# CVEs published 2019-07-11

84 CVEs were published on July 11, 2019: 2 critical, 6 high. Days are UTC.

- [CVE-2019-10930](https://cve.now/CVE-2019-10930.md): A vulnerability has been identified in All other SIPROTEC 5 device types with CPU variants CP300 and CP100 and the respective Ethernet commu (no CVSS, Siemens AG All other SIPROTEC 5 device types with CPU va… +3)
- [CVE-2019-10931](https://cve.now/CVE-2019-10931.md): A vulnerability has been identified in All other SIPROTEC 5 device types with CPU variants CP300 and CP100 and the respective Ethernet commu (no CVSS, Siemens AG All other SIPROTEC 5 device types with CPU va… +4)
- [CVE-2019-10933](https://cve.now/CVE-2019-10933.md): A vulnerability has been identified in Spectrum Power 3 (Corporate User Interface) (All versions \<= v3.11), Spectrum Power 4 (Corporate User (no CVSS, Siemens AG Spectrum Power)
- [CVE-2019-10935](https://cve.now/CVE-2019-10935.md): A vulnerability has been identified in SIMATIC PCS 7 V8.0 and earlier (All versions), SIMATIC PCS 7 V8.1 (All versions \< V8.1 with WinCC V7. (no CVSS, Siemens AG SIMATIC PCS 7 V8.0 and earlier · Siemens AG S… +4)
- [CVE-2019-10915](https://cve.now/CVE-2019-10915.md): A vulnerability has been identified in TIA Administrator (All versions \< V1.0 SP1 Upd1). (no CVSS, Siemens AG TIA Administrator)
- [CVE-2019-3415](https://cve.now/CVE-2019-3415.md): ZTE MW NR8000V2.4.4.03 and NR8000V2.4.4.04 are impacted by path traversal vulnerability. (no CVSS, ZTE MW)
- [CVE-2018-17196](https://cve.now/CVE-2018-17196.md): In Apache Kafka versions between 0.11.0.0 and 2.1.0, it is possible to manually craft a Produce request which bypasses transaction/idempoten (no CVSS, Apache Kafka · org.apache.kafka:kafka)
- [CVE-2018-18095](https://cve.now/CVE-2018-18095.md): Improper authentication in firmware for Intel(R) SSD DC S4500 Series and Intel(R) SSD DC S4600 Series before SCV10150 may allow an unprivile (no CVSS, Intel(R) SSD DC S4500/S4600 Series)
- [CVE-2019-11133](https://cve.now/CVE-2019-11133.md): Improper access control in the Intel(R) Processor Diagnostic Tool before version 4.1.2.24 may allow an authenticated user to potentially ena (no CVSS, Intel(R) Processor Diagnostic Tool Advisory)
- [CVE-2019-5528](https://cve.now/CVE-2019-5528.md): VMware ESXi 6.5 suffers from partial denial of service vulnerability in hostd process. (no CVSS, VMware ESXi)
- [CVE-2019-12751](https://cve.now/CVE-2019-12751.md): Symantec Messaging Gateway, prior to 10.7.1, may be susceptible to a privilege escalation vulnerability, which is a type of issue whereby an (no CVSS, Symantec Messaging Gateway)
- [CVE-2019-12574](https://cve.now/CVE-2019-12574.md): A vulnerability in the London Trust Media Private Internet Access (PIA) VPN Client v1.0 for Windows could allow an authenticated, local atta (no CVSS)
- [CVE-2019-4263](https://cve.now/CVE-2019-4263.md): IBM Content Navigator 3.0CD is vulnerable to local file inclusion, allowing an attacker to access a configuration file in the ICN server. (CVSS 4.3, IBM Content Navigator)
- [CVE-2019-4193](https://cve.now/CVE-2019-4193.md): IBM Jazz for Service Management 1.1.3 and 1.1.3.2 stores sensitive information in URL parameters. (CVSS 5.9, IBM Jazz for Service Management)
