# CVEs published 2019-07-15

85 CVEs were published on July 15, 2019: 0 critical, 2 high. 2 are now in CISA KEV. Days are UTC.

- [CVE-2019-13611](https://cve.now/CVE-2019-13611.md): An issue was discovered in python-engineio through 3.8.2. (no CVSS, python-engineio)
- [CVE-2019-0234](https://cve.now/CVE-2019-0234.md): A Reflected Cross-site Scripting (XSS) vulnerability exists in Apache Roller. (no CVSS, Apache Roller)
- [CVE-2018-7838](https://cve.now/CVE-2018-7838.md): A CWE-119 Buffer Errors vulnerability exists in Modicon M580 CPU - BMEP582040, all versions before V2.90, and Modicon Ethernet Module BMENOC (no CVSS, Modicon M580 CPU - BMEP582040 all versions before V2.90 and…)
- [CVE-2019-6827](https://cve.now/CVE-2019-6827.md): A CWE-787: Out-of-bounds Write vulnerability exists in Interactive Graphical SCADA System (IGSS), Version 14 and prior, which could cause a (no CVSS, Interactive Graphical SCADA System (IGSS))
- [CVE-2019-6822](https://cve.now/CVE-2019-6822.md): A Use After Free: CWE-416 vulnerability exists in Zelio Soft 2, V5.2 and earlier, which could cause remote code execution when opening a spe (no CVSS, Zelio Soft 2 V5.2 and prior)
- [CVE-2019-6825](https://cve.now/CVE-2019-6825.md): A CWE-427: Uncontrolled Search Path Element vulnerability exists in ProClima (all versions prior to version 8.0.0) which could allow a malic (no CVSS, ProClima all versions prior to)
- [CVE-2019-6824](https://cve.now/CVE-2019-6824.md): A CWE-119: Buffer Errors vulnerability exists in ProClima (all versions prior to version 8.0.0) which allows an unauthenticated, remote atta (no CVSS, ProClima all versions prior to)
- [CVE-2019-6823](https://cve.now/CVE-2019-6823.md): A CWE-94: Code Injection vulnerability exists in ProClima (all versions prior to version 8.0.0) which could allow an unauthenticated, remote (no CVSS, ProClima all versions prior to)
- [CVE-2019-1083](https://cve.now/CVE-2019-1083.md): A denial of service vulnerability exists when Microsoft Common Object Runtime Library improperly handles web requests, aka '.NET Denial of S (no CVSS, Microsoft .NET Framework)
- [CVE-2019-1084](https://cve.now/CVE-2019-1084.md): An information disclosure vulnerability exists when Exchange allows creation of entities with Display Names having non-printable characters. (no CVSS, Microsoft Exchange Server · Microsoft Outlook +4)
- [CVE-2019-1085](https://cve.now/CVE-2019-1085.md): An elevation of privilege vulnerability exists in the way that the wlansvc.dll handles objects in memory, aka 'Windows WLAN Service Elevatio (no CVSS, Microsoft Windows)
- [CVE-2019-1086](https://cve.now/CVE-2019-1086.md): An elevation of privilege exists in Windows Audio Service, aka 'Windows Audio Service Elevation of Privilege Vulnerability'. (no CVSS, Microsoft Windows)
- [CVE-2019-1087](https://cve.now/CVE-2019-1087.md): An elevation of privilege exists in Windows Audio Service, aka 'Windows Audio Service Elevation of Privilege Vulnerability'. (no CVSS, Microsoft Windows)
- [CVE-2019-1088](https://cve.now/CVE-2019-1088.md): An elevation of privilege exists in Windows Audio Service, aka 'Windows Audio Service Elevation of Privilege Vulnerability'. (no CVSS, Microsoft Windows)
- [CVE-2019-1089](https://cve.now/CVE-2019-1089.md): An elevation of privilege vulnerability exists in rpcss.dll when the RPC service Activation Kernel improperly handles an RPC request. (no CVSS, Microsoft Multiple)
