# CVEs published 2019-07-16

36 CVEs were published on July 16, 2019: 1 critical, 3 high. 2 are now in CISA KEV. Days are UTC.

- [CVE-2019-3571](https://cve.now/CVE-2019-3571.md): An input validation issue affected WhatsApp Desktop versions prior to 0.3.3793 which allows malicious clients to send files to users that wo (no CVSS, Facebook WhatsApp Desktop)
- [CVE-2019-6160](https://cve.now/CVE-2019-6160.md): A vulnerability in various versions of Iomega and LenovoEMC NAS products could allow an unauthenticated user to access files on NAS shares v (CVSS 8.8, Iomega and LenovoEMC NAS products)
- [CVE-2019-9700](https://cve.now/CVE-2019-9700.md): Norton Password Manager, prior to 6.3.0.2082, may be susceptible to an address spoofing issue. (no CVSS, Norton Password Manager)
- [CVE-2018-13442](https://cve.now/CVE-2018-13442.md): SolarWinds Network Performance Monitor 12.3 allows SQL Injection via the /api/ActiveAlertsOnThisEntity/GetActiveAlerts TriggeringObjectEntit (no CVSS)
- [CVE-2019-12834](https://cve.now/CVE-2019-12834.md): In HT2 Labs Learning Locker 3.15.1, it's possible to inject malicious HTML and JavaScript code into the DOM of the website via the PATH\_INFO (CVSS 7.3)
- [CVE-2019-12985](https://cve.now/CVE-2019-12985.md): Citrix SD-WAN 10.2.x before 10.2.3 and NetScaler SD-WAN 10.0.x before 10.0.8 have Improper Input Validation (issue 1 of 6). (no CVSS)
- [CVE-2019-10191](https://cve.now/CVE-2019-10191.md): A vulnerability was discovered in DNS resolver of knot resolver before version 4.1.0 which allows remote attackers to downgrade DNSSEC-secur (CVSS 6.3, CZ.NIC knot-resolver)
- [CVE-2019-10190](https://cve.now/CVE-2019-10190.md): A vulnerability was discovered in DNS resolver component of knot resolver through version 3.2.0 before 4.1.0 which allows remote attackers t (CVSS 5.4, CZ.NIC knot-resolver)
- [CVE-2019-12986](https://cve.now/CVE-2019-12986.md): Citrix SD-WAN 10.2.x before 10.2.3 and NetScaler SD-WAN 10.0.x before 10.0.8 have Improper Input Validation (issue 2 of 6). (no CVSS)
- [CVE-2019-12987](https://cve.now/CVE-2019-12987.md): Citrix SD-WAN 10.2.x before 10.2.3 and NetScaler SD-WAN 10.0.x before 10.0.8 have Improper Input Validation (issue 3 of 6). (no CVSS)
- [CVE-2019-12988](https://cve.now/CVE-2019-12988.md): Citrix SD-WAN 10.2.x before 10.2.3 and NetScaler SD-WAN 10.0.x before 10.0.8 have Improper Input Validation (issue 4 of 6). (no CVSS)
- [CVE-2019-12989](https://cve.now/CVE-2019-12989.md): Citrix SD-WAN 10.2.x before 10.2.3 and NetScaler SD-WAN 10.0.x before 10.0.8 allow SQL Injection. (CVSS 9.8, KEV)
- [CVE-2019-12990](https://cve.now/CVE-2019-12990.md): Citrix SD-WAN 10.2.x before 10.2.3 and NetScaler SD-WAN 10.0.x before 10.0.8 allow Directory Traversal. (no CVSS)
- [CVE-2019-12991](https://cve.now/CVE-2019-12991.md): Citrix SD-WAN 10.2.x before 10.2.3 and NetScaler SD-WAN 10.0.x before 10.0.8 have Improper Input Validation (issue 5 of 6). (CVSS 8.8, KEV)
- [CVE-2019-12992](https://cve.now/CVE-2019-12992.md): Citrix SD-WAN 10.2.x before 10.2.3 and NetScaler SD-WAN 10.0.x before 10.0.8 have Improper Input Validation (issue 6 of 6). (no CVSS)
- [CVE-2019-13359](https://cve.now/CVE-2019-13359.md): In CentOS-WebPanel.com (aka CWP) CentOS Web Panel 0.9.8.836, a cwpsrv-xxx cookie allows a normal user to craft and upload a session file to (no CVSS)
- [CVE-2019-13360](https://cve.now/CVE-2019-13360.md): In CentOS-WebPanel.com (aka CWP) CentOS Web Panel 0.9.8.836, remote attackers can bypass authentication in the login process by leveraging k (no CVSS)
- [CVE-2019-13383](https://cve.now/CVE-2019-13383.md): In CentOS-WebPanel.com (aka CWP) CentOS Web Panel 0.9.8.846, the Login process allows attackers to check whether a username is valid by read (no CVSS)