- [CVE-2019-4131](https://cve.now/CVE-2019-4131.md): IBM Application Performance Management (IBM Monitoring 8.1.4) could allow a remote attacker to induce the application to perform server-side (CVSS 5.3, IBM Monitoring)
- [CVE-2019-4118](https://cve.now/CVE-2019-4118.md): IBM Multicloud Manager 3.1.0, 3.1.1, and 3.1.2 ibm-mcm-chart could allow a local attacker with admin privileges to obtain highly sensitive i (CVSS 4.4, IBM Multicloud Manager)
- [CVE-2018-1968](https://cve.now/CVE-2018-1968.md): IBM Security Identity Manager 7.0.1 discloses sensitive information to unauthorized users. (CVSS 5.3, IBM Security Identity Manager)
- [CVE-2019-12578](https://cve.now/CVE-2019-12578.md): A vulnerability in the London Trust Media Private Internet Access (PIA) VPN Client v82 for Linux could allow an authenticated, local attacke (no CVSS)
- [CVE-2019-10970](https://cve.now/CVE-2019-10970.md): In Rockwell Automation PanelView 5510 (all versions manufactured before March 13, 2019 that have never been updated to v4.003, v5.002, or la (no CVSS, Rockwell Automation PanelView)
- [CVE-2019-12571](https://cve.now/CVE-2019-12571.md): A vulnerability in the London Trust Media Private Internet Access (PIA) VPN Client v0.9.8 beta (build 02099) for macOS could allow an authen (no CVSS)
- [CVE-2019-0053](https://cve.now/CVE-2019-0053.md): Junos OS: Insufficient validation of environment variables in telnet client may lead to stack-based buffer overflow (CVSS 7.8, Juniper Networks Junos OS)
- [CVE-2019-0052](https://cve.now/CVE-2019-0052.md): SRX Series: srxpfe process crash while JSF/UTM module parses specific HTTP packets (CVSS 7.5, Juniper Networks Junos OS)
- [CVE-2019-0049](https://cve.now/CVE-2019-0049.md): Junos OS: RPD process crashes when BGP peer restarts (CVSS 7.5, Juniper Networks Junos OS)
- [CVE-2019-0048](https://cve.now/CVE-2019-0048.md): EX4300 Series: When a firewall filter is applied to a loopback interface, other firewall filters for multicast traffic may fail (CVSS 5.8, Juniper Networks Junos OS)
- [CVE-2019-0046](https://cve.now/CVE-2019-0046.md): Junos OS: EX4300 Series: Denial of Service upon receipt of large number of specific valid packets on management interface. (CVSS 6.5, Juniper Networks Junos OS)
- [CVE-2019-12576](https://cve.now/CVE-2019-12576.md): A vulnerability in the London Trust Media Private Internet Access (PIA) VPN Client v82 for macOS could allow an authenticated, local attacke (no CVSS)
- [CVE-2019-1010315](https://cve.now/CVE-2019-1010315.md): WavPack 5.1 and earlier is affected by: CWE 369: Divide by Zero. (no CVSS, WavPack)
- [CVE-2019-1010314](https://cve.now/CVE-2019-1010314.md): Gitea 1.7.2, 1.7.3 is affected by: Cross Site Scripting (XSS). (no CVSS, Gitea · code.gitea.io/gitea)
- [CVE-2019-12573](https://cve.now/CVE-2019-12573.md): A vulnerability in the London Trust Media Private Internet Access (PIA) VPN Client v82 for Linux and macOS could allow an authenticated, loc (no CVSS)
- [CVE-2019-12577](https://cve.now/CVE-2019-12577.md): A vulnerability in the London Trust Media Private Internet Access (PIA) VPN Client v82 for macOS could allow an authenticated, local attacke (no CVSS)