- [CVE-2019-1090](https://cve.now/CVE-2019-1090.md): An elevation of privilege vulnerability exists in the way that the dnsrslvr.dll handles objects in memory, aka 'Windows dnsrlvr.dll Elevatio (no CVSS, Microsoft Windows)
- [CVE-2019-1091](https://cve.now/CVE-2019-1091.md): An information disclosure vulnerability exists when Unistore.dll fails to properly handle objects in memory, aka 'Microsoft unistore.dll Inf (no CVSS, Microsoft Windows)
- [CVE-2019-1092](https://cve.now/CVE-2019-1092.md): A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka 'C (no CVSS, Microsoft Edge · Microsoft ChakraCore +1)
- [CVE-2019-1093](https://cve.now/CVE-2019-1093.md): An information disclosure vulnerability exists when DirectWrite improperly discloses the contents of its memory, aka 'DirectWrite Informatio (no CVSS, Microsoft Windows)
- [CVE-2019-1094](https://cve.now/CVE-2019-1094.md): An information disclosure vulnerability exists when the Windows GDI component improperly discloses the contents of its memory, aka 'Windows (no CVSS, Microsoft Windows)
- [CVE-2019-1095](https://cve.now/CVE-2019-1095.md): An information disclosure vulnerability exists when the Windows GDI component improperly discloses the contents of its memory, aka 'Windows (no CVSS, Microsoft Windows)
- [CVE-2019-1096](https://cve.now/CVE-2019-1096.md): An information disclosure vulnerability exists when the win32k component improperly provides kernel information, aka 'Win32k Information Dis (no CVSS, Microsoft Windows)
- [CVE-2019-1097](https://cve.now/CVE-2019-1097.md): An information disclosure vulnerability exists when DirectWrite improperly discloses the contents of its memory, aka 'DirectWrite Informatio (no CVSS, Microsoft Windows)
- [CVE-2019-1001](https://cve.now/CVE-2019-1001.md): A remote code execution vulnerability exists in the way the scripting engine handles objects in memory in Microsoft browsers, aka 'Scripting (no CVSS, Microsoft Internet Explorer · Microsoft Edge +1)
- [CVE-2019-1004](https://cve.now/CVE-2019-1004.md): A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Internet Explorer, aka 'Scrip (no CVSS, Microsoft Internet Explorer)
- [CVE-2019-1006](https://cve.now/CVE-2019-1006.md): An authentication bypass vulnerability exists in Windows Communication Foundation (WCF) and Windows Identity Foundation (WIF), allowing sign (no CVSS, Microsoft Windows · Microsoft SharePoint Foundation +4)
- [CVE-2019-1037](https://cve.now/CVE-2019-1037.md): An elevation of privilege vulnerability exists in the way Windows Error Reporting (WER) handles files, aka 'Windows Error Reporting Elevatio (no CVSS, Microsoft Windows)
- [CVE-2019-1056](https://cve.now/CVE-2019-1056.md): A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Internet Explorer, aka 'Scrip (no CVSS, Microsoft Internet Explorer)
- [CVE-2019-1059](https://cve.now/CVE-2019-1059.md): A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Internet Explorer, aka 'Scrip (no CVSS, Microsoft Internet Explorer)
- [CVE-2019-1062](https://cve.now/CVE-2019-1062.md): A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka 'C (no CVSS, Microsoft Edge · Microsoft ChakraCore +1)
- [CVE-2019-1063](https://cve.now/CVE-2019-1063.md): A remote code execution vulnerability exists when Internet Explorer improperly accesses objects in memory, aka 'Internet Explorer Memory Cor (no CVSS, Microsoft Internet Explorer)