- [CVE-2019-13603](https://cve.now/CVE-2019-13603.md): An issue was discovered in the HID Global DigitalPersona (formerly Crossmatch) U.are.U 4500 Fingerprint Reader Windows Biometric Framework d (no CVSS)
- [CVE-2019-13605](https://cve.now/CVE-2019-13605.md): In CentOS-WebPanel.com (aka CWP) CentOS Web Panel 0.9.8.838 to 0.9.8.846, remote attackers can bypass authentication in the login process by (no CVSS)
- [CVE-2019-13618](https://cve.now/CVE-2019-13618.md): In GPAC before 0.8.0, isomedia/isom\_read.c in libgpac.a has a heap-based buffer over-read, as demonstrated by a crash in gf\_m2ts\_sync in med (no CVSS)
- [CVE-2019-13617](https://cve.now/CVE-2019-13617.md): njs through 0.3.3, used in NGINX, has a heap-based buffer over-read in nxt\_vsprintf in nxt/nxt\_sprintf.c during error handling, as demonstra (no CVSS)
- [CVE-2019-13615](https://cve.now/CVE-2019-13615.md): libebml before 1.3.6, as used in the MKV module in VideoLAN VLC Media Player binaries before 3.0.3, has a heap-based buffer over-read in Ebm (no CVSS)
- [CVE-2018-19629](https://cve.now/CVE-2018-19629.md): A Denial of Service vulnerability in the ImageNow Server service in Hyland Perceptive Content Server before 7.1.5 allows an attacker to cras (no CVSS)
- [CVE-2019-1010290](https://cve.now/CVE-2019-1010290.md): Babel: Multilingual site Babel All is affected by: Open Redirection. (no CVSS, Babel: Multilingual site Babel)
- [CVE-2019-1575](https://cve.now/CVE-2019-1575.md): Information disclosure in PAN-OS 7.1.23 and earlier, PAN-OS 8.0.18 and earlier, PAN-OS 8.1.8-h4 and earlier, and PAN-OS 9.0.2 and earlier ma (no CVSS, Palo Alto Networks PAN-OS)
- [CVE-2019-1576](https://cve.now/CVE-2019-1576.md): Command injection in PAN-0S 9.0.2 and earlier may allow an authenticated attacker to gain access to a remote shell in PAN-OS, and potentiall (no CVSS, Palo Alto Networks PAN-OS)
- [CVE-2019-1010292](https://cve.now/CVE-2019-1010292.md): Linaro/OP-TEE OP-TEE Prior to version v3.4.0 is affected by: Boundary checks. (no CVSS, Linaro/OP-TEE OP-TEE)
- [CVE-2019-1010043](https://cve.now/CVE-2019-1010043.md): Quake3e \< 5ed740d is affected by: Buffer Overflow. (no CVSS, Quake3e)
- [CVE-2019-1010018](https://cve.now/CVE-2019-1010018.md): Zammad GmbH Zammad 2.3.0 and earlier is affected by: Cross Site Scripting (XSS) - CWE-80. (no CVSS, Zammad)
- [CVE-2019-13612](https://cve.now/CVE-2019-13612.md): MDaemon Email Server 19 through 20.0.1 skips SpamAssassin checks by default for e-mail messages larger than 2 MB (and limits checks to 10 MB (no CVSS)
- [CVE-2019-1010062](https://cve.now/CVE-2019-1010062.md): PluckCMS 4.7.4 and earlier is affected by: CWE-434 Unrestricted Upload of File with Dangerous Type. (no CVSS, pluck-cms PluckCMS)
- [CVE-2019-1010060](https://cve.now/CVE-2019-1010060.md): NASA CFITSIO prior to 3.43 is affected by: Buffer Overflow. (no CVSS, NASA CFITSIO)
- [CVE-2019-1010057](https://cve.now/CVE-2019-1010057.md): nfdump 1.6.16 and earlier is affected by: Buffer Overflow. (no CVSS, nfdump)
- [CVE-2019-13115](https://cve.now/CVE-2019-13115.md): In libssh2 before 1.9.0, kex\_method\_diffie\_hellman\_group\_exchange\_sha256\_key\_exchange in kex.c has an integer overflow that could lead to an (no CVSS)
- [CVE-2019-13616](https://cve.now/CVE-2019-13616.md): SDL (Simple DirectMedia Layer) through 1.2.15 and 2.x through 2.0.9 has a heap-based buffer over-read in BlitNtoN in video/SDL\_blit\_N.c when (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2019-07-16
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.