- [CVE-2019-1010316](https://cve.now/CVE-2019-1010316.md): pyxtrlock 0.3 and earlier is affected by: Incorrect Access Control. (no CVSS, pyxtrlock)
- [CVE-2019-1010317](https://cve.now/CVE-2019-1010317.md): WavPack 5.1.0 and earlier is affected by: CWE-457: Use of Uninitialized Variable. (no CVSS, WavPack)
- [CVE-2019-12579](https://cve.now/CVE-2019-12579.md): A vulnerability in the London Trust Media Private Internet Access (PIA) VPN Client v82 for Linux and macOS could allow an authenticated, loc (no CVSS)
- [CVE-2019-1010319](https://cve.now/CVE-2019-1010319.md): WavPack 5.1.0 and earlier is affected by: CWE-457: Use of Uninitialized Variable. (no CVSS, WavPack)
- [CVE-2019-12575](https://cve.now/CVE-2019-12575.md): A vulnerability in the London Trust Media Private Internet Access (PIA) VPN Client v82 for Linux could allow an authenticated, local attacke (no CVSS)
- [CVE-2014-3798](https://cve.now/CVE-2014-3798.md): The Windows Guest Tools in Citrix XenServer 6.2 SP1 and earlier allows remote attackers to cause a denial of service (guest OS crash) via a (no CVSS)
- [CVE-2019-9657](https://cve.now/CVE-2019-9657.md): Alarm.com ADC-V522IR 0100b9 devices have Incorrect Access Control, a different issue than CVE-2018-19588. (no CVSS)
- [CVE-2019-13029](https://cve.now/CVE-2019-13029.md): Multiple stored Cross-site scripting (XSS) issues in the admin panel and survey system in REDCap 8 before 8.10.20 and 9 before 9.1.2 allow a (no CVSS)
- [CVE-2018-19588](https://cve.now/CVE-2018-19588.md): Alarm.com ADC-V522IR 0100b9 devices have Incorrect Access Control. (no CVSS)
- [CVE-2018-17151](https://cve.now/CVE-2018-17151.md): Intersystems Cache 2017.2.2.865.0 has Incorrect Access Control. (no CVSS)
- [CVE-2018-17152](https://cve.now/CVE-2018-17152.md): Intersystems Cache 2017.2.2.865.0 allows XXE. (no CVSS)
- [CVE-2018-17150](https://cve.now/CVE-2018-17150.md): Intersystems Cache 2017.2.2.865.0 allows XSS. (no CVSS)
- [CVE-2019-7003](https://cve.now/CVE-2019-7003.md): ACM SQL Injection (CVSS 9.3, Avaya Control Manager)
- [CVE-2019-12529](https://cve.now/CVE-2019-12529.md): An issue was discovered in Squid 2.x through 2.7.STABLE9, 3.x through 3.5.28, and 4.x through 4.7. (no CVSS)
- [CVE-2019-10194](https://cve.now/CVE-2019-10194.md): Sensitive passwords used in deployment and configuration of oVirt Metrics, all versions. (CVSS 5.9, Red Hat ovirt-engine-metrics)
- [CVE-2019-10192](https://cve.now/CVE-2019-10192.md): A heap-buffer overflow vulnerability was found in the Redis hyperloglog data structure versions 3.x before 3.2.13, 4.x before 4.0.14 and 5.x (CVSS 7.2, Redis Labs redis)
- [CVE-2019-10193](https://cve.now/CVE-2019-10193.md): A stack-buffer overflow vulnerability was found in the Redis hyperloglog data structure versions 3.x before 3.2.13, 4.x before 4.0.14 and 5. (CVSS 7.2, Redis Labs redis)
- [CVE-2019-3889](https://cve.now/CVE-2019-3889.md): A reflected XSS vulnerability exists in authorization flow of OpenShift Container Platform versions: openshift-online-3, openshift-enterpris (CVSS 4.6, Red Hat atomic-openshift)
- [CVE-2019-11062](https://cve.now/CVE-2019-11062.md): SUNNET WMPro v5.0 and v5.1 has OS Command Injection (no CVSS, SUNNET WMPro)