- [CVE-2019-1067](https://cve.now/CVE-2019-1067.md): An elevation of privilege vulnerability exists when the Windows kernel fails to properly handle objects in memory, aka 'Windows Kernel Eleva (no CVSS, Microsoft Windows)
- [CVE-2019-1068](https://cve.now/CVE-2019-1068.md): A remote code execution vulnerability exists in Microsoft SQL Server when it incorrectly handles processing of internal functions, aka 'Micr (CVSS 8.8, KEV, Microsoft SQL Server 2014 Service Pack 2 for 32-bit Systems…)
- [CVE-2019-1071](https://cve.now/CVE-2019-1071.md): An information disclosure vulnerability exists when the Windows kernel improperly handles objects in memory, aka 'Windows Kernel Information (no CVSS, Microsoft Windows)
- [CVE-2019-1072](https://cve.now/CVE-2019-1072.md): A remote code execution vulnerability exists when Azure DevOps Server and Team Foundation Server (TFS) improperly handle user input, aka 'Az (no CVSS, Microsoft Team Foundation Server · Microsoft Azure DevOps S…)
- [CVE-2019-1073](https://cve.now/CVE-2019-1073.md): An information disclosure vulnerability exists when the Windows kernel improperly handles objects in memory, aka 'Windows Kernel Information (no CVSS, Microsoft Windows)
- [CVE-2019-1074](https://cve.now/CVE-2019-1074.md): An elevation of privilege vulnerability exists in Microsoft Windows where certain folders, with local service privilege, are vulnerable to s (no CVSS, Microsoft Windows)
- [CVE-2019-1075](https://cve.now/CVE-2019-1075.md): A spoofing vulnerability exists in ASP.NET Core that could lead to an open redirect, aka 'ASP.NET Core Spoofing Vulnerability'. (no CVSS, Microsoft ASP.NET Core · Microsoft.AspNetCore.App +3)
- [CVE-2019-1076](https://cve.now/CVE-2019-1076.md): A Cross-site Scripting (XSS) vulnerability exists when Team Foundation Server does not properly sanitize user provided input, aka 'Team Foun (no CVSS, Microsoft Team Foundation Server · Microsoft Azure DevOps S…)
- [CVE-2019-1077](https://cve.now/CVE-2019-1077.md): An elevation of privilege vulnerability exists when the Visual Studio updater service improperly handles file permissions, aka 'Visual Studi (no CVSS, Microsoft Visual Studio)
- [CVE-2019-1079](https://cve.now/CVE-2019-1079.md): An information disclosure vulnerability exists when Visual Studio improperly parses XML input in certain settings files, aka 'Visual Studio (no CVSS, Microsoft Visual Studio)
- [CVE-2019-1082](https://cve.now/CVE-2019-1082.md): An elevation of privilege vulnerability exists in Microsoft Windows where a certain DLL, with Local Service privilege, is vulnerable to race (no CVSS, Microsoft Windows)
- [CVE-2019-0811](https://cve.now/CVE-2019-0811.md): A denial of service vulnerability exists in Windows DNS Server when it fails to properly handle DNS queries, aka 'Windows DNS Server Denial (no CVSS, Microsoft Windows Server · Microsoft Windows Server,)
- [CVE-2019-0865](https://cve.now/CVE-2019-0865.md): A denial of service vulnerability exists when SymCrypt improperly handles a specially crafted digital signature.An attacker could exploit th (no CVSS, Microsoft Windows)
- [CVE-2019-0880](https://cve.now/CVE-2019-0880.md): A local elevation of privilege vulnerability exists in how splwow64.exe handles certain calls, aka 'Microsoft splwow64 Elevation of Privileg (CVSS 7.8, KEV, Microsoft Windows Server · Microsoft Windows)
- [CVE-2019-0887](https://cve.now/CVE-2019-0887.md): A remote code execution vulnerability exists in Remote Desktop Services - formerly known as Terminal Services - when an authenticated attack (no CVSS, Microsoft Multiple)
