CVEs published July 11, 2019
84 CVEs were published on July 11, 2019: 2 critical, 6 high.
- Published
- 84
- Critical
- 2
- High
- 6
- Medium
- 10
- Low
- 0
- Unrated
- 66
- Now in CISA KEV
- 0
- Fix available
- 11
Most affected products
- Juniper Networks Junos OS
- 5
- Jenkins project Jenkins Docker Plugin · io.jenkins.docker:d…
- 3
- WavPack
- 3
- Redis Labs redis
- 2
- @nuxt/devalue
- 1
- Apache Kafka · org.apache.kafka:kafka
- 1
- Avaya Control Manager
- 1
- BroadLearning eclass
- 1
- Cloud Foundry UAA Release
- 1
- Gitea · code.gitea.io/gitea
- 1
Critical 2
High 6
- CVE-2019-0053Junos OS: Insufficient validation of environment variables in telnet client may lead to stack-based buffer overflowJuniper Networks Junos OS
- CVE-2019-0052SRX Series: srxpfe process crash while JSF/UTM module parses specific HTTP packetsJuniper Networks Junos OS
- CVE-2019-0049Junos OS: RPD process crashes when BGP peer restartsJuniper Networks Junos OS
- CVE-2019-10192A heap-buffer overflow vulnerability was found in the Redis hyperloglog data structure versions 3.x before 3.2.13, 4.x before 4.0.14 and 5.xRedis Labs redis
- CVE-2019-10193A stack-buffer overflow vulnerability was found in the Redis hyperloglog data structure versions 3.x before 3.2.13, 4.x before 4.0.14 and 5.Redis Labs redis
- CVE-2019-10135A flaw was found in the yaml.load() function in the osbs-client versions since 0.46 before 0.56.1.Red Hat osbs-client
Medium, low and unrated 76
- CVE-2019-10930A vulnerability has been identified in All other SIPROTEC 5 device types with CPU variants CP300 and CP100 and the respective Ethernet commuSiemens AG All other SIPROTEC 5 device types with CPU va… +3
- CVE-2019-10931A vulnerability has been identified in All other SIPROTEC 5 device types with CPU variants CP300 and CP100 and the respective Ethernet commuSiemens AG All other SIPROTEC 5 device types with CPU va… +4
- CVE-2019-10933A vulnerability has been identified in Spectrum Power 3 (Corporate User Interface) (All versions <= v3.11), Spectrum Power 4 (Corporate UserSiemens AG Spectrum Power
- CVE-2019-10935A vulnerability has been identified in SIMATIC PCS 7 V8.0 and earlier (All versions), SIMATIC PCS 7 V8.1 (All versions < V8.1 with WinCC V7.Siemens AG SIMATIC PCS 7 V8.0 and earlier · Siemens AG S… +4
- CVE-2019-10915A vulnerability has been identified in TIA Administrator (All versions < V1.0 SP1 Upd1).Siemens AG TIA Administrator
- CVE-2019-3415ZTE MW NR8000V2.4.4.03 and NR8000V2.4.4.04 are impacted by path traversal vulnerability.ZTE MW
- CVE-2018-17196In Apache Kafka versions between 0.11.0.0 and 2.1.0, it is possible to manually craft a Produce request which bypasses transaction/idempotenApache Kafka · org.apache.kafka:kafka
- CVE-2018-18095Improper authentication in firmware for Intel(R) SSD DC S4500 Series and Intel(R) SSD DC S4600 Series before SCV10150 may allow an unprivileIntel(R) SSD DC S4500/S4600 Series
- CVE-2019-11133Improper access control in the Intel(R) Processor Diagnostic Tool before version 4.1.2.24 may allow an authenticated user to potentially enaIntel(R) Processor Diagnostic Tool Advisory
- CVE-2019-5528VMware ESXi 6.5 suffers from partial denial of service vulnerability in hostd process.VMware ESXi
- CVE-2019-12751Symantec Messaging Gateway, prior to 10.7.1, may be susceptible to a privilege escalation vulnerability, which is a type of issue whereby anSymantec Messaging Gateway
- CVE-2019-12574A vulnerability in the London Trust Media Private Internet Access (PIA) VPN Client v1.0 for Windows could allow an authenticated, local atta
- CVE-2019-4263IBM Content Navigator 3.0CD is vulnerable to local file inclusion, allowing an attacker to access a configuration file in the ICN server.IBM Content Navigator
- CVE-2019-4193IBM Jazz for Service Management 1.1.3 and 1.1.3.2 stores sensitive information in URL parameters.IBM Jazz for Service Management
- CVE-2019-4131IBM Application Performance Management (IBM Monitoring 8.1.4) could allow a remote attacker to induce the application to perform server-sideIBM Monitoring