- [CVE-2019-9886](https://cve.now/CVE-2019-9886.md): eClass platform allows user to download arbitrary files without authentication (CVSS 9.1, BroadLearning eclass)
- [CVE-2019-12525](https://cve.now/CVE-2019-12525.md): An issue was discovered in Squid 3.3.9 through 3.5.28 and 4.x through 4.7. (no CVSS)
- [CVE-2019-11268](https://cve.now/CVE-2019-11268.md): UAA SQL Identity Zone Vulnerability (CVSS 6.5, Cloud Foundry UAA Release)
- [CVE-2019-12527](https://cve.now/CVE-2019-12527.md): An issue was discovered in Squid 4.0.23 through 4.7. (no CVSS)
- [CVE-2019-10651](https://cve.now/CVE-2019-10651.md): An issue was discovered in the Core Server in Ivanti Endpoint Manager (EPM) 2017.3 before SU7 and 2018.x before 2018.3 SU3, with remote code (no CVSS)
- [CVE-2019-13564](https://cve.now/CVE-2019-13564.md): XSS exists in Ping Identity Agentless Integration Kit before 1.5. (no CVSS)
- [CVE-2019-13563](https://cve.now/CVE-2019-13563.md): D-Link DIR-655 C devices before 3.02B05 BETA03 allow CSRF for the entire management console. (no CVSS)
- [CVE-2019-13562](https://cve.now/CVE-2019-13562.md): D-Link DIR-655 C devices before 3.02B05 BETA03 allow XSS, as demonstrated by the /www/ping\_response.cgi ping\_ipaddr parameter, the /www/ping (no CVSS)
- [CVE-2019-13561](https://cve.now/CVE-2019-13561.md): D-Link DIR-655 C devices before 3.02B05 BETA03 allow remote attackers to execute arbitrary commands via shell metacharacters in the online\_f (no CVSS)
- [CVE-2019-13560](https://cve.now/CVE-2019-13560.md): D-Link DIR-655 C devices before 3.02B05 BETA03 allow remote attackers to force a blank password via the apply\_sec.cgi setup\_wizard parameter (no CVSS)
- [CVE-2019-10340](https://cve.now/CVE-2019-10340.md): A cross-site request forgery vulnerability in Jenkins Docker Plugin 1.1.6 and earlier in DockerAPI.DescriptorImpl#doTestConnection allowed u (no CVSS, Jenkins project Jenkins Docker Plugin · io.jenkins.docker:d…)
- [CVE-2019-10341](https://cve.now/CVE-2019-10341.md): A missing permission check in Jenkins Docker Plugin 1.1.6 and earlier in DockerAPI.DescriptorImpl#doTestConnection allowed users with Overal (no CVSS, Jenkins project Jenkins Docker Plugin · io.jenkins.docker:d…)
- [CVE-2019-10342](https://cve.now/CVE-2019-10342.md): A missing permission check in Jenkins Docker Plugin 1.1.6 and earlier in various 'fillCredentialsIdItems' methods allowed users with Overall (no CVSS, Jenkins project Jenkins Docker Plugin · io.jenkins.docker:d…)
- [CVE-2019-10346](https://cve.now/CVE-2019-10346.md): A reflected cross site scripting vulnerability in Jenkins Embeddable Build Status Plugin 2.0.1 and earlier allowed attackers inject arbitrar (no CVSS, Jenkins project Jenkins Embeddable Build Status Plugin · io…)
- [CVE-2019-10347](https://cve.now/CVE-2019-10347.md): Jenkins Mashup Portlets Plugin stored credentials unencrypted on the Jenkins master where they can be viewed by users with access to the mas (no CVSS, Jenkins project Jenkins Mashup Portlets Plugin · javagh.jen…)
- [CVE-2019-10348](https://cve.now/CVE-2019-10348.md): Jenkins Gogs Plugin stored credentials unencrypted in job config.xml files on the Jenkins master where they can be viewed by users with Exte (no CVSS, Jenkins project Jenkins Gogs Plugin · org.jenkins-ci.plugin…)