- [CVE-2019-0962](https://cve.now/CVE-2019-0962.md): An elevation of privilege vulnerability exists in Azure Automation "RunAs account" runbooks for users with contributor role, aka 'Azure Auto (no CVSS, Microsoft Azure Automation)
- [CVE-2019-0966](https://cve.now/CVE-2019-0966.md): A denial of service vulnerability exists when Microsoft Hyper-V on a host server fails to properly validate input from a privileged user on (no CVSS, Microsoft Windows Server · Microsoft Windows)
- [CVE-2019-0975](https://cve.now/CVE-2019-0975.md): A security feature bypass vulnerability exists when Active Directory Federation Services (ADFS) improperly updates its list of banned IP add (no CVSS, Microsoft Windows Server · Microsoft Windows Server,)
- [CVE-2019-0999](https://cve.now/CVE-2019-0999.md): An elevation of privilege vulnerability exists when DirectX improperly handles objects in memory, aka 'DirectX Elevation of Privilege Vulner (no CVSS, Microsoft Windows)
- [CVE-2019-0785](https://cve.now/CVE-2019-0785.md): A memory corruption vulnerability exists in the Windows Server DHCP service when an attacker sends specially crafted packets to a DHCP failo (no CVSS, Microsoft Windows Server · Microsoft Windows Server,)
- [CVE-2019-5447](https://cve.now/CVE-2019-5447.md): A path traversal vulnerability in \<= v0.2.6 of http-file-server npm module allows attackers to list files in arbitrary folders. (no CVSS, http-file-server)
- [CVE-2019-1010293](https://cve.now/CVE-2019-1010293.md): Linaro/OP-TEE OP-TEE 3.3.0 and earlier is affected by: Boundary crossing. (no CVSS, Linaro/OP-TEE OP-TEE)
- [CVE-2019-1010294](https://cve.now/CVE-2019-1010294.md): Linaro/OP-TEE OP-TEE 3.3.0 and earlier is affected by: Rounding error. (no CVSS, Linaro/OP-TEE OP-TEE)
- [CVE-2019-1010295](https://cve.now/CVE-2019-1010295.md): Linaro/OP-TEE OP-TEE 3.3.0 and earlier is affected by: Buffer Overflow. (no CVSS, Linaro/OP-TEE OP-TEE)
- [CVE-2019-1010296](https://cve.now/CVE-2019-1010296.md): Linaro/OP-TEE OP-TEE 3.3.0 and earlier is affected by: Buffer Overflow. (no CVSS, Linaro/OP-TEE OP-TEE)
- [CVE-2019-1010297](https://cve.now/CVE-2019-1010297.md): Linaro/OP-TEE OP-TEE 3.3.0 and earlier is affected by: Buffer Overflow. (no CVSS, Linaro/OP-TEE OP-TEE)
- [CVE-2019-1010298](https://cve.now/CVE-2019-1010298.md): Linaro/OP-TEE OP-TEE 3.3.0 and earlier is affected by: Buffer Overflow. (no CVSS, Linaro/OP-TEE OP-TEE)
- [CVE-2019-1010299](https://cve.now/CVE-2019-1010299.md): The Rust Programming Language Standard Library 1.18.0 and later is affected by: CWE-200: Information Exposure. (no CVSS, The Rust Programming Language Standard Library)
- [CVE-2019-1010300](https://cve.now/CVE-2019-1010300.md): mz-automation libiec61850 1.3.2 1.3.1 1.3.0 is affected by: Buffer Overflow. (no CVSS, mz-automation libiec61850)
- [CVE-2019-1010301](https://cve.now/CVE-2019-1010301.md): jhead 3.03 is affected by: Buffer Overflow. (no CVSS, jhead)
- [CVE-2019-1010302](https://cve.now/CVE-2019-1010302.md): jhead 3.03 is affected by: Incorrect Access Control. (no CVSS, jhead)
- [CVE-2019-1010307](https://cve.now/CVE-2019-1010307.md): GLPI GLPI Product 9.3.1 is affected by: Cross Site Scripting (XSS). (no CVSS, GLPI Product)
- [CVE-2019-1010308](https://cve.now/CVE-2019-1010308.md): Aquaverde GmbH Aquarius CMS prior to version 4.1.1 is affected by: Incorrect Access Control. (no CVSS, Aquaverde Aquarius CMS)