- CVE-2019-4118IBM Multicloud Manager 3.1.0, 3.1.1, and 3.1.2 ibm-mcm-chart could allow a local attacker with admin privileges to obtain highly sensitive iIBM Multicloud Manager
- CVE-2018-1968IBM Security Identity Manager 7.0.1 discloses sensitive information to unauthorized users.IBM Security Identity Manager
- CVE-2019-12578A vulnerability in the London Trust Media Private Internet Access (PIA) VPN Client v82 for Linux could allow an authenticated, local attacke
- CVE-2019-10970In Rockwell Automation PanelView 5510 (all versions manufactured before March 13, 2019 that have never been updated to v4.003, v5.002, or laRockwell Automation PanelView
- CVE-2019-12571A vulnerability in the London Trust Media Private Internet Access (PIA) VPN Client v0.9.8 beta (build 02099) for macOS could allow an authen
- CVE-2019-0048EX4300 Series: When a firewall filter is applied to a loopback interface, other firewall filters for multicast traffic may failJuniper Networks Junos OS
- CVE-2019-0046Junos OS: EX4300 Series: Denial of Service upon receipt of large number of specific valid packets on management interface.Juniper Networks Junos OS
- CVE-2019-12576A vulnerability in the London Trust Media Private Internet Access (PIA) VPN Client v82 for macOS could allow an authenticated, local attacke
- CVE-2019-1010315WavPack 5.1 and earlier is affected by: CWE 369: Divide by Zero.WavPack
- CVE-2019-1010314Gitea 1.7.2, 1.7.3 is affected by: Cross Site Scripting (XSS).Gitea · code.gitea.io/gitea
- CVE-2019-12573A vulnerability in the London Trust Media Private Internet Access (PIA) VPN Client v82 for Linux and macOS could allow an authenticated, loc
- CVE-2019-12577A vulnerability in the London Trust Media Private Internet Access (PIA) VPN Client v82 for macOS could allow an authenticated, local attacke
- CVE-2019-1010316pyxtrlock 0.3 and earlier is affected by: Incorrect Access Control.pyxtrlock
- CVE-2019-1010317WavPack 5.1.0 and earlier is affected by: CWE-457: Use of Uninitialized Variable.WavPack
- CVE-2019-12579A vulnerability in the London Trust Media Private Internet Access (PIA) VPN Client v82 for Linux and macOS could allow an authenticated, loc
- CVE-2019-1010319WavPack 5.1.0 and earlier is affected by: CWE-457: Use of Uninitialized Variable.WavPack
- CVE-2019-12575A vulnerability in the London Trust Media Private Internet Access (PIA) VPN Client v82 for Linux could allow an authenticated, local attacke
- CVE-2014-3798The Windows Guest Tools in Citrix XenServer 6.2 SP1 and earlier allows remote attackers to cause a denial of service (guest OS crash) via a
- CVE-2019-9657Alarm.com ADC-V522IR 0100b9 devices have Incorrect Access Control, a different issue than CVE-2018-19588.
- CVE-2019-13029Multiple stored Cross-site scripting (XSS) issues in the admin panel and survey system in REDCap 8 before 8.10.20 and 9 before 9.1.2 allow a
- CVE-2018-19588Alarm.com ADC-V522IR 0100b9 devices have Incorrect Access Control.
- CVE-2018-17151Intersystems Cache 2017.2.2.865.0 has Incorrect Access Control.
- CVE-2018-17152Intersystems Cache 2017.2.2.865.0 allows XXE.
- CVE-2018-17150Intersystems Cache 2017.2.2.865.0 allows XSS.
- CVE-2019-12529An issue was discovered in Squid 2.x through 2.7.STABLE9, 3.x through 3.5.28, and 4.x through 4.7.
- CVE-2019-10194Sensitive passwords used in deployment and configuration of oVirt Metrics, all versions.Red Hat ovirt-engine-metrics
- CVE-2019-3889A reflected XSS vulnerability exists in authorization flow of OpenShift Container Platform versions: openshift-online-3, openshift-enterprisRed Hat atomic-openshift
- CVE-2019-11062SUNNET WMPro v5.0 and v5.1 has OS Command InjectionSUNNET WMPro
- CVE-2019-12525An issue was discovered in Squid 3.3.9 through 3.5.28 and 4.x through 4.7.
- CVE-2019-11268UAA SQL Identity Zone VulnerabilityCloud Foundry UAA Release
- CVE-2019-12527An issue was discovered in Squid 4.0.23 through 4.7.
- CVE-2019-10651An issue was discovered in the Core Server in Ivanti Endpoint Manager (EPM) 2017.3 before SU7 and 2018.x before 2018.3 SU3, with remote code
- CVE-2019-13564XSS exists in Ping Identity Agentless Integration Kit before 1.5.
