240](https://cve.now/CVE-2019-13240.md): An issue was discovered in GLPI before 9.4.1. (no CVSS)
- [CVE-2019-13071](https://cve.now/CVE-2019-13071.md): CSRF in the Agent/Center component of CyberPower PowerPanel Business Edition 3.4.0 allows an attacker to submit POST requests to any forms i (CVSS 8.8)
- [CVE-2019-13396](https://cve.now/CVE-2019-13396.md): FlightPath 4.x and 5.0-x allows directory traversal and Local File Inclusion through the form\_include parameter in an index.php?q=system-han (no CVSS)
- [CVE-2018-20851](https://cve.now/CVE-2018-20851.md): Helpy before 2.2.0 allows agents to edit admins. (no CVSS)
- [CVE-2018-14496](https://cve.now/CVE-2018-14496.md): Vivotek FD8136 devices allow remote memory corruption and remote code execution because of a stack-based buffer overflow, related to sprintf (no CVSS)
- [CVE-2018-14495](https://cve.now/CVE-2018-14495.md): Vivotek FD8136 devices allow Remote Command Injection, aka "another command injection vulnerability in our target device," a different issue (no CVSS)
- [CVE-2018-14494](https://cve.now/CVE-2018-14494.md): Vivotek FD8136 devices allow Remote Command Injection, related to BusyBox and wget. (no CVSS)
- [CVE-2019-12723](https://cve.now/CVE-2019-12723.md): An issue was discovered in the Teclib Fields plugin through 1.9.2 for GLPI. (no CVSS)
- [CVE-2019-10122](https://cve.now/CVE-2019-10122.md): eQ-3 HomeMatic CCU2 devices before 2.41.9 and CCU3 devices before 3.43.16 have buffer overflows in the ReGa ise GmbH HTTP-Server 2.0 compone (no CVSS)
- [CVE-2019-10121](https://cve.now/CVE-2019-10121.md): eQ-3 HomeMatic CCU2 devices before 2.41.8 and CCU3 devices before 3.43.15 use session IDs for authentication but lack authorization checks. (no CVSS)
- [CVE-2019-10119](https://cve.now/CVE-2019-10119.md): eQ-3 HomeMatic CCU2 devices before 2.41.8 and CCU3 devices before 3.43.16 use session IDs for authentication but lack authorization checks. (no CVSS)
- [CVE-2019-10120](https://cve.now/CVE-2019-10120.md): On eQ-3 HomeMatic CCU2 devices before 2.41.8 and CCU3 devices before 3.43.16, automatic login configuration (aka setAutoLogin) can be achiev (no CVSS)
- [CVE-2018-12628](https://cve.now/CVE-2018-12628.md): An issue was discovered in Eventum 3.5.0. (no CVSS)
- [CVE-2018-12627](https://cve.now/CVE-2018-12627.md): An issue was discovered in Eventum 3.5.0. (no CVSS)
- [CVE-2018-12626](https://cve.now/CVE-2018-12626.md): An issue was discovered in Eventum 3.5.0. (no CVSS)
- [CVE-2018-12625](https://cve.now/CVE-2018-12625.md): An issue was discovered in Eventum 3.5.0. (no CVSS)
- [CVE-2018-12623](https://cve.now/CVE-2018-12623.md): An issue was discovered in Eventum 3.5.0. (no CVSS)
- [CVE-2018-12622](https://cve.now/CVE-2018-12622.md): An issue was discovered in Eventum 3.5.0. (no CVSS)
- [CVE-2018-14550](https://cve.now/CVE-2018-14550.md): An issue has been found in third-party PNM decoding associated with libpng 1.6.35. (no CVSS, libpng)
- [CVE-2019-13132](https://cve.now/CVE-2019-13132.md): In ZeroMQ libzmq before 4.0.9, 4.1.x before 4.1.7, and 4.2.x before 4.3.2, a remote, unauthenticated client connecting to a libzmq applicati (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2019-07-10
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.