- [CVE-2019-10349](https://cve.now/CVE-2019-10349.md): A stored cross site scripting vulnerability in Jenkins Dependency Graph Viewer Plugin 0.13 and earlier allowed attackers able to configure j (no CVSS, Jenkins project Jenkins Dependency Graph Viewer Plugin · or…)
- [CVE-2019-10350](https://cve.now/CVE-2019-10350.md): Jenkins Port Allocator Plugin stores credentials unencrypted in job config.xml files on the Jenkins master where they can be viewed by users (no CVSS, Jenkins project Jenkins Port Allocator Plugin · org.jenkins…)
- [CVE-2019-10351](https://cve.now/CVE-2019-10351.md): Jenkins Caliper CI Plugin stores credentials unencrypted in job config.xml files on the Jenkins master where they can be viewed by users wit (no CVSS, Jenkins project Jenkins Caliper CI Plugin · com.brianfromor…)
- [CVE-2018-11744](https://cve.now/CVE-2018-11744.md): Cloudera Manager through 5.15 has Incorrect Access Control. (no CVSS)
- [CVE-2019-13507](https://cve.now/CVE-2019-13507.md): hidea.com AZ Admin 1.0 has news\_det.php?cod= SQL Injection. (no CVSS)
- [CVE-2019-12363](https://cve.now/CVE-2019-12363.md): An CSRF issue was discovered in the JN-Jones MyBB-2FA plugin through 2014-11-05 for MyBB. (no CVSS)
- [CVE-2019-12537](https://cve.now/CVE-2019-12537.md): An issue was discovered in Zoho ManageEngine AssetExplorer. (no CVSS)
- [CVE-2019-12539](https://cve.now/CVE-2019-12539.md): An issue was discovered in the Purchase component of Zoho ManageEngine ServiceDesk Plus. (no CVSS)
- [CVE-2019-12540](https://cve.now/CVE-2019-12540.md): An issue was discovered in Zoho ManageEngine ServiceDesk Plus 10.5. (no CVSS)
- [CVE-2019-12595](https://cve.now/CVE-2019-12595.md): An issue was discovered in Zoho ManageEngine AssetExplorer. (no CVSS)
- [CVE-2019-12596](https://cve.now/CVE-2019-12596.md): An issue was discovered in Zoho ManageEngine AssetExplorer. (no CVSS)
- [CVE-2019-12597](https://cve.now/CVE-2019-12597.md): An issue was discovered in Zoho ManageEngine AssetExplorer. (no CVSS)
- [CVE-2019-13506](https://cve.now/CVE-2019-13506.md): @nuxt/devalue before 1.2.3, as used in Nuxt.js before 2.6.2, mishandles object keys, leading to XSS. (no CVSS, @nuxt/devalue)
- [CVE-2019-12838](https://cve.now/CVE-2019-12838.md): SchedMD Slurm 17.11.x, 18.08.0 through 18.08.7, and 19.05.0 allows SQL Injection. (no CVSS)
- [CVE-2019-1010003](https://cve.now/CVE-2019-1010003.md): Leanote prior to version 2.6 is affected by: Cross Site Scripting (XSS). (no CVSS, Leanote)
- [CVE-2019-13505](https://cve.now/CVE-2019-13505.md): The Appointment Hour Booking plugin 1.1.44 for WordPress allows XSS via the E-mail field, as demonstrated by email\_1. (no CVSS)
- [CVE-2019-13503](https://cve.now/CVE-2019-13503.md): mq\_parse\_http in mongoose.c in Mongoose 6.15 has a heap-based buffer over-read. (no CVSS)
- [CVE-2019-10135](https://cve.now/CVE-2019-10135.md): A flaw was found in the yaml.load() function in the osbs-client versions since 0.46 before 0.56.1. (CVSS 7.2, Red Hat osbs-client)
- [CVE-2019-13504](https://cve.now/CVE-2019-13504.md): There is an out-of-bounds read in Exiv2::MrwImage::readMetadata in mrwimage.cpp in Exiv2 through 0.27.2. (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2019-07-11
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.