- CVE-2019-13563D-Link DIR-655 C devices before 3.02B05 BETA03 allow CSRF for the entire management console.
- CVE-2019-13562D-Link DIR-655 C devices before 3.02B05 BETA03 allow XSS, as demonstrated by the /www/ping_response.cgi ping_ipaddr parameter, the /www/ping
- CVE-2019-13561D-Link DIR-655 C devices before 3.02B05 BETA03 allow remote attackers to execute arbitrary commands via shell metacharacters in the online_f
- CVE-2019-13560D-Link DIR-655 C devices before 3.02B05 BETA03 allow remote attackers to force a blank password via the apply_sec.cgi setup_wizard parameter
- CVE-2019-10340A cross-site request forgery vulnerability in Jenkins Docker Plugin 1.1.6 and earlier in DockerAPI.DescriptorImpl#doTestConnection allowed uJenkins project Jenkins Docker Plugin · io.jenkins.docker:d…
- CVE-2019-10341A missing permission check in Jenkins Docker Plugin 1.1.6 and earlier in DockerAPI.DescriptorImpl#doTestConnection allowed users with OveralJenkins project Jenkins Docker Plugin · io.jenkins.docker:d…
- CVE-2019-10342A missing permission check in Jenkins Docker Plugin 1.1.6 and earlier in various 'fillCredentialsIdItems' methods allowed users with OverallJenkins project Jenkins Docker Plugin · io.jenkins.docker:d…
- CVE-2019-10346A reflected cross site scripting vulnerability in Jenkins Embeddable Build Status Plugin 2.0.1 and earlier allowed attackers inject arbitrarJenkins project Jenkins Embeddable Build Status Plugin · io…
- CVE-2019-10347Jenkins Mashup Portlets Plugin stored credentials unencrypted on the Jenkins master where they can be viewed by users with access to the masJenkins project Jenkins Mashup Portlets Plugin · javagh.jen…
- CVE-2019-10348Jenkins Gogs Plugin stored credentials unencrypted in job config.xml files on the Jenkins master where they can be viewed by users with ExteJenkins project Jenkins Gogs Plugin · org.jenkins-ci.plugin…
- CVE-2019-10349A stored cross site scripting vulnerability in Jenkins Dependency Graph Viewer Plugin 0.13 and earlier allowed attackers able to configure jJenkins project Jenkins Dependency Graph Viewer Plugin · or…
- CVE-2019-10350Jenkins Port Allocator Plugin stores credentials unencrypted in job config.xml files on the Jenkins master where they can be viewed by usersJenkins project Jenkins Port Allocator Plugin · org.jenkins…
- CVE-2019-10351Jenkins Caliper CI Plugin stores credentials unencrypted in job config.xml files on the Jenkins master where they can be viewed by users witJenkins project Jenkins Caliper CI Plugin · com.brianfromor…
- CVE-2018-11744Cloudera Manager through 5.15 has Incorrect Access Control.
- CVE-2019-13507hidea.com AZ Admin 1.0 has news_det.php?cod= SQL Injection.
- CVE-2019-12363An CSRF issue was discovered in the JN-Jones MyBB-2FA plugin through 2014-11-05 for MyBB.
- CVE-2019-12537An issue was discovered in Zoho ManageEngine AssetExplorer.
- CVE-2019-12539An issue was discovered in the Purchase component of Zoho ManageEngine ServiceDesk Plus.
- CVE-2019-12540An issue was discovered in Zoho ManageEngine ServiceDesk Plus 10.5.
- CVE-2019-12595An issue was discovered in Zoho ManageEngine AssetExplorer.
- CVE-2019-12596An issue was discovered in Zoho ManageEngine AssetExplorer.
- CVE-2019-12597An issue was discovered in Zoho ManageEngine AssetExplorer.
- CVE-2019-13506@nuxt/devalue before 1.2.3, as used in Nuxt.js before 2.6.2, mishandles object keys, leading to XSS.@nuxt/devalue
- CVE-2019-12838SchedMD Slurm 17.11.x, 18.08.0 through 18.08.7, and 19.05.0 allows SQL Injection.
- CVE-2019-1010003Leanote prior to version 2.6 is affected by: Cross Site Scripting (XSS).Leanote
- CVE-2019-13505The Appointment Hour Booking plugin 1.1.44 for WordPress allows XSS via the E-mail field, as demonstrated by email_1.
- CVE-2019-13503mq_parse_http in mongoose.c in Mongoose 6.15 has a heap-based buffer over-read.
- CVE-2019-13504There is an out-of-bounds read in Exiv2::MrwImage::readMetadata in mrwimage.cpp in Exiv2 through 0.27.2.