- [CVE-2019-1010044](https://cve.now/CVE-2019-1010044.md): borg-reducer c6d5240 is affected by: Buffer Overflow. (no CVSS, borg-reducer)
- [CVE-2019-1010304](https://cve.now/CVE-2019-1010304.md): Saleor Issue was introduced by merge commit: e1b01bad0703afd08d297ed3f1f472248312cc9c. (no CVSS, Saleor)
- [CVE-2019-1010305](https://cve.now/CVE-2019-1010305.md): libmspack 0.9.1alpha is affected by: Buffer Overflow. (no CVSS, libmspack)
- [CVE-2019-1010306](https://cve.now/CVE-2019-1010306.md): Slanger 0.6.0 is affected by: Remote Code Execution (RCE). (no CVSS, Slanger)
- [CVE-2019-13604](https://cve.now/CVE-2019-13604.md): There is a short key vulnerability in HID Global DigitalPersona (formerly Crossmatch) U.are.U 4500 Fingerprint Reader v24. (no CVSS)
- [CVE-2019-1010039](https://cve.now/CVE-2019-1010039.md): uLaunchELF \< commit 170827a is affected by: Buffer Overflow. (no CVSS, uLaunchELF)
- [CVE-2019-1010038](https://cve.now/CVE-2019-1010038.md): OpenModelica OMCompiler is affected by: Buffer Overflow. (no CVSS, OpenModelica OMCompiler)
- [CVE-2014-10374](https://cve.now/CVE-2014-10374.md): On Fitbit activity-tracker devices, certain addresses never change. (no CVSS)
- [CVE-2019-1010034](https://cve.now/CVE-2019-1010034.md): Deepwoods Software WebLibrarian 3.5.2 and earlier is affected by: SQL Injection. (no CVSS, Deepwoods Software WebLibrarian)
- [CVE-2019-1010028](https://cve.now/CVE-2019-1010028.md): phpscriptsmall.com School College Portal with ERP Script 2.6.1 and earlier is affected by: Cross Site Scripting (XSS). (no CVSS, PHP Scripts Mall Pvt. School College Portal with ERP Script)
- [CVE-2019-1010025](https://cve.now/CVE-2019-1010025.md): GNU Libc current is affected by: Mitigation bypass. (no CVSS, GNU Libc glibc)
- [CVE-2019-1010023](https://cve.now/CVE-2019-1010023.md): GNU Libc current is affected by: Re-mapping current loaded library with malicious ELF file. (CVSS 5.4, GNU Libc glibc)
- [CVE-2019-1010024](https://cve.now/CVE-2019-1010024.md): GNU Libc current is affected by: Mitigation bypass. (no CVSS, GNU Libc glibc)
- [CVE-2019-1010022](https://cve.now/CVE-2019-1010022.md): GNU Libc current is affected by: Mitigation bypass. (no CVSS, GNU C Library glibc)
- [CVE-2019-1010017](https://cve.now/CVE-2019-1010017.md): libnmap \< v0.6.3 is affected by: XML Injection. (no CVSS, libnmap · python-libnmap)
- [CVE-2019-1010016](https://cve.now/CVE-2019-1010016.md): Dolibarr 6.0.4 is affected by: Cross Site Scripting (XSS). (no CVSS, Dolibarr ERP & CRM Dolibarr · dolibarr/dolibarr)
- [CVE-2019-1010009](https://cve.now/CVE-2019-1010009.md): DGLogik Inc DGLux Server All Versions is affected by: Insecure Permissions. (no CVSS, DGLogik DGLux Server)
- [CVE-2019-1010008](https://cve.now/CVE-2019-1010008.md): OpenEnergyMonitor Project Emoncms 9.8.8 is affected by: Cross Site Scripting (XSS). (no CVSS, OpenEnergyMonitor Project Emoncms)
- [CVE-2019-1010006](https://cve.now/CVE-2019-1010006.md): Evince 3.26.0 is affected by buffer overflow. (no CVSS, Evince Team Evince)
- [CVE-2019-1010005](https://cve.now/CVE-2019-1010005.md): HexoEditor v1.1.8-beta is affected by: XSS to code execution. (no CVSS, HexoEditor)
- [CVE-2019-1010004](https://cve.now/CVE-2019-1010004.md): SoX - Sound eXchange 14.4.2 and earlier is affected by: Out-of-bounds Read. (no CVSS, Sourceforge SoX - Sound eXchange)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2019-07-